Codex/fix provisioning 401 token flow#977
Open
fairenow wants to merge 25 commits into
Open
Conversation
…anding This commit contains all custom modifications to the Chef application: ## Authentication Changes - Replaced WorkOS authentication with custom Google OAuth implementation - Created GoogleAuthProvider (app/lib/auth/GoogleAuthProvider.tsx) - Added OAuth callback route (app/routes/api.auth.google.callback.ts) - Updated convex/auth.config.ts to use Convex OIDC - Updated all auth imports across 12+ components - Renamed workosAccessToken → convexAccessToken throughout backend ## Branding Updates - Changed branding to "AI Standard" - Updated logo to AI_Standard_Logo_Clean.png - Updated favicons (favicon.ico, android-chrome icons, apple-touch-icon) - Customized README with AI Standard messaging ## Bug Fixes - Fixed pageLoadChatId duplicate initialization error (app/lib/stores/chatId.ts) - Wrapped setPageLoadChatId in useEffect hooks to prevent multiple calls - Fixed ChefAuthWrapper to use custom GoogleAuthProvider ## Deployment Configuration - Created deployment documentation (docs/DEPLOYMENT_*.md, GOOGLE_*.md) - Added vercel.json for Remix deployment configuration - Added .mcp.json for Claude MCP server configuration - Environment variables organized for local, Convex, and Vercel ## Development - Set primary AI provider to Google/Gemini - Configured Vertex AI service account support - Added analytics and feature flags Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Added patchedDependencies configuration for @ai-sdk/openai@1.3.6 - Regenerated pnpm-lock.yaml to match current package.json - Resolves deployment error: ERR_PNPM_LOCKFILE_CONFIG_MISMATCH Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
The @vercel/remix edge adapter references entry.server.js, which causes the Remix Vite plugin to throw "Server-only module referenced by client" during the client build. Since the project uses Node.js runtime (not Edge), importing directly from @remix-run/node avoids pulling the edge adapter into the dependency graph. https://claude.ai/code/session_01FwKWnANrQwC6C1KA4QPd6w
Updated Convex auth configuration to accept Google OAuth tokens directly instead of Convex Auth OIDC tokens. This resolves the authentication error where ctx.auth.getUserIdentity() was failing because Convex couldn't validate Google-issued JWTs. Changes: - Updated auth.config.ts to use Google's JWKS endpoint and issuer - Added getMemberIdFromIdentity() helper to support both 'sub' (Google) and 'convex_member_id' (Convex Auth) token claims - Updated all identity queries to use the helper function This aligns the backend auth configuration with the frontend's Google OAuth implementation, fixing the convexMemberId query errors in production. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
The callback route was using process.env instead of globalThis.process.env, which is required for Remix/Vite on Vercel to access runtime environment variables. This pattern is already used correctly in all other API routes. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Implement hybrid OAuth approach: - Keep Google OAuth for user authentication - Add Convex OAuth for dashboard API access (teams, profile, usage) New features: - Created convexDashboardAuth store to manage Convex access tokens - Added /convex/connect-dashboard route to initiate Convex OAuth - Added /api/convex/dashboard/callback to handle OAuth callback - Updated team/profile fetching to use Convex dashboard token - Added ConvexAccountCard component in settings to connect account - Initialize dashboard token on app load This fixes the 'AccessTokenInvalid' errors when accessing Convex dashboard APIs with Google ID tokens. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Build was failing due to missing lucide-react dependency. Replaced with Radix UI icons that are already in the project: - CheckCircle → CheckCircledIcon - Link → Link2Icon Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Changed from '@ui/button' to '@ui/Button' to match project convention. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Need to rebuild to include VITE_CONVEX_OAUTH_CLIENT_ID in frontend bundle. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Updated all code that calls Convex dashboard APIs to use getConvexDashboardToken() instead of getConvexAuthToken(convex). Dashboard APIs (teams, profile, usage, optins) require Convex OAuth tokens, not Google ID tokens. This fixes JavaScript errors that were breaking the Settings page and making buttons unclickable. Changes: - UserProvider.tsx: Use dashboard token for profile fetching - Chat.tsx: Use dashboard token for usage checks - MessageInput.tsx: Use dashboard token for prompt enhancement - ChefAuthWrapper.tsx: Remove convex param from fetchOptIns call - convexOptins.ts: Use dashboard token instead of convex param - usage.ts: Use dashboard token for team usage queries Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
…ation - Implemented phase tracking system (planning → foundation → backend-schema → backend-functions → frontend-components → integration → review) - Added anti-repetition guidelines to system prompts - Created phase detection logic based on file patterns and tool usage - Added automatic review cycles for deployment failures - Implemented phase badges in UI for user visibility - Removed usage tracking UI (third-party OAuth apps can't access Convex team usage data) - Updated Convex account card description - Added Convex OAuth environment variables documentation
- Changed OAuth token endpoint from dashboard.convex.dev to auth.convex.dev - Added detailed error logging for debugging - Added request logging to track OAuth flow
Third-party OAuth apps don't have access to Convex dashboard APIs: - Disabled useTeamsInitializer (no access to /api/dashboard/teams) - Disabled getConvexProfile (no access to /api/dashboard/profile) - UserProvider already has fallback to Google OAuth profile - Updated ConvexAccountCard description to clarify limitations This fixes the 403 Forbidden errors when connecting Convex account.
