β¨ feat(auth): preserve utm_source through the OIDC sign-in/sign-up flow#15544
Merged
Conversation
When Market kicks off OIDC against LobeHub, unauthenticated users are redirected by the auth middleware to /signin (and onward to /signup). The utm_source param sent on the original /oidc/auth request was only buried inside callbackUrl and never surfaced on the sign-up page. Carry utm_source as a first-class query param through the auth detour, mirroring how the `hl` locale param is already preserved: - middleware lifts utm_source from the request onto the /signin URL - sign-in forwards utm_source to /signup in both navigation paths Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Codecov Reportβ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## canary #15544 +/- ##
=========================================
Coverage 70.57% 70.57%
=========================================
Files 3303 3303
Lines 326110 326115 +5
Branches 29763 34551 +4788
=========================================
+ Hits 230140 230147 +7
+ Misses 95787 95785 -2
Partials 183 183
Flags with carried forward coverage won't be shown. Click here to find out more.
π New features to boost your workflow:
|
This was referenced Jun 10, 2026
arvinxx
added a commit
that referenced
this pull request
Jun 10, 2026
# π LobeHub Release (20260610) **Release Date:** June 10, 2026 **Since v2.2.2:** 131 merged PRs Β· 13 contributors > This weekly release strengthens agent collaboration across cloud, desktop, CLI, and workspace flows, with steadier runtime behavior and a broader foundation for workspace-scoped data. --- ## β¨ Highlights - **Agent execution across devices** β Unifies per-device working directories, project skill discovery, and sub-agent suspend/resume behavior across server, QStash, and device RPC flows. (#15543, #15566, #15481, #15620, #15591) - **Connector and sandbox platform** β Expands connector permissions, custom OAuth MCP connector onboarding, sandbox provider support, and user-uploaded file sync into cloud sandbox runs. (#15463, #15546, #15184, #15550) - **Desktop and CLI reliability** β Fixes desktop cold-start, auto-update, Windows build, CLI skill discovery, and `lh connect` agent dispatch paths. (#15547, #15525, #15527, #15562, #15632, #15634) - **Pages and sharing** β Refreshes topic sharing, improves Page Editor layout behavior, and routes Page Agent tool execution through the server-side editor path. (#15581, #15556, #15588, #15023, #15610) - **Model availability and provider updates** β Adds user-scoped LobeHub model availability, Claude Fable 5, Qwen thinking preservation, and MiniMax M3 updates. (#15590, #15639, #13494, #15376) --- ## ποΈ Core Product & Architecture ### Agent Runtime & Heterogeneous Agents - Improves sub-agent lifecycle handling, including async suspend/resume, queue-mode QStash resume delivery, and blocking nested sub-agent calls. (#15481, #15620, #15575) - Stabilizes heterogeneous agent ingestion and streaming with raw stream dumps, per-turn usage, image forwarding on regenerate, and duplicate-text fixes. (#15602, #15577, #15592, #15585) - Adds execution-device and working-directory controls across device RPC, legacy defaults, and remote-spawned Claude Code sessions. (#15543, #15566, #15591, #15572) - Improves runtime diagnostics and compatibility, including Gemini multimodal output capture, abort stream semantics, and trace quality analysis. (#15535, #13677, #15508) --- ## π± Platforms, Integrations & UX ### Connectors, Sandbox & Tools - Ships API-level connector tool permissions, custom OAuth MCP connector onboarding, and connector-first runtime execution. (#15463, #15546) - Adds sandbox provider support, cloud sandbox file sync, and safer external URL file input handling with SSRF validation. (#15184, #15550, #12657) - Improves tool visibility and execution with pinned app-fixed tools, ANSI output rendering, gateway-tunneled MCP calls, and automatic headless tool runs. (#15509, #15516, #15469, #15492) ### Desktop, CLI & Web UX - Restores desktop startup and reload behavior, preserves IPC error causes, and keeps the tab bar new-tab action visible across routes. (#15547, #15597, #15638) - Fixes desktop update and build stability for browser quit guards, macOS update signing, and Windows Visual Studio detection. (#15525, #15527, #15562) - Shows the plan-limit upgrade UI on desktop builds. (#15628) - Adds the Agent Run delivery checker and fixes CLI device dispatch plus skill list/search output. (#15489, #15634, #15632) - Refreshes onboarding, auth source preservation, topic UI states, referral/Fable campaign copy, and chat-input control bar behavior. (#15629, #15544, #15573, #15614, #15616, #15617, #15622, #15643) --- ## π Security, Reliability & Rollout Notes - External URL file input now includes SSRF validation for safer Google file handling. (#12657) - Database workspace-scope migrations are part of this release; self-hosted operators should run the normal migration path before serving the updated app. (#15446, #15465, #15468, #15472) - The release branch was re-cut from `canary` and includes the latest `main` release-version commit so `v2.2.2` is the verified compare base. --- ## π₯ Contributors @ONLY-yours, @sxjeru, @hardy-one, @xujingli, @hezhijie0327, @Coooolfan, @arvinxx, @tjx666, @Innei, @rivertwilight, @rdmclin2, @cy948, @AmAzing129 **Full Changelog**: v2.2.2...release/weekly-20260610-recut-3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
π» Change Type
π Description of Change
When LobeHub Market kicks off the OIDC flow against LobeHub, the request to
/oidc/authnow carries autm_sourceso sign-ups originating from Market can be attributed./oidc/authis a protected route, so the auth middleware redirects unauthenticated users to/signin(and from there to/signup). Previouslyutm_sourceonly survived buried inside thecallbackUrlparam and never surfaced as a usable param on the sign-up page.This PR carries
utm_sourceas a first-class query param through the auth detour, mirroring exactly how the existinghl(locale) param is already preserved:src/libs/next/proxy/define-config.ts): liftsutm_sourcefrom the incoming request onto the/signinURL, right next to the existinghlhandling.src/app/[variants]/(auth)/signin/useSignIn.ts): forwardsutm_sourceto/signupin both navigation paths (handleCheckUserfor unknown emails, andhandleGoToSignupfor the explicit "create account" action).Scope is intentionally minimal β this only propagates the param through the redirects. No analytics wiring and no persistence/DB changes are included.
π§ͺ How to Test
Visit a protected OIDC entry with the param while logged out, e.g.:
The middleware redirects to
/signin?...&utm_source=lobehub-market, and proceeding to registration lands on/signup?...&utm_source=lobehub-market.useSignIn.test.tspasses; signup redirect assertion still holds)π€ Generated with Claude Code