feat(vercel): add connectable account flow for linking existing orgs#49112
Merged
feat(vercel): add connectable account flow for linking existing orgs#49112
Conversation
Implements the "Link Existing Account" flow for the Vercel Marketplace integration. When a user installs PostHog from Vercel and already has an existing PostHog account, they can now link their org instead of being forced to create a new one. Billing stays with PostHog for connected accounts. Backend: - OAuth code exchange via POST /v2/oauth/access_token - Cache-based session flow with 10min TTL - Org selection API with admin permission checks - Creates OrganizationIntegration with type=connectable Frontend: - VercelConnect scene (popup) for org selection - Handles login redirect, org picker, success/error states Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add 18 tests for connectable account flow (callback, session, complete) - Handle integration.configuration-removed webhook to clean up OrganizationIntegration records on uninstall - Remove VERCEL_EXTERNAL_REDIRECT_URI env var, use SITE_URL instead - Update webhook tests to cover deauthorization Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Include X-CSRFToken header in the POST to /api/vercel/connect/complete - Add Scenario 5 (Link Existing Account) to manual testing checklist - Update README architecture section for connectable account flow Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
|
Size Change: +704 B (0%) Total Size: 106 MB ℹ️ View Unchanged
|
- Validate next_url against allowed Vercel domains to prevent open redirects - Add capture_exception on error paths for monitoring - Sanitize error messages to avoid leaking Vercel internals to clients - Fix N+1 query in session_info (batch lookup for linked orgs) - Add OAuth response field validation with proper error handling - Distinguish connectable vs native integrations in deauthorize webhook (native uses VercelIntegration.delete_installation for billing cleanup) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Contributor
|
⏭️ Skipped snapshot commit because branch advanced to The new commit will trigger its own snapshot update workflow. If you expected this workflow to succeed: This can happen due to concurrent commits. To get a fresh workflow run, either:
|
Contributor
Visual regression: Storybook UI snapshots updatedChanges: 1 snapshots (1 modified, 0 added, 0 deleted) What this means:
Next steps:
|
Contributor
|
⏭️ Skipped snapshot commit because branch advanced to The new commit will trigger its own snapshot update workflow. If you expected this workflow to succeed: This can happen due to concurrent commits. To get a fresh workflow run, either:
|
Cast request.user to User in authenticated views to satisfy mypy's User | AnonymousUser type check. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
Query snapshots: Backend query snapshots updatedChanges: 1 snapshots (1 modified, 0 added, 0 deleted) What this means:
Next steps:
|
…able-account # Conflicts: # frontend/__snapshots__/replay-tabs-home-success--recordings-play-list-with-pinned-recordings--light.png
Contributor
Query snapshots: Backend query snapshots updatedChanges: 1 snapshots (1 modified, 0 added, 0 deleted) What this means:
Next steps:
|
Contributor
|
🎭 Playwright report · View test results →
These issues are not necessarily caused by your changes. |
MattBro
requested review from
a team,
fercgomes and
rafaeelaudibert
and removed request for
a team
fercgomes
reviewed
Feb 27, 2026
fercgomes
reviewed
Feb 27, 2026
fercgomes
reviewed
Feb 27, 2026
fercgomes
reviewed
Feb 27, 2026
rafaeelaudibert
approved these changes
Mar 2, 2026
Member
rafaeelaudibert
left a comment
rafaeelaudibert
left a comment
There was a problem hiding this comment.
Makes sense! Left some nits
fercgomes
approved these changes
Mar 2, 2026
tomasfarias
pushed a commit
that referenced
this pull request
Mar 6, 2026
…49112) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Vercel Marketplace integrations support a "Link Existing Account" (connectable account) flow where users can connect their existing PostHog organization to Vercel without going through the full installation flow. This enables billing to stay with PostHog rather than migrating to Vercel's billing.
Currently there is no support for this flow.
Changes
Backend
/connect/vercel/callback): Exchanges Vercel OAuth code for access token, caches session data, redirects to login if needed/api/vercel/connect/session): Returns user's admin+ orgs with linked status for the frontend dropdown/api/vercel/connect/complete): CreatesOrganizationIntegrationwithtype=connectableconfigintegration.configuration-removedevents, distinguishing connectable (direct delete) from native (billing cleanup viaVercelIntegration.delete_installation)oauth_token_exchange()for the/v2/oauth/access_tokenendpoint with response field validationFrontend
/connect/vercel/link): Org selector UI with loading, error, and success statesSecurity
next_urlvalidated against allowed Vercel domainscapture_exceptionon error paths for monitoringHow did you test this code?
Automated tests
Manual testing
/connect/vercel/callbackwith OAuth codeChangelog
Yes - adds Vercel "Link Existing Account" support for connecting existing PostHog orgs.
🤖 Generated with Claude Code