fix(auth): persist Google OAuth session on Studio (A1-fix) by groupthinking · Pull Request #2007 · groupthinking/EventRelay

groupthinking · 2026-09-18T20:31:55Z

Canonical issue

Named cut A1-fix (AXIOM: OAuth/config session does not stick on https://uvai.io/studio after Google consent). Baseline: e91f4a4 / #1973.

Outcome

After Google sign-in for garveyht@gmail.com, Studio shows a signed-in identity (email + Sign out) instead of a permanent Sign in link, and session-gated API routes can read the same JWT cookie NextAuth sets on callback.

Root cause

Two separate gaps (not initiation-UX / not retry-button):

Studio chrome never consulted session state — OneLoopStudio always rendered a hardcoded Sign in link; the app had no SessionProvider / useSession, so post-OAuth UX looked unsigned even when /api/auth/session could succeed.
JWT verification drift — auth.ts forces useSecureCookies when NODE_ENV === 'production', but proxy.ts and billing-context.ts called getToken() with NextAuth’s default secureCookie heuristic (NEXTAUTH_URL + VERCEL only). On production-shaped hosts where that default is false while secure cookies are still set, middleware and billing would not see __Secure-next-auth.session-token (session-gated pack/enrich/deploy paths stay 401).

Fix

Add nextAuthUseSecureCookies() + getNextAuthJwtFromRequest() in apps/web/src/lib/auth-jwt.ts and route all server JWT reads through it (auth.ts, proxy.ts, studio/security.ts, billing-context.ts).
Mount AuthSessionProvider in root layout; replace Studio nav Sign in stub with StudioAuthNavLink (email + Sign out when authenticated).

Scope

Included: NextAuth session visibility on /studio, aligned JWT cookie verification for gated /api/*.
Explicitly excluded: Origin G.A.T.E. (Fix E2E preview auth failures and harden Origin GATE checks #1937), retry-button-only UX (fix(auth): restore Google sign-in retry state #1995 family), RCE pins, docs spam.

Verification

Automated (head c16106593):

cd apps/web && npx vitest run \
  src/lib/__tests__/auth-jwt.test.ts \
  src/components/__tests__/StudioAuthNavLink.test.tsx \
  src/lib/__tests__/auth-config-source.test.ts \
  src/lib/studio/__tests__/security.test.ts \
  src/__tests__/proxy-auth-gate.test.ts
cd apps/web && npm run type-check

Manual dogfood (after Vercel preview/production deploy — record dpl_ + merge SHA here when READY):

Open https://uvai.io/studio (or PR preview) signed out → nav shows Sign in.
Sign in → Google → complete consent for garveyht@gmail.com.
Land on /studio → nav shows garveyht@gmail.com and Sign out (no Sign in).
DevTools → Application → Cookies → __Secure-next-auth.session-token present for uvai.io.
GET /api/auth/session (same browser) → JSON includes user.email.
Run pack flow (paste fixture https://www.youtube.com/watch?v=auJzb1D-fag, Run) → pack workbench populates; session-gated enrich (POST /api/extract-events) returns 200 when signed in (not 401).

Google Cloud console (no change required if already live): authorized redirect URI must include https://uvai.io/api/auth/callback/google. Production /api/auth/providers already advertises that callback (verified 2026-09-18).

Risk

Risk level: low
Failure mode: misconfigured NEXTAUTH_SECRET / Google creds unchanged from baseline; worst case auth still fails closed on gated APIs.
Rollback: revert this PR; no schema or env migrations.

Production evidence

READY deployment: pending Vercel build for c16106593 — update with dpl_… when preview/production is green.
Merge SHA (when merged): not merged (draft).

Agent handoff

One PR path (no dual-write)
Acceptance criteria mapped above
Required CI on current head — awaiting GitHub Actions
Live AXIOM re-score on uvai.io after deploy
Human decision only for merge/deploy approval

Align NextAuth JWT cookie verification with production secure cookies across proxy, billing, and studio security paths. Mount SessionProvider and render session-aware Studio nav after Google sign-in. Co-authored-by: Hayden <groupthinking@users.noreply.github.com>

coderabbitai · 2026-09-18T20:32:02Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: groupthinking/EventRelay/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1fe331c5-bb65-44dc-baa1-ad8c4e496968

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

SessionProvider triggers next-auth client logging that fetches /api/auth/_log without a base URL in jsdom, failing test-frontend. Co-authored-by: Hayden <groupthinking@users.noreply.github.com>

Copilot

🟡 Changes recommended

It leaves a lint-triggering unused import and introduces avoidable site-wide authentication overhead.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Aligns NextAuth secure-cookie JWT verification and exposes authenticated identity controls in Studio.

