Skip to content

fix(auth): add User-Agent header to GitHub API requests - #452

Merged
ascorbic merged 4 commits into
emdash-cms:mainfrom
kamine81:fix/github-oauth-user-agent
Apr 11, 2026
Merged

fix(auth): add User-Agent header to GitHub API requests#452
ascorbic merged 4 commits into
emdash-cms:mainfrom
kamine81:fix/github-oauth-user-agent

Conversation

@kamine81

Copy link
Copy Markdown
Contributor

What does this PR do?

GitHub's REST API requires a User-Agent header and returns 403 for any request without one. Both fetchProfile (in consumer.ts) and fetchGitHubEmail (in providers/github.ts) were omitting this header, causing OAuth login to fail for users whose GitHub email is set to private.

Type of change

  • Bug fix

Checklist

  • I have read CONTRIBUTING.md
  • pnpm typecheck passes
  • pnpm --silent lint:json | jq '.diagnostics | length' returns 0
  • pnpm test passes (or targeted tests for my change)
  • pnpm format has been run
  • I have added/updated tests for my changes (if applicable)
  • I have added a changeset (if this PR changes a published package)

AI-generated code disclosure

  • This PR includes AI-generated code

Screenshots / test output

✓ src/oauth/providers/github.test.ts (4 tests) 22ms
  ✓ fetchGitHubEmail > sends User-Agent header required by GitHub API
  ✓ fetchGitHubEmail > returns the primary verified email
  ✓ fetchGitHubEmail > throws when GitHub API returns 403 (e.g. missing User-Agent)
  ✓ fetchGitHubEmail > throws when no verified primary email exists
GitHub's REST API returns 403 for any request without a User-Agent header.
Both fetchProfile and fetchGitHubEmail were omitting this header, causing
OAuth login to fail for users whose GitHub email is set to private.
@changeset-bot

changeset-bot Bot commented Apr 11, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: e3a4a3c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
Name Type
@emdash-cms/auth Patch
emdash Patch
@emdash-cms/cloudflare Patch
@emdash-cms/plugin-ai-moderation Patch
@emdash-cms/plugin-atproto Patch
@emdash-cms/plugin-audit-log Patch
@emdash-cms/plugin-color Patch
@emdash-cms/plugin-embeds Patch
@emdash-cms/plugin-forms Patch
@emdash-cms/plugin-webhook-notifier Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions

github-actions Bot commented Apr 11, 2026

Copy link
Copy Markdown
Contributor

All contributors have signed the CLA ✍️ ✅
Posted by the CLA Assistant Lite bot.

@kamine81

Copy link
Copy Markdown
Contributor Author

I have read the CLA Document and I hereby sign the CLA

github-actions Bot added a commit that referenced this pull request Apr 11, 2026

@ascorbic ascorbic left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@ascorbic
ascorbic enabled auto-merge (squash) April 11, 2026 13:46
@pkg-pr-new

pkg-pr-new Bot commented Apr 11, 2026

Copy link
Copy Markdown

Open in StackBlitz

@emdash-cms/admin

npm i https://pkg.pr.new/@emdash-cms/admin@452

@emdash-cms/auth

npm i https://pkg.pr.new/@emdash-cms/auth@452

@emdash-cms/blocks

npm i https://pkg.pr.new/@emdash-cms/blocks@452

@emdash-cms/cloudflare

npm i https://pkg.pr.new/@emdash-cms/cloudflare@452

emdash

npm i https://pkg.pr.new/emdash@452

create-emdash

npm i https://pkg.pr.new/create-emdash@452

@emdash-cms/gutenberg-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/gutenberg-to-portable-text@452

@emdash-cms/x402

npm i https://pkg.pr.new/@emdash-cms/x402@452

@emdash-cms/plugin-ai-moderation

npm i https://pkg.pr.new/@emdash-cms/plugin-ai-moderation@452

@emdash-cms/plugin-atproto

npm i https://pkg.pr.new/@emdash-cms/plugin-atproto@452

@emdash-cms/plugin-audit-log

npm i https://pkg.pr.new/@emdash-cms/plugin-audit-log@452

@emdash-cms/plugin-color

npm i https://pkg.pr.new/@emdash-cms/plugin-color@452

@emdash-cms/plugin-embeds

npm i https://pkg.pr.new/@emdash-cms/plugin-embeds@452

@emdash-cms/plugin-forms

npm i https://pkg.pr.new/@emdash-cms/plugin-forms@452

@emdash-cms/plugin-webhook-notifier

npm i https://pkg.pr.new/@emdash-cms/plugin-webhook-notifier@452

commit: e3a4a3c

@ascorbic
ascorbic merged commit 1a93d51 into emdash-cms:main Apr 11, 2026
25 checks passed
This was referenced Apr 11, 2026
fmhall pushed a commit to fmhall/emdash that referenced this pull request Apr 13, 2026
* fix(auth): require User-Agent on GitHub API calls to unblock OAuth login

GitHub's REST API returns 403 for any request without a User-Agent header.
Both fetchProfile and fetchGitHubEmail were omitting this header, causing
OAuth login to fail for users whose GitHub email is set to private.

* test(auth): cover fetchGitHubEmail User-Agent and error cases

* style: format

---------

Co-authored-by: emdashbot[bot] <emdashbot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment