[PR #70] [MERGED] fix: GitHub OAuth callback 500s fetching userinfo — KeyError: userinfo_endpoint #70

New issue

Closed

opened 2026-08-12 19:09:22 +02:00 by zaph0d · 0 comments

zaph0d commented

2026-08-12 19:09:22 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/niels-emmer/myace/pull/70
Author: @niels-emmer
Created: 8/12/2026
Status: ✅ Merged
Merged: 8/12/2026
Merged by: @niels-emmer

Base: main ← Head: fix/github-userinfo-endpoint

📝 Commits (1)

a99dd59 fix: GitHub OAuth callback 500s fetching userinfo (KeyError: userinfo_endpoint)

📊 Changes

5 files changed (+199 additions, -9 deletions)

View changed files

📝 AGENTS.md (+15 -0)
📝 backend/app/api/auth.py (+37 -4)
📝 backend/app/core/security.py (+5 -0)
📝 backend/tests/test_oauth_callback.py (+134 -5)
📝 docs/extending.md (+8 -0)

📄 Description

Summary

Third production bug in the OAuth flow, found by the user actually completing a real GitHub registration end-to-end now that the previous two fixes (#67 redirect_uri scheme, #68 PKCE code_verifier) got them past the earlier failure points for the first time.

Root cause: GitHub isn't an OIDC provider — no .well-known/openid-configuration discovery document. get_oauth_client()'s GitHub registration never set api_base_url/userinfo_endpoint, so Authlib's generic client.userinfo(token=token) (called because GitHub's token response has no userinfo/id_token) raised KeyError: 'userinfo_endpoint' trying to read it from empty discovery metadata.
Fixed by setting api_base_url="https://api.github.com/" / userinfo_endpoint="https://api.github.com/user" explicitly in the GitHub client registration.
Also fixed the next failure in line: GitHub's /user response uses different field names than OIDC claims (id not sub, login/avatar_url not preferred_username/picture), and its email field is null unless the user made one public — true even with the user:email scope granted. auth_callback() now branches on provider == "github" to map the real fields, falling back to GET /user/emails for the primary verified address when email is null. If a user truly has no verified email at all, they now get a clear 400 instead of crashing on User.email's NOT NULL/UNIQUE constraint.

Test plan

Extended test_oauth_callback.py with a FakeGitHubClient (GitHub-shaped responses, no network) covering: normal field normalization, private-email fallback to /user/emails, and the no-verified-email 400 rejection.
Moved the two provider-agnostic PKCE tests from github to oidc so they test PKCE mechanics without coupling to GitHub's field-mapping logic (they were incidentally using github as a stand-in "any provider" before this fix introduced provider-specific branching).
Reverted the auth_callback() fix locally and confirmed the 3 new GitHub tests fail with the exact error shapes (KeyError/AttributeError) GitHub's real response would actually produce; restored and confirmed all pass.
ruff check clean.
Full backend suite: 155 passed (excludes 3 files with pre-existing, unrelated Postgres-connection contention when run back-to-back against this long-lived local dev container — documented in prior PRs, not caused by this change).
Documented the OIDC-vs-plain-OAuth2 distinction in AGENTS.md and docs/extending.md so the next non-OIDC provider gets the same treatment.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/niels-emmer/myace/pull/70 **Author:** [@niels-emmer](https://github.com/niels-emmer) **Created:** 8/12/2026 **Status:** ✅ Merged **Merged:** 8/12/2026 **Merged by:** [@niels-emmer](https://github.com/niels-emmer) **Base:** `main` ← **Head:** `fix/github-userinfo-endpoint` --- ### 📝 Commits (1) - [`a99dd59`](https://github.com/niels-emmer/myace/commit/a99dd59241b22244c93622b7abf0ec609bc3ca05) fix: GitHub OAuth callback 500s fetching userinfo (KeyError: userinfo_endpoint) ### 📊 Changes **5 files changed** (+199 additions, -9 deletions) <details> <summary>View changed files</summary> 📝 `AGENTS.md` (+15 -0) 📝 `backend/app/api/auth.py` (+37 -4) 📝 `backend/app/core/security.py` (+5 -0) 📝 `backend/tests/test_oauth_callback.py` (+134 -5) 📝 `docs/extending.md` (+8 -0) </details> ### 📄 Description ## Summary Third production bug in the OAuth flow, found by the user actually completing a real GitHub registration end-to-end now that the previous two fixes (#67 redirect_uri scheme, #68 PKCE code_verifier) got them past the earlier failure points for the first time. - **Root cause**: GitHub isn't an OIDC provider — no `.well-known/openid-configuration` discovery document. `get_oauth_client()`'s GitHub registration never set `api_base_url`/`userinfo_endpoint`, so Authlib's generic `client.userinfo(token=token)` (called because GitHub's token response has no `userinfo`/`id_token`) raised `KeyError: 'userinfo_endpoint'` trying to read it from empty discovery metadata. - **Fixed** by setting `api_base_url="https://api.github.com/"` / `userinfo_endpoint="https://api.github.com/user"` explicitly in the GitHub client registration. - **Also fixed the next failure in line**: GitHub's `/user` response uses different field names than OIDC claims (`id` not `sub`, `login`/`avatar_url` not `preferred_username`/`picture`), and its `email` field is `null` unless the user made one public — true even with the `user:email` scope granted. `auth_callback()` now branches on `provider == "github"` to map the real fields, falling back to `GET /user/emails` for the primary verified address when `email` is null. If a user truly has no verified email at all, they now get a clear 400 instead of crashing on `User.email`'s `NOT NULL`/`UNIQUE` constraint. ## Test plan - [x] Extended `test_oauth_callback.py` with a `FakeGitHubClient` (GitHub-shaped responses, no network) covering: normal field normalization, private-email fallback to `/user/emails`, and the no-verified-email 400 rejection. - [x] Moved the two provider-agnostic PKCE tests from `github` to `oidc` so they test PKCE mechanics without coupling to GitHub's field-mapping logic (they were incidentally using `github` as a stand-in "any provider" before this fix introduced provider-specific branching). - [x] Reverted the `auth_callback()` fix locally and confirmed the 3 new GitHub tests fail with the exact error shapes (`KeyError`/`AttributeError`) GitHub's real response would actually produce; restored and confirmed all pass. - [x] `ruff check` clean. - [x] Full backend suite: 155 passed (excludes 3 files with pre-existing, unrelated Postgres-connection contention when run back-to-back against this long-lived local dev container — documented in prior PRs, not caused by this change). - [x] Documented the OIDC-vs-plain-OAuth2 distinction in `AGENTS.md` and `docs/extending.md` so the next non-OIDC provider gets the same treatment. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

zaph0d

2026-08-12 19:09:22 +02:00