Fix GitHub OAuth callback issuer validation (#1264)

Co-authored-by: Fatih Kadir Akın <f@users.noreply.github.com>

README.md

@@ -58,7 +58,7 @@
 
 ## What is this?
 
-A curated collection of **prompt examples** for AI chat models. Originally created for ChatGPT, these prompts work great with any modern AI assistant.
+A curated collection of **prompts** for AI chat models. Originally created for ChatGPT, these prompts work great with any modern AI assistant.
 
 | Browse Prompts | Data Formats |
 |----------------|--------------|

src/__tests__/api/prompts.test.ts

@@ -87,6 +87,36 @@ describe("GET /api/prompts", () => {
     expect(data.perPage).toBe(24);
   });
 
+  it("should fall back to defaults when pagination parameters are malformed", async () => {
+    vi.mocked(db.prompt.findMany).mockResolvedValue([]);
+    vi.mocked(db.prompt.count).mockResolvedValue(0);
+
+    const request = new Request(
+      "http://localhost:3000/api/prompts?page=not-a-number&perPage=bad-value"
+    );
+    const response = await GET(request);
+    const data = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(data.page).toBe(1);
+    expect(data.perPage).toBe(24);
+  });
+
+  it("should clamp pagination parameters to configured maximums", async () => {
+    vi.mocked(db.prompt.findMany).mockResolvedValue([]);
+    vi.mocked(db.prompt.count).mockResolvedValue(0);
+
+    const request = new Request(
+      "http://localhost:3000/api/prompts?page=20000&perPage=999"
+    );
+    const response = await GET(request);
+    const data = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(data.page).toBe(10000);
+    expect(data.perPage).toBe(100);
+  });
+
   it("should filter by type", async () => {
     vi.mocked(db.prompt.findMany).mockResolvedValue([]);
     vi.mocked(db.prompt.count).mockResolvedValue(0);

src/__tests__/lib/plugins/auth/github.test.ts

@@ -0,0 +1,110 @@
+// @vitest-environment node
+
+import { Auth, type AuthConfig } from "@auth/core";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { githubPlugin } from "@/lib/plugins/auth/github";
+
+const ORIGIN = "https://prompts.test";
+const GITHUB_ISSUER = "https://github.com/login/oauth";
+
+function responseCookies(response: Response): string {
+  return response.headers.getSetCookie().map((cookie) => cookie.split(";")[0]).join("; ");
+}
+
+describe("GitHub OAuth callback", () => {
+  const fetchMock = vi.fn<typeof fetch>();
+  const signIn = vi.fn(() => true);
+  const logError = vi.fn();
+  let config: AuthConfig;
+
+  beforeEach(() => {
+    vi.stubEnv("GITHUB_CLIENT_ID", "test-github-client");
+    vi.stubEnv("GITHUB_CLIENT_SECRET", "test-github-secret");
+    vi.stubGlobal("fetch", fetchMock);
+    fetchMock.mockImplementation(async (input) => {
+      const url = String(input);
+      if (url === "https://github.com/login/oauth/access_token") {
+        return Response.json({ access_token: "test-access-token", token_type: "bearer" });
+      }
+      if (url === "https://api.github.com/user") {
+        return Response.json({
+          id: 123,
+          login: "testuser",
+          name: "Test User",
+          email: "test@example.com",
+          avatar_url: "https://avatars.githubusercontent.com/u/123",
+        });
+      }
+      throw new Error(`Unexpected fetch: ${url}`);
+    });
+    config = {
+      providers: [githubPlugin.getProvider()],
+      secret: "github-callback-test-secret",
+      trustHost: true,
+      basePath: "/api/auth",
+      callbacks: { signIn },
+      logger: { error: logError, warn: vi.fn(), debug: vi.fn() },
+    };
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+    vi.unstubAllGlobals();
+    vi.clearAllMocks();
+  });
+
+  async function startSignIn(): Promise<string> {
+    const csrfResponse = await Auth(new Request(`${ORIGIN}/api/auth/csrf`), config);
+    const { csrfToken } = await csrfResponse.json() as { csrfToken: string };
+    const response = await Auth(new Request(`${ORIGIN}/api/auth/signin/github`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Cookie: responseCookies(csrfResponse),
+      },
+      body: new URLSearchParams({ csrfToken, callbackUrl: ORIGIN }),
+    }), config);
+
+    const authorizationUrl = new URL(response.headers.get("location")!);
+    expect(authorizationUrl.origin).toBe("https://github.com");
+    expect(authorizationUrl.searchParams.get("code_challenge_method")).toBe("S256");
+    expect(authorizationUrl.searchParams.get("code_challenge")).toBeTruthy();
+    return responseCookies(response);
+  }
+
+  it.each([GITHUB_ISSUER, undefined])("accepts GitHub callbacks with issuer %s", async (issuer) => {
+    const cookies = await startSignIn();
+    const callbackUrl = new URL(`${ORIGIN}/api/auth/callback/github?code=test-code`);
+    if (issuer) callbackUrl.searchParams.set("iss", issuer);
+
+    const response = await Auth(new Request(callbackUrl, { headers: { Cookie: cookies } }), config);
+
+    expect(logError).not.toHaveBeenCalled();
+    expect(response.headers.get("location")).toBe(ORIGIN);
+    expect(signIn).toHaveBeenCalledWith(expect.objectContaining({
+      user: expect.objectContaining({ email: "test@example.com", username: "testuser" }),
+      account: expect.objectContaining({ provider: "github", providerAccountId: "123" }),
+    }));
+    expect(responseCookies(response)).toContain("__Secure-authjs.session-token=");
+    const tokenRequest = fetchMock.mock.calls.find(([url]) => String(url).endsWith("/access_token"));
+    expect((tokenRequest?.[1]?.body as URLSearchParams).get("code_verifier")).toBeTruthy();
+  });
+
+  it("rejects a callback from an unexpected issuer before exchanging the code", async () => {
+    const cookies = await startSignIn();
+    const callbackUrl = new URL(`${ORIGIN}/api/auth/callback/github?code=test-code`);
+    callbackUrl.searchParams.set("iss", "https://unexpected.example.com");
+
+    const response = await Auth(new Request(callbackUrl, { headers: { Cookie: cookies } }), config);
+
+    expect(new URL(response.headers.get("location")!).searchParams.get("error")).toBe("Configuration");
+    expect(logError).toHaveBeenCalledWith(expect.objectContaining({
+      cause: expect.objectContaining({
+        err: expect.objectContaining({ message: 'unexpected "iss" (issuer) response parameter value' }),
+      }),
+    }));
+    expect(fetchMock).not.toHaveBeenCalled();
+    expect(signIn).not.toHaveBeenCalled();
+    expect(responseCookies(response)).not.toContain("authjs.session-token");
+  });
+});

src/__tests__/lib/works-best-with.test.ts

@@ -30,6 +30,11 @@ describe("getModelInfo", () => {
     expect(getModelInfo("sora 2")).toEqual({ name: "Sora 2", provider: "OpenAI" });
     expect(getModelInfo("runway-gen4")).toEqual({ name: "Runway Gen-4", provider: "Runway" });
   });
+
+  it("returns correct info for MiniMax models", () => {
+    expect(getModelInfo("minimax-m3")).toEqual({ name: "MiniMax-M3", provider: "MiniMax" });
+    expect(getModelInfo("minimax-m2-7")).toEqual({ name: "MiniMax-M2.7", provider: "MiniMax" });
+  });
 });
 
 describe("isValidModelSlug", () => {
@@ -61,6 +66,7 @@ describe("getModelsByProvider", () => {
     expect(grouped).toHaveProperty("Anthropic");
     expect(grouped).toHaveProperty("Google");
     expect(grouped).toHaveProperty("xAI");
+    expect(grouped).toHaveProperty("MiniMax");
   });
 
   it("includes all OpenAI models under OpenAI provider", () => {

src/app/api/prompts/route.ts

@@ -306,11 +306,33 @@ export async function POST(request: Request) {
 }
 
 // List prompts (for API access)
+const MAX_API_PER_PAGE = 100;
+const DEFAULT_API_PER_PAGE = 24;
+const MAX_API_PAGE = 10000;
+const DEFAULT_API_PAGE = 1;
+
+const paginationQuerySchema = z.object({
+  page: z.coerce
+    .number()
+    .int()
+    .min(1)
+    .transform((value) => Math.min(value, MAX_API_PAGE))
+    .catch(DEFAULT_API_PAGE),
+  perPage: z.coerce
+    .number()
+    .int()
+    .min(1)
+    .transform((value) => Math.min(value, MAX_API_PER_PAGE))
+    .catch(DEFAULT_API_PER_PAGE),
+});
+
 export async function GET(request: Request) {
   try {
     const { searchParams } = new URL(request.url);
-    const page = parseInt(searchParams.get("page") || "1");
-    const perPage = parseInt(searchParams.get("perPage") || "24");
+    const { page, perPage } = paginationQuerySchema.parse({
+      page: searchParams.get("page"),
+      perPage: searchParams.get("perPage"),
+    });
     const type = searchParams.get("type");
     const categoryId = searchParams.get("category");
     const tag = searchParams.get("tag");

src/lib/plugins/auth/github.ts

@@ -6,6 +6,8 @@ export const githubPlugin: AuthPlugin = {
   name: "GitHub",
   getProvider: () =>
     GitHub({
+      // GitHub includes this issuer in OAuth authorization responses.
+      issuer: "https://github.com/login/oauth",
       clientId: process.env.GITHUB_CLIENT_ID!,
       clientSecret: process.env.GITHUB_CLIENT_SECRET!,
       profile(profile) {

src/lib/works-best-with.ts

@@ -32,6 +32,10 @@ export const AI_MODELS = {
   "grok-4": { name: "Grok 4", provider: "xAI" },
   "grok-3": { name: "Grok 3", provider: "xAI" },
 
+  // MiniMax
+  "minimax-m3": { name: "MiniMax-M3", provider: "MiniMax" },
+  "minimax-m2-7": { name: "MiniMax-M2.7", provider: "MiniMax" },
+
   // Image Generation
   "nano-banana": { name: "Nano Banana", provider: "Google" },
   "nano-banana-pro": { name: "Nano Banana Pro", provider: "Google" },