Skip to content

fix(oauth): prevent duplicate connections on re-authentication #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
diegosouzapw merged 1 commit into from
Feb 13, 2026
Merged

fix(oauth): prevent duplicate connections on re-authentication #5

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions src/lib/db/providers.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,16 @@ export async function createProviderConnection(data) {
"SELECT * FROM provider_connections WHERE provider = ? AND auth_type = 'oauth' AND email = ?"
)
.get(data.provider, data.email);
} else if (data.authType === "oauth" && !data.email) {
// Fallback for providers that don't return email (e.g. Codex):
// find the most recent failed connection for this provider to update instead of duplicating
existing = db
.prepare(
`SELECT * FROM provider_connections WHERE provider = ? AND auth_type = 'oauth'
AND (test_status = 'auth_failed' OR test_status = 'refresh_failed' OR test_status = 'error')

Copilot AI Feb 13, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The fallback upsert is filtering on test_status = 'auth_failed' | 'refresh_failed', but in this codebase auth_failed/refresh_failed are stored in error_code (while test_status is typically active/error/etc.). As written, this will almost never match the intended rows. Update the WHERE clause to filter on error_code (and/or last_error_type) instead of test_status for these values.

Suggested change
AND (test_status = 'auth_failed' OR test_status = 'refresh_failed' OR test_status = 'error')
AND (error_code IN ('auth_failed', 'refresh_failed') OR test_status = 'error')

Copilot uses AI. Check for mistakes.
ORDER BY updated_at DESC LIMIT 1`
Comment on lines +58 to +60

@gemini-code-assist gemini-code-assist Bot Feb 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

For better readability and conciseness, you can use the IN operator in your SQL query instead of multiple OR conditions. This is a common practice for checking against a list of values.

Suggested change
`SELECT * FROM provider_connections WHERE provider = ? AND auth_type = 'oauth'
AND (test_status = 'auth_failed' OR test_status = 'refresh_failed' OR test_status = 'error')
ORDER BY updated_at DESC LIMIT 1`
`SELECT * FROM provider_connections WHERE provider = ? AND auth_type = 'oauth'
AND test_status IN ('auth_failed', 'refresh_failed', 'error')
ORDER BY updated_at DESC LIMIT 1`

)
.get(data.provider);
Comment on lines +53 to +62

Copilot AI Feb 13, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This fallback query can select and overwrite any recent failed OAuth connection for the provider, including ones that do have an email, whenever the incoming token payload lacks email (e.g., transient user-info fetch failure). To avoid updating the wrong account, consider narrowing the match (e.g., email IS NULL/empty, or restricting this fallback to known no-email providers like codex).

Copilot uses AI. Check for mistakes.
} else if (data.authType === "apikey" && data.name) {
existing = db
.prepare(
Expand Down