feat: add OAuth login and migrate to the seamless-auth-react main SDK - #120
Merged
Conversation
The login screen now offers OAuth sign-in alongside passkey, magic link, and
OTP, and the whole auth integration moves to the main SDK's result convention.
Registration stays with the main applications; this is login only, and access
is still gated on the admin role by PublicAuthRoute and RequireAuth.
Migrate every SDK call site from the Response/.ok convention to the main SDK's
SeamlessAuthResult ({ data, error }): SignIn, MagicLinkVerification, and
useStepUpGuard. UserMenu drops the last-login line because the main User type no
longer exposes it. The magic-link poll keeps its 204-until-consumed semantics by
checking data.message === 'Success' rather than a bare no-error.
Add OAuthProviderButtons (lists providers, stashes the chosen id in
sessionStorage, starts the login, and redirects) and an OAuthCallback route that
finishes the login and lands behind the admin gate. The callback path
/oauth/callback is fixed because it is registered as the provider redirect URI,
and the redirect URI is built with useHref so the /console basename is honored.
Buttons render nothing when no providers are configured.
The dependency points at a local main build via file: link. This branch is not
mergeable until seamless-auth-react publishes the main changes (which also
depend on @seamless-auth/express >= 0.9.0 for the magic-link POST); flip the
dependency to the published version before merge.
Depends on fells-code/seamless-auth-react#102 (the dts fix that makes the SDK
types resolvable, without which this migration could not be typechecked).
The OAuth login and {data,error} migration were built against a local file:
link to the unreleased SDK. Now that 0.5.0 is published, point the dependency
at the registry version so the branch installs and builds in CI, and add the
changeset for the OAuth login feature and SDK upgrade.
Bccorb
marked this pull request as ready for review
July 23, 2026 02:49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
Adds OAuth sign-in to the admin login screen and migrates the whole auth
integration to the published
@seamless-auth/react0.5.0 SDK. Login-only(registration stays with the main apps); access is still gated on
admin:readby
PublicAuthRoute/RequireAuth, unchanged.SDK is now published (0.5.0)
@seamless-auth/reactis pinned at the published^0.5.0(previously a localfile:link while the SDK was unreleased). CI installs and builds against theregistry version. The branch is merged up to date with
main(system-configpartial patch, styled confirm dialog, and per-provider OAuth routes are all
included). The dts fix that this migration depended on shipped in 0.5.0.
Migration to
{ data, error }Every SDK call site moved off the old
Response/.okconvention:SignIn(login, passkey, magic link, email/phone OTP, the magic-link poll)MagicLinkVerificationuseStepUpGuard(step-up now returnsSeamlessAuthResult<StepUpStatus>)UserMenudrops the last-login line (0.5.0'sUserno longer exposes it)The magic-link poll keeps its 204-until-consumed semantics via
data.message === 'Success', not a bare no-error.OAuth login
OAuthProviderButtons: lists providers, stashes the chosen id insessionStorage,startOAuthLogin, then redirects. Renders nothing when noproviders are configured.
redirectUriusesuseHrefso the/consolebasename is honored.
OAuthCallbackat the fixed/oauth/callbackpath (registered providerredirect URI):
finishOAuthLogin→ refresh session → land behind the admin gate.Verification
against the published 0.5.0 SDK (local checkout is the tagged
v0.5.0, so thismatches what ships).
npm ciresolves cleanly.loads with zero console errors, OAuth component queries
GET /auth/oauth/providers → 200and renders nothing for an empty provider list, and the migrated
login(){data,error}error path was verified end-to-end.Still worth an eyeball on a stack with a configured OAuth provider: a full
provider redirect and callback landing in the gated console. Happy to run that
against your stack if you want it before merge.