Conversation
…ame in login title Co-authored-by: Cursor <cursoragent@cursor.com>
|
Welcome to Cal.diy, JOY (@JOY)! Thanks for opening this pull request. A few things to keep in mind:
A maintainer will review your PR soon. Thanks for contributing! |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_e109250a-3b8f-469c-9204-7be88ec854c9) |
There was a problem hiding this comment.
Code Review
This pull request replaces the hardcoded application name in the login view with an environment variable and maps the OIDC provider's email verification status. However, a critical type mismatch was identified where a boolean is assigned to the emailVerified field instead of a Date or null, which will cause Prisma database validation errors during login.
| id: profile.sub, | ||
| name: profile.name || profile.email?.split("@")[0] || "User", | ||
| email: profile.email, | ||
| emailVerified: profile.email_verified ?? true, |
There was a problem hiding this comment.
Critical Type Mismatch Bug
In the Prisma schema, the emailVerified field on the User model is defined as a DateTime? (timestamp), which maps to a Date | null type in TypeScript:
model User {
...
emailVerified DateTime?
}By setting emailVerified: profile.email_verified ?? true, you are passing a boolean (true or false) to this field. When NextAuth attempts to create or update the user in the database via the Prisma adapter, Prisma will throw a validation/runtime error because it cannot write a boolean value to a DateTime column. This will completely break the OIDC login flow for new users.
To fix this, you should map the boolean verification status to a Date object (e.g., new Date()) if verified, or null if not verified.
| emailVerified: profile.email_verified ?? true, | |
| emailVerified: (profile.email_verified ?? true) ? new Date() : null, |
Summary
ext-auth-options.ts.
Test plan
Note
Medium Risk
Touches OIDC sign-in by treating missing
email_verifiedas verified, which can affect login gating and identity auto-merge. Branding change is low risk.Overview
Passes
emailVerifiedfrom the DOS ID OIDC profile into NextAuth (profile.email_verified ?? true) so the sign-in callback can treat the IdP email as verified instead of failing when the claim is missing.Also replaces the hardcoded login heading
Cal.diywithNEXT_PUBLIC_APP_NAME(fallbackCrove).Reviewed by Cursor Bugbot for commit b84ca0d. Bugbot is set up for automated code reviews on this repo. Configure here.