Repository navigation
Conversation
- 新增 /api/auth/mobile/google 後端路由，驗證 Google ID Token 並換發 Clerk sign-in token - 手機端改用 @react-native-google-signin/google-signin + ticket 策略，繞過 Clerk redirect URL 限制 - 更新 version 至 3.0.0 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
More reviews will be available in 46 minutes and 19 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughA new Next.js API route exchanges a Google ID token for a Clerk sign-in ticket. The mobile sign-in screen replaces the OAuth redirect flow with the ChangesMobile Google Sign-In & Auth Gating
Sequence Diagram(s)sequenceDiagram
participant User
participant SignInScreen
participant GoogleSignIn SDK
participant POST /api/auth/mobile/google
participant Clerk
User->>SignInScreen: Tap "Sign in with Google"
SignInScreen->>GoogleSignIn SDK: GoogleSignin.signIn()
GoogleSignIn SDK-->>SignInScreen: idToken
SignInScreen->>POST /api/auth/mobile/google: POST { idToken }
POST /api/auth/mobile/google->>Clerk: getUserList / createUser
Clerk-->>POST /api/auth/mobile/google: userId
POST /api/auth/mobile/google->>Clerk: createSignInToken(userId, 300s)
Clerk-->>POST /api/auth/mobile/google: ticket token
POST /api/auth/mobile/google-->>SignInScreen: { token }
SignInScreen->>Clerk: signIn.create({ strategy: "ticket", ticket: token })
Clerk-->>SignInScreen: session
SignInScreen->>SignInScreen: setActive(session) → route to /(tabs)
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
mobile/app/(auth)/sign-in.tsx (1)
21-54: 🛠️ Refactor suggestion | 🟠 Major | ⚡ Quick winExtract shared sign-in logic to avoid duplication.
The
handleGoogleSignInfunction is duplicated nearly identically inmobile/app/(tabs)/profile.tsx(lines 21-54). Extract this logic into a shared utility or custom hook to maintain consistency and reduce maintenance burden.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@mobile/app/`(auth)/sign-in.tsx around lines 21 - 54, The handleGoogleSignIn function is duplicated across multiple files, which creates maintenance burden and risk of inconsistency when updates are needed. Extract the shared sign-in logic (including the Google token retrieval, backend verification, and Clerk session creation steps) into a custom hook or utility function that can be imported and reused in both locations. This hook should accept necessary dependencies like router, signIn, and setActive, and return the configured async handler function that both files can use consistently.
🧹 Nitpick comments (2)
mobile/app/(auth)/sign-in.tsx (2)
9-10: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick winMove
WEB_CLIENT_IDto environment variable.Hardcoding the Google client ID in source code makes it harder to manage different environments (dev/staging/production) and exposes internal configuration. Move it to an environment variable like
EXPO_PUBLIC_GOOGLE_WEB_CLIENT_ID.♻️ Proposed fix
-const WEB_CLIENT_ID = '679544930449-vo4mgolhcfm8qp1v374phl611p6nv597.apps.googleusercontent.com' -const API_BASE = process.env.EXPO_PUBLIC_API_BASE_URL +const WEB_CLIENT_ID = process.env.EXPO_PUBLIC_GOOGLE_WEB_CLIENT_ID +const API_BASE = process.env.EXPO_PUBLIC_API_BASE_URL🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@mobile/app/`(auth)/sign-in.tsx around lines 9 - 10, The WEB_CLIENT_ID constant is hardcoded with the Google client ID value which should be moved to an environment variable for better environment management and security. Replace the hardcoded string in the WEB_CLIENT_ID assignment with process.env.EXPO_PUBLIC_GOOGLE_WEB_CLIENT_ID to retrieve it from an environment variable instead, similar to how API_BASE is already configured.
