From 518b6ab9ac3ffc061a2f293a5b97533dc66f29d9 Mon Sep 17 00:00:00 2001 From: Bryan Helmkamp Date: Tue, 3 Mar 2026 16:41:33 -0500 Subject: [PATCH] Fix JWT sub claim to use GitHub profile URL instead of API URL The sub claim was set to https://api.github.com/user/{id} (numeric ID), but the API-side username extractor splits on '/' expecting a login name. Use https://github.com/{login} so the extracted segment matches the allowed_usernames config. Co-Authored-By: Claude Opus 4.6 (1M context) --- apps/arc-web/app/routes/auth-callback.tsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/arc-web/app/routes/auth-callback.tsx b/apps/arc-web/app/routes/auth-callback.tsx index ac015a9f6..669959dbb 100644 --- a/apps/arc-web/app/routes/auth-callback.tsx +++ b/apps/arc-web/app/routes/auth-callback.tsx @@ -49,7 +49,7 @@ export async function loader({ request }: Route.LoaderArgs) { } const session = await getSession(request); - session.set("userUrl", `https://api.github.com/user/${profile.id}`); + session.set("userUrl", `https://github.com/${profile.login}`); session.set("githubId", profile.id); session.set("githubNodeId", profile.node_id); session.set("githubLogin", profile.login);