Add GitHub and Bitbucket OAuth login for all accessible repos

[Modsofthenation]

Yes. Loadpath can sign in with GitHub and Bitbucket OAuth and then list every repository that account can access.

What changed

• Settings: Sign in with GitHub (device flow) or Bitbucket (authorization code + loopback callback). Classic PATs / app passwords still work.
• Pull requests: My repos loads the signed-in account’s repositories into the owner/repo picker (GitHub /user/repos, Bitbucket role=member). If a registered workspace has a matching git remote, reviewing a PR fills the local path.
• Tokens stay in ~/.loadpath/settings.json. Bitbucket access tokens are refreshed automatically (UI and MCP).

OAuth app setup

GitHub needs an OAuth App with Device Flow enabled (repo read:user read:org). Set LOADPATH_GITHUB_CLIENT_ID or paste the client ID in Settings.

Bitbucket needs an OAuth consumer whose callback is http://127.0.0.1:7345/api/oauth/bitbucket/callback. Set LOADPATH_BITBUCKET_CLIENT_ID / LOADPATH_BITBUCKET_CLIENT_SECRET or paste the key and secret in Settings.

Review still runs against a local clone; OAuth is for listing remotes, PRs, and posting the brief.

Adversarial review

Addressed:

• SCM sign-in, disconnect, and /api/scm/repos are loopback-only, so a tunneled MCP server or a random website cannot list private repos or complete GitHub device-flow login CSRF.
• GitHub verification_uri must be https://github.com/login/device; the UI only window.opens GitHub/Bitbucket OAuth URLs.
• Disconnect no longer clears a Bitbucket app-password username.
• MCP SCM tools refresh expired Bitbucket tokens like the HTTP API.

Left as existing product threat model (not introduced as a new bypass): /api/settings and /api/prs were already unauthenticated on the local server; CORS * remains for browser MCP connectors. Tightening those is a follow-up, not a blocker for this login feature.

Tests

• Unit: device flow, Bitbucket callback, token refresh, repo pagination, git-remote matching, cross-origin 403, verification URL allowlist
• Playwright: remote repo list + GitHub sign-in code UI

  

Summary by CodeRabbit

• New Features

  • Added GitHub and Bitbucket OAuth sign-in, token refresh, account status, and disconnect options.
  • Added remote repository browsing and selection for pull-request workflows, with local workspace matching.
  • Added an MCP tool for listing accessible remote repositories.
  • Added Atlassian login support for desktop authentication links.

• Security

  • Restricted SCM authentication and private repository listing to local loopback access.

• Documentation

  • Updated setup, authentication, repository selection, and security guidance.

• Tests

  • Added coverage for OAuth flows, repository listing, URL validation, and end-to-end login behavior.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: 3bccd312-3f91-417c-bf14-feb001fda996

📥 Commits

Reviewing files that changed from the base of the PR and between 3709163 and 062308f.

📒 Files selected for processing (23)

• README.md
• SECURITY.md
• desktop/urls.mjs
• desktop/urls.test.mjs
• src/loadpath/mcp/server.py
• src/loadpath/mcp/tools.py
• src/loadpath/providers/__init__.py
• src/loadpath/providers/oauth.py
• src/loadpath/providers/scm.py
• src/loadpath/server/app.py
• src/loadpath/settings.py
• src/loadpath/static/assets/LayeredGraph3D-mUQO6wms.js
• src/loadpath/static/assets/index-B5eCWnJO.css
• src/loadpath/static/assets/index-CEZTl1rC.js
• src/loadpath/static/assets/index-CPytLSOG.js
• src/loadpath/static/index.html
• tests/e2e/test_ui_flows.py
• tests/unit/test_providers_and_api.py
• tests/unit/test_scm_oauth.py
• ui/src/App.tsx
• ui/src/api.ts
• ui/src/styles.css
• ui/src/types.ts

---

📝 Walkthrough

Walkthrough

Added GitHub and Bitbucket OAuth authentication, protected SCM endpoints, remote repository listing, local workspace mapping, MCP support, and UI controls for repository selection and account management. Added provider, API, browser-security, integration-test, and documentation coverage.

Changes

SCM authentication and repository workflows

Layer / File(s)	Summary
Provider contracts and repository mapping src/loadpath/providers/*, src/loadpath/settings.py	Added RemoteRepo, repository-listing contracts, GitHub and Bitbucket repository retrieval, remote URL parsing, local workspace matching, and OAuth settings fields.
OAuth backend and protected endpoints src/loadpath/providers/oauth.py, src/loadpath/server/app.py	Added GitHub device flow, Bitbucket authorization and refresh flows, credential persistence, disconnect handling, callback responses, and loopback-only SCM/OAuth endpoints.
Shared SCM operations and MCP access src/loadpath/mcp/*, src/loadpath/server/app.py	Centralized credential lookup and Bitbucket refresh handling. Added remote repository listing to MCP and reused the helper for pull-request operations.
Repository selection and OAuth settings ui/src/*, src/loadpath/static/*, src/loadpath/static/index.html	Added typed OAuth APIs, repository search and selection, local-path mapping, OAuth polling, disconnect controls, settings fields, styles, and updated production assets.
Security validation and workflow coverage tests/unit/*, tests/e2e/*, desktop/*, README.md, SECURITY.md	Added OAuth, repository, loopback, URL-validation, disconnect, and UI-flow tests. Updated SCM documentation and Atlassian URL allowlisting.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant LoadpathUI
  participant LoadpathAPI
  participant OAuthProvider
  participant SCMProvider
  LoadpathUI->>LoadpathAPI: Start OAuth or request repositories
  LoadpathAPI->>OAuthProvider: Exchange or poll credentials
  OAuthProvider-->>LoadpathAPI: Return access and refresh tokens
  LoadpathAPI->>SCMProvider: List repositories and current user
  SCMProvider-->>LoadpathAPI: Return repository metadata
  LoadpathAPI-->>LoadpathUI: Return profile and repositories

Loading

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands.}