Feature/authentication/phase2

[DevOlabode]

Phase 2: Frontend — Auth + GitHub Connect
Provider-neutral API shape; GitHub picker wired, Google deferred to Phase 3.

[DevOlabode]

Phase 2 complete

Implemented the frontend authentication flow, GitHub storage picker, storage validation/setup, real user state, logout flow, and replaced placeholder data with backend-powered APIs. Google support remains deferred to Phase 3.

[ieliofficial]

Good progress here, especially the provider-neutral frontend flow and the added tests. I found three issues that need fixing before merge:

1. Please verify the signed-in user can access the submitted repo, and that its GitHub node ID matches storageRef.id, before minting an installation token. Right now a user could submit another repo where the app is installed.
2. Please make concurrent scan saves merge against current scan truth. Refreshing only the SHA can overwrite a newer index, and the three sequential writes can leave partial state. A two-writer test would help confirm the fix.
3. Please open saved reports by scan ID from storage. The current dashboard click starts a fresh scan of the host, so it does not show the saved historical report.

The backend suite and frontend build pass. Once these data access and persistence issues are addressed, this will be in much better shape.

[ieliofficial]

Good progress. The saved-report-by-id flow works, the repo access check is in, and the concurrent-save reconcile is a real step up.

Two things still block merge:

1. The repo identity check can be skipped. In authService it's if (storageRef.id && data.node_id !== storageRef.id), so a request that leaves storageRef.id out never runs the comparison. Make the id required and check it every time.
2. A scan can get duplicated on retry. _saveScanResultsOnce generates the scan id with randomUUID() inside the attempt, and saveScanResults re-runs that method on a conflict. So if the scan file writes but the index write conflicts, the retry mints a new id and writes a second file for the same scan. Generate the id and payload once, before the retry loop, and reuse them. Then add a test for that exact order: scan file succeeds, index write returns a conflict.

Also get lint green before the next push (set-state-in-effect in App.jsx, and the process global in vite.config.js). Ping me when those are done and I'll take another look.

[ieliofficial]

All three issues are sorted. 🎉