feat: AUTH_MODE support, anonymous suggestions, and sign-in-to-edit UX #57
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -407,8 +407,13 @@ export default function SuggestionReviewPage() { | |
| <div className="flex-1"> | ||
| <div className="flex items-center gap-2"> | ||
| <span className="text-sm font-medium text-slate-900 dark:text-white"> | ||
| {s.submitter?.name || s.submitter?.email || (s.is_anonymous ? "Anonymous" : "Unknown user")} | ||
| </span> | ||
| {s.is_anonymous && ( | ||
| <span className="rounded bg-slate-100 px-1.5 py-0.5 text-xs text-slate-600 dark:bg-slate-700 dark:text-slate-300"> | ||
| Anonymous | ||
| </span> | ||
|
Comment on lines
+410
to
+415
There was a problem hiding this comment. Avoid the duplicated “Anonymous” label. When Also applies to: 523-531 🤖 Prompt for AI Agents |
||
| )} | ||
| {(s.revision ?? 1) > 1 && ( | ||
| <span className="rounded-sm bg-blue-100 px-1.5 py-0.5 text-xs font-medium text-blue-700 dark:bg-blue-900/30 dark:text-blue-400"> | ||
| v{s.revision} | ||
|
|
@@ -510,9 +515,16 @@ export default function SuggestionReviewPage() { | |
| <h4 className="text-xs font-medium uppercase tracking-wider text-slate-400 dark:text-slate-500"> | ||
| Submitted by | ||
| </h4> | ||
| <div className="mt-1 flex items-center gap-2"> | ||
| <p className="text-sm text-slate-900 dark:text-white"> | ||
| {s.submitter?.name || s.submitter?.email || (s.is_anonymous ? "Anonymous" : "Unknown user")} | ||
| </p> | ||
| {s.is_anonymous && ( | ||
| <span className="rounded bg-slate-100 px-1.5 py-0.5 text-xs text-slate-600 dark:bg-slate-700 dark:text-slate-300"> | ||
| Anonymous | ||
| </span> | ||
| )} | ||
| </div> | ||
| <p className="text-xs text-slate-500 dark:text-slate-400"> | ||
| <Clock className="mr-1 inline h-3 w-3" /> | ||
| {lastActivity.toLocaleString()} | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,12 @@ | ||
| import NextAuth from "next-auth"; | ||
| import type { NextAuthConfig, User } from "next-auth"; | ||
| import "next-auth/jwt"; | ||
| import { getAuthMode, isZitadelConfigured } from "@/lib/auth-mode"; | ||
|
|
||
| // When auth is not required, provide a default secret so NextAuth doesn't crash | ||
| if (getAuthMode() !== "required" && !process.env.NEXTAUTH_SECRET) { | ||
| process.env.NEXTAUTH_SECRET = "ontokit-optional-auth-secret"; | ||
| } | ||
|
Comment on lines
+6
to
+9
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "Expected: there should be a single source of truth for NEXTAUTH_SECRET, and production auth-capable modes should not rely on a public fallback."
echo
echo "== secret fallbacks and reads =="
rg -nP --type=ts 'NEXTAUTH_SECRET|AUTH_SECRET|ontokit-optional-auth-secret|ontokit-dev-secret' auth.ts lib
echo
echo "== auth.ts =="
sed -n '1,140p' auth.tsRepository: CatholicOS/ontokit-web Length of output: 4639 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Checking lib/env.ts context around NEXTAUTH_SECRET defaults ==="
rg -B5 -A5 'NEXTAUTH_SECRET.*default' lib/env.ts
echo
echo "=== Checking how lib/env.ts is imported/used in auth.ts ==="
rg -n 'env|import.*env' auth.ts | head -20
echo
echo "=== Full lib/env.ts to understand the schema structure ==="
wc -l lib/env.ts && head -50 lib/env.tsRepository: CatholicOS/ontokit-web Length of output: 133 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Listing files in lib directory ==="
fd . lib --max-depth 2 -t f
echo
echo "=== Check if lib/env.ts exists ==="
ls -la lib/env.ts 2>&1 || echo "File not found"
echo
echo "=== Reading lib/env.ts entirely ==="
cat -n lib/env.ts 2>&1 || echo "Cannot read file"Repository: CatholicOS/ontokit-web Length of output: 5855 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Reading lib/auth-mode.ts to understand getAuthMode() and isAuthRequired() ==="
cat -n lib/auth-mode.ts
echo
echo "=== Checking where auth.ts is imported to understand initialization order ==="
rg -l 'import.*auth' --type=ts --type=tsx | head -10Repository: CatholicOS/ontokit-web Length of output: 1395 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Check if auth.ts is imported in middleware or app entry points ==="
rg 'import.*auth' . --type ts -l | grep -E '(middleware|layout|page)' | head -10
echo
echo "=== Check middleware.ts ==="
cat -n middleware.ts 2>/dev/null || echo "No middleware.ts found"
echo
echo "=== Check app layout ==="
find . -name 'layout.ts' -o -name 'layout.tsx' | head -3 | xargs cat -n 2>/dev/null || echo "Layout file not found or error"
echo
echo "=== Key question: When auth.ts sets NEXTAUTH_SECRET, does lib/env.ts validation run before or after? ==="
echo "Checking if auth.ts is imported at module level in app initialization..."
