Conversation
* add Microsoft environment variables to .env.example and env.ts * add microsoft.svg image file * set default value for MICROSOFT_ISSUER in env.ts * Add Microsoft authentication support and scopes * Add Microsoft sign-in functionality to LoginForm * Update README.md with Microsoft authentication setup instructions
|
@WhiteSoxx is attempting to deploy a commit to the Inbox Zero Team on Vercel. A member of the Team first needs to authorize it. |
WalkthroughThe changes introduce Microsoft Entra ID (Azure) as an additional authentication provider alongside Google. This includes updates to authentication logic, environment configuration, documentation, and login UI. Microsoft OAuth scopes are centralized, and database/account handling is extended to support multiple providers. Redirect logic in one page is temporarily disabled. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant LoginForm
participant AuthProvider (Google/Microsoft)
participant Backend
participant Database
User->>LoginForm: Click "Sign in with Microsoft"
LoginForm->>AuthProvider: Initiate OAuth flow (Microsoft)
AuthProvider->>LoginForm: Return OAuth code/token
LoginForm->>Backend: Send code/token for authentication
Backend->>AuthProvider: Exchange code for tokens
AuthProvider->>Backend: Return access/refresh tokens
Backend->>Database: Save tokens (provider-aware)
Backend-->>User: Complete login
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
⏰ Context from checks skipped due to timeout of 90000ms (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
Hi, I’m Jit, a friendly security platform designed to help developers build secure applications from day zero with an MVS (Minimal viable security) mindset. In case there are security findings, they will be communicated to you as a comment inside the PR. Hope you’ll enjoy using Jit. Questions? Comments? Want to learn more? Get in touch with us. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🔭 Outside diff range comments (1)
apps/web/app/(landing)/login/LoginForm.tsx (1)
22-23:⚠️ Potential issueFix shared loading state between Google and Microsoft sign-in dialogs.
Both dialogs share the same
loadingstate, which will cause both buttons to show loading when either is clicked. Each dialog should have its own loading state.-const [loading, setLoading] = useState(false); +const [googleLoading, setGoogleLoading] = useState(false); +const [microsoftLoading, setMicrosoftLoading] = useState(false);Then update the Google dialog:
-loading={loading} +loading={googleLoading} onClick={() => { - setLoading(true); + setGoogleLoading(true);And the Microsoft dialog:
-loading={loading} +loading={microsoftLoading} onClick={() => { - setLoading(true); + setMicrosoftLoading(true);Also applies to: 58-60, 111-113
🧹 Nitpick comments (4)
apps/web/app/(app)/[emailAccountId]/assistant/page.tsx (1)
31-34: Good temporary fix for the redirect loop issue.Commenting out the problematic redirect logic prevents the "redirected too many times" error. Consider investigating the root cause of the infinite redirect to properly resolve this in the future, possibly by adding additional conditions or redirect guards.
README.md (1)
175-175: Remove trailing punctuation from heading.-### Updating .env file with Azure credentials: +### Updating .env file with Azure credentials🧰 Tools
🪛 markdownlint-cli2 (0.17.2)
175-175: Trailing punctuation in heading
Punctuation: ':'(MD026, no-trailing-punctuation)
apps/web/app/(landing)/login/LoginForm.tsx (1)
78-78: Address or remove the TODO comment.This TODO suggests incomplete implementation. Please either implement the waitlist filtering or remove the comment if it's no longer needed.
Do you want me to help implement the waitlist user filtering logic or create an issue to track this task?
apps/web/utils/auth.ts (1)
133-133: Simplify template literal to regular string.-primaryPhotoUrl = profile.photo - ? `https://graph.microsoft.com/v1.0/me/photo/$value` - : null; +primaryPhotoUrl = profile.photo + ? "https://graph.microsoft.com/v1.0/me/photo/$value" + : null;🧰 Tools
🪛 Biome (1.9.4)
[error] 133-133: Do not use template literals if interpolation and special-character handling are not needed.
Unsafe fix: Replace with string literal
(lint/style/noUnusedTemplateLiteral)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
apps/web/public/images/microsoft.svgis excluded by!**/*.svg
📒 Files selected for processing (8)
README.md(2 hunks)apps/web/.env.example(1 hunks)apps/web/app/(app)/[emailAccountId]/assistant/page.tsx(1 hunks)apps/web/app/(landing)/login/LoginForm.tsx(1 hunks)apps/web/env.ts(1 hunks)apps/web/package.json(1 hunks)apps/web/utils/auth.ts(11 hunks)apps/web/utils/outlook/scopes.ts(1 hunks)
🧰 Additional context used
🧬 Code Graph Analysis (3)
apps/web/utils/outlook/scopes.ts (1)
apps/web/env.ts (1)
env(5-206)
apps/web/app/(landing)/login/LoginForm.tsx (1)
apps/web/components/Typography.tsx (1)
SectionDescription(114-114)
apps/web/utils/auth.ts (1)
apps/web/env.ts (1)
env(5-206)
🪛 LanguageTool
README.md
[uncategorized] ~134-~134: Possible missing preposition found.
Context: ...4. Enter your contact information 5. Agree to the User Data policy and then click ...
(AI_HYDRA_LEO_MISSING_TO)
[duplication] ~140-~140: Possible typo: you repeated a word.
Context: ...Client ID. 2. In Application Type, Choose Web application 3. Choose a name for your web client 4. In Aut...
(ENGLISH_WORD_REPEAT_RULE)
[grammar] ~156-~156: Did you mean “Copy and paste”?
Context: ... 2. Click Add or remove scopes 3. Copy paste the below into the `Manually add scopes...
(COPY_PASTE)
[duplication] ~166-~166: Possible typo: you repeated a word.
Context: ...gleapis.com/auth/contacts ``` 4. Click Update 5. Click `Save` in the Data Access page. 5. Add...
(ENGLISH_WORD_REPEAT_RULE)
[uncategorized] ~167-~167: The preposition “on” seems more likely in this position than the preposition “in”.
Context: ... 4. Click Update 5. Click Save in the Data Access page. 5. Add yourself ...
(AI_EN_LECTOR_REPLACEMENT_PREPOSITION_IN_ON)
[style] ~209-~209: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...f the client secret you just created. - Set MICROSOFT_ISSUER to your **Directory ...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🪛 markdownlint-cli2 (0.17.2)
README.md
175-175: Trailing punctuation in heading
Punctuation: ':'
(MD026, no-trailing-punctuation)
🪛 Biome (1.9.4)
apps/web/utils/auth.ts
[error] 133-133: Do not use template literals if interpolation and special-character handling are not needed.
Unsafe fix: Replace with string literal
(lint/style/noUnusedTemplateLiteral)
[error] 393-393: This variable implicitly has the any type.
Variable declarations without type annotation and initialization implicitly have the any type. Declare a type or initialize the variable with some value.
(lint/suspicious/noImplicitAnyLet)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: Static Code Analysis Js
- GitHub Check: Jit Security
🔇 Additional comments (4)
apps/web/package.json (1)
37-37:Details
✅ Verification successful
Verify the Microsoft Graph client package version.
The dependency addition looks good for Microsoft authentication support. Please ensure you're using the latest stable version of the package for security and feature updates.
🌐 Web query:
What is the latest version of @microsoft/microsoft-graph-client package?💡 Result:
The latest stable version of the
@microsoft/microsoft-graph-clientpackage is 3.0.7, released on September 19, 2023. (github.com) This version is available on npm. (npmjs.com)Additionally, there is a preview version 4.0.0-RestPreview.1 available. (socket.dev)
To install the latest stable version, you can use the following npm command:
npm install @microsoft/microsoft-graph-client@3.0.7For more details, you can visit the npm package page. (npmjs.com)
Citations:
- 1: https://github.com/microsoftgraph/msgraph-sdk-javascript/releases?utm_source=openai
- 2: https://www.npmjs.com/package/%40microsoft/microsoft-graph-client?utm_source=openai
- 3: https://socket.dev/npm/package/%40microsoft/microsoft-graph-client?utm_source=openai
- 4: https://www.npmjs.com/package/%40microsoft/microsoft-graph-client?utm_source=openai
Microsoft Graph Client Version Confirmed
The dependency in apps/web/package.json (line 37) uses “^3.0.7”, which is the latest stable release (3.0.7, Sep 19 2023). No update required.
apps/web/.env.example (1)
13-15: Environment variables look good for Microsoft authentication setup.The Microsoft authentication environment variables are properly added to the example file. These will help users configure their Azure OAuth credentials correctly.
apps/web/utils/outlook/scopes.ts (1)
1-16: LGTM! Well-structured Microsoft OAuth scopes configuration.The scopes are appropriately selected for an email client application, and the conditional inclusion of
Contacts.ReadWritebased on the environment variable is implemented correctly.apps/web/utils/auth.ts (1)
484-485: Great implementation of multi-provider support with backward compatibility!The addition of the
providerfield with a default of "google" ensures existing data continues to work while supporting the new Microsoft provider.Also applies to: 511-512, 541-542
| MICROSOFT_CLIENT_ID: z.string().min(1), | ||
| MICROSOFT_CLIENT_SECRET: z.string().min(1), | ||
| MICROSOFT_ISSUER: z.string().default("common"), |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Address inconsistency between environment variable names.
There's a naming inconsistency: .env.example defines MICROSOFT_TENANT_ID but the validation schema uses MICROSOFT_ISSUER. This could confuse users during setup.
Please clarify:
- Should both files use the same variable name?
- Is
MICROSOFT_ISSUERwith default"common"intended for multi-tenant support?
🏁 Script executed:
#!/bin/bash
# Check for Microsoft environment variable usage across the codebase
echo "Searching for Microsoft environment variable usage..."
rg -A 2 -B 2 "MICROSOFT_(CLIENT_ID|CLIENT_SECRET|TENANT_ID|ISSUER)"Length of output: 2859
🏁 Script executed:
#!/bin/bash
# Locate .env.example files and check for MICROSOFT_TENANT_ID usage
echo "Locating .env.example files..."
find . -type f -name ".env.example"
echo
echo "Searching for MICROSOFT_TENANT_ID in .env.example files..."
for file in $(find . -type f -name ".env.example"); do
echo "File: $file"
grep -n "MICROSOFT_TENANT_ID" "$file" || echo " → No occurrences found in $file"
doneLength of output: 1224
Standardize Microsoft tenant environment variable naming
There’s an inconsistency between your validation schema and example files:
- apps/web/env.ts expects
MICROSOFT_ISSUER(with a default of"common") - apps/web/.env.example defines
MICROSOFT_TENANT_ID
This can confuse users setting up Azure credentials. Please align the names across all references.
Affected locations:
- apps/web/env.ts (lines ~11–13)
- apps/web/.env.example (line 15)
- README.md (all mentions of
MICROSOFT_TENANT_IDorMICROSOFT_ISSUER)
Suggested diff for .env.example:
- MICROSOFT_TENANT_ID=
+ MICROSOFT_ISSUER=And update the README so it consistently describes MICROSOFT_ISSUER (e.g. “Set MICROSOFT_ISSUER to your Directory (tenant) ID or leave as common for multi-tenant”).
Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
In apps/web/env.ts around lines 11 to 13, the environment variable name
MICROSOFT_ISSUER is inconsistent with MICROSOFT_TENANT_ID used in
apps/web/.env.example and README.md. To fix this, rename MICROSOFT_ISSUER to
MICROSOFT_TENANT_ID in env.ts and set its default to "common" if multi-tenant
support is intended. Then, update apps/web/.env.example and README.md to
consistently use MICROSOFT_TENANT_ID, clarifying in the README that it can be
set to the Directory (tenant) ID or left as "common" for multi-tenant scenarios.
| - `MICROSOFT_CLIENT_ID` -- Google OAuth client ID. More info [here](https://authjs.dev/getting-started/providers/microsoft-entra-id) | ||
| - `MICROSOFT_CLIENT_SECRET` -- Google OAuth client secret. More info [here](https://authjs.dev/getting-started/providers/microsoft-entra-id) | ||
| - `MICROSOFT_ISSUER` -- Google OAuth client secret. More info [here](https://authjs.dev/getting-started/providers/microsoft-entra-id) |
There was a problem hiding this comment.
Fix copy-paste error: These should reference Microsoft/Azure, not Google.
These environment variable descriptions incorrectly reference "Google OAuth" when they should reference "Microsoft" or "Azure".
-- `MICROSOFT_CLIENT_ID` -- Google OAuth client ID. More info [here](https://authjs.dev/getting-started/providers/microsoft-entra-id)
-- `MICROSOFT_CLIENT_SECRET` -- Google OAuth client secret. More info [here](https://authjs.dev/getting-started/providers/microsoft-entra-id)
-- `MICROSOFT_ISSUER` -- Google OAuth client secret. More info [here](https://authjs.dev/getting-started/providers/microsoft-entra-id)
+- `MICROSOFT_CLIENT_ID` -- Microsoft OAuth client ID. More info [here](https://authjs.dev/getting-started/providers/microsoft-entra-id)
+- `MICROSOFT_CLIENT_SECRET` -- Microsoft OAuth client secret. More info [here](https://authjs.dev/getting-started/providers/microsoft-entra-id)
+- `MICROSOFT_ISSUER` -- Microsoft tenant ID or issuer. More info [here](https://authjs.dev/getting-started/providers/microsoft-entra-id)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - `MICROSOFT_CLIENT_ID` -- Google OAuth client ID. More info [here](https://authjs.dev/getting-started/providers/microsoft-entra-id) | |
| - `MICROSOFT_CLIENT_SECRET` -- Google OAuth client secret. More info [here](https://authjs.dev/getting-started/providers/microsoft-entra-id) | |
| - `MICROSOFT_ISSUER` -- Google OAuth client secret. More info [here](https://authjs.dev/getting-started/providers/microsoft-entra-id) | |
| - `MICROSOFT_CLIENT_ID` -- Microsoft OAuth client ID. More info [here](https://authjs.dev/getting-started/providers/microsoft-entra-id) | |
| - `MICROSOFT_CLIENT_SECRET` -- Microsoft OAuth client secret. More info [here](https://authjs.dev/getting-started/providers/microsoft-entra-id) | |
| - `MICROSOFT_ISSUER` -- Microsoft tenant ID or issuer. More info [here](https://authjs.dev/getting-started/providers/microsoft-entra-id) |
🤖 Prompt for AI Agents
In README.md around lines 177 to 179, the descriptions for MICROSOFT_CLIENT_ID,
MICROSOFT_CLIENT_SECRET, and MICROSOFT_ISSUER incorrectly mention "Google OAuth"
instead of "Microsoft" or "Azure". Update these descriptions to correctly
reference Microsoft or Azure OAuth to accurately reflect the environment
variables' purpose.
| }), | ||
| method: "POST", | ||
| }); | ||
| let response; |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Add explicit type annotation for response variable.
-let response;
+let response: Response;📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| let response; | |
| let response: Response; |
🧰 Tools
🪛 Biome (1.9.4)
[error] 393-393: This variable implicitly has the any type.
Variable declarations without type annotation and initialization implicitly have the any type. Declare a type or initialize the variable with some value.
(lint/suspicious/noImplicitAnyLet)
🤖 Prompt for AI Agents
In apps/web/utils/auth.ts at line 393, the variable 'response' is declared
without an explicit type annotation. Add an explicit type annotation to the
'response' variable declaration to clearly specify its expected type, improving
code readability and type safety.
|
Thanks! I'll ask the other one to check over this if there's anything worth adding from it. |
|
outlook support will go live soon via the other pr |
3 participants
This PR introduces Outlook login integration using NextAuth.
Notes:
Related Issue:
Summary by CodeRabbit