client/packages/create-instant-app/template/rules/cursor-rules.md (1)

286-308: Inconsistent transaction reference in code example.

The code example on line 302 uses tx.settings[id()], but the convention shown elsewhere in this file (line 243) uses a fully-qualified reference like db.tx.todos[id()]. For consistency and clarity, the example should show where tx comes from or use the full db.tx reference.

📝 Suggested fix for consistency

 // Scaffold data for new users
 if (created) {
   db.transact([
-    tx.settings[id()]
+    db.tx.settings[id()]
       .update({ theme: 'light', notifications: true })
       .link({ user: user.id }),
   ]);
 }

Otherwise, the documentation accurately reflects the new extraFields API and the created flag, and the code examples effectively demonstrate the key use cases.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/packages/create-instant-app/template/rules/cursor-rules.md` around
lines 286 - 308, The example uses an undefined local `tx` (tx.settings[id()])
causing inconsistency; update the snippet to reference the full transaction
helper `db.tx` (e.g., use db.tx.settings[id()]) or explicitly show how `tx` is
defined before use; ensure the example uses the same convention as other
examples with signInWithMagicCode/extraFields and the created flag so the
db.transact call references db.tx.settings[id()] (or introduces a prior const tx
= db.tx) for clarity.

client/packages/core/vitest.config.ts (1)

4-5: LGTM with a minor observation on edge case handling.

The nullish coalescing (?? 0) handles undefined, but if DEV_SLOT is set to a non-numeric string (e.g., DEV_SLOT=abc), localPort will be NaN. Given the context in e2e.ts, this is safe since NaN is falsy and tests would fall back to production URLs—but this silent fallback might mask configuration errors.

If explicit validation is preferred, consider:

🔧 Optional: Add validation for DEV_SLOT

-const devSlot = Number(process.env.DEV_SLOT ?? 0);
-const localPort = process.env.CI ? 0 : 8888 + devSlot * 1000;
+const devSlot = Number(process.env.DEV_SLOT ?? 0);
+if (Number.isNaN(devSlot)) {
+  throw new Error(`Invalid DEV_SLOT value: ${process.env.DEV_SLOT}`);
+}
+const localPort = process.env.CI ? 0 : 8888 + devSlot * 1000;

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/packages/core/vitest.config.ts` around lines 4 - 5, The code uses
Number(process.env.DEV_SLOT ?? 0) which yields NaN for non-numeric DEV_SLOT
values; update the logic in vitest.config.ts around devSlot and localPort to
validate DEV_SLOT explicitly: read the raw string from process.env.DEV_SLOT,
attempt to parse it (e.g., parseInt/Number), check isFinite/Number.isNaN, and if
invalid fall back to 0 (or optionally throw) and compute localPort from the
validated devSlot so stray non-numeric environment values no longer produce NaN
silently.

client/packages/core/__tests__/src/auth-extra-fields.e2e.test.ts (1)

57-70: Cover the “ignore extraFields for existing users” contract.

This test proves created=false, but it would still pass if a later sign-in overwrote the existing $users row. Since that behavior is a core contract in this PR, re-sign in with different extraFields and assert the stored values stay unchanged.

💡 Suggested test expansion

 authTest(
   'returning user gets created=false',
   async ({ db, appId, adminToken }) => {
     const email = `returning-${Date.now()}@test.com`;

     // First sign in -- creates user
     const code1 = await generateMagicCode(appId, adminToken, email);
-    const res1 = await db.auth.signInWithMagicCode({ email, code: code1 });
+    const res1 = await db.auth.signInWithMagicCode({
+      email,
+      code: code1,
+      extraFields: { username: 'first_user', displayName: 'First User' },
+    });
     expect(res1.created).toBe(true);

