openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

[PR #177] [MERGED] fix: allow soft-deleted users to re-authenticate #283

New Issue
Closed
opened 2026-02-15 17:16:40 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:40 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/openclaw/clawhub/pull/177
Author: @tanujbhaud
Created: 2/8/2026
Status: ✅ Merged
Merged: 2/12/2026
Merged by: @steipete

Base: main ← Head: fix/auth-reauth-soft-deleted

📝 Commits (10+)

  • 70a2fb5 fix: allow soft-deleted users to re-authenticate
  • 5cd9a5f test: update auth tests for direct deletedAt check
  • de549f5 fix: restore existingUserId check for type safety
  • 59ace3f fix: update tests to include required existingUserId parameter
  • d99f57a fix: resolve final lint error in auth tests
  • e3469c2 fix: ensure reactivation only matches soft-deleted user (prevents bypass)
  • 9458a9b fix: allow re-auth when existingUserId is null
  • 0e70e9a fix: use valid crons.interval and set to 1 minute
  • 593d80f test: add missing coverage for fresh-login reactivation and identity mismatch guard
  • c8fa868 fix: scope reauth fix; keep banned users blocked (#177) (thanks @tanujbhaud)

📊 Changes

3 files changed (+41 additions, -5 deletions)

View changed files

📝 CHANGELOG.md (+1 -0)
📝 convex/auth.test.ts (+35 -3)
📝 convex/auth.ts (+5 -2)

📄 Description

Fixes Issue #32 where users who soft-deleted their accounts were unable to sign back in. The re-auth logic was strictly looking for an existingUserId flag which wasn't consistently provided during standard fresh login flows.

Greptile Overview

Greptile Summary

This PR updates the authentication logic to allow soft-deleted users to sign back in by relaxing the requirement for an existingUserId flag during re-authentication, and adjusts tests accordingly to assert on deletedAt directly.

The change affects the core auth flow in convex/auth.ts and its corresponding tests in convex/auth.test.ts, aiming to unblock standard “fresh login” flows that don’t always provide existingUserId while still supporting account reactivation.

Confidence Score: 2/5

  • This PR changes core auth reactivation behavior and needs careful identity-matching validation before merging.
  • Allowing soft-deleted users to re-authenticate without a consistent existingUserId can be correct, but it raises the risk of reactivating or linking the wrong account unless the code strictly matches incoming identities (provider + subject) to the soft-deleted user record. Without verifying that invariant, this can become an account-takeover class bug in certain provider/identifier scenarios.
  • convex/auth.ts (reactivation/linking logic); convex/auth.test.ts (ensure negative tests cover wrong-identity reactivation)

(4/5) You can add custom instructions or style guidelines for the agent here!

Context used:

  • Context from dashboard - AGENTS.md (source)

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/openclaw/clawhub/pull/177 **Author:** [@tanujbhaud](https://github.com/tanujbhaud) **Created:** 2/8/2026 **Status:** ✅ Merged **Merged:** 2/12/2026 **Merged by:** [@steipete](https://github.com/steipete) **Base:** `main` ← **Head:** `fix/auth-reauth-soft-deleted` --- ### 📝 Commits (10+) - [`70a2fb5`](https://github.com/openclaw/clawhub/commit/70a2fb58168f2fc1dd5ce9db044f34f7465f8ed1) fix: allow soft-deleted users to re-authenticate - [`5cd9a5f`](https://github.com/openclaw/clawhub/commit/5cd9a5f69fe397fc5fddbfb83aec24880cbe668e) test: update auth tests for direct deletedAt check - [`de549f5`](https://github.com/openclaw/clawhub/commit/de549f5f0145ebe8e073d23fbb5d0a6eba983d57) fix: restore existingUserId check for type safety - [`59ace3f`](https://github.com/openclaw/clawhub/commit/59ace3f17230f4fa0ef7676512d7999e25d363b6) fix: update tests to include required existingUserId parameter - [`d99f57a`](https://github.com/openclaw/clawhub/commit/d99f57a9a572c1a964c97021eb9c92cd33d5e085) fix: resolve final lint error in auth tests - [`e3469c2`](https://github.com/openclaw/clawhub/commit/e3469c22c2cc56a4d07f73920d23a9a4963e6c99) fix: ensure reactivation only matches soft-deleted user (prevents bypass) - [`9458a9b`](https://github.com/openclaw/clawhub/commit/9458a9b5305329632dae6d72804c3545835793ae) fix: allow re-auth when existingUserId is null - [`0e70e9a`](https://github.com/openclaw/clawhub/commit/0e70e9a9d1a17a3c58815423f5c5ff96d7148c8e) fix: use valid crons.interval and set to 1 minute - [`593d80f`](https://github.com/openclaw/clawhub/commit/593d80f1de7873dc2f2d5d9807127744fb5a976e) test: add missing coverage for fresh-login reactivation and identity mismatch guard - [`c8fa868`](https://github.com/openclaw/clawhub/commit/c8fa868cde4369f0bed33784249591c95519c054) fix: scope reauth fix; keep banned users blocked (#177) (thanks @tanujbhaud) ### 📊 Changes **3 files changed** (+41 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `CHANGELOG.md` (+1 -0) 📝 `convex/auth.test.ts` (+35 -3) 📝 `convex/auth.ts` (+5 -2) </details> ### 📄 Description Fixes Issue #32 where users who soft-deleted their accounts were unable to sign back in. The re-auth logic was strictly looking for an existingUserId flag which wasn't consistently provided during standard fresh login flows. <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> This PR updates the authentication logic to allow soft-deleted users to sign back in by relaxing the requirement for an `existingUserId` flag during re-authentication, and adjusts tests accordingly to assert on `deletedAt` directly. The change affects the core auth flow in `convex/auth.ts` and its corresponding tests in `convex/auth.test.ts`, aiming to unblock standard “fresh login” flows that don’t always provide `existingUserId` while still supporting account reactivation. <h3>Confidence Score: 2/5</h3> - This PR changes core auth reactivation behavior and needs careful identity-matching validation before merging. - Allowing soft-deleted users to re-authenticate without a consistent `existingUserId` can be correct, but it raises the risk of reactivating or linking the wrong account unless the code strictly matches incoming identities (provider + subject) to the soft-deleted user record. Without verifying that invariant, this can become an account-takeover class bug in certain provider/identifier scenarios. - convex/auth.ts (reactivation/linking logic); convex/auth.test.ts (ensure negative tests cover wrong-identity reactivation) <!-- greptile_other_comments_section --> <sub>(4/5) You can add custom instructions or style guidelines for the agent [here](https://app.greptile.com/review/github)!</sub> **Context used:** - Context from `dashboard` - AGENTS.md ([source](https://app.greptile.com/review/custom-context?memory=a1d58d20-b4dd-4cbb-973a-9fd7824e1921)) <!-- /greptile_comment --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-15 17:16:40 -05:00
yindo closed this issue 2026-02-15 17:16:40 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#283
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?