sso: polyfill buffer for browser

v3.8.7
Merge pull request #124 from RayLabsHQ/fix/sso-stability
2026-08-23 11:01:54 +08:00 · 2025-10-22 18:13:36 +05:30 · 2025-10-22 17:54:25 +05:30 · 2025-10-22 17:54:01 +05:30 · 2025-10-22 16:34:37 +05:30 · 2025-10-22 16:33:33 +05:30
25 changed files with 707 additions and 414 deletions
@@ -259,8 +259,9 @@ CLEANUP_DRY_RUN=false                 # Set to true to test without changes
 - **No Accidental Deletions**: Repository cleanup is automatically skipped if GitHub is inaccessible (account deleted, banned, or API errors)
 - **Archive Never Deletes Data**: The `archive` action preserves all repository data:
  - Regular repositories: Made read-only using Gitea's archive feature
-  - Mirror repositories: Renamed with `[ARCHIVED]` prefix (Gitea API limitation prevents archiving mirrors)
+  - Mirror repositories: Renamed with `archived-` prefix (Gitea API limitation prevents archiving mirrors)
  - Failed operations: Repository remains fully accessible even if marking as archived fails
+- **Manual Sync on Demand**: Archived mirrors stay in Gitea with automatic syncs disabled; trigger `Manual Sync` from the Repositories page whenever you need fresh data.
 - **The Whole Point of Backups**: Your Gitea mirrors are preserved even when GitHub sources disappear - that's why you have backups!
 - **Strongly Recommended**: Always use `CLEANUP_ORPHANED_REPO_ACTION=archive` (default) instead of `delete`

@@ -14,9 +14,9 @@ export default defineConfig({
    plugins: [tailwindcss()],
    build: {
      rollupOptions: {
-        external: ['bun']
-      }
-    }
+        external: ['bun', 'bun:*'],
+      },
+    },
  },
  integrations: [react()]
-});
+});
@@ -8,7 +8,7 @@
        "@astrojs/mdx": "4.3.7",
        "@astrojs/node": "9.5.0",
        "@astrojs/react": "^4.4.0",
-        "@better-auth/sso": "^1.3.28",
+        "@better-auth/sso": "1.4.0-beta.12",
        "@octokit/plugin-throttling": "^11.0.2",
        "@octokit/rest": "^22.0.0",
        "@radix-ui/react-accordion": "^1.2.12",
@@ -36,7 +36,8 @@
        "@types/react-dom": "^19.2.2",
        "astro": "^5.14.8",
        "bcryptjs": "^3.0.2",
-        "better-auth": "^1.3.28",
+        "better-auth": "1.4.0-beta.12",
+        "buffer": "^6.0.3",
        "canvas-confetti": "^1.9.3",
        "class-variance-authority": "^0.7.1",
        "clsx": "^2.1.1",
@@ -149,11 +150,11 @@

    "@babel/types": ["@babel/types@7.28.4", "", { "dependencies": { "@babel/helper-string-parser": "^7.27.1", "@babel/helper-validator-identifier": "^7.27.1" } }, "sha512-bkFqkLhh3pMBUQQkpVgWDWq/lqzc2678eUyDlTBhRqhCHFguYYGM0Efga7tYk4TogG/3x0EEl66/OQ+WGbWB/Q=="],