     // Second sign in -- existing user
     const code2 = await generateMagicCode(appId, adminToken, email);
-    const res2 = await db.auth.signInWithMagicCode({ email, code: code2 });
+    const res2 = await db.auth.signInWithMagicCode({
+      email,
+      code: code2,
+      extraFields: { username: 'second_user', displayName: 'Second User' },
+    });
     expect(res2.created).toBe(false);
+
+    const { data } = await db.queryOnce({ $users: {} });
+    const user = data.$users.find((u: any) => u.email === email);
+    expect(user!.username).toBe('first_user');
+    expect(user!.displayName).toBe('First User');
   },
 );

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/packages/core/__tests__/src/auth-extra-fields.e2e.test.ts` around
lines 57 - 70, The test currently only asserts created=false but doesn't verify
that extraFields were not overwritten; update the test in
auth-extra-fields.e2e.test.ts to capture the stored user after the first sign-in
(use the returned user id or query the $users row) then perform the second
sign-in with different extraFields via generateMagicCode and
db.auth.signInWithMagicCode, and finally re-fetch the same $users row and assert
its extraFields still equal the original values (and that res2.created is false)
to ensure existing users are not updated.

client/packages/core/src/Reactor.js (1)

2266-2273: ⚠️ Potential issue | 🟠 Major

Prevent stale extraFields reuse across OAuth attempts.

createAuthorizationURL only writes when extraFields exists, so a later flow without extraFields can reuse old persisted data. Also, one shared key makes concurrent auth links last-write-wins.

Suggested minimum fix

 createAuthorizationURL({ clientName, redirectURL, extraFields }) {
-  if (extraFields) {
-    this.kv.updateInPlace((prev) => {
-      prev[oauthExtraFieldsKey] = extraFields;
-    });
-  }
+  this.kv.updateInPlace((prev) => {
+    if (extraFields) {
+      prev[oauthExtraFieldsKey] = extraFields;
+    } else {
+      delete prev[oauthExtraFieldsKey];
+    }
+  });
   const { apiURI, appId } = this.config;
   return `${apiURI}/runtime/oauth/start?app_id=${appId}&client_name=${clientName}&redirect_uri=${redirectURL}`;
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/packages/core/src/Reactor.js` around lines 2266 - 2273,
createAuthorizationURL currently only writes extraFields to kv when present,
causing stale data reuse and last-write-wins across concurrent flows; modify
createAuthorizationURL to (1) when extraFields is provided, generate a unique
per-attempt key (e.g., include a nonce/timestamp or clientName) instead of a
single shared oauthExtraFieldsKey, persist extraFields under that unique key via
kv.updateInPlace (or equivalent), and include that unique key as a query param
in the returned URL; and (2) when extraFields is not provided, ensure you do not
reuse an existing shared key—either omit the extraFields query param or
explicitly clear the stored value for that unique key so no stale data is
applied; reference createAuthorizationURL, kv.updateInPlace, and
oauthExtraFieldsKey to locate and update the logic.

client/sandbox/react-nextjs/pages/play/oauth-extra-fields-google.tsx (1)

101-105: ⚠️ Potential issue | 🟠 Major

Move redirect URL creation out of render.

window.location.href in render can break SSR, and calling createAuthorizationURL() during render can repeatedly execute redirect-persistence side effects. Compute it in the click handler instead.

🛠️ Suggested fix

-  const redirectLoginURL = db.auth.createAuthorizationURL({
-    clientName: 'google-web',
-    redirectURL: window.location.href,
-    extraFields: displayName ? { displayName } : undefined,
-  });
-
   return (
@@
-          <a
-            href={redirectLoginURL}
-            className="inline-block rounded bg-blue-500 px-4 py-2 text-white"
+          <button
+            type="button"
+            className="inline-block rounded bg-blue-500 px-4 py-2 text-white"
+            onClick={() => {
+              const url = db.auth.createAuthorizationURL({
+                clientName: 'google-web',
+                redirectURL: window.location.href,
+                extraFields: displayName ? { displayName } : undefined,
+              });
+              window.location.assign(url);
+            }}
           >
             Google (Redirect)
-          </a>
+          </button>