rg 'from.*auth' . --type ts | grep -v node_modules | head -10Repository: CatholicOS/ontokit-web Length of output: 5610 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Check if lib/env.ts is imported anywhere that would run at module init ==="
rg 'import.*env' . --type ts | grep -v node_modules | head -20
echo
echo "=== Check app/providers.ts which is imported at root layout ==="
cat -n app/providers.ts 2>/dev/null || echo "Not found"
echo
echo "=== Search for where serverEnv from lib/env.ts is actually used ==="
rg 'serverEnv|validateServerEnv|clientEnv|validateClientEnv' . --type ts | grep -v node_modules | head -15Repository: CatholicOS/ontokit-web Length of output: 1480 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Search for actual usage of serverEnv export from lib/env.ts ==="
rg 'import.*serverEnv|from.*lib/env' . --type ts | grep -v test | grep -v node_modules
echo
echo "=== Check if NextAuth initialization in auth.ts happens before env validation anywhere ==="
echo "Looking for any files that import from both auth.ts and lib/env.ts..."
rg 'import.*auth' . --type ts | grep -v node_modules | xargs rg 'import.*env' | head -10
echo
echo "=== Check what actually imports auth.ts at the app level ==="
rg 'import.*auth' app --type ts 2>/dev/null | head -20Repository: CatholicOS/ontokit-web Length of output: 133 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Check what happens when auth.ts is loaded - look at auth.ts more closely ==="
cat -n auth.ts | head -15
echo
echo "=== Confirm: the NEXTAUTH_SECRET fallback in auth.ts is set BEFORE NextAuth() is called ==="
grep -n 'NextAuth(' auth.ts
echo
echo "=== When does lib/env.ts validation actually run? Check if serverEnv is exported/used ==="
rg 'serverEnv' . --type ts | grep -v test | grep -v 'function validateServerEnv' | grep -v 'export const serverEnv' | grep -v 'return validateServerEnv'
echo
echo "=== Summary: Is auth.ts imported/executed at module level by NextAuth setup? ==="
echo "NextAuth handlers are exported from auth.ts, so auth.ts runs immediately when imported."
echo "The NEXTAUTH_SECRET assignment on lines 7-8 runs BEFORE NextAuth(authConfig) on line 107."
echo "This means the fallback secret is set into process.env before any other code can read it."Repository: CatholicOS/ontokit-web Length of output: 1031 Don't ship a shared fallback Lines 7–8 set 🤖 Prompt for AI Agents |
||
|
|
||
| // Zitadel provider configuration | ||
| const zitadelProvider = { | ||
|
|
@@ -26,7 +32,9 @@ const zitadelProvider = { | |
| }; | ||
|
|
||
| export const authConfig: NextAuthConfig = { | ||
| providers: getAuthMode() === "disabled" || !isZitadelConfigured() | ||
| ? [] | ||
| : [zitadelProvider], | ||
| events: { | ||
| async signOut(_message) { | ||
| // This event fires after local session is cleared | ||
|
|
@@ -46,6 +54,11 @@ export const authConfig: NextAuthConfig = { | |
| }; | ||
| } | ||
|
|
||
| // Skip token refresh when Zitadel is not configured | ||
| if (!isZitadelConfigured()) { | ||
| return token; | ||
| } | ||
|
|
||
| // Return previous token if the access token has not expired yet | ||
| if (Date.now() < ((token.expiresAt as number) ?? 0) * 1000) { | ||
| return token; | ||
|
|
@@ -95,10 +108,9 @@ export const authConfig: NextAuthConfig = { | |
| return session; | ||
| }, | ||
| }, | ||
| pages: getAuthMode() === "required" | ||
| ? { signIn: "/auth/signin", error: "/auth/error" } | ||
| : {}, | ||
| debug: process.env.NODE_ENV === "development", | ||
| }; | ||
|
|
||
|
|
||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.