feat(auth): add Google OAuth authentication#124
Conversation
|
@TejasNere99 is attempting to deploy a commit to the Akash Santra 's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
Warning Review limit reached
Next review available in: 42 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughGoogle OAuth sign-in and sign-up are implemented across the backend and frontend, including token verification, provider-aware user records, account creation/linking, frontend OAuth controls, and authenticated session handling. ChangesGoogle OAuth authentication
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Frontend
participant GoogleOAuth
participant Backend
participant UserModel
Frontend->>GoogleOAuth: Obtain Google ID token
Frontend->>Backend: POST /auth/google with token
Backend->>GoogleOAuth: Verify ID token
GoogleOAuth-->>Backend: Verified email and profile
Backend->>UserModel: Find, link, or create user
UserModel-->>Backend: User record
Backend-->>Frontend: JWT and user profile
Possibly related issues
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
backend/src/models/user.model.js (1)
35-39: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick winGuard password login for Google accounts
googleAuthcan create users without a local password, butloginstill callsbcrypt.compare(password, user.password)unconditionally. For those accounts this returns a 500 instead of a clear “use Google Sign-In” response. Add an early!user.passwordcheck inlogin.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@backend/src/models/user.model.js` around lines 35 - 39, Update the login method to check for a missing user.password before calling bcrypt.compare, and return a clear response directing Google-linked accounts to use Google Sign-In. Preserve the existing password comparison flow for users with local passwords.
🧹 Nitpick comments (2)
backend/src/models/user.model.js (1)
136-146: 🗄️ Data Integrity & Integration | 🔵 Trivial | 💤 Low valueConsider a unique/sparse index on
googleId.
googleIdhas no index constraints. Addingunique: true, sparse: trueguards against two user documents ever sharing the same Google account identifier, which is otherwise only implicitly prevented by the email-based lookup in the controller.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@backend/src/models/user.model.js` around lines 136 - 146, Update the googleId field in the user model schema to enforce a unique sparse index by adding the corresponding schema options. Preserve the existing String type and null default so users without Google accounts remain allowed while duplicate non-null Google identifiers are rejected.backend/src/controllers/auth.controller.js (1)
1066-1072: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winToken-verification failures return
500instead of401.Any failure inside the try block — including
verifyIdTokenrejecting an invalid/expired/tampered token — falls through to a generic500 "Internal Server Error". Distinguishing token-verification errors (401) from true server errors would give the frontend a more accurate signal and avoid masking client-side issues as backend failures.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@backend/src/controllers/auth.controller.js` around lines 1066 - 1072, Update the Google authentication error handling around the controller’s verifyIdToken flow to detect invalid, expired, or tampered token-verification failures and return HTTP 401 instead of the generic 500 response. Preserve the existing 500 response for unrelated server errors and keep the current error logging context.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/src/controllers/auth.controller.js`:
- Around line 1028-1052: Update the existing-user branch after User.findOne to
reject banned users and prevent Google linking or authentication for users whose
isVerified flag is false. Apply these checks before assigning googleId, saving
the user, or issuing the JWT, while preserving Google linking for verified,
non-banned users and the existing new-user creation flow.
- Around line 1-11: Add a startup validation immediately after the
`googleClient` initialization to require `process.env.GOOGLE_CLIENT_ID`,
matching the existing `JWT_SECRET` guard’s fail-fast behavior and error-handling
style. Ensure application startup stops when the value is missing, before any
token verification can occur.
---
Outside diff comments:
In `@backend/src/models/user.model.js`:
- Around line 35-39: Update the login method to check for a missing
user.password before calling bcrypt.compare, and return a clear response
directing Google-linked accounts to use Google Sign-In. Preserve the existing
password comparison flow for users with local passwords.
---
Nitpick comments:
In `@backend/src/controllers/auth.controller.js`:
- Around line 1066-1072: Update the Google authentication error handling around
the controller’s verifyIdToken flow to detect invalid, expired, or tampered
token-verification failures and return HTTP 401 instead of the generic 500
response. Preserve the existing 500 response for unrelated server errors and
keep the current error logging context.
In `@backend/src/models/user.model.js`:
- Around line 136-146: Update the googleId field in the user model schema to
enforce a unique sparse index by adding the corresponding schema options.
Preserve the existing String type and null default so users without Google
accounts remain allowed while duplicate non-null Google identifiers are
rejected.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: bbfcb0a6-fe39-40dd-86ff-ccde88070166
⛔ Files ignored due to path filters (2)
backend/package-lock.jsonis excluded by!**/package-lock.jsonfrontend/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (11)
backend/.env.examplebackend/package.jsonbackend/src/controllers/auth.controller.jsbackend/src/models/user.model.jsbackend/src/routes/auth.route.jsfrontend/.env.examplefrontend/package.jsonfrontend/src/main.jsxfrontend/src/pages/LoginPage.jsxfrontend/src/pages/SignUpPage.jsxfrontend/src/store/useAuthStore.js
|
Thanks for the contribution! The implementation looks good overall. Before I review it further, please address the security issues highlighted by CodeRabbit, especially the |
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Refactor Google OAuth client initialization to handle undefined GOOGLE_CLIENT_ID gracefully.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/src/controllers/auth.controller.js`:
- Around line 1048-1055: Update the Google-user lookup in the relevant auth
controller flow to explicitly select the password field before setting it
undefined, ensuring Mongoose persists its removal. In the local login handler,
guard against users without a password and return the existing
invalid-credentials response before calling bcrypt.compare.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 824774c6-ec82-48ee-addb-f9b992714725
📒 Files selected for processing (1)
backend/src/controllers/auth.controller.js
Add validation for missing password in authentication.
|
Hi @Akash504-ai, I've addressed all the CodeRabbit review comments and pushed the required changes. The CI checks are now passing successfully. Could you please review the PR when you have a chance? If there's anything else that needs to be improved, I'd be happy to make the necessary changes. Thank you! |
|
Thanks for the updates! Looks good so far. |
2 participants
Summary
fixes : #122
This PR adds Google OAuth authentication to the application, allowing users to securely sign in or sign up using their Google account.
The authentication pages were updated to include the Google Sign-In option while preserving the existing authentication flow.
Changes Made
Backend
google-auth-library./auth/googleendpoint.providerandgoogleIdin the User model.Frontend
@react-oauth/google.Testing
Screenshots
Summary by CodeRabbit