47-47: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick winReplace
anywithunknownfor proper type safety.The ESLint error flags the
anytype. Useunknownwith a type guard for safer error handling.♻️ Proposed fix
- } catch (err: any) { - if (err.code === statusCodes.SIGN_IN_CANCELLED) return + } catch (err: unknown) { + if (err && typeof err === 'object' && 'code' in err && err.code === statusCodes.SIGN_IN_CANCELLED) return🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@mobile/app/`(auth)/sign-in.tsx at line 47, Replace the `any` type annotation in the catch clause with `unknown` to ensure proper type safety. After changing the parameter type from `any` to `unknown`, add a type guard before accessing any properties on the error object. This will require you to check the actual type of the error (typically using instanceof Error or typeof checks) before using it, ensuring the code is type-safe and compliant with ESLint rules.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@app/api/auth/mobile/google/route.ts`:
- Around line 4-17: The verifyGoogleIdToken function lacks validation of the
`aud` claim in the Google ID token, creating a token substitution vulnerability
where tokens from other applications could be accepted. After fetching and
parsing the token payload, add a check to verify that the `aud` claim matches
your application's Google Client ID (which should be stored as an environment
variable). If the audience claim does not match the expected client ID, throw an
error similar to the existing validation checks for email_verified. This ensures
that only tokens issued specifically for your application are accepted.
In `@mobile/app/`(tabs)/profile.tsx:
- Around line 349-366: The SignInPrompt component must be updated to use the
token-based Google sign-in strategy instead of the redirect-based OAuth flow.
Replace the useOAuth hook call with the Google Sign-in hook from
`@react-native-google-signin/google-signin`. In the handleGoogleSignIn function,
remove the startOAuthFlow call and instead call GoogleSignin.signIn() to get the
ID token, then POST that idToken to the /api/auth/mobile/google endpoint, and
finally use signIn.create with strategy 'ticket' and the returned token value to
create the session, matching the implementation pattern already used in the main
sign-in screen.
---
Outside diff comments:
In `@mobile/app/`(auth)/sign-in.tsx:
- Around line 21-54: The handleGoogleSignIn function is duplicated across
multiple files, which creates maintenance burden and risk of inconsistency when
updates are needed. Extract the shared sign-in logic (including the Google token
retrieval, backend verification, and Clerk session creation steps) into a custom
hook or utility function that can be imported and reused in both locations. This
hook should accept necessary dependencies like router, signIn, and setActive,
and return the configured async handler function that both files can use
consistently.
---
Nitpick comments:
In `@mobile/app/`(auth)/sign-in.tsx:
- Around line 9-10: The WEB_CLIENT_ID constant is hardcoded with the Google
client ID value which should be moved to an environment variable for better
environment management and security. Replace the hardcoded string in the
WEB_CLIENT_ID assignment with process.env.EXPO_PUBLIC_GOOGLE_WEB_CLIENT_ID to
retrieve it from an environment variable instead, similar to how API_BASE is
already configured.
- Line 47: Replace the `any` type annotation in the catch clause with `unknown`
to ensure proper type safety. After changing the parameter type from `any` to
`unknown`, add a type guard before accessing any properties on the error object.
This will require you to check the actual type of the error (typically using
instanceof Error or typeof checks) before using it, ensuring the code is
type-safe and compliant with ESLint rules.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 93925d36-5407-4822-a8a8-3bed2cd2bcd3
⛔ Files ignored due to path filters (3)
mobile/assets/android-icon-foreground.pngis excluded by!**/*.pngmobile/assets/icon.pngis excluded by!**/*.pngmobile/yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (14)
app/api/auth/mobile/google/route.tsmobile/app.jsonmobile/app/(auth)/sign-in.tsxmobile/app/(tabs)/create.tsxmobile/app/(tabs)/index.tsxmobile/app/(tabs)/learn.tsxmobile/app/(tabs)/profile.tsxmobile/app/_layout.tsxmobile/app/chart/[id].tsxmobile/app/chart/preview.tsxmobile/app/learn/[topic].tsxmobile/eas.jsonmobile/package.jsonpackage.json
- route.ts 加入 aud claim 驗證防止 token 替換攻擊 - SignInPrompt 改用 ticket 策略取代舊的 OAuth redirect - 提取 useGoogleSignIn hook 消除重複邏輯 - WEB_CLIENT_ID 改用環境變數 EXPO_PUBLIC_GOOGLE_WEB_CLIENT_ID - 修正 err: any → unknown 型別安全 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This branch was successfully deployed
1 participant
Summary by CodeRabbit
Release Notes
New Features
Enhancements