Conversation
…f api docs
## Problem
When a new user completes Microsoft SSO during portal onboarding, they are redirected to the Swagger API docs page instead of the portal. This blocks new user signup flow.
## Root cause
The portal initiates Microsoft OAuth via `authClient.signIn.social({callbackURL})` without specifying an `errorCallbackURL`. On the server side, better-auth has no `onAPIError.errorURL` configured. When the OAuth callback encounters any error, better-auth's fallback redirect logic routes to the baseURL (api.trycomp.ai), which has a root redirect to /api/docs, landing the user on Swagger docs.
A June fix addressed one specific cause (email_not_found via upn fallback) but did not fix the error redirect target itself, leaving the issue live for any other callback error.
## Fix
Add `errorCallbackURL` to the portal's Microsoft SSO sign-in call, pointing to the portal origin. This ensures callback errors redirect back to the portal UI instead of the API docs page. No changes to auth logic, RBAC, or server config.
## Explicitly NOT touched
No modifications to better-auth server configuration or global error handling. Auth flow logic and RBAC remain unchanged.
## Verification
Added regression test asserting that portal sign-in specifies a portal-origin errorCallbackURL. Targeted unit tests pass locally ✅
…o-callback-redirecting fix(auth): redirect microsoft sso callback errors to portal instead of api docs
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 6 files
Confidence score: 5/5
- Safe to merge after the addressed issues were fixed.
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
…rectly GitHub's 2026 Code Security GA renamed `security_and_analysis.advanced_security` to `code_security`, so the code scanning check read an always-undefined field and classified every private repo whose code-scanning API 403'd as "permission denied" — telling customers to add a GitHub App permission that does nothing. The check calls the default-setup endpoint (which needs Administration: read, already granted), not the alerts endpoint, and the feature is simply not enabled on the repo, so no permission change can fix it. Use GitHub's own 403 body as the authoritative signal: "...must be enabled..." means the code-scanning feature is off (private repo -> needs Code Security; public -> not configured), while "Resource not accessible by integration" is a genuine permission gap. Also read the new `code_security` field with an `advanced_security` fallback for GitHub Enterprise Server, and correct the now-misleading permission-denied remediation text. Shared by the github and github-app integrations. Adds tests for the feature-off vs permission split; the CS-756 visible-but-unknown -> permission case still holds.
…de-security fix(integrations): report code scanning off vs missing permission correctly
… link (#3459) * fix(people): create invited employees with verified emails so SSO can link Employees added via the invite flow (people-invite.service) and the add-people flow (lib/db/employee) were created with emailVerified: false. better-auth refuses to link a trusted OAuth provider (Google/Microsoft) sign-in to an existing unverified local user and aborts the callback with account_not_linked, so those employees could not sign in to the portal with SSO at all — this was the dominant OAuth error in production logs, and it hit Google and Microsoft equally. Create the user rows with emailVerified: true instead, and backfill existing org members with a data migration so already-invited employees are unblocked too. This is safe because password auth is disabled: every sign-in method (email OTP, magic link, trusted OAuth) proves control of the mailbox before a session is issued, so the flag grants nothing to anyone who cannot already receive mail at the address. The employee-sync paths (Google Workspace etc.) already create users with emailVerified: true; this aligns the manual paths with them. Intentionally NOT changed: better-auth's accountLinking config (requireLocalEmailVerified is deprecated and slated to become unconditional, so relying on it would re-break on a future upgrade). * fix(people): verify legacy users on re-invite, drop dead employee action Review follow-ups: - Re-inviting a user whose row predates created-verified behavior (and who was not a member when the backfill ran, e.g. after their previous org was deleted) left them unverified and still unable to link Google/Microsoft sign-ins. Both invite paths (employee add + role invitation) now upgrade an existing unverified row to verified, with the same justification as creation: the address is admin-provided and every sign-in method proves mailbox ownership before a session is issued. No-op when already verified. - createEmployeeAction (and its completeEmployeeCreation helper) had no callers anywhere in the app: the live add-people flow goes through the API, where POST /v1/people/invite, POST /v1/people and /bulk all enforce member:create. Rather than leave an unreferenced server action that creates users and members with no permission check of its own, delete it and prune lib/db/employee.ts to the one export that is actually used (createTrainingVideoEntries).
The portal vitest config (added in #3454 / CS-760) had two gaps that would break any test beyond the current pure-logic one: - No resolve.alias for the tsconfig `@/*` path, so any test importing via `@/...` fails at module resolution. Mirror `@` -> ./src, matching apps/app and apps/framework-editor. - environment was 'node' while the include glob targets .jsx/.tsx component tests, which need DOM APIs. Switch to jsdom (both sibling configs use it); node-only tests still run fine under it. Follow no-plugin approach (hand-mapped alias) like framework-editor to avoid the vite plugin type clash with Next's build-time typecheck on Vercel. Add jsdom + vitest as portal devDependencies so resolution no longer relies on workspace hoisting.
Contributor
|
🎉 This PR is included in version 3.104.2 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.
Summary by cubic
Fixes SSO callback error redirects and unblocks invited users from linking Google/Microsoft SSO. Also corrects GitHub Code Scanning checks to distinguish feature-off vs permission issues (CS-760, CS-762).
Bug Fixes
errorCallbackURLformicrosoftandgooglesign-ins to return OAuth errors to the portal; preserve invite and device-auth params.emailVerified: true, upgrade legacy unverified users on re‑invite (employee and admin paths), and backfill existing members via SQL so SSO can link.security_and_analysis.code_security(fallbackadvanced_security), parse 403 bodies to tell feature-off from permission, handle public repos and third‑party SARIF, and update titles/remediation to “GitHub Code Security” while keeping CS‑756 behavior.Refactors
buildSignInCallbackUrlsto centralize success/error URL construction; added tests andtestscript inapps/portal/package.json.vitestconfig usingjsdomand@alias; addedjsdom/vitestas dev deps and removed the unusedcreate-employeeserver action, pruningemployee.tstocreateTrainingVideoEntriesonly.Written for commit 2ca14a5. Summary will update on new commits.