#!/bin/bash
# Verify render-time usage of window/createAuthorizationURL on this page.
rg -n "createAuthorizationURL|window\\.location\\.href|href=\\{redirectLoginURL\\}" client/sandbox/react-nextjs/pages/play/oauth-extra-fields-google.tsx

Also applies to: 125-130

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/sandbox/react-nextjs/pages/play/oauth-extra-fields-google.tsx` around
lines 101 - 105, The code currently computes redirectLoginURL during render
using window.location.href and db.auth.createAuthorizationURL (variable
redirectLoginURL), which breaks SSR and causes side effects; move the
createAuthorizationURL call into the sign-in click handler (the onClick that
triggers the login flow), compute const redirectURL = window.location.href
inside that handler (or derive it safely client-side) and then call
db.auth.createAuthorizationURL({ clientName: 'google-web', redirectURL,
extraFields: displayName ? { displayName } : undefined }) there so nothing runs
at render time and the extraFields (displayName) are passed from the current
component state.

client/www/pages/docs/users.md (1)

237-243: ⚠️ Potential issue | 🟡 Minor

Use db.tx in this docs snippet.

Line 240 references tx.settings, but tx is not defined anywhere in the example. As written, the copy-paste path throws before it creates the default record.

📝 Suggested fix

 if (created) {
   // Create default data for the new user
   db.transact([
-    tx.settings[id()]
+    db.tx.settings[id()]
       .update({ theme: 'light', notifications: true })
       .link({ user: user.id }),
   ]);
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/www/pages/docs/users.md` around lines 237 - 243, The snippet uses an
undefined identifier `tx` inside the db.transact call
(tx.settings[id()].update(...).link(...)), causing a runtime error; replace the
`tx` usage with the correct transactional API `db.tx` (i.e., use
db.tx.settings[id()].update(...) .link(...)) so the default user settings are
created within the transaction invoked by db.transact/db.tx and the references
to created, db.transact and settings[id()].update(...).link(...) remain
consistent.

client/packages/core/src/Reactor.js (1)

2282-2290: ⚠️ Potential issue | 🟠 Major

Clear stale OAuth extraFields when a new flow doesn't provide any.

The current implementation only writes to storage when extraFields is provided. If a previous OAuth flow stored fields and the next attempt omits them, the old payload survives and _oauthLoginInit() will attach it to the later sign-in.

Suggested fix

   createAuthorizationURL({ clientName, redirectURL, extraFields }) {
-    if (extraFields) {
-      this.kv.updateInPlace((prev) => {
-        prev[oauthExtraFieldsKey] = extraFields;
-      });
-    }
+    this.kv.updateInPlace((prev) => {
+      if (extraFields) {
+        prev[oauthExtraFieldsKey] = extraFields;
+      } else {
+        delete prev[oauthExtraFieldsKey];
+      }
+    });
     const { apiURI, appId } = this.config;
     return `${apiURI}/runtime/oauth/start?app_id=${appId}&client_name=${clientName}&redirect_uri=${redirectURL}`;
   }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/packages/core/src/Reactor.js` around lines 2282 - 2290, The
createAuthorizationURL function only updates storage when extraFields is
present, leaving stale oauthExtraFieldsKey values around; modify
createAuthorizationURL so that when extraFields is falsy it explicitly clears
the stored value (e.g., call this.kv.updateInPlace and delete or null-out
prev[oauthExtraFieldsKey]) so subsequent calls (and _oauthLoginInit) won't pick
up prior extraFields; keep the existing write behavior when extraFields is
provided.

client/sandbox/react-nextjs/pages/play/oauth-extra-fields.tsx (1)

136-137: Consider removing temporary debug logs before merge.

These console.log calls are useful during development, but trimming them keeps sandbox output cleaner.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/sandbox/react-nextjs/pages/play/oauth-extra-fields.tsx` around lines
136 - 137, Remove the temporary console.log debug statements in the
signInWithMagicCode flow (the lines logging 'signInWithMagicCode result:' and
'created:') — either delete them or replace with a proper debug/logger call if
persistent telemetry is desired (e.g., use the app's logger at debug level).
Ensure you update the function handling sign-in so no leftover console.log
remains after verification.

client/packages/create-instant-app/template/rules/windsurf-rules.md (1)

294-298: Avoid using a client clock for createdAt in the signup example.

Line 297 makes createdAt look like a trusted signup timestamp, but this rules file is meant to be copied into generated apps and Date.now() here is entirely client-controlled. A neutral profile field is safer unless the timestamp is set server-side.

✏️ Suggested tweak

 const { user, created } = await db.auth.signInWithMagicCode({
   email,
   code,
-  extraFields: { nickname, createdAt: Date.now() },
+  extraFields: { nickname },
 });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@client/packages/create-instant-app/template/rules/windsurf-rules.md` around
lines 294 - 298, The example uses Date.now() for the signup `createdAt` in the
call to db.auth.signInWithMagicCode (inside extraFields), which relies on an
untrusted client clock; update the example to avoid setting a client-controlled
timestamp—remove or null out the `createdAt` field (or replace it with a neutral
profile field like `bio` or `signupSource`) in the `extraFields` passed to
db.auth.signInWithMagicCode so that the server can set the canonical creation
timestamp instead.

server/test/instant/runtime/routes_test.clj (2)

647-672: Remove unused app binding.

The static analyzer flagged an unused app binding at line 649. The test only uses app-id.

🧹 Suggested fix

 (deftest users-create-rule-oauth-test
   (with-empty-app
-    (fn [{app-id :id :as app}]
+    (fn [{app-id :id}]

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@server/test/instant/runtime/routes_test.clj` around lines 647 - 672, The test
binding includes an unused :as app in the with-empty-app callback; update the
argument destructuring in users-create-rule-oauth-test from (fn [{app-id :id :as
app}]) to only capture app-id (e.g. (fn [{app-id :id}]) ) so the unused app
symbol is removed, leaving the rest of the test (rule-model/put!,
route/upsert-oauth-link!, assertions) unchanged.

---

486-518: Remove unused app binding.

The static analyzer flagged an unused app binding at line 488. The test only uses app-id.

🧹 Suggested fix

 (deftest extra-fields-oauth-test
   (with-empty-app
-    (fn [{app-id :id :as app}]
+    (fn [{app-id :id}]

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@server/test/instant/runtime/routes_test.clj` around lines 486 - 518, The
anonymous function in extra-fields-oauth-test currently destructures its
argument as ({app-id :id :as app}) but never uses the app binding; remove the
unused :as app to silence the analyzer by changing the parameter destructuring
to ({app-id :id}) in the with-empty-app callback (the anonymous fn used inside
extra-fields-oauth-test) so only app-id is bound.

server/src/instant/db/permissioned_transaction.clj (1)

49-57: Remove unused eid binding.

The eid parameter is destructured but never used in the function body. The static analyzer correctly flagged this.

🧹 Suggested fix

-(defn- validate-system-create-entity! [{:keys [admin? attrs]} {:keys [aid eid] :as tx-step}]
+(defn- validate-system-create-entity! [{:keys [admin? attrs]} {:keys [aid] :as tx-step}]
   (let [attr (attr-model/seek-by-id aid attrs)
         [etype label] (attr-model/fwd-ident-name attr)]

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@server/src/instant/db/permissioned_transaction.clj` around lines 49 - 57, The
destructured eid in the function validate-system-create-entity! is unused;
remove it from the destructuring vector (change {:keys [aid eid] :as tx-step} to
{:keys [aid] :as tx-step}) or rename it to _eid to silence the analyzer,
updating only the parameter list in validate-system-create-entity! so behavior
remains unchanged.