From fb8dc8a440a898c0dfe6536d0dd89ae05dedbefc Mon Sep 17 00:00:00 2001
From: martin-mfg <2026226+martin-mfg@users.noreply.github.com>
Date: Tue, 6 Jan 2026 12:13:21 +0100
Subject: [PATCH] different fix for scope problem

---
 backend/api-renamed/authenticate.js |  8 ++++++--
 backend/src/users.js                | 22 ++++++++++++++--------
 frontend/frontend/src/api/user.js   |  9 ++++++++-
 3 files changed, 28 insertions(+), 11 deletions(-)

diff --git a/backend/api-renamed/authenticate.js b/backend/api-renamed/authenticate.js
index a0a697e6..18511a22 100644
--- a/backend/api-renamed/authenticate.js
+++ b/backend/api-renamed/authenticate.js
@@ -8,8 +8,12 @@ import { authenticate } from "../src/users.js";
 export default async (req, res) => {
   const { code, private_access, user_key } = req.query;
   try {
-    let userId = await authenticate(code, private_access === "true", user_key);
-    res.send(userId);
+    let { userId, needDowngrade } = await authenticate(
+      code,
+      private_access === "true",
+      user_key,
+    );
+    res.send({ userId, needDowngrade });
   } catch (err) {
     logger.error(err);
     res.send("Something went wrong: " + err.message);
diff --git a/backend/src/users.js b/backend/src/users.js
index fe10b53c..55e43e9e 100644
--- a/backend/src/users.js
+++ b/backend/src/users.js
@@ -22,9 +22,10 @@ async function getUserFromToken(accessToken) {
  * Exchanges OAuth code for access token and returns userId + accessToken
  *
  * @param {string} code GitHub authentication code from OAuth process
- * @returns {Promise<{userId: string, accessToken: string}>} user_id and access_token of authenticated user
+ * @param privateAccess whether private access was requested
+ * @returns {Promise<{userId: string, accessToken: string, needDowngrade: boolean}>} user_id and access_token of authenticated user, and whether downgrade is needed
  */
-async function githubAuthenticate(code) {
+async function githubAuthenticate(code, privateAccess) {
   if (
     !process.env.OAUTH_CLIENT_ID ||
     !process.env.OAUTH_CLIENT_SECRET ||
@@ -41,7 +42,6 @@ async function githubAuthenticate(code) {
     client_secret: process.env.OAUTH_CLIENT_SECRET,
     code,
     redirect_uri: process.env.OAUTH_REDIRECT_URI,
-    prompt: "select_account",
   });
 
   try {
@@ -69,8 +69,11 @@ async function githubAuthenticate(code) {
       throw new Error("OAuth Error: Invalid user_id/access_token");
     }
 
+    // if user previously granted private access, then logged in via public flow
+    const needDowngrade = body.scope && !privateAccess;
+
     console.log("GitHub Authentication", `${Date.now() - start} ms`);
-    return { userId, accessToken };
+    return { userId, accessToken, needDowngrade };
   } catch (err) {
     if (err.response) {
       throw new Error(`OAuth Error: ${err.response.status}`);
@@ -85,10 +88,13 @@ async function githubAuthenticate(code) {
  * @param {string} code GitHub authentication code from OAuth process
  * @param {boolean} privateAccess whether private access was requested
  * @param {string} userKey user key to associate with the user
- * @returns {Promise<string>} user_id of authenticated user
+ * @returns {Promise<{userId: string, needDowngrade: boolean}>} user_id of authenticated user and whether downgrade is needed
  */
 export async function authenticate(code, privateAccess, userKey) {
-  const { userId, accessToken } = await githubAuthenticate(code);
-  await storeUser(userId, accessToken, userKey, privateAccess);
-  return userId;
+  const { userId, accessToken, needDowngrade } = await githubAuthenticate(
+    code,
+    privateAccess,
+  );
+  await storeUser(userId, accessToken, userKey, needDowngrade || privateAccess);
+  return { userId, needDowngrade };
 }
diff --git a/frontend/frontend/src/api/user.js b/frontend/frontend/src/api/user.js
index 955276b2..1d336535 100644
--- a/frontend/frontend/src/api/user.js
+++ b/frontend/frontend/src/api/user.js
@@ -6,7 +6,14 @@ const authenticate = async (code, privateAccess, userKey) => {
   try {
     const fullUrl = `https://${HOST}/api/authenticate?code=${code}&private_access=${privateAccess}&user_key=${userKey}`;
     const result = await axios.post(fullUrl);
-    return result.data;
+    const { userId, needDowngrade } = result.data;
+    if (needDowngrade) {
+      console.info(
+        `User ${userId} needs downgrade from private to public access.`,
+      );
+      window.location.href = `https://${HOST}/api/downgrade?user_key=${userKey}`;
+    }
+    return userId;
   } catch (error) {
     console.error(error);
     return '';