The /auth page was titled 'Welcome back' which made first-time
visitors think they needed an existing account. Google OAuth
already creates accounts on first sign-in, so this was a copy
problem, not a missing flow.
- Default copy is now neutral ('Sign in or sign up'); explicitly
notes that an account is auto-created on first sign-in.
- All marketing 'Get started' / 'Start free' CTAs now link to
/auth?new=1 which switches the page to 'Create your account'
copy. Plain 'Log in' links keep the neutral default.
Co-authored-by: Cursor <cursoragent@cursor.com>
Without this the bot PAT 403s on POST /orgs/{org}/repos, which is
the single most important operation — creating new project repos
inside the workspace's Gitea org.
Made-with: Cursor
New users were being sent to /marks-account/projects. Now derives
workspace from the signed-in user's email so everyone lands on
their own workspace after Google OAuth.
Made-with: Cursor
BREAKING CHANGE: Replace SuperTokens with NextAuth.js
Why:
- SuperTokens had persistent Traefik routing issues
- SSL certificate not issuing correctly
- Complex infrastructure (separate container)
- NextAuth runs in Next.js app (simpler, no separate service)
Changes:
- Install next-auth, @auth/prisma-adapter, prisma
- Create NextAuth API route: app/api/auth/[...nextauth]/route.ts
- Add Prisma schema for NextAuth tables (users, sessions, accounts)
- Update auth page to use NextAuth signIn()
- Remove all SuperTokens code and dependencies
- Keep same Google OAuth (just simpler integration)
Benefits:
- No separate auth service needed
- No Traefik routing issues
- Sessions stored in Montreal PostgreSQL
- Simpler configuration
- Battle-tested, widely used
All authentication data stays in Montreal!
Co-authored-by: Cursor <cursoragent@cursor.com>
- SuperTokens requires redirectURIOnProviderDashboard param
- Construct it from NEXT_PUBLIC_APP_URL or window.location.origin
- Properly encode the redirect URI in the query string
- Fixes 400 error: 'Please provide the redirectURIOnProviderDashboard'
Co-authored-by: Cursor <cursoragent@cursor.com>
