[Kitenite]

What & why

GitHub sign-in can reuse the wrong browser account, leaving mobile users unable to choose another account. Set prompt: "select_account" on the shared GitHub provider, matching Google, so GitHub displays its account picker.

This takes effect after the API deploys; no mobile app update is needed.

How I tested it

• bun run lint, bun run typecheck (42 tasks), auth package typecheck, and git diff --check passed.
• Ran the local API with the setting removed, then restored it. Used authorization URLs generated by the real /api/auth/sign-in/social endpoint in the same signed-in GitHub browser session.
• Before: no prompt parameter. GitHub went directly from /login/oauth/authorize to Superset's callback without showing an account picker.
• After: prompt=select_account. GitHub stopped at /login/oauth/select_account, showing the current account and Use a different account. Clicking that control opened GitHub's username/password login form.
• iPhone 17 Pro simulator, iOS 26.5: launched the real mobile sign-in screen against the local API and opened GitHub before and after. Both reached the GitHub login form; the after flow passed a Maestro assertion for the username field. The simulator has no signed-in GitHub session, so cached-account switching on iOS and a complete OAuth login remain unverified. No broader mobile edge/locale/accessibility pass was run.
• CI Test is currently failing: its process terminated with SIGILL (illegal instruction). This is not a passing test run; no claim that the failure also occurs on main.

Checklist

• PR title follows conventional commits (type(scope): subject)
• bun run lint and bun run typecheck pass (CI fails on lint warnings too)
• "Allow edits from maintainers" is checked on fork PRs (not applicable)

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: cf468e1b-c920-4d1b-a6b5-5ab288e8fb6b

📥 Commits

Reviewing files that changed from the base of the PR and between ba71a73 and f0f231f.

📒 Files selected for processing (1)

• packages/auth/src/server.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

GitHub OAuth now sets prompt: "select_account" to prompt users to choose an account during sign-in.

Changes

GitHub OAuth

Layer / File(s)	Summary
Set the account-selection prompt packages/auth/src/server.ts	GitHub OAuth configuration adds prompt: "select_account".

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Suggested reviewers: saddlepaddle

Merge Risk: ⚪ Minimal · up to f0f23

GitHub sign-in will ask users to choose an account; users with only one available account can still continue. No material merge-blocking risk is evident.

Security Architecture Review

Security architecture risk: ⚪ Minimal · up to f0f23

The change requests GitHub’s account picker without changing permissions, account-linking rules, or session handling. No material security risk was identified in the change. Account selection should not be treated as requiring fresh authentication.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The affected scope is GitHub sign-in flows using this shared provider configuration. The diff adds no OAuth scopes, credentials, tenant authority, or downstream privileges; other providers are unchanged.

Trust Boundaries and Controls

• inferred — The existing application-to-GitHub authentication boundary remains in place. The picker influences which account enters the flow; it neither replaces callback validation nor establishes fresh authentication. Existing validation and session controls are not modified by this PR, but their broader correctness was not established by this narrow review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title uses conventional commit format and clearly describes the main change: showing the GitHub account picker during sign-in.
Description check	✅ Passed	The description includes the required What & why, How I tested it, and Checklist sections. It explains the problem, implementation, validation steps, limitations, and CI failure.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[expo]

No installed development build can load this pull request as an update: its native fingerprint is 7084d376924a and no development build has it. Add the mobile-build label to build one.

[github-actions]

🧹 Preview Cleanup Complete

The following preview resources have been cleaned up:

• ✅ Neon database branch

Thank you for your contribution! 🎉