V2#43
Merged
Merged
Conversation
Review Summary by Qodov2.0.0: Schema validation with Zod, refactored providers, and new composables
WalkthroughsDescription• **Major version bump to v2.0.0** with comprehensive schema validation support using Zod • **Schema validation pipeline**: Build-time conversion of Zod schemas to JSON Schema, runtime reconstruction via z.fromJSONSchema(), and per-provider schema configuration • **LocalAuthProvider refactored**: Removed hardcoded principal/password field mapping; now accepts flexible Record with Zod schema validation via schemas.login and schemas.user • **New composables**: useAuthLogin() for typed login methods, useAuthUser() for user state access, useAuthToken() for token management • **Auth plugin property renamed**: loggedIn → isLoggedIn for consistency across plugin, middleware, and composables • **Schema utilities module**: New schema-utils.ts with collectSchemas(), stripSchemasFromProviders(), renderAuthSchemasRuntime(), and renderAuthSchemasTypes() for build-time code generation • **Runtime auth schemas store**: New auth-schemas.ts module providing authSchemas store and defineAuthSchemas() helper for runtime schema access • **OAuth providers enhanced**: GoogleAuthProvider and GithubAuthProvider now support optional schemas.user validation • **Error handling improvements**: Standardized error responses in login and refresh endpoints with proper HTTP status codes and field-level error reporting • **Comprehensive test coverage**: 15+ new test files covering unit tests (auth provider methods, schema utilities, token utilities, helpers), E2E tests (local auth, schema validation, middleware, composables), and test fixtures with mock API endpoints • **Documentation**: Complete README rewrite with schema validation guide, migration guide for v1→v2, and new AGENTS.md developer guide covering architecture and maintenance • **Build-time schema generation**: Module now generates virtual #auth-schemas module and TypeScript definitions at build time Diagramflowchart LR
A["Zod Schemas<br/>in Config"] -->|Build Time| B["collectSchemas()"]
B -->|Convert| C["JSON Schema"]
C -->|Generate| D["Virtual Module<br/>#auth-schemas"]
D -->|Runtime| E["z.fromJSONSchema()"]
E -->|Validate| F["Login/User Data"]
G["LocalAuthProvider"] -->|Flexible Body| H["validateRequestBody()"]
H -->|Zod Schema| I["Field Errors"]
J["Auth Plugin"] -->|Renamed| K["isLoggedIn"]
K -->|Used by| L["Composables<br/>useAuthUser"]
L -->|Access| M["User State"]
File Changes1. test/unit/auth-provider-methods.test.ts
|
Code Review by Qodo
1. Weak OAuth state secret
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
20
to
26
| const provider = authClient.provider(providerKey); | ||
| if (!provider || !provider.refreshTokens) { | ||
| return Promise.reject( | ||
| "refresh tokens is not implemented for this provider" | ||
| ); | ||
| setResponseStatus(event, 400); | ||
| return { | ||
| message: "refresh tokens is not implemented for this provider", | ||
| } satisfies ErrorResponse; | ||
| } |
There was a problem hiding this comment.
2. Refresh provider crash 🐞 Bug ☼ Reliability
/api/auth/refresh calls authClient.provider(providerKey) directly; if the auth:provider cookie is an unregistered key, AuthProvider.provider() throws and the route returns a 500. This is inconsistent with /api/auth/login, which already catches unknown providers and returns a 400 ErrorResponse.
Agent Prompt
## Issue description
`/api/auth/refresh` does an unconditional `authClient.provider(providerKey)` based on a client-controlled cookie value. When the cookie contains an unknown provider key, `AuthProvider.provider()` throws, producing a 500 instead of a controlled 4xx response.
## Issue Context
`/api/auth/login` already wraps `authClient.provider(...)` in try/catch and returns a 400 with a structured ErrorResponse; `/api/auth/refresh` should behave the same.
## Fix Focus Areas
- src/runtime/server/api/refresh.post.ts[20-26]
- src/runtime/providers/AuthProvider.ts[61-67]
- src/runtime/server/api/login.post.ts[33-42]
## Proposed fix
1. Wrap `authClient.provider(providerKey)` in try/catch.
2. On error: set an appropriate status (likely 400), return an `ErrorResponse` shaped like login.post.ts, and optionally clear auth cookies to self-heal corrupted state.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
|
🎉 This PR is included in version 1.6.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.