feat(auth): Facebook OAuth provider (#285)

[auerbachb]

Summary

Adds Auth.js built-in Facebook login alongside Google: provider registration in auth-config.ts, Continue with Facebook on AuthScreen, .env.example for AUTH_FACEBOOK_ID / AUTH_FACEBOOK_SECRET, and a Meta Data Policy link on the privacy page.

Facebook is treated like Google for the email-verification gate: the default Auth.js Facebook provider requests the email scope and Graph /me returns the account email when granted (Facebook’s profile object does not expose email_verified the way OIDC providers do).

Manual / follow-up (not in repo)

• Meta Developer Console: app, redirect URIs, privacy policy URL, Live mode; add secrets to Vercel Production and local .env.local (never commit).
• Live E2E test on preview/production with a real Facebook account (new user, returning user, email-match account linking).

Closes #285.

  

Summary by CodeRabbit

• New Features

  • Facebook (Meta) sign-in added alongside existing providers.

• Documentation

  • Privacy page updated to include Meta with a direct privacy policy link.
  • Example configuration updated to surface Facebook credential entries and reference the privacy policy.

• Bug Fixes

  • OAuth error messages made provider-agnostic for clearer, consistent wording.

Test plan

• Facebook app created with both redirect URIs and privacy policy URL configured (console step)
• App is in Live mode (or staged behind feature flag if waiting on FB review)
• Secrets added to Vercel (Production) and .env.local (dev): AUTH_FACEBOOK_ID, AUTH_FACEBOOK_SECRET
• Facebook button visible in AuthScreen.tsx with provider="facebook" — verified in code
• End-to-end sign-in works on production with email scope; account linking works for matching email
• Privacy page links to Facebook's data-use disclosure (https://www.facebook.com/about/privacy/) — verified in code
• No provider tokens logged — no console.log/access_token calls in auth-config.ts — verified in code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
still-point	Ready	Preview, Comment	May 1, 2026 10:47pm

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds Facebook (Meta) as an OAuth sign-in provider: updates .env.example, registers Facebook in NextAuth config (email scope and verification handling), adds a reusable OAuth button and Facebook sign-in UI, and updates the privacy page to include Meta's privacy policy link. (50 words)

Changes

Cohort / File(s)	Summary
Env / Config \.env.example, src/lib/auth-config.ts	Uncommented/added AUTH_FACEBOOK_ID and AUTH_FACEBOOK_SECRET to .env.example; added Facebook provider to NextAuth with email scope and adjusted per-provider email verification logic to treat facebook like google for emailVerified.
Auth UI src/components/AuthScreen.tsx	Refactored OAuth button rendering into a reusable OAuthProviderSignInButton, centralized callbackUrl construction (removes error param), generalized OAuth error messages, and added a Facebook sign-in button alongside Google.
Privacy page src/app/privacy/page.tsx	Added Meta (Facebook) to the third-party sign-in disclosures with an outbound link to Meta’s privacy policy.

Sequence Diagram

sequenceDiagram
    participant User as User (Browser)
    participant AuthUI as AuthScreen
    participant NextAuth as NextAuth Server
    participant Facebook as Facebook OAuth
    participant DB as Database

    User->>AuthUI: Click "Sign in with Facebook"
    AuthUI->>NextAuth: signIn("facebook", { callbackUrl })
    NextAuth->>Facebook: Redirect to Facebook login (auth request)
    Facebook->>User: Display login / consent
    User->>Facebook: Authenticate & consent
    Facebook->>NextAuth: Redirect with code
    NextAuth->>Facebook: Exchange code for token & email
    NextAuth->>DB: signIn callback — verify/trust email, lookup or create/link account
    DB-->>NextAuth: Return user record
    NextAuth->>User: Redirect back to application (callbackUrl)

Loading

Estimated Code Review Effort

🎯 3 (Moderate) | ⏱️ ~22 minutes

Poem

🐰 I hopped a little code-filled trail,
A Facebook leaf caught on my tail,
Buttons spring, the OAuth breeze,
Emails trusted, logins ease,
Meta link tucked in privacy hail.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'feat(auth): Facebook OAuth provider (#285)' accurately summarizes the main change—adding Facebook as an OAuth provider—and is concise and specific.
Linked Issues check	✅ Passed	The pull request meets coding requirements from issue #285: Facebook OAuth provider registered, sign-in button added to AuthScreen, environment variables documented, and privacy page updated.
Out of Scope Changes check	✅ Passed	All changes are within scope—auth-config.ts provider setup, AuthScreen button implementation, .env.example documentation, and privacy page link are all directly required by issue #285.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

📋 Issue Planner

Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).

View plan for ticket: #285

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/facebook-oauth-285-aaff

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 59cab24. Configure here.}

[auerbachb]

@CodeAnt-AI review
@graphite-app re-review

[codeant-ai]

Your free trial PR review limit of 100 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI.

[auerbachb]

Closing — Facebook OAuth deferred indefinitely.

Hit a hard blocker at the Meta for Developers console: switching the app to Live mode requires Meta Business Verification, which demands business identity documents (IRS 147c, EIN, business bank statement, articles of incorporation, etc.) that Still Point doesn't have as a personal/hobby project.

This PR's code is correct — the issue is purely operational on the Meta side. The branch cursor/facebook-oauth-285-aaff is preserved on the remote so the code can be reopened or rebased when business verification is sorted.

Full context, decision options, and code-revival path: #341
Tickler to revisit in ~6 months: see the follow-up issue created alongside #341.

Original issue #285 also closed; superseded by #341.