-    "@better-auth/core": ["@better-auth/core@1.3.28", "", { "dependencies": { "zod": "^4.1.5" }, "peerDependencies": { "@better-auth/utils": "0.3.0", "@better-fetch/fetch": "1.1.18", "better-call": "1.0.19", "better-sqlite3": "^12.4.1", "jose": "^6.1.0", "kysely": "^0.28.5", "nanostores": "^1.0.1" } }, "sha512-iZOGKlXaNEIEj0Q3z7+REE94I89YUJ0sel/1pvm1qqdHkm59G+ToTysHtyTcLYby3+UtAeJRKyFAY0nwJH0H7A=="],
+    "@better-auth/core": ["@better-auth/core@1.4.0-beta.12", "", { "dependencies": { "zod": "^4.1.5" }, "peerDependencies": { "@better-auth/utils": "0.3.0", "@better-fetch/fetch": "1.1.18", "better-call": "1.0.24", "better-sqlite3": "^12.4.1", "jose": "^6.1.0", "kysely": "^0.28.5", "nanostores": "^1.0.1" } }, "sha512-2GisAGuSVZS4gtnwP5Owk3RyC6GevZe9zcODTrtbwRCvBTrHUmu0j6bcklK9uNG8DaWDmzCK1+VGA5qIHzg5Pw=="],

-    "@better-auth/sso": ["@better-auth/sso@1.3.28", "", { "dependencies": { "@better-fetch/fetch": "1.1.18", "fast-xml-parser": "^5.2.5", "jose": "^6.1.0", "oauth2-mock-server": "^7.2.1", "samlify": "^2.10.1", "zod": "^4.1.5" }, "peerDependencies": { "better-auth": "1.3.28" } }, "sha512-BeuQFB/tWKR3Nx89fiD6e0Ei5VoKmman0VDBkoOIu+P3PGdSSzvbmBUTZi8aao+tAPoD6/Z5gje+oiQBDAnp4w=="],
+    "@better-auth/sso": ["@better-auth/sso@1.4.0-beta.12", "", { "dependencies": { "@better-fetch/fetch": "1.1.18", "fast-xml-parser": "^5.2.5", "jose": "^6.1.0", "oauth2-mock-server": "^7.2.1", "samlify": "^2.10.1", "zod": "^4.1.5" }, "peerDependencies": { "better-auth": "1.4.0-beta.12" } }, "sha512-iuRuy59J3yXQihZJ34rqYClWyuVjSkxuBkdFblccKbOhNy7pmRO1lfmBMpyeth3ET5Cp0PDVV/z1XBbDcQp0LA=="],

-    "@better-auth/telemetry": ["@better-auth/telemetry@1.3.28", "", { "dependencies": { "@better-auth/core": "1.3.28", "@better-auth/utils": "0.3.0", "@better-fetch/fetch": "1.1.18" } }, "sha512-qZtV82IFuyQZc2c37VkiDgO/qfqPnJuWIyeC/iFK1AA5N8RSuC2+CVIH1sNDytPXUAthbYeOzcOCW2YEkgz1Ow=="],
+    "@better-auth/telemetry": ["@better-auth/telemetry@1.4.0-beta.12", "", { "dependencies": { "@better-auth/utils": "0.3.0", "@better-fetch/fetch": "1.1.18" }, "peerDependencies": { "@better-auth/core": "1.4.0-beta.12" } }, "sha512-pQ5HITRGXMHQPcPCDnz0xlxFqqxvpD4kQMvY6cdt1vDsPVePHAj9R3S318XEfaw3NAgtw3af/wCN6eBt2u4Kew=="],

    "@better-auth/utils": ["@better-auth/utils@0.3.0", "", {}, "sha512-W+Adw6ZA6mgvnSnhOki270rwJ42t4XzSK6YWGF//BbVXL6SwCLWfyzBc1lN2m/4RM28KubdBKQ4X5VMoLRNPQw=="],

@@ -697,9 +698,9 @@

    "before-after-hook": ["before-after-hook@4.0.0", "", {}, "sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ=="],

