Skip to content

Assignment operator (=) used instead of comparison (===) in GitHub OAuth user matching #3877

@Nixxx19

Description

@Nixxx19

p5.js version

latest

What is your operating system?

None

Web browser and version

all

Actual Behavior

In server/config/passport.js at line 180, the GitHub OAuth callback uses an assignment operator (=) instead of a strict comparison (===) inside a .find() callback:

if (existingEmailUsers.length > 1) {
  existingEmailUser = existingEmailUsers.find(
    (u) => (u.email = primaryEmail)  //  assignment, not comparison
  );
}

Because u.email = primaryEmail is an assignment:

  1. It overwrites u.email with primaryEmail for every user iterated
  2. The expression returns the assigned string, which is always truthy
  3. .find() returns the first user in the array instead of the one that actually matches primaryEmail

This means when a user has multiple p5.js Editor accounts with emails tied to the same GitHub account, the wrong account may get linked and other users' email fields get silently corrupted during iteration.

Expected Behavior

The callback should use strict comparison (===) so that .find() returns the user whose email actually matches primaryEmail:

existingEmailUser = existingEmailUsers.find(
  (u) => (u.email === primaryEmail)  // comparison
);

Steps to reproduce

  1. Create two p5.js Editor accounts with different emails (e.g., user-a@example.com and user-b@example.com)
  2. Add both emails to the same GitHub account
  3. Log in via GitHub OAuth
  4. The existingEmailUsers array will contain both accounts
  5. Due to the = operator, .find() always returns the first user regardless of which email is primaryEmail
  6. The wrong account gets linked to the GitHub profile

Metadata

Metadata

Assignees

No one assigned

    Labels

    Awaiting Maintainer ApprovalNeeds review from a maintainer before moving forwardBugError or unexpected behaviors

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions