feat(core): support custom userInfo functions in OAuth providers#182
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
|
Warning Review limit reached
More reviews will be available in 51 minutes. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR adds support for custom OAuth user info request callbacks, allowing OAuth provider configuration to define a ChangesCustom OAuth UserInfo Request Callback Feature
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/core/src/actions/callback/userinfo.ts (1)
59-75:⚠️ Potential issue | 🟠 Major | ⚡ Quick winParse OAuth error payload before the non-2xx early throw.
Line 59 currently throws on
!response.okbefore Line 65 can parse OAuth error bodies, so standard provider error JSON on 4xx/5xx never gets normalized.Proposed fix
- if (!response.ok) { - logger?.log("OAUTH_USERINFO_INVALID_RESPONSE") - throw new OAuthProtocolError("INVALID_REQUEST", "Invalid userinfo response format") - } - const json = await response.json() const { success, data } = OAuthErrorResponse.safeParse(json) if (success) { logger?.log("OAUTH_USERINFO_ERROR", { message: "Error response received from OAuth userinfo endpoint", @@ }) throw new OAuthProtocolError("INVALID_REQUEST", "An error was received from the OAuth userinfo endpoint.") } + if (!response.ok) { + logger?.log("OAUTH_USERINFO_INVALID_RESPONSE") + throw new OAuthProtocolError("INVALID_REQUEST", "Invalid userinfo response format") + } logger?.log("OAUTH_USERINFO_SUCCESS")🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/core/src/actions/callback/userinfo.ts` around lines 59 - 75, When a non-2xx response arrives, parse the response body and inspect it with OAuthErrorResponse.safeParse before immediately throwing; specifically, in the code around response handling in packages/core/src/actions/callback/userinfo.ts use await response.json() and call OAuthErrorResponse.safeParse(json) when !response.ok, and if the parse indicates an OAuth error, log via logger?.log("OAUTH_USERINFO_ERROR", { message: ..., structuredData: { error, error_description } }) and throw an OAuthProtocolError with that context; only if the body is not a normalized OAuth error fall back to the current generic logger?.log("OAUTH_USERINFO_INVALID_RESPONSE") and throw the generic OAuthProtocolError. Ensure you reference response, OAuthErrorResponse.safeParse, logger?.log, and OAuthProtocolError when making the change.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/core/CHANGELOG.md`:
- Line 13: Update the CHANGELOG sentence describing the OAuth provider
`userInfo` option to explicitly state the allowed shapes: it accepts either a
URL string, or an object with a `url` and optional `headers`/`method`, or an
object `{ url, request }`, or a custom `userInfo` function (which lets callers
perform the user info request themselves); replace the ambiguous phrase “URL
string or custom headers” with this precise contract to avoid implying
headers-only configuration is valid.
---
Outside diff comments:
In `@packages/core/src/actions/callback/userinfo.ts`:
- Around line 59-75: When a non-2xx response arrives, parse the response body
and inspect it with OAuthErrorResponse.safeParse before immediately throwing;
specifically, in the code around response handling in
packages/core/src/actions/callback/userinfo.ts use await response.json() and
call OAuthErrorResponse.safeParse(json) when !response.ok, and if the parse
indicates an OAuth error, log via logger?.log("OAUTH_USERINFO_ERROR", { message:
..., structuredData: { error, error_description } }) and throw an
OAuthProtocolError with that context; only if the body is not a normalized OAuth
error fall back to the current generic
logger?.log("OAUTH_USERINFO_INVALID_RESPONSE") and throw the generic
OAuthProtocolError. Ensure you reference response, OAuthErrorResponse.safeParse,
logger?.log, and OAuthProtocolError when making the change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 4289ae1f-5fda-4c0c-a886-451da7aa381a
📒 Files selected for processing (7)
packages/core/CHANGELOG.mdpackages/core/src/@types/oauth.tspackages/core/src/actions/callback/callback.tspackages/core/src/actions/callback/userinfo.tspackages/core/src/shared/assert.tspackages/core/src/shared/index.tspackages/core/test/actions/callback/userinfo.test.ts
1 participant
Description
This pull request adds support for custom
userInforequest functions in OAuth providers, allowing developers to fully customize how user information is retrieved from the provider.With this feature, Aura Auth continues to manage the OAuth flow, token exchange, and token context, while developers can implement their own logic for fetching and mapping user profile data. This provides greater flexibility for providers that require custom request headers, response transformations, or non-standard user information endpoints.
Usage
Benefits