Conversation
Summary of ChangesHello @XiNiHa, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances user management by implementing account linking based on email addresses, allowing for a more seamless experience for users who might have multiple SuperTokens accounts but a single Hive identity. It also refines OIDC integration by enforcing stricter access checks for OIDC-only organizations and removes previous limitations on OIDC users, granting them more flexibility within the platform. These changes streamline user provisioning and access control, particularly in environments leveraging OIDC. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces significant changes to user and session management, particularly around OIDC integration. The UserActor and SuperTokensCookieBasedSession types are updated to include oidcIntegrationId and userId, allowing sessions to carry more detailed user and OIDC context. The SuperTokensUserAuthNStrategy and SuperTokenAccessTokenModel are adjusted to handle these new fields, with internalApi.ensureUser being called during session creation to populate userId and oidcIntegrationId in the session payload. The oidcIntegrationId field is removed from the core User entity in the database schema and UserModel is updated to reflect superTokensUserId as nullable, indicating a shift in how OIDC user data is stored and managed. User creation and lookup logic in the storage layer (ensureUser, createUser) is refactored to prioritize email-based lookup and to decouple superTokensUserId and oidcIntegrationId from the initial user creation, with a new mechanism to nullify these fields for existing users. Permissions and organization management are also updated: OIDC users can now create and join organizations, and the logic for canSwitchOrganization and myDefaultOrganization is simplified. Review comments highlight critical issues: a try...catch block in supertokens.ts that swallows errors from internalApi.ensureUser, a SQL syntax error (trailing comma) in storage/src/index.ts's getUserById query, and two instances where database operations within a transaction in storage/src/index.ts incorrectly use the main connection pool instead of the transaction connection, risking data inconsistency.
📚 Storybook DeploymentThe latest changes are available as preview in: https://pr-7390.hive-storybook.pages.dev |
💻 Website PreviewThe latest changes are available as preview in: https://pr-7390.hive-landing-page.pages.dev |
XiNiHa
force-pushed
the
CONSOLE-1623
branch
2 times, most recently
from
351c3d4 to
c48d261
Compare
|
🐋 This PR was built and pushed to the following Docker images: Targets: Platforms: Image Tag: |
| ALTER TABLE IF EXISTS "oidc_integrations" | ||
| RENAME COLUMN "oidc_user_access_only" TO "oidc_user_join_only"; |
There was a problem hiding this comment.
note: Renaming the column should be safe here as it only updates the metadata of the column and does not lock the table for a long time or result in rewriting all rows. Compared to other tables this one is quite small 👍
| if (org.ownerId === actor.user.id) { | ||
| return 1; | ||
| } | ||
| if (actor.oidcIntegrationId) { | ||
| // prioritize OIDC connected organization when user is authenticated with SSO | ||
| if (org.oidcIntegration?.id === actor.oidcIntegrationId) { | ||
| return 2; | ||
| } |
There was a problem hiding this comment.
Shouldn't the default org be the oidc org if the user is logged in via that provider?
2 participants
Background
Part of #470
We can easily introduce Account Linking for users who don't have any duplicate accounts yet.
Description
supertoken_user_idChecklist