fix(deploy): harden oauth smoke secret contract

[LucasSantana-Dev]

Summary

• harden deploy OAuth redirect smoke check to fail fast when WEBAPP_EXPECTED_CLIENT_ID is missing
• compare auth-config client id against configured secret with explicit mismatch message
• align README env var guidance for redirect/client-id/backend URL semantics
• document the stricter deploy smoke behavior in changelog

Track split note

• Track A (runtime/test stabilization) was inspected and intentionally skipped in this cycle because the origin/main...chore/root-main-aligned package-level diff was formatting-only (no runtime/contract token changes).

Verification

• npm run lint
• npm run type:check
• npm run test --workspace=packages/backend -- tests/unit/utils/authHealth.test.ts tests/unit/utils/oauthRedirectUri.test.ts

Summary by CodeRabbit

Release Notes

• Bug Fixes

  • Deployment workflow now fails fast with explicit error messages when OAuth authentication configuration is missing or mismatched.

• Documentation

  • Updated environment variable guidance to clarify that OAuth client ID should be configured via deployment secrets.

• Chores

  • Enhanced deployment workflow error detection and reporting for OAuth configuration validation.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
lucky	Ready	Preview, Comment	Mar 13, 2026 9:18pm

[netlify]

✅ Deploy Preview for regal-bunny-0c8efe ready!

Name	Link
🔨 Latest commit	7b457ec
🔍 Latest deploy log	https://app.netlify.com/projects/regal-bunny-0c8efe/deploys/69b47f12fc27e10008cb3713
😎 Deploy Preview	https://deploy-preview-208--regal-bunny-0c8efe.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

📝 Walkthrough

Walkthrough

Updates the OAuth smoke tests in the deploy workflow to guard the WEBAPP_EXPECTED_CLIENT_ID secret with early validation that errors if missing. Renames local variable from expected_client_id to auth_config_client_id and adjusts validation logic accordingly. Updates README and changelog documentation.

Changes

Cohort / File(s)	Summary
Deploy Workflow OAuth Validation .github/workflows/deploy.yml	Introduces guarded optional variable configured_expected_client_id from the WEBAPP_EXPECTED_CLIENT_ID secret with early failure check if missing. Renames local variable from expected_client_id to auth_config_client_id extracted from auth-config payload. Updates validation logic to compare auth-config client ID against the configured value and propagates it after validation. Error messages now reference WEBAPP_EXPECTED_CLIENT_ID secret on mismatch.
Documentation Updates CHANGELOG.md, README.md	Adds changelog entry documenting that deploy workflow OAuth smoke tests now fail fast when WEBAPP_EXPECTED_CLIENT_ID is missing and report explicit auth-config client-id mismatches. Updates README environment variable descriptions to clarify that WEBAPP_EXPECTED_CLIENT_ID is recommended via deployment secret and simplifies descriptions for WEBAPP_REDIRECT_URI and WEBAPP_BACKEND_URL.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• fix(ci): require auth-config deploy smoke contract #146: Modifies deploy workflow's auth-config smoke test to tighten validation around configured client ID with similar variable guarding and renaming patterns.
• chore(security): remediate GitGuardian incident 28574658 #205: Updates deploy workflow to read and validate expected client_id from WEBAPP_EXPECTED_CLIENT_ID secret, implementing the same source and validation approach.
• fix(backend): stabilize redis startup and auth health contract #145: Implements the /api/health/auth-config endpoint that provides the client-id responses being validated by these workflow smoke tests.

Suggested labels

size/m

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'fix(deploy): harden oauth smoke secret contract' directly reflects the main changes: hardening OAuth smoke tests to better validate secrets and fail fast when required values are missing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/deploy-secret-smoke-hardening

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud