Refactor auth routes to use controller functions

[Copilot]

Description

Inline route handlers in providers.ts violated the established pattern of delegating logic to controllers. Four routes (/callback/github, /connect/github, /callback/bitbucket, /authorize/local) implemented business logic directly in route definitions.

Changes:

• Extracted inline handlers to controller functions in src/app/controllers/auth.ts:
  • callbackGithub - handles GitHub OAuth callback with login strategy routing
  • connectGithub - initiates GitHub authentication for account linking
  • callbackBitbucket - handles Bitbucket OAuth callback
  • authorizeLocal - handles local auth with header injection
• Added null guards for req.user and req.user.token to prevent silent failures

Before:

router.get('/connect/github', secure, (req: any, res: any, next: any) => {
  const user = req.user
  if (user) {
    passport.authenticate('github', {
      scope: ['user:email'],
      state: req.user.email
    })(req, res, next)
  } else {
    res.redirect(`${process.env.FRONTEND_HOST}/#/signin/invalid`)
  }
})

After:

router.get('/connect/github', secure, controllers.connectGithub)

Routes now follow the same pattern as /callback/github/private and /authorize/github/disconnect.

Thank you for your contribution!

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

To fix the problem, introduce a rate-limiting middleware in this router and apply it to the sensitive authorization/connection routes, including /connect/github (the one using secure). The most straightforward approach in an Express-based codebase is to use the widely adopted express-rate-limit package. This avoids changing the business logic or existing behavior beyond rejecting or slowing excessive requests.

Concretely, in src/app/routes/auth/providers.ts:

1. Add an import for express-rate-limit.
2. Define a rateLimiter instance with sensible defaults (e.g., a window and max number of requests) near the router initialization.
3. Apply rateLimiter as middleware to the routes that perform authorization: at minimum the /connect/github route where secure is used, and optionally other /authorize/* and /callback/* routes if you want broader coverage. To minimally satisfy the CodeQL finding, we will wrap only /connect/github with the limiter while leaving existing logic intact: router.get('/connect/github', rateLimiter, secure, controllers.connectGithub).

No existing imports are modified or removed; we only add a new import and a small configuration block plus the extra middleware parameter on the specific route definition.

In general, this should be fixed by applying rate limiting middleware to routes that perform authentication or authorization, especially those that can trigger expensive work (external API calls, DB writes, etc.). In an Express app, this is typically done by importing a rate limiting library such as express-rate-limit, configuring a limiter instance, and applying it to the specific routes that need protection (instead of globally if we want minimal behavioral change).

For this file, the minimal-change fix is to: (1) import express-rate-limit; (2) define a limiter configured for auth-related routes (e.g., a modest number of requests per IP per time window); and (3) apply that limiter to the /connect/github route (and potentially other similar authorization routes, but CodeQL’s complaint is specifically about controllers.connectGithub). We will add the import at the top of src/app/routes/auth/providers.ts, define the limiter just below the router initialization, and then include the limiter as middleware in the route definition before secure and controllers.connectGithub so that rate limiting occurs before other logic executes. This preserves existing behavior for requests that are under the limit and only changes behavior when a client exceeds the configured rate.

Concretely:

• Add import rateLimit from 'express-rate-limit' at the top.
• After const router = express.Router(), add a constant such as const authRateLimiter = rateLimit({ windowMs: ..., max: ... }).
• Change line 39 from router.get('/connect/github', secure, controllers.connectGithub) to router.get('/connect/github', authRateLimiter, secure, controllers.connectGithub).