From 3fe3f826f2649ebae976a07ca3cb4458ef2a8581 Mon Sep 17 00:00:00 2001 From: Contentrain Date: Thu, 14 May 2026 00:09:22 +0300 Subject: [PATCH] fix(github-app): reconnect uses POST /api/auth/login, not bare URL MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous reconnect flow built a GET URL to /api/auth/login — which only exposes a POST handler (with CSRF-state cookie + body shape). Browser hits to that path 404 the user out instead of starting OAuth. Switch to `useAuth().signInWithOAuth('github')` so the reconnect path uses the exact same endpoint (and state-cookie protocol) as the regular sign-in screen. Save the current path via `useWorkspaces().saveLastPath` so the user lands back on the project they came from once OAuth completes. Observed on staging: clicking "Reconnect GitHub" on the ConnectRepoDialog's connect-existing empty state landed on: /api/auth/login?provider=github&redirect_to=/w/... → 404 --- .../organisms/ConnectRepoDialog.vue | 24 +++++++++++++++---- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/app/components/organisms/ConnectRepoDialog.vue b/app/components/organisms/ConnectRepoDialog.vue index 7a951b3..f45175c 100644 --- a/app/components/organisms/ConnectRepoDialog.vue +++ b/app/components/organisms/ConnectRepoDialog.vue @@ -231,11 +231,25 @@ async function connectExistingInstallation(installation: AvailableInstallation) } } -function reconnectGitHub() { - // Trigger Supabase GitHub OAuth flow; on return the OAuth callback - // captures and persists provider_token. After success, the user - // re-opens this dialog and the available list resolves. - window.location.href = `/api/auth/login?provider=github&redirect_to=${encodeURIComponent(window.location.pathname + window.location.search)}` +async function reconnectGitHub() { + // Trigger Supabase GitHub OAuth flow via the same POST endpoint + // (and CSRF-state cookie) that the standard sign-in screen uses. + // The auth callback handler captures `provider_token` and persists + // it via `auth/verify.post.ts` → DatabaseProvider.upsertOAuthProviderToken, + // so on return the user's available installations list will resolve. + // + // Save the current path so the user lands back here after callback — + // `useWorkspaces.saveLastPath` is what the workspace bootstrap reads + // when deciding where to redirect post-callback. + const { saveLastPath } = useWorkspaces() + const { signInWithOAuth } = useAuth() + saveLastPath(window.location.pathname + window.location.search) + try { + await signInWithOAuth('github') + } + catch (e: unknown) { + toast.error(resolveApiError(e, t('github.connect_existing_error'))) + } } // Auto-detect GitHub App installation when user returns to tab