refactor(auth): extract connector definitions out of auth.ts - #6203
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
PR SummaryMedium Risk Overview
The stale-account migration comment in
Reviewed by Cursor Bugbot for commit 243d6a0. Configure here. |
Greptile SummaryThe PR extracts the generic OAuth provider definitions from the central Better Auth configuration and relocates the Microsoft ID-token identity helper into the OAuth module without changing behavior.
Confidence Score: 5/5The PR appears safe to merge, with no changed-code regression identified in the provider extraction or Microsoft helper relocation. The provider count, order, callback behavior, configuration values, evaluation timing, and imports remain equivalent, and the relocated Microsoft helper has identical semantics with no new dependency cycle.
|
| Filename | Overview |
|---|---|
| apps/sim/lib/auth/auth.ts | Replaces the large inline provider array with a single builder call while preserving its position in Better Auth initialization. |
| apps/sim/lib/auth/connectors/providers.ts | Contains the mechanically relocated 49-provider generic OAuth configuration with an explicit return type that preserves contextual type checking. |
| apps/sim/lib/oauth/microsoft.ts | Adds the relocated Microsoft ID-token user-info helper with unchanged logic, dependencies, ID generation, and logging scope. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart LR
Auth["auth.ts<br/>Better Auth initialization"] --> Builder["buildConnectorProviders()"]
Builder --> Providers["Generic OAuth provider configurations"]
Providers --> Microsoft["Microsoft ID-token helper"]
Auth --> GenericOAuth["genericOAuth plugin"]
Providers --> GenericOAuth
Reviews (1): Last reviewed commit: "refactor(auth): extract connector defini..." | Re-trigger Greptile
auth.ts had grown to 3,927 lines, of which ~2,340 were the genericOAuth
connector list — the OAuth apps a workspace connects tools to, as distinct from
the handful of providers used to sign in to Sim. Adding a connector meant
editing the same file that configures sessions, database hooks and Stripe.
Moves that list to lib/auth/connectors/providers.ts behind
buildConnectorProviders(), and relocates getMicrosoftUserInfoFromIdToken to
lib/oauth/microsoft.ts alongside the three Microsoft helpers it already depends
on. auth.ts drops to 1,489 lines and reads as auth configuration again.
Pure move, verified mechanically: the connector array is token-identical after
stripping whitespace, and all 179 template literals emit byte-identical strings
(the one apparent diff was reindentation inside a ${} expression, not text).
Behavior, evaluation order and log scopes are unchanged; the array is still
built once, when betterAuth() runs.
The explicit GenericOAuthConfig[] return type is required, not cosmetic —
inline, the entries were contextually typed by the config property. Without it
prompt: 'consent' widens to string and every getUserInfo parameter becomes
implicitly any.
243d6a0 to
d8bc901
Compare
Stacked on #6201 — review that one first. Base will retarget to
stagingonce #6201 merges.Summary
auth.tswas 3,927 lines, ~2,340 of them thegenericOAuthconnector list. Adding a connector meant editing the same file that configures sessions,databaseHooksand Stripe. Moved tolib/auth/connectors/providers.tsbehindbuildConnectorProviders(); auth.ts drops to 1,489 linesgetMicrosoftUserInfoFromIdTokentolib/oauth/microsoft.ts, next to the three Microsoft helpers it already imports from. It was the last Microsoft identity helper outside that module, and it now has a home where it can be unit-testedauth.ts's own diff is 3 insertions / 2,441 deletionsThis is a pure move — verified mechanically, not by eye
Review with
git diff -w; dedenting by four spaces made Biome reflow ~10 wrapped calls.${}expressions showed the one apparent difference was reindentation inside an interpolation, not in emitted textOne thing that is not cosmetic
The explicit
GenericOAuthConfig[]return type is load-bearing. Inline, the entries were contextually typed by theconfigproperty. Without the annotationprompt: 'consent'widens tostringand stops matching its union, and everygetUserInfoparameter becomes implicitlyany— the extraction would have silently weakened type checking. Caught bytsc, fixed by the annotation.Type of Change
Testing
667 tests pass across the touched suites. Typecheck, biome,
check:api-validation,check:boundaries,check:client-boundary,check:utils,check:tool-registry-boundaryall clean.Known follow-ups (deliberately not in this PR)
Folding these in would destroy the reviewer's ability to diff the move with
-w:providerIdstring; so are the 8 Microsoft ones. Two factories collapse them to ~85 lines. That duplication has already caused a live drift:google-adsis missing theawait response.text().catch(() => {})body-drain that the other 13 Google entries haveproviders.ts(initial exchange) andlib/oauth/oauth.tsgetProviderAuthConfig(refresh). Change one and connect keeps working while refresh silently dies.getCanonicalScopesForProvideralready shows the right patternreturn nullvs ~17throw, andreadResponseJsonWithLimitis used in 5 of 42 response reads.lib/credentials/token-service-accounts/validators/*is the same problem already solved properly in this repolib/oauth/rather thanlib/auth/Checklist