- Fix broken Google profile image URLs by using v3 API and adding size params - Add error handling for failed image loads with fallback to default icon - Auto-create personal team for users (third-party OAuth apps can't access dashboard API) - Fix TypeScript error in ConvexAccountConnect button variant Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Disable usage tracking API calls (third-party OAuth apps can't access) - Disable referral stats API calls (third-party OAuth apps can't access) - Add npm run convex:dev script to package.json - Create comprehensive VERCEL_SETUP.md guide for production deployment - Update set-vercel-env.sh script to auto-configure Vercel environment variables - Fix TypeScript errors in Chat and StreamingIndicator components This resolves 401/404 errors from dashboard API endpoints and provides complete setup instructions for deploying to Vercel with production Convex. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
PROBLEM: - Projects were being created under wrong team (24hrautollc-personal) - Should be created under production team (ramon-williams) - User saw projects in wrong team in Convex dashboard ROOT CAUSE: - Third-party OAuth apps can't fetch teams from dashboard API - App auto-generated team slug from user's email - Didn't match user's actual production team slug SOLUTION: - Add VITE_DEFAULT_TEAM_SLUG environment variable - Update team initialization to respect this variable - Set to "ramon-williams" in .env.local and Vercel - User needs to clear localStorage to apply CHANGES: - app/lib/stores/startup/useTeamsInitializer.ts: Check env var first - .env.local: Add VITE_DEFAULT_TEAM_SLUG=ramon-williams - .env.local.additions: Document new required variable - set-vercel-env.sh: Include team slug in deployment script - TEAM_SLUG_FIX.md: Complete guide for applying the fix USER ACTION REQUIRED: - Clear browser localStorage to reset team selection - New projects will then go to ramon-williams team Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
PROBLEM 1 - chatIdStore initialization error: - Error: "chatIdStore used before pageLoadChatId was set" - Blocked loading of existing chats completely - UserProvider tried to access chatId during first render - But setPageLoadChatId was in useEffect (runs AFTER render) ROOT CAUSE: - ExistingChat.client.tsx called setPageLoadChatId in useEffect - useEffect runs after component render - UserProvider.tsx line 25 calls useChatId() during render - This caused chatIdStore to be accessed before initialization SOLUTION: - Call setPageLoadChatId synchronously BEFORE rendering children - Use ref to track initialization and prevent duplicate calls - Now chatId is available for UserProvider's first render PROBLEM 2 - LaunchDarkly errors: - Multiple LD errors when VITE_LD_CLIENT_SIDE_ID not set - "No environment/client-side ID was specified" - "Invalid context specified" - "Environment not found" SOLUTION: - Make LaunchDarkly optional with deferInitialization - Wrap useLDClient() in try/catch - App works fine without LaunchDarkly configured CHANGES: - app/components/ExistingChat.client.tsx: * Move setPageLoadChatId before render using ref * Remove useEffect approach * Add ref to prevent duplicate initialization - app/components/UserProvider.tsx: * Add deferInitialization option to withLDProvider * Wrap useLDClient in try/catch * Handle case when LD is not configured IMPACT: - ✅ Existing chats now load without errors - ✅ LaunchDarkly errors eliminated when not configured - ✅ App works without VITE_LD_CLIENT_SIDE_ID set Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
|
Someone is attempting to deploy a commit to the Convex Team on Vercel. A member of the Team first needs to authorize it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.