Uh oh!
There was an error while loading. Please reload this page.
chore: remove deprecated env-var identity provider configuration - #1297
Merged
Conversation
Removes support for configuring GitHub, GitLab, Google, Okta, Keycloak, and Microsoft Entra ID identity providers via the deprecated AUTH_EE_*_CLIENT_ID/ SECRET/etc. environment variables. These providers must now be defined through the identityProviders section of the config file. GCP IAP env vars (AUTH_EE_GCP_IAP_ENABLED / AUTH_EE_GCP_IAP_AUDIENCE) are unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This comment has been minimized.
This comment has been minimized.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughThis PR removes deprecated ChangesRemove deprecated OAuth environment variable fallback
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/backend/src/ee/tokenRefresh.ts (1)
52-62:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winUpdate docstring to remove outdated reference to deprecated env vars.
Line 57 still mentions that token refresh attempts use "client credentials from the config file (or deprecated env vars)." Since this PR removes the deprecated env-var fallback, the docstring should be updated.
📝 Proposed fix
/** * Ensures the OAuth access token for a given account is fresh. * * - If the token is not expired (or has no expiry), decrypts and returns it as-is. * - If the token is expired or near expiry, attempts a refresh using the OAuth - * client credentials from the config file (or deprecated env vars).+ * client credentials from the config file. * - On successful refresh: persists the new tokens to the DB, clears any * tokenRefreshErrorMessage, and returns the fresh access token. * - On failure: sets tokenRefreshErrorMessage on the account and throws, so * the calling job fails with a clear error. */🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/backend/src/ee/tokenRefresh.ts` around lines 52 - 62, Update the top docstring in tokenRefresh.ts to remove the outdated mention of deprecated env vars: change the line that currently reads that refresh attempts use "client credentials from the config file (or deprecated env vars)" to state they use OAuth client credentials from the config file only; ensure any other bullets in the same comment no longer reference deprecated env vars so the docstring accurately reflects the removed fallback.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@packages/backend/src/ee/tokenRefresh.ts`:
- Around line 52-62: Update the top docstring in tokenRefresh.ts to remove the
outdated mention of deprecated env vars: change the line that currently reads
that refresh attempts use "client credentials from the config file (or
deprecated env vars)" to state they use OAuth client credentials from the config
file only; ensure any other bullets in the same comment no longer reference
deprecated env vars so the docstring accurately reflects the removed fallback.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 14ff19a4-9283-4e79-9b87-a8c834bd0b71
📒 Files selected for processing (4)
CHANGELOG.mdpackages/backend/src/ee/tokenRefresh.tspackages/shared/src/env.server.tspackages/web/src/ee/features/sso/sso.ts
💤 Files with no reviewable changes (2)
- packages/web/src/ee/features/sso/sso.ts
- packages/shared/src/env.server.ts
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
docs/docs/upgrade/v4-to-v5-guide.mdx (1)
186-186: ⚡ Quick winBreak this paragraph into shorter chunks.
This paragraph contains 5 sentences. As per coding guidelines, documentation should prefer short paragraphs (1-3 sentences) to improve readability. Consider breaking this into 2-3 shorter paragraphs to align with the guideline.
♻️ Suggested restructuring
-In v4, you could configure these identity providers using `AUTH_EE_*` environment variables (for example `AUTH_EE_GITHUB_CLIENT_ID`). Those variables were deprecated in favor of the [`identityProviders`](/docs/configuration/idp) section of the config file. Starting in v5.0.2, the environment variable path has been removed. Sourcebot no longer reads these variables, and any provider configured only through them will stop appearing on the login screen. This also applies if you are upgrading from an earlier v5 release (v5.0.0 or v5.0.1), where these variables were still supported.+In v4, you could configure these identity providers using `AUTH_EE_*` environment variables (for example `AUTH_EE_GITHUB_CLIENT_ID`). Those variables were deprecated in favor of the [`identityProviders`](/docs/configuration/idp) section of the config file.++Starting in v5.0.2, the environment variable path has been removed. Sourcebot no longer reads these variables, and any provider configured only through them will stop appearing on the login screen.++This also applies if you are upgrading from an earlier v5 release (v5.0.0 or v5.0.1), where these variables were still supported.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/docs/upgrade/v4-to-v5-guide.mdx` at line 186, The paragraph about deprecation of AUTH_EE_* env vars should be split into two or three shorter paragraphs to improve readability: first, state that AUTH_EE_* (e.g., AUTH_EE_GITHUB_CLIENT_ID) were deprecated in favor of the identityProviders config section; second, explain that starting in v5.0.2 the env var path was removed and Sourcebot no longer reads those vars; and optionally add a third short sentence noting that upgrades from v5.0.0 or v5.0.1 are affected if providers were only configured via those env vars. Keep each paragraph to 1–3 sentences and preserve the references to AUTH_EE_*, identityProviders, and v5.0.2.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@docs/docs/upgrade/v4-to-v5-guide.mdx`:
- Line 186: The paragraph about deprecation of AUTH_EE_* env vars should be
split into two or three shorter paragraphs to improve readability: first, state
that AUTH_EE_* (e.g., AUTH_EE_GITHUB_CLIENT_ID) were deprecated in favor of the
identityProviders config section; second, explain that starting in v5.0.2 the
env var path was removed and Sourcebot no longer reads those vars; and
optionally add a third short sentence noting that upgrades from v5.0.0 or v5.0.1
are affected if providers were only configured via those env vars. Keep each
paragraph to 1–3 sentences and preserve the references to AUTH_EE_*,
identityProviders, and v5.0.2.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 9a29743a-acff-4895-ab84-3f55dfe2cb34
📒 Files selected for processing (2)
CHANGELOG.mddocs/docs/upgrade/v4-to-v5-guide.mdx
✅ Files skipped from review due to trivial changes (1)
- CHANGELOG.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes support for configuring identity providers via the deprecated
AUTH_EE_*environment variables for GitHub, GitLab, Google, Okta, Keycloak, and Microsoft Entra ID. These providers must now be configured through theidentityProviderssection of the config file, which is already a complete replacement (every one of these providers is supported there).GCP IAP is intentionally unaffected —
AUTH_EE_GCP_IAP_ENABLEDandAUTH_EE_GCP_IAP_AUDIENCEremain supported (they're also read inlayout.tsx/onboard/page.tsxto drive the IAP bridge sign-in).AUTH_EE_ALLOW_EMAIL_ACCOUNT_LINKINGis also untouched (it's a behavioral flag, not a provider credential).Changes
packages/web/src/ee/features/sso/sso.ts— removed the deprecated env-var provider blocks from theidentityProviders.length == 0path (kept GCP IAP).packages/backend/src/ee/tokenRefresh.ts— removedgetDeprecatedEnvCredentialsand its fallback inrefreshOAuthToken; token refresh now relies solely on config-file provider credentials.packages/shared/src/env.server.ts— removed the deprecatedAUTH_EE_{GITHUB,GITLAB,GOOGLE,OKTA,KEYCLOAK,MICROSOFT_ENTRA_ID}_*env var declarations.Breaking change
Deployments configuring any of the six providers via
AUTH_EE_*environment variables must migrate to theidentityProvidersconfig-file section. No functionality is lost — only the configuration mechanism changes.🤖 Generated with Claude Code
Summary by CodeRabbit
Breaking Changes
Documentation