008 fix oauth configuration

[MikePfunk28]

merge main test into main

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
agent-builder-application	Ready	Preview	Comment	Oct 19, 2025 2:02am

💡 Enable Vercel Agent with $100 free credit for automated AI reviews

[Copilot]

Pull Request Overview

This PR merges the main test branch into main, focusing on OAuth configuration fixes for the agent builder application. The changes primarily address authentication setup and remove extensive documentation files.

Key Changes

• OAuth Configuration Updates: Modified authentication setup in convex/auth.ts and convex/auth.config.ts to properly handle GitHub, Google, and AWS Cognito providers
• Schema Enhancements: Extended user profile schema with OAuth-specific fields, AWS federated identity support, and additional indexes
• Test Configuration: Updated test setup to properly import modules for convex-test
• Documentation Cleanup: Removed 17 large documentation files (over 10,000 lines) including deployment guides, architecture documentation, and setup instructions

Reviewed Changes

Copilot reviewed 63 out of 111 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
convex/auth.ts	Enhanced OAuth providers with custom profile handlers and AWS Cognito integration
convex/auth.config.ts	Simplified provider configuration, removed redundant credential specifications
convex/schema.ts	Added OAuth metadata fields, AWS credentials support, and new indexes
convex/mcpClient.test.ts	Fixed test configuration to properly load Convex modules
convex/authDebug.ts	Updated environment variable references for Google OAuth
convex/tsconfig.json	Excluded test files from TypeScript compilation
.npmrc	Added configuration for platform-specific optional dependencies

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

This fallback configuration using GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET creates duplicate logic with the primary configuration block. Consider removing this fallback or documenting why both environment variable naming conventions need to be supported.

Suggested change

	} else if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
	providers.push(
	Google({
	clientId: process.env.GOOGLE_CLIENT_ID,
	clientSecret: process.env.GOOGLE_CLIENT_SECRET,
	profile(profile: any) {
	return {
	id: profile.sub,
	name: profile.name,
	email: profile.email,
	image: profile.picture,
	locale: profile.locale, // User's locale preference - custom field
	};
	},
	} as any)
	);

[Copilot]

Storing AWS credentials directly in the database poses a security risk. Consider using a secure vault service or encrypting these credentials at rest. The credentials should also be rotated regularly and the expiration timestamp should be validated before use.

Suggested change

	awsCredentials: v.optional(v.object({
	accessKeyId: v.string(),
	secretKey: v.string(),
	sessionToken: v.string(),
	expiration: v.number(),
	})),
	// AWS credentials must be encrypted before storage. Store only the encrypted blob.
	awsCredentialsEncrypted: v.optional(v.string()), // Encrypted AWS credentials (accessKeyId, secretKey, sessionToken)
	awsCredentialsExpiration: v.optional(v.number()), // Expiration timestamp for credentials

[Copilot]

Storing the Cognito ID token in the profile could expose sensitive authentication data. Consider whether this token needs to be persisted, and if so, ensure it's properly secured and has appropriate expiration handling.

Suggested change

	// Store the ID token for AWS credential exchange
	cognitoIdToken: profile.id_token,
	// Do NOT store the ID token in the profile; handle it securely and ephemerally if needed
	// cognitoIdToken: profile.id_token, // Removed for security