fix: address code review observations for multi-platform integration

- Add explicit check for accounts already linked to other users in OAuth callback
- Change GitLab client to use standard Bearer auth header for OAuth consistency
- Update implementation tracker to mark P1 deliverables complete
- Add note about Bitbucket date filtering limitation

Author: devakone

apps/web/src/app/api/auth/[provider]/callback/route.ts

@@ -138,6 +138,23 @@ export async function GET(
 
     const isFirstConnection = count === 0;
 
+    // Check if this external account is already linked to a different user
+    const { data: existingConnection } = await service
+      .from("platform_connections")
+      .select("user_id")
+      .eq("platform", provider)
+      .eq("platform_user_id", platformUserId)
+      .single();
+
+    if (existingConnection && existingConnection.user_id !== userId) {
+      // This external account is linked to another user
+      console.warn(`${provider} account ${platformUserId} already linked to user ${existingConnection.user_id}, current user: ${userId}`);
+      url.pathname = "/login";
+      url.searchParams.set("error", "account_already_linked");
+      url.searchParams.set("provider", provider);
+      return NextResponse.redirect(url);
+    }
+
     // Prepare upsert data
     const upsertData = {
       user_id: userId,
@@ -153,10 +170,10 @@ export async function GET(
       ...(isFirstConnection ? { is_primary: true } : {}),
     };
 
-    // Upsert platform connection
+    // Upsert platform connection using user_id + platform to handle reconnections properly
     await service.from("platform_connections").upsert(
       upsertData,
-      { onConflict: "platform, platform_user_id" }
+      { onConflict: "user_id, platform" }
     );
   }
 

apps/web/src/app/login/LoginButton.tsx

@@ -3,6 +3,7 @@
 import { createSupabaseBrowserClient } from "@/lib/supabase/browser";
 import { useState } from "react";
 import { OAUTH_CONFIG, OAuthProvider } from "@/lib/platforms/oauth";
+import { PlatformIcon } from "@/components/icons/platform";
 
 interface LoginButtonProps {
   provider?: OAuthProvider;
@@ -77,10 +78,11 @@ export default function LoginButton({ provider = "github" }: LoginButtonProps) {
     <div className="flex flex-col gap-3">
       <button
         type="button"
-        className="rounded-md bg-black px-4 py-2 text-white disabled:opacity-60"
+        className="flex items-center justify-center gap-2 rounded-md bg-black px-4 py-2 text-white disabled:opacity-60"
         onClick={signIn}
         disabled={isLoading}
       >
+        <PlatformIcon platform={provider} className="h-5 w-5" />
         {isLoading ? "Signing in..." : `Sign in with ${config.label}`}
       </button>
       {error ? <p className="whitespace-pre-wrap text-sm text-red-600">{error}</p> : null}

docs/implementation-trackers/multi-platform-integration.md

@@ -8,12 +8,12 @@ This tracker accompanies `docs/prd/platform/prd-multi-platform-integration.md`.
 ### P1. Platform Client Abstraction
 **Task:** Create platform abstraction layer in `@vibed/core` without breaking existing functionality.
 **Deliverables:**
-- [ ] Platform types created (`packages/core/src/platforms/types.ts`)
-- [ ] GitHub client extracted from existing code
-- [ ] GitLab client implemented (including file_paths via diff endpoint)
-- [ ] Bitbucket client implemented (including file_paths via diffstat endpoint)
-- [ ] Factory and exports created (`packages/core/src/platforms/index.ts`)
-- [ ] Unit tests for all platform clients
+- [x] Platform types created (`packages/core/src/platforms/types.ts`)
+- [x] GitHub client extracted from existing code
+- [x] GitLab client implemented (including file_paths via diff endpoint)
+- [x] Bitbucket client implemented (including file_paths via diffstat endpoint; note: no date filtering support, uses recent commits)
+- [x] Factory and exports created (`packages/core/src/platforms/index.ts`)
+- [x] Unit tests for all platform clients (`packages/core/src/__tests__/platform-clients.test.ts`)
 **Success Criteria:** `npm run type-check` and `npm run test` pass; existing analysis works; all clients return `filePaths` in `NormalizedCommit`
 **Blocks:** P3, P5, P6
 

packages/core/src/platforms/gitlab.ts

@@ -57,12 +57,12 @@ export class GitLabClient implements CommitFetcher, RepoLister {
   constructor(
     private readonly accessToken: string,
     private readonly fetcher: typeof fetch = fetch
-  ) {}
+  ) { }
 
   private async gitlabFetch<T>(url: string): Promise<T> {
     const res = await this.fetcher(url, {
       headers: {
-        "PRIVATE-TOKEN": this.accessToken,
+        Authorization: `Bearer ${this.accessToken}`,
         Accept: "application/json",
       },
     });