Skip to content

✨ feat(auth): preserve utm_source through the OIDC sign-in/sign-up flow#15544

Merged
ONLY-yours merged 1 commit into
canaryfrom
feat/oidc-utm-source
Jun 8, 2026
Merged

✨ feat(auth): preserve utm_source through the OIDC sign-in/sign-up flow#15544
ONLY-yours merged 1 commit into
canaryfrom
feat/oidc-utm-source

Conversation

@ONLY-yours

Copy link
Copy Markdown
Member

πŸ’» Change Type

  • ✨ feat

πŸ”€ Description of Change

When LobeHub Market kicks off the OIDC flow against LobeHub, the request to /oidc/auth now carries a utm_source so sign-ups originating from Market can be attributed.

/oidc/auth is a protected route, so the auth middleware redirects unauthenticated users to /signin (and from there to /signup). Previously utm_source only survived buried inside the callbackUrl param and never surfaced as a usable param on the sign-up page.

This PR carries utm_source as a first-class query param through the auth detour, mirroring exactly how the existing hl (locale) param is already preserved:

  • Middleware (src/libs/next/proxy/define-config.ts): lifts utm_source from the incoming request onto the /signin URL, right next to the existing hl handling.
  • Sign-in (src/app/[variants]/(auth)/signin/useSignIn.ts): forwards utm_source to /signup in both navigation paths (handleCheckUser for unknown emails, and handleGoToSignup for the explicit "create account" action).

Scope is intentionally minimal β€” this only propagates the param through the redirects. No analytics wiring and no persistence/DB changes are included.

πŸ§ͺ How to Test

Visit a protected OIDC entry with the param while logged out, e.g.:

https://app.lobehub.com/oidc/auth?...&utm_source=lobehub-market

The middleware redirects to /signin?...&utm_source=lobehub-market, and proceeding to registration lands on /signup?...&utm_source=lobehub-market.

  • Tested locally
  • Added/updated tests (existing useSignIn.test.ts passes; signup redirect assertion still holds)
  • No tests needed

πŸ€– Generated with Claude Code

When Market kicks off OIDC against LobeHub, unauthenticated users are
redirected by the auth middleware to /signin (and onward to /signup).
The utm_source param sent on the original /oidc/auth request was only
buried inside callbackUrl and never surfaced on the sign-up page.

Carry utm_source as a first-class query param through the auth detour,
mirroring how the `hl` locale param is already preserved:
- middleware lifts utm_source from the request onto the /signin URL
- sign-in forwards utm_source to /signup in both navigation paths

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@dosubot dosubot Bot added the size:S This PR changes 10-29 lines, ignoring generated files. label Jun 8, 2026
@vercel

vercel Bot commented Jun 8, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
lobehub Ready Ready Preview, Comment Jun 8, 2026 5:16am

Request Review

@dosubot dosubot Bot added the feature:auth Authentication and authorization label Jun 8, 2026

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We've reviewed this pull request using the Sourcery rules engine

@codecov

codecov Bot commented Jun 8, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 75.00000% with 2 lines in your changes missing coverage. Please review.
βœ… Project coverage is 70.57%. Comparing base (419aca2) to head (0272ac4).
⚠️ Report is 1 commits behind head on canary.

Additional details and impacted files
@@            Coverage Diff            @@
##           canary   #15544     +/-   ##
=========================================
  Coverage   70.57%   70.57%             
=========================================
  Files        3303     3303             
  Lines      326110   326115      +5     
  Branches    29763    34551   +4788     
=========================================
+ Hits       230140   230147      +7     
+ Misses      95787    95785      -2     
  Partials      183      183             
Flag Coverage Ξ”
app 61.31% <75.00%> (+<0.01%) ⬆️
database 92.22% <ΓΈ> (ΓΈ)
packages/agent-manager-runtime 49.69% <ΓΈ> (ΓΈ)
packages/agent-runtime 81.06% <ΓΈ> (ΓΈ)
packages/builtin-tool-lobe-agent 18.52% <ΓΈ> (ΓΈ)
packages/context-engine 84.25% <ΓΈ> (ΓΈ)
packages/conversation-flow 91.29% <ΓΈ> (ΓΈ)
packages/device-gateway-client 90.18% <ΓΈ> (ΓΈ)
packages/eval-dataset-parser 95.15% <ΓΈ> (ΓΈ)
packages/eval-rubric 76.11% <ΓΈ> (ΓΈ)
packages/fetch-sse 85.57% <ΓΈ> (ΓΈ)
packages/file-loaders 87.89% <ΓΈ> (ΓΈ)
packages/memory-user-memory 74.99% <ΓΈ> (ΓΈ)
packages/model-bank 99.99% <ΓΈ> (ΓΈ)
packages/model-runtime 84.22% <ΓΈ> (ΓΈ)
packages/prompts 72.51% <ΓΈ> (ΓΈ)
packages/python-interpreter 92.90% <ΓΈ> (ΓΈ)
packages/ssrf-safe-fetch 0.00% <ΓΈ> (ΓΈ)
packages/types 35.23% <ΓΈ> (ΓΈ)
packages/utils 84.98% <ΓΈ> (ΓΈ)
packages/web-crawler 88.08% <ΓΈ> (ΓΈ)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components Coverage Ξ”
Store 68.37% <ΓΈ> (ΓΈ)
Services 54.90% <ΓΈ> (ΓΈ)
Server 71.44% <ΓΈ> (-0.01%) ⬇️
Libs 54.58% <ΓΈ> (+0.13%) ⬆️
Utils 81.93% <ΓΈ> (ΓΈ)
πŸš€ New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • πŸ“¦ JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@ONLY-yours ONLY-yours merged commit 927a79c into canary Jun 8, 2026
48 checks passed
@ONLY-yours ONLY-yours deleted the feat/oidc-utm-source branch June 8, 2026 05:24
arvinxx added a commit that referenced this pull request Jun 10, 2026
# πŸš€ LobeHub Release (20260610)

**Release Date:** June 10, 2026  
**Since v2.2.2:** 131 merged PRs Β· 13 contributors

> This weekly release strengthens agent collaboration across cloud,
desktop, CLI, and workspace flows, with steadier runtime behavior and a
broader foundation for workspace-scoped data.

---

## ✨ Highlights

- **Agent execution across devices** β€” Unifies per-device working
directories, project skill discovery, and sub-agent suspend/resume
behavior across server, QStash, and device RPC flows. (#15543, #15566,
#15481, #15620, #15591)
- **Connector and sandbox platform** β€” Expands connector permissions,
custom OAuth MCP connector onboarding, sandbox provider support, and
user-uploaded file sync into cloud sandbox runs. (#15463, #15546,
#15184, #15550)
- **Desktop and CLI reliability** β€” Fixes desktop cold-start,
auto-update, Windows build, CLI skill discovery, and `lh connect` agent
dispatch paths. (#15547, #15525, #15527, #15562, #15632, #15634)
- **Pages and sharing** β€” Refreshes topic sharing, improves Page Editor
layout behavior, and routes Page Agent tool execution through the
server-side editor path. (#15581, #15556, #15588, #15023, #15610)
- **Model availability and provider updates** β€” Adds user-scoped LobeHub
model availability, Claude Fable 5, Qwen thinking preservation, and
MiniMax M3 updates. (#15590, #15639, #13494, #15376)

---

## πŸ—οΈ Core Product & Architecture

### Agent Runtime & Heterogeneous Agents

- Improves sub-agent lifecycle handling, including async suspend/resume,
queue-mode QStash resume delivery, and blocking nested sub-agent calls.
(#15481, #15620, #15575)
- Stabilizes heterogeneous agent ingestion and streaming with raw stream
dumps, per-turn usage, image forwarding on regenerate, and
duplicate-text fixes. (#15602, #15577, #15592, #15585)
- Adds execution-device and working-directory controls across device
RPC, legacy defaults, and remote-spawned Claude Code sessions. (#15543,
#15566, #15591, #15572)
- Improves runtime diagnostics and compatibility, including Gemini
multimodal output capture, abort stream semantics, and trace quality
analysis. (#15535, #13677, #15508)

---

## πŸ“± Platforms, Integrations & UX

### Connectors, Sandbox & Tools

- Ships API-level connector tool permissions, custom OAuth MCP connector
onboarding, and connector-first runtime execution. (#15463, #15546)
- Adds sandbox provider support, cloud sandbox file sync, and safer
external URL file input handling with SSRF validation. (#15184, #15550,
#12657)
- Improves tool visibility and execution with pinned app-fixed tools,
ANSI output rendering, gateway-tunneled MCP calls, and automatic
headless tool runs. (#15509, #15516, #15469, #15492)

### Desktop, CLI & Web UX

- Restores desktop startup and reload behavior, preserves IPC error
causes, and keeps the tab bar new-tab action visible across routes.
(#15547, #15597, #15638)
- Fixes desktop update and build stability for browser quit guards,
macOS update signing, and Windows Visual Studio detection. (#15525,
#15527, #15562)
- Shows the plan-limit upgrade UI on desktop builds. (#15628)
- Adds the Agent Run delivery checker and fixes CLI device dispatch plus
skill list/search output. (#15489, #15634, #15632)
- Refreshes onboarding, auth source preservation, topic UI states,
referral/Fable campaign copy, and chat-input control bar behavior.
(#15629, #15544, #15573, #15614, #15616, #15617, #15622, #15643)

---

## πŸ”’ Security, Reliability & Rollout Notes

- External URL file input now includes SSRF validation for safer Google
file handling. (#12657)
- Database workspace-scope migrations are part of this release;
self-hosted operators should run the normal migration path before
serving the updated app. (#15446, #15465, #15468, #15472)
- The release branch was re-cut from `canary` and includes the latest
`main` release-version commit so `v2.2.2` is the verified compare base.

---

## πŸ‘₯ Contributors

@ONLY-yours, @sxjeru, @hardy-one, @xujingli, @hezhijie0327, @Coooolfan,
@arvinxx, @tjx666, @Innei, @rivertwilight, @rdmclin2, @cy948,
@AmAzing129

**Full Changelog**:
v2.2.2...release/weekly-20260610-recut-3
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

feature:auth Authentication and authorization size:S This PR changes 10-29 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant