[codex] Fix GitHub OAuth in iframe

[Che-Zhu]

Summary

• Add request-aware auth cookie policy for iframe-compatible session cookies, including localhost development hosts.
• Make GitHub popup completion resilient to missed iframe messages by checking /api/auth/info.
• Harden GitHub account merge handling and keep auth logs static.

Root Cause

GitHub OAuth was completing and writing users/sessions, but the app was embedded under a different top-level site. The session cookie was written as SameSite=Lax without Secure for localhost development, so iframe requests to /api/auth/info did not include the session cookie.

Validation

• pnpm exec tsx --test lib/auth/iframe-oauth.test.ts
• pnpm format
• pnpm format:check
• pnpm type-check
• pnpm lint
• Manual Chrome verification inside the Sealos iframe: GitHub avatar appears after sign-in.

Notes

The worktree still contains unrelated local changes that are not included in this PR.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 936bd09500

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep auth session cookies Lax outside iframe flows

getAuthCookieSameSite() now returns none whenever cookies are secure, and getAuthCookieSecure() returns true for all production requests, so every production session cookie becomes SameSite=None. That causes the auth cookie to be sent on cross-site requests, while many mutating endpoints (for example app/api/api-keys/route.ts POST/DELETE) authenticate only via getSessionFromReq and do not perform origin/CSRF checks, which enables cross-site request forgery from third-party sites. Limit SameSite=None to explicitly embedded iframe contexts and keep Lax as the default for normal sessions.

Useful? React with 👍 / 👎.