-    "better-auth": ["better-auth@1.3.28", "", { "dependencies": { "@better-auth/core": "1.3.28", "@better-auth/telemetry": "1.3.28", "@better-auth/utils": "0.3.0", "@better-fetch/fetch": "1.1.18", "@noble/ciphers": "^2.0.0", "@noble/hashes": "^2.0.0", "@simplewebauthn/browser": "^13.1.2", "@simplewebauthn/server": "^13.1.2", "better-call": "1.0.19", "defu": "^6.1.4", "jose": "^6.1.0", "kysely": "^0.28.5", "nanostores": "^1.0.1", "zod": "^4.1.5" } }, "sha512-fSaeRsTSkzCSSKREFsm7z7TsTMC8ghGrwCN+mumxCZiyc8Fh/UThUwURlTJmsR0YVB0DMR8ejQH+c38WhdQslQ=="],
+    "better-auth": ["better-auth@1.4.0-beta.12", "", { "dependencies": { "@better-auth/core": "1.4.0-beta.12", "@better-auth/telemetry": "1.4.0-beta.12", "@better-auth/utils": "0.3.0", "@better-fetch/fetch": "1.1.18", "@noble/ciphers": "^2.0.0", "@noble/hashes": "^2.0.0", "@simplewebauthn/browser": "^13.1.2", "@simplewebauthn/server": "^13.1.2", "better-call": "1.0.24", "defu": "^6.1.4", "jose": "^6.1.0", "kysely": "^0.28.5", "nanostores": "^1.0.1", "zod": "^4.1.5" } }, "sha512-IvrSBmQkHgOinDh6JyJCoKwbMPmHpkmt98/0hBU9Nc0s7Y7u72AOx1Z35J2dRQxxX4SzvFQ9pHqlV6wPnm72Ww=="],

-    "better-call": ["better-call@1.0.19", "", { "dependencies": { "@better-auth/utils": "^0.3.0", "@better-fetch/fetch": "^1.1.4", "rou3": "^0.5.1", "set-cookie-parser": "^2.7.1", "uncrypto": "^0.1.3" } }, "sha512-sI3GcA1SCVa3H+CDHl8W8qzhlrckwXOTKhqq3OOPXjgn5aTOMIqGY34zLY/pHA6tRRMjTUC3lz5Mi7EbDA24Kw=="],
+    "better-call": ["better-call@1.0.24", "", { "dependencies": { "@better-auth/utils": "^0.3.0", "@better-fetch/fetch": "^1.1.4", "rou3": "^0.5.1", "set-cookie-parser": "^2.7.1", "uncrypto": "^0.1.3" } }, "sha512-iGqL29cstPp4xLD2MjKL1EmyAqQHjYS+cBMt4W27rPs3vf+kuqkVPA0NYaf7JciBOzVsJdNj4cbZWXC5TardWQ=="],

    "better-sqlite3": ["better-sqlite3@12.4.1", "", { "dependencies": { "bindings": "^1.5.0", "prebuild-install": "^7.1.1" } }, "sha512-3yVdyZhklTiNrtg+4WqHpJpFDd+WHTg2oM7UcR80GqL05AOV0xEJzc6qNvFYoEtE+hRp1n9MpN6/+4yhlGkDXQ=="],

@@ -719,7 +720,7 @@

    "browserslist": ["browserslist@4.24.5", "", { "dependencies": { "caniuse-lite": "^1.0.30001716", "electron-to-chromium": "^1.5.149", "node-releases": "^2.0.19", "update-browserslist-db": "^1.1.3" }, "bin": { "browserslist": "cli.js" } }, "sha512-FDToo4Wo82hIdgc1CQ+NQD0hEhmpPjrZ3hiUgwgOG6IuTdlpr8jdjyG24P6cNP1yJpTLzS5OcGgSw0xmDU1/Tw=="],

-    "buffer": ["buffer@5.7.1", "", { "dependencies": { "base64-js": "^1.3.1", "ieee754": "^1.1.13" } }, "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ=="],
+    "buffer": ["buffer@6.0.3", "", { "dependencies": { "base64-js": "^1.3.1", "ieee754": "^1.2.1" } }, "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA=="],

    "buffer-equal-constant-time": ["buffer-equal-constant-time@1.0.1", "", {}, "sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA=="],

@@ -1925,6 +1926,8 @@

    "basic-auth/safe