Skip to content

Google auth: no lockout on missing profile; server-time new/existing check - #21

Merged
KrishP147 merged 3 commits into
mainfrom
krish/fix-google-auth-lockout
Sep 24, 2026
Merged

Google auth: no lockout on missing profile; server-time new/existing check#21
KrishP147 merged 3 commits into
mainfrom
krish/fix-google-auth-lockout

Conversation

@KrishP147

@KrishP147 KrishP147 commented Sep 24, 2026

Copy link
Copy Markdown
Owner

Closes #8

  • New pure helpers (frontend/src/utils/authHelpers.js): isNewOAuthAccount compares last_sign_in_at vs created_at (both GoTrue server clock, 30 s window; null when unknown), resolveOAuthAction maps origin x user x hasProfile to allow / block_existing / allow_to_profile. 29 unit tests.
  • App.jsx register-origin Google flow uses the helper (blocks only a clearly existing account; unknown allows through). Login-origin flow never signs out over a missing user_profile row: it redirects to /profile instead. Failed profile query fails open. PII console.logs removed.
  • No migration; server-side profile-stub trigger tracked in Migration 009: create user_profile stub on signup (manual apply) #18.

Manual smoke test still worth doing: Google sign-in from Register with an existing account, from Login with no profile row, and a normal login.

🤖 Generated with Claude Code

KrishP147 and others added 3 commits September 23, 2026 22:43
@KrishP147 @claude
feat: add isNewOAuthAccount/resolveOAuthAction helpers + tests
df8db2b 
pure server-field-only OAuth new-vs-existing decision, no client clock

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@KrishP147 @claude
fix: use authHelpers for OAuth register/login decisions
b47e109 
register: drop fragile 3s new Date() check, use server-field helper
login: never signOut on missing user_profile row, redirect to /profile
instead; query error now fails open (unknown), not treated as no-row
also drop console.logs that leaked session.user fields

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@KrishP147 @claude
test: label user in resolveOAuthAction table titles
14a7456 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Copilot AI lite review requested due to automatic review settings September 24, 2026 02:51
@vercel

vercel Bot commented Sep 24, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
nutrisync-frontend Ready Ready Preview Sep 24, 2026 2:52am UTC

Copilot AI reviewed Sep 24, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@codecov

codecov Bot commented Sep 24, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@KrishP147
KrishP147 merged commit 7a545ab into main Sep 24, 2026
9 checks passed

This branch was successfully deployed

1 active deployment
Preview — 14a74560 Deployed Sep 24, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Google auth: users without a user_profile row are locked out; 3s account-age check is fragile

2 participants

@KrishP147