feat: fix GitHub auth callback

[MekDrop]

Summary

Worker-side fixes for GitHub OAuth (pairs with git-extract.github.io#56).

Changes

src/routes/auth.js

• Fixed error code: missing_code → no_code (aligned with frontend error map)
• Pass state query parameter through to the SPA redirect so the frontend can verify CSRF state
• Token and error message are now properly encodeURIComponent-encoded in the redirect URL

src/index.js

• Added Vary: Origin response header to all CORS responses, preventing caching of incorrect CORS headers for different origins

Test plan

• GET /auth/github/callback?code=valid_code&state=abc → 302 to ${SPA_URL}/#/auth/github?token=xxx&state=abc
• GET /auth/github/callback (no code) → 302 to ${SPA_URL}/#/login?error=no_code
• Invalid code → 302 to ${SPA_URL}/#/login?error=<github_error_description>
• CORS response includes Vary: Origin

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	git-extract	433cdb6	Commit Preview URL	Apr 28 2026, 06:53 PM