feat(oauth): add Click Up OAuth provider

[halvaradop]

Description

This pull request adds the Atlassian OAuth provider to the list of supported OAuth integrations in the Aura Auth library.
With this addition, Aura Auth now supports seven OAuth providers: GitHub, Bitbucket, Figma, Discord, GitLab, Spotify, X, Strava and Atlassian

Usage

import { createAuth } from "@aura-stack/auth"

export const auth = createAuth({
  oauth: ["click-up"],
})

export const { handlers } = auth

Summary by CodeRabbit

• New Features

  • Added ClickUp OAuth provider for authentication integration

• Documentation

  • Added comprehensive guide for configuring and implementing ClickUp OAuth, including setup instructions and integration examples

• Chores

  • Updated changelog with new provider support

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
auth	Ready	Preview, Comment	Apr 23, 2026 5:35pm

[coderabbitai]

Warning

Rate limit exceeded

@halvaradop has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 44 minutes and 50 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 44 minutes and 50 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7fc0a09d-64f7-422a-adc5-ba245d86420e

📥 Commits

Reviewing files that changed from the base of the PR and between 8a3b521 and a71fd74.

📒 Files selected for processing (3)

• docs/src/content/docs/oauth/click-up.mdx
• packages/core/CHANGELOG.md
• packages/core/src/oauth/click-up.ts

📝 Walkthrough

Walkthrough

This PR adds ClickUp as a new built-in OAuth provider to Aura Auth. It includes the ClickUp provider module implementation, integration into the OAuth registry, comprehensive documentation, and a changelog entry.

Changes

Cohort / File(s)	Summary
ClickUp OAuth Provider Implementation packages/core/src/oauth/click-up.ts, packages/core/src/oauth/index.ts	New ClickUp OAuth provider module with profile interface and factory function. Registers clickUp in builtInOAuthProviders and updates environment variable credential loading to map provider names with dashes (e.g., click-up) to env var keys by replacing - with _.
Documentation & Changelog docs/src/content/docs/oauth/click-up.mdx, packages/core/CHANGELOG.md	Comprehensive ClickUp OAuth guide covering app setup, environment configuration, provider initialization, and multiple sign-in entry points. Changelog entry documents ClickUp OAuth provider support.
Code Cleanup packages/core/src/actions/callback/access-token.ts	Removes two blank lines from token endpoint response handling section.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• #49: Adds new OAuth provider module and updates packages/core/src/oauth/index.ts to register the provider in builtInOAuthProviders.
• #47: Adds Twitch OAuth provider with identical structure and registration pattern in the OAuth registry.
• #60: Adds Atlassian OAuth provider module and modifies packages/core/src/oauth/index.ts to import, re-export, and register the provider.

Poem

🐰 Click-up, click-up, hop we go,
New OAuth flows now start to grow,
With profiles mapped and docs so clear,
Aura Auth's magic reigns this year! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat(oauth): add Click Up OAuth provider' accurately and specifically describes the main change—adding a new ClickUp OAuth provider to Aura Auth, which is reflected across all modified files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/add-click-up-oauth

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@docs/src/content/docs/oauth/click-up.mdx`:
- Around line 39-40: Update the ClickUp docs instruction to require the full
OAuth callback URL (including scheme and path) that Aura will send as
redirect_uri; specifically replace the example `localhost:3000` with a complete
callback such as `http://localhost:3000/auth/callback/click-up` and note to swap
in your production domain (e.g.,
`https://yourdomain.com/auth/callback/click-up`) so ClickUp will not reject the
OAuth redirect due to a URI mismatch.
- Around line 111-123: The ClickUp OAuth example includes an unsupported "scope"
parameter; update the example using the clickUp factory so the authorize.params
object does not include "scope" (remove the scope entry under clickUp({
authorize: { params: { ... } } })) and leave only supported keys
(client_id/redirect_uri/state) in the authorize params; ensure the createAuth
usage and clickUp(...) call remain otherwise unchanged so docs reflect ClickUp's
actual authorization URL parameters.

In `@packages/core/CHANGELOG.md`:
- Line 13: Update the changelog entry that currently reads `Click UP` to use the
official casing `ClickUp`; locate the line containing the string `Click UP` (the
entry "- Added the `Click UP` OAuth provider...") and replace it with `ClickUp`
so the changelog matches the rest of the PR.

In `@packages/core/src/oauth/click-up.ts`:
- Around line 6-43: ClickUp's user.id is returned as a number but the code types
it as string and assigns it directly to the UserIdentity.sub (must be string);
update the ClickUpProfile interface so user.id is number (not string) and in the
clickUp provider's profile mapping (profile => {...}) coerce the id with
String(profile.user.id) when setting sub (leave other fields as-is) to match the
pattern used in gitlab.ts/github.ts.

In `@packages/core/src/oauth/index.ts`:
- Line 58: The built-in provider is registered as clickUp but must be available
under the public "click-up" key and use the documented env names; update the
builtInOAuthProviders map so the entry key is "click-up" (not clickUp) and
adjust the provider factory (the BuiltInOAuthProvider implementation for
ClickUp) to read CLICK_UP_CLIENT_ID and CLICK_UP_CLIENT_SECRET (and CLICK_UP_*
env names used elsewhere) so oauth: ["click-up"] resolves correctly and the
correct env vars are loaded.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 4636eed8-3c87-48de-9b62-c59a6f5a8ad8

📥 Commits

Reviewing files that changed from the base of the PR and between 37edb5b and 8a3b521.

📒 Files selected for processing (5)

• docs/src/content/docs/oauth/click-up.mdx
• packages/core/CHANGELOG.md
• packages/core/src/actions/callback/access-token.ts
• packages/core/src/oauth/click-up.ts
• packages/core/src/oauth/index.ts

💤 Files with no reviewable changes (1)

• packages/core/src/actions/callback/access-token.ts