From 78a1b5c0d63138236644ad8508e266fbc27821d6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Raimondas=20Rimkevi=C4=8Dius?= <github@mekdrop.name>
Date: Tue, 28 Apr 2026 20:25:37 +0300
Subject: [PATCH 1/2] =?UTF-8?q?feat:=20fix=20GitHub=20auth=20callback=20?=
 =?UTF-8?q?=E2=80=94=20state=20passthrough,=20error=20codes,=20Vary=20head?=
 =?UTF-8?q?er?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/index.js       |  1 +
 src/routes/auth.js | 22 ++++++++++++++--------
 2 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/src/index.js b/src/index.js
index a36a6c7..56098b8 100644
--- a/src/index.js
+++ b/src/index.js
@@ -18,6 +18,7 @@ function withCors(response, request, env) {
   headers.set('Access-Control-Allow-Origin', env.SPA_URL)
   headers.set('Access-Control-Allow-Methods', 'GET, POST, OPTIONS')
   headers.set('Access-Control-Allow-Headers', 'Content-Type')
+  headers.set('Vary', 'Origin')
   return new Response(response.body, { status: response.status, statusText: response.statusText, headers })
 }
 
diff --git a/src/routes/auth.js b/src/routes/auth.js
index 1911bf7..e0a648d 100644
--- a/src/routes/auth.js
+++ b/src/routes/auth.js
@@ -1,9 +1,10 @@
 export async function githubCallback(request, env) {
-  const url = new URL(request.url);
-  const code = url.searchParams.get('code');
+  const url = new URL(request.url)
+  const code = url.searchParams.get('code')
+  const state = url.searchParams.get('state')
 
   if (!code) {
-    return Response.redirect(`${env.SPA_URL}/#/login?error=missing_code`, 302);
+    return Response.redirect(`${env.SPA_URL}/#/login?error=no_code`, 302)
   }
 
   const tokenRes = await fetch('https://github.com/login/oauth/access_token', {
@@ -14,14 +15,19 @@ export async function githubCallback(request, env) {
       client_secret: env.GITHUB_CLIENT_SECRET,
       code,
     }),
-  });
+  })
 
-  const data = await tokenRes.json();
+  const data = await tokenRes.json()
 
   if (data.error || !data.access_token) {
-    const msg = data.error_description || data.error || 'token_exchange_failed';
-    return Response.redirect(`${env.SPA_URL}/#/login?error=${encodeURIComponent(msg)}`, 302);
+    const msg = data.error_description || data.error || 'token_exchange_failed'
+    return Response.redirect(
+      `${env.SPA_URL}/#/login?error=${encodeURIComponent(msg)}`,
+      302,
+    )
   }
 
-  return Response.redirect(`${env.SPA_URL}/#/auth/github?token=${data.access_token}`, 302);
+  const params = new URLSearchParams({ token: data.access_token })
+  if (state) params.set('state', state)
+  return Response.redirect(`${env.SPA_URL}/#/auth/github?${params}`, 302)
 }

From 433cdb6d84037bbcc01b9ad894831ac76169be46 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Raimondas=20Rimkevi=C4=8Dius?= <github@mekdrop.name>
Date: Tue, 28 Apr 2026 21:53:29 +0300
Subject: [PATCH 2/2] infra: rename worker to git-extract, change callback
 route to /callback/github

---
 src/index.js  | 2 +-
 wrangler.toml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/index.js b/src/index.js
index 56098b8..4de1ee8 100644
--- a/src/index.js
+++ b/src/index.js
@@ -5,7 +5,7 @@ import { handleStatus } from './routes/status.js'
 
 const router = Router()
 
-router.get('/auth/github/callback', githubCallback)
+router.get('/callback/github', githubCallback)
 router.post('/extract', handleExtract)
 router.get('/status', handleStatus)
 router.options('*', () => new Response(null, { status: 204 }))
diff --git a/wrangler.toml b/wrangler.toml
index edac947..0f01ae0 100644
--- a/wrangler.toml
+++ b/wrangler.toml
@@ -1,4 +1,4 @@
-name = "git-extract-worker"
+name = "git-extract"
 main = "src/index.js"
 compatibility_date = "2024-01-01"