Skip to content

feat(auth): migrates from GitHub App to OAuth App#4

Merged
wgordon17 merged 22 commits intogordon-code:mainfrom
wgordon17:roadmap/phase-1/oauth-app-migration
Mar 24, 2026
Merged

feat(auth): migrates from GitHub App to OAuth App#4
wgordon17 merged 22 commits intogordon-code:mainfrom
wgordon17:roadmap/phase-1/oauth-app-migration

Conversation

@wgordon17
Copy link
Copy Markdown
Member

Summary

  • Migrates authentication from GitHub App (expiring tokens + HttpOnly cookie refresh) to OAuth App (permanent tokens in localStorage with explicit scopes repo read:org notifications)
  • Simplifies Cloudflare Worker from 3 OAuth endpoints to 1 (token exchange only), removing all cookie/refresh infrastructure (-893 lines)
  • Adds dashboard data reset and poll coordinator cleanup on logout to prevent cross-user data leakage

- Adds read-only guard to Octokit client (blocks non-GET except POST /graphql)
- Fixes _coordinator not nulled on DashboardPage unmount (polling died after navigation)
- Validates token before navigating in OAuthCallback (clears auth on failure)
- Deduplicates onCleanup/destroy in poll coordinator (onCleanup delegates to destroy)
- Merges two onAuthCleared registrations into single callback in DashboardPage
- Uses top-level import type for DashboardData instead of inline import()
- Simplifies localStorage init guard in auth.ts (drops typeof, keeps optional chaining)
- Adds tests: destroy(), reentrancy guard, validateToken=false, OPTIONS 404, cold-start
@wgordon17 wgordon17 merged commit d490ec4 into gordon-code:main Mar 24, 2026
1 check passed
@wgordon17 wgordon17 deleted the roadmap/phase-1/oauth-app-migration branch March 25, 2026 00:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant