fix(auth): update auth to use localStorage by domoritz · Pull Request #543 · vega/editor-backend

domoritz · 2025-06-08T19:09:08Z

No description provided.

vercel · 2025-06-08T19:09:11Z

Deployment failed with the following error:

Environment Variable "GITHUB_CLIENT_ID" references Secret "github-client-id", which does not exist.

domoritz · 2025-06-08T19:30:34Z

http://localhost:3000/auth/github/logout is leading to a loop

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

domoritz · 2025-06-08T20:01:11Z

   * @param {Response} res Response object
   */
  private success = (req, res) => {
+    // eslint-disable-next-line no-console


Why do we need the log? I'd be okay with having console.info if it's really helpful

Ah, I was just leaving it until we tested the entire auth flow and then remove them once and for all. But I can remove them

That's okay. Let me know when it works so I can test it with the editor.

You can try testing now. Works for me locally

domoritz · 2025-06-08T21:55:33Z

One thing that's a bit annoying right now is that http://localhost:3000/auth/github/check will return false if you open it in a stand alone window because we don't send the right token from local storage. Should we add another endpoint that sets the correct header?

openhands-ai · 2025-06-08T22:16:28Z

Looks like there are a few issues preventing this PR from being merged!

GitHub Actions are failing:
- Test

If you'd like me to help, just leave a comment, like

@OpenHands please fix the failing actions on PR #543

Feel free to include any additional details that might help me get this PR into a better state.

_{^{You can manage your notification settings}}

domoritz · 2025-06-08T22:20:14Z

I added debugging to the main endpoint. Note that the redirect doesn't work for debug yet. It should really redirect back to the main page but I get a loop.

domoritz · 2025-06-10T19:28:42Z

When I go to http://localhost:3000 and do the auth, I should get redirected to http://localhost:3000, not the editor, though. Can you fix that?

domoritz · 2025-06-10T19:29:04Z

Also, always make sure that listing passes. Just helps keep things clean.

yuvvantalreja · 2025-06-10T19:34:14Z

When I go to http://localhost:3000 and do the auth, I should get redirected to http://localhost:3000, not the editor, though. Can you fix that?

Sure, I can change that.

Copilot

Pull Request Overview

This PR replaces session-based authentication (using Redis and express-session) with a token-based approach stored in localStorage, updates routing and controllers accordingly, and removes legacy functionality related to gists.

Migrate to token-based auth: generate/validate HMAC-signed tokens, add getGithubToken endpoint
Remove Redis/session middleware and related environment vars
Update Pug view to display and verify auth tokens

Reviewed Changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
vercel.json	Removed Redis env vars
typedoc.json	Switched to `entryPoints` schema, added `$schema` field
src/views/index.pug	Added debug panel for token display and auth check script
src/urls.ts	Added `getGithubToken`, removed Gist URLs, adjusted hosts
src/controllers/auth.ts	Implemented token logic, removed session handling
src/app.ts	Dropped session/Redis setup, switched to ES modules
package.json	Set `"type": "module"`, bumped deps
.vscode/settings.json	Tweaked `eslint` code actions setting

Comments suppressed due to low confidence (3)

src/controllers/auth.ts:187

[nitpick] On logout you post {type: 'auth'} without a distinct flag for logout. Consider using a separate message type (e.g. {type: 'logout'}) so the opener can differentiate login vs. logout events.

{type: 'auth'}, '*'

typedoc.json:6

Trailing comma in a JSON array is invalid; remove the comma after the last entry to ensure typedoc.json parses correctly.

    "src/**/*.ts",

.vscode/settings.json:12

The source.fixAll.eslint setting expects a boolean, not a string. Change it to true or false to restore auto-fix on save.

"source.fixAll.eslint": "explicit"

Copilot · 2025-06-10T19:41:11Z

+      name: user._json.name,
+      profilePicUrl: user._json.avatar_url,
+      authToken: tokenUser ? authToken : this.generateToken(user),
+      githubAccessToken: tokenUser.accessToken,


When tokenUser is null (session-based flow), this will throw. Use user.accessToken instead of tokenUser.accessToken to cover both cases.

