Feat/auth oauth visibility and registration toggle - #350
Merged
arozumenko merged 2 commits intoMay 22, 2026
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds runtime-driven auth configuration to the Next.js web app so the login UI reflects which OAuth providers are actually configured and whether self-service registration is allowed, and improves backend SSE connection stability via periodic pings.
Changes:
- Introduces
/api/auth/configto expose booleans for GitHub/Google OAuth availability and registration enablement, and updates the login page to consume it. - Adds an
ALLOW_REGISTRATIONguard to block email sign-up routes (Better-Auth catch-all + custom register endpoint), with Jest coverage for the new routes/guards. - Configures backend SSE endpoints to send keepalive pings (
ping=15) to reduce idle disconnects.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| web/src/app/login/page.tsx | Fetches /api/auth/config client-side to toggle OAuth buttons + registration UI. |
| web/src/app/api/auth/register/route.ts | Blocks custom registration endpoint when ALLOW_REGISTRATION=false. |
| web/src/app/api/auth/config/route.ts | New endpoint returning OAuth/registration availability booleans with cache headers. |
| web/src/app/api/auth/config/tests/route.test.ts | Adds unit tests for /api/auth/config env-driven behavior and headers. |
| web/src/app/api/auth/[...all]/route.ts | Wraps Better-Auth handler to block /sign-up/email when registration is disabled. |
| web/src/app/api/auth/[...all]/tests/route.test.ts | Adds unit tests verifying the registration guard behavior on the catch-all route. |
| web/.env.example | Updates OAuth env guidance and adds ALLOW_REGISTRATION. |
| backend/app/api/routes.py | Adds ping=15 to SSE EventSourceResponse for invocation and recompute streams. |
| .env.example | Documents OAuth “blank hides button” behavior and adds ALLOW_REGISTRATION. |
Comment on lines
+11
to
+15
| const url = new URL(request.url); | ||
| if (process.env.ALLOW_REGISTRATION === 'false' && url.pathname === '/api/auth/sign-up/email') { | ||
| return NextResponse.json({ message: 'Registration is disabled' }, { status: 403 }); | ||
| } | ||
| return handlers.POST(request); |
Comment on lines
+18
to
+26
| const originalEnv = process.env; | ||
|
|
||
| beforeEach(() => { | ||
| process.env = { ...originalEnv }; | ||
| }); | ||
|
|
||
| afterAll(() => { | ||
| process.env = originalEnv; | ||
| }); |
Comment on lines
+4
to
+11
| const originalEnv = process.env; | ||
|
|
||
| beforeEach(() => { | ||
| process.env = { ...originalEnv }; | ||
| }); | ||
|
|
||
| afterAll(() => { | ||
| process.env = originalEnv; |
…lation
- Add ping=15 to both EventSourceResponse calls so cloud LB idle timeouts
don't drop long-running wiki generation / project recompute SSE streams
- Return { error, message } in registration-disabled 403 responses so clients
reading either field get the reason ([...all] and /register endpoints)
- Replace process.env={...clone} with per-key save/restore in both route
tests; full env replacement can leak state between test suites in Node
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
arozumenko
force-pushed
the
feat/auth-oauth-visibility-and-registration-toggle
branch
from
May 22, 2026 16:12
fea9290 to
a6ca779
Compare
Comment on lines
10
to
15
| export async function POST(request: NextRequest, _context: { params: Promise<{ all: string[] }> }) { | ||
| const url = new URL(request.url); | ||
| if (process.env.ALLOW_REGISTRATION === 'false' && url.pathname === '/api/auth/sign-up/email') { | ||
| return NextResponse.json({ message: 'Registration is disabled' }, { status: 403 }); | ||
| return NextResponse.json({ error: 'Registration is disabled', message: 'Registration is disabled' }, { status: 403 }); | ||
| } | ||
| return handlers.POST(request); |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.