feat(auth): implement Wikimedia OAuth 2.0 authentication - #46
Open
pushpaktiwarii wants to merge 1 commit into
Open
feat(auth): implement Wikimedia OAuth 2.0 authentication#46pushpaktiwarii wants to merge 1 commit into
pushpaktiwarii wants to merge 1 commit into
Conversation
|
@pushpaktiwarii is attempting to deploy a commit to the Tiisu's projects Team on Vercel. A member of the Team first needs to authorize it. |
pushpaktiwarii
force-pushed
the
feat/wikimedia-oauth
branch
from
July 10, 2026 20:54
fe34bc8 to
767b6ac
Compare
Resolves T431227 This commit introduces 'Sign in with Wikimedia' functionality using the OAuth 2.0 Authorization Code grant flow, integrating alongside the existing local JWT authentication. Key changes: - Backend Auth Controller: Added logic to redirect users to the Wikimedia authorization endpoint and handle the callback code to exchange for access tokens. - User Model: Updated schema to support wikimedia_id and wikimedia_username, and made the password field optional for OAuth users. - Frontend Auth Page: Added a 'Sign in with Wikimedia' button seamlessly integrated into the UI. - Frontend Callback Page: Implemented a new /auth/callback page that safely extracts tokens from the URL and authenticates the user in the React context without double-rendering issues. - Environment: Added necessary WIKIMEDIA environment variables to .env.example for open-source contributors.
There was a problem hiding this comment.
Pull request overview
This PR adds “Sign in with Wikimedia” using an OAuth 2.0 authorization code flow, integrating it alongside the existing JWT-based auth by introducing new backend OAuth endpoints and frontend callback handling.
Changes:
- Added backend
/auth/wikimediaand/auth/wikimedia/callbackroutes to initiate OAuth and handle the authorization-code exchange + user provisioning. - Added frontend
/auth/callbackroute/page to ingest OAuth results and establish an authenticated session in the React auth context. - Extended the
Usermodel to support Wikimedia-linked accounts and made passwords optional for OAuth-created users.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 10 comments.
Show a summary per file
| File | Description |
|---|---|
| frontend/src/pages/OAuthCallback.tsx | New callback page to process OAuth redirect results and finalize login in the client. |
| frontend/src/pages/index.ts | Exposes the new OAuthCallback page via the pages barrel export. |
| frontend/src/pages/AuthPage.tsx | Adds a “Sign in with Wikimedia” button and surfaces OAuth errors on the auth page. |
| frontend/src/lib/auth-context.tsx | Adds loginWithTokens for establishing auth state from externally obtained tokens. |
| frontend/src/App.tsx | Registers the new /auth/callback route. |
| backend/src/routes/authRoutes.js | Adds Wikimedia OAuth routes to the auth router. |
| backend/src/models/User.js | Adds Wikimedia identity fields and relaxes password requirements for OAuth users. |
| backend/src/controllers/authController.js | Implements Wikimedia OAuth redirect + callback exchange and user provisioning flow. |
| backend/.env.example | Documents required Wikimedia OAuth configuration variables. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+19
to
+21
| const accessToken = searchParams.get('accessToken'); | ||
| const refreshToken = searchParams.get('refreshToken'); | ||
| const error = searchParams.get('error'); |
Comment on lines
+24
to
+26
| toast.error(`Authentication failed: ${error}`); | ||
| navigate('/auth'); | ||
| return; |
Comment on lines
+29
to
+37
| if (accessToken && refreshToken) { | ||
| loginWithTokens(accessToken, refreshToken).then(success => { | ||
| if (success) { | ||
| navigate('/'); | ||
| } else { | ||
| navigate('/auth'); | ||
| } | ||
| }); | ||
| } else { |
Comment on lines
+38
to
+40
| toast.error('Authentication failed: Missing tokens'); | ||
| navigate('/auth'); | ||
| } |
Comment on lines
+20
to
+27
| useEffect(() => { | ||
| // Check for errors from OAuth redirect | ||
| const params = new URLSearchParams(window.location.search); | ||
| const error = params.get('error'); | ||
| if (error) { | ||
| toast.error(error); | ||
| } | ||
| }, []); |
Comment on lines
+208
to
+210
| if (oauthError || !code) { | ||
| return res.redirect(`${process.env.FRONTEND_URL}/auth?error=${oauthError || 'No code provided'}`); | ||
| } |
Comment on lines
+268
to
+272
| const accessToken = generateAccessToken(user._id); | ||
| const refreshToken = generateRefreshToken(user._id); | ||
|
|
||
| res.redirect(`${process.env.FRONTEND_URL}/auth/callback?accessToken=${accessToken}&refreshToken=${refreshToken}`); | ||
|
|
Comment on lines
+192
to
+196
| const params = new URLSearchParams({ | ||
| response_type: 'code', | ||
| client_id: process.env.WIKIMEDIA_CLIENT_ID, | ||
| redirect_uri: process.env.WIKIMEDIA_CALLBACK_URL | ||
| }); |
Comment on lines
+20
to
+21
| router.get('/wikimedia', wikimediaLogin); | ||
| router.get('/wikimedia/callback', wikimediaCallback); |
Comment on lines
76
to
79
| userSchema.pre('save', async function(next) { | ||
| if (!this.isModified('password')) { | ||
| if (!this.isModified('password') || !this.password) { | ||
| return next(); | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR introduces the 'Sign in with Wikimedia' functionality using the OAuth 2.0 Authorization Code grant flow. It seamlessly integrates alongside the existing local JWT authentication system.
Resolves T431227
Key Changes
wikimedia_idandwikimedia_username, making the password field optional for OAuth-based users./auth/callbackpage that safely extracts tokens from the URL and authenticates the user in the React context without double-rendering issues.WIKIMEDIA_*environment variables to.env.examplefor open-source contributors.Testing