Suggested change

githubAccessToken: tokenUser.accessToken,

githubAccessToken: user.accessToken,

Copilot · 2025-06-10T19:41:12Z

-  redirectUrl.successful = authUrl.isAuthenticated;
+} else if (nodeEnv === 'development' || !nodeEnv) {
+  redirectUrl.successful = 'http://localhost:1234';
+  hostUrl = 'http://localhost:3000';


If nodeEnv has another value (e.g., staging), neither branch runs and hostUrl remains undefined. Consider adding a default case to avoid unexpected undefined values.

Suggested change

hostUrl = 'http://localhost:3000';

hostUrl = 'http://localhost:3000';

} else {

// Default case for unexpected `nodeEnv` values

redirectUrl.successful = 'https://default-url.com';

hostUrl = 'https://default-host.com';

yuvvantalreja and others added 8 commits May 15, 2025 13:42

feat(auth): enhance postMessage handling and improve cookie settings

a8a8fa1

fix(auth): Auth Issue fixed

6b11ad2

fix(auth): Gist methods updated for new auth integration

c37d0e7

fix(auth): Unified auth with local storage

127ac2c

feat(auth): Enhance authentication flow with GitHub access token support

4e98fb0

refactor(auth): Implement in-time GitHub token retrieval for API calls

4271b68

Update config/passport.ts

3dab1ab

remove redis

293b027

domoritz changed the title ~~New backend~~ fix(auth): update auth to use localStorage Jun 8, 2025

domoritz mentioned this pull request Jun 8, 2025

fix(auth): update auth to use localStorage #540

Closed

cleanups

8fdebf3

More cleanups

1abaffe

domoritz requested a review from Copilot June 8, 2025 19:33

This comment was marked as outdated.

Sign in to view

domoritz and others added 2 commits June 8, 2025 15:40

Update src/controllers/auth.ts

26e6933

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Fixed lint issues

364e112

domoritz commented Jun 8, 2025

View reviewed changes

yuvvantalreja added 2 commits June 8, 2025 16:11

Removed console logs

ff84c67

Changed to use handle options

9f977f9

yuvvantalreja force-pushed the new-backend branch from 2367d44 to 9f977f9 Compare June 8, 2025 20:30

domoritz added 7 commits June 8, 2025 16:40

simplify, fox import

6c684ec

code style

2cdb6dd

update typedoc

b16e339

update eslint

0b04191

chore: switch to npm

e93f322

update vscode setting

c34b907

update express, simplify cors

783aff0

debug at main url

09a751b

Send token through URL

1c1533d

domoritz requested a review from Copilot June 10, 2025 19:38

Copilot AI reviewed Jun 10, 2025

View reviewed changes

yuvvantalreja added 2 commits June 10, 2025 16:20

redirect to backend

b6e3e76

Minor changes

20aec71

domoritz merged commit a6bbbd6 into master Jun 10, 2025
1 of 2 checks passed

domoritz deleted the new-backend branch June 10, 2025 21:10

	githubAccessToken: tokenUser.accessToken,
	githubAccessToken: user.accessToken,

-  hostUrl = 'http://localhost:3000';
+  hostUrl = 'http://localhost:3000';
+} else {
+  // Default case for unexpected `nodeEnv` values
+  redirectUrl.successful = 'https://default-url.com';
+  hostUrl = 'https://default-host.com';

Uh oh!

Conversation

domoritz commented Jun 8, 2025

Uh oh!

vercel Bot commented Jun 8, 2025

Uh oh!

domoritz commented Jun 8, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

domoritz Jun 8, 2025

Choose a reason for hiding this comment

Uh oh!

yuvvantalreja Jun 8, 2025

Choose a reason for hiding this comment

Uh oh!

domoritz Jun 8, 2025

Choose a reason for hiding this comment

Uh oh!

yuvvantalreja Jun 8, 2025

Choose a reason for hiding this comment

Uh oh!

domoritz commented Jun 8, 2025

Uh oh!

openhands-ai Bot commented Jun 8, 2025

Uh oh!

domoritz commented Jun 8, 2025

Uh oh!

domoritz commented Jun 10, 2025

Uh oh!

domoritz commented Jun 10, 2025

Uh oh!

yuvvantalreja commented Jun 10, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Jun 10, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jun 10, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants