Skip to content

Add dynamic auth configuration endpoint - #264

Merged
kargig merged 1 commit into
mainfrom
feature/auth-providers-config
Oct 7, 2026
Merged

kargig merged 1 commit into
mainfrom
feature/auth-providers-config

Conversation

@kargig

@kargig kargig commented Oct 7, 2026

Copy link
Copy Markdown
Owner

Implement GET /api/v1/auth/config to inform the frontend of enabled auth providers (Google, Facebook) and their public client/app IDs based on server-side environment variables.

Update Login, Register, and Profile pages to dynamically show or hide social login buttons based on backend capability, preventing the Facebook button from appearing when server credentials are not set.

Implement GET /api/v1/auth/config to inform the frontend of enabled
auth providers (Google, Facebook) and their public client/app IDs based
on server-side environment variables.

Update Login, Register, and Profile pages to dynamically show or hide
social login buttons based on backend capability, preventing the
Facebook button from appearing when server credentials are not set.
@github-actions

github-actions Bot commented Oct 7, 2026

Copy link
Copy Markdown

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪
🧪 PR contains tests
🔒 No security concerns identified
⚡ Recommended focus areas for review

Possible Issue

The Facebook account-linking block is now gated on isFacebookEnabled, which is derived from authConfig?.facebook?.enabled. When the backend config query has not yet resolved (or fails), authConfig is undefined, so isFacebookEnabled is false. A user who already has user.facebook_id set will no longer see the "Facebook Connected" / "Disconnect" UI until the config request succeeds. If the config endpoint is unreachable, the user cannot disconnect their linked Facebook account at all. Consider showing the connected state whenever user?.facebook_id is truthy, independent of provider enablement.

{!user?.google_id && (user?.facebook_id || isFacebookEnabled) && (
Stale Closure

handleFacebookLogin now calls facebookAuth.signIn(fbAppId), but fbAppId is computed from authConfig which resolves asynchronously. The useCallback dependency array includes fbAppId, so the callback is recreated when config loads; however, if the user clicks the Facebook button before the config query resolves, fbAppId falls back to import.meta.env.VITE_FACEBOOK_APP_ID. If that env var is unset, signIn is called with undefined and throws 'Facebook App ID not configured.' The button is only rendered when isFacebookEnabled is true, which requires fbAppId to be truthy, so this is mostly guarded — but the same pattern in Register.jsx and Profile.jsx should be verified for consistency.

const token = await facebookAuth.signIn(fbAppId);

@kargig
kargig merged commit 1b34571 into main Oct 7, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant