Skip to content

fix(identity): remember para logins com OAuth#417

Merged
gvieira18 merged 3 commits into
he4rt:4.xfrom
joaopabdala:fix/identity-oauth-remember
Jul 18, 2026
Merged

fix(identity): remember para logins com OAuth#417
gvieira18 merged 3 commits into
he4rt:4.xfrom
joaopabdala:fix/identity-oauth-remember

Conversation

@joaopabdala

Copy link
Copy Markdown
Contributor

O login com qualquer OAuth (Discord/GitHub/Twitch) não guardava a informação de login porque a variável remember não era passada no controller. Assim a sessão expirava com base no SESSION_LIFETIME — não sei qual o valor em prod, mas no .env.example está 120, ou seja, 2 horas após o login — e o usuário era deslogado, com o painel pedindo para reconectar o Discord.

Resolvi isso passando o remember como true por padrão no OAuth

  • Auth::login($result->user);
  • Auth::login($result->user, remember: true);

Testei localmente deletar a tabela de sessões
(php artisan tinker --execute="DB::table('sessions')->delete();") para reproduzir as informações do perfil desaparecendo, mas não consegui reproduzir essa parte. Ainda assim, o remember por padrão deve resolver esse comportamento.

Closes #409

O login com qualquer OAuth (Discord/GitHub/Twitch) não guardava a
informação de login porque a variável remember não era passada no
controller. Assim a sessão expirava com base no SESSION_LIFETIME —
no .env.example está 120, ou seja, 2 horas após o login — e o usuário
era deslogado, com o painel pedindo para reconectar o Discord.

Passando remember por padrão na hora de logar:

  - Auth::login($result->user);
  + Auth::login($result->user, remember: true);

o login OAuth passa a definir o cookie de "remember me" e reautentica
o usuário após a expiração da sessão.

Testei localmente deletar a tabela de sessões
(php artisan tinker --execute="DB::table('sessions')->delete();") para
reproduzir as informações do perfil desaparecendo, mas não consegui
reproduzir essa parte. Ainda assim, o remember por padrão deve resolver
esse comportamento.

Closes he4rt#409

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@joaopabdala
joaopabdala requested a review from a team July 13, 2026 19:40
@coderabbitai

coderabbitai Bot commented Jul 13, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro

Run ID: f9fd4e64-2fb8-4866-b807-d5d674a863f5

📥 Commits

Reviewing files that changed from the base of the PR and between 81045cc and 36fd210.

📒 Files selected for processing (1)
  • app-modules/identity/src/Auth/Http/Controllers/OAuthController.php

📝 Walkthrough

Walkthrough

OAuthController::getAuthenticate() now calls Auth::login() with the remember option enabled, making OAuth-authenticated sessions persistent.

Suggested reviewers: danielhe4rt

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title matches the main change: enabling remember-me for OAuth logins.
Description check ✅ Passed The description accurately describes the OAuth remember-me fix and its intent.
Linked Issues check ✅ Passed The change directly addresses the reported session loss by making OAuth logins persistent with remember-me.
Out of Scope Changes check ✅ Passed The PR only changes OAuth login persistence and adds no unrelated code.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@YuriSouzaDev YuriSouzaDev left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@davicbtoliveira davicbtoliveira left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@GustavoSimao GustavoSimao left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

L G T M!!!

@sirelves sirelves left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

O fluxo OAuth não oferece uma opção de "Lembrar de mim". Sem remember, a autenticação depende exclusivamente da sessão e o usuário precisa autenticar novamente após o SESSION_LIFETIME. Como o objetivo desse fluxo é manter o usuário autenticado entre sessões, usar remember: true torna o comportamento consistente com a expectativa de um login via OAuth, portanto, LGTM!

@Danilo-Sam Danilo-Sam left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@gvieira18
gvieira18 merged commit 1eb7a1b into he4rt:4.x Jul 18, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

painel solicita reconexão com o discord e perde informações do perfil ao retornar para a aba.

10 participants