Changes:

Centralizes secure-cookie JWT handling across protected routes.
Adds session-aware Studio sign-in/sign-out navigation.
Adds focused authentication tests.

File summaries

File	Description
`apps/web/src/proxy.ts`	Uses centralized JWT verification.
`apps/web/src/lib/studio/security.ts`	Aligns Studio owner authentication.
`apps/web/src/lib/billing/billing-context.ts`	Aligns billing session lookup.
`apps/web/src/lib/auth.ts`	Shares secure-cookie policy.
`apps/web/src/lib/auth-jwt.ts`	Adds centralized JWT helper.
`apps/web/src/lib/__tests__/auth-jwt.test.ts`	Tests secure-cookie decoding.
`apps/web/src/lib/__tests__/auth-config-source.test.ts`	Guards shared policy usage.
`apps/web/src/components/StudioAuthNavLink.tsx`	Adds session-aware navigation.
`apps/web/src/components/OneLoopStudio.tsx`	Integrates authentication control.
`apps/web/src/components/AuthSessionProvider.tsx`	Provides client session context.
`apps/web/src/components/__tests__/StudioAuthNavLink.test.tsx`	Tests navigation states.
`apps/web/src/app/layout.tsx`	Mounts the session provider.

Review details

Files reviewed: 13/13 changed files
Comments generated: 3
Review effort level: Balanced

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

          {/* Keep JSON-LD away from preview scripts injected into the head. */}
          <StructuredData />
-          {children}
+          <AuthSessionProvider>{children}</AuthSessionProvider>


-          </Link>
-        }
-      />
+      <Nav rightSlot={<StudioAuthNavLink />} />


+
+afterEach(() => {
+  cleanup();
+  vi.restoreAllMocks();


github-actions · 2026-09-18T20:41:16Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA ad0d8dd.

Ensure that dependencies are being submitted on PR branches. Re-running this action after a short time may resolve the issue. See the documentation for more information and troubleshooting advice.

Scanned Files

None

linear-code · 2026-09-18T20:42:56Z

GRV-599

github-actions Bot added javascript Pull requests that update javascript code tests labels Sep 18, 2026

groupthinking marked this pull request as ready for review September 18, 2026 20:32

Copilot AI balanced review requested due to automatic review settings September 18, 2026 20:32

Copilot started reviewing on behalf of groupthinking September 18, 2026 20:33 View session

test(web): mock AuthSessionProvider in layout hydration tests

ad0d8dd

SessionProvider triggers next-auth client logging that fetches /api/auth/_log without a base URL in jsdom, failing test-frontend. Co-authored-by: Hayden <groupthinking@users.noreply.github.com>

Copilot AI reviewed Sep 18, 2026

View reviewed changes

kk-agent merged commit 7d0d58f into main Sep 18, 2026
23 of 25 checks passed

kk-agent deleted the cursor/a1-fix-oauth-session-6502 branch September 18, 2026 20:42

kk-agent mentioned this pull request Sep 19, 2026

[Agent] Restore Google login retry state #1987

Closed

7 tasks

Navigation Menu

fix(auth): persist Google OAuth session on Studio (A1-fix) - #2007

fix(auth): persist Google OAuth session on Studio (A1-fix)#2007
kk-agent merged 2 commits into
mainfrom
cursor/a1-fix-oauth-session-6502

groupthinking commented Sep 18, 2026

Uh oh!

coderabbitai Bot commented Sep 18, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Sep 18, 2026

Uh oh!

Uh oh!

linear-code Bot commented Sep 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

groupthinking commented Sep 18, 2026

Canonical issue

Outcome

Root cause

Fix

Scope

Verification

Risk

Production evidence

Agent handoff

Uh oh!

coderabbitai Bot commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

github-actions Bot commented Sep 18, 2026

Dependency Review

Snapshot Warnings

Scanned Files

Uh oh!

Uh oh!

linear-code Bot commented Sep 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

coderabbitai Bot commented Sep 18, 2026 •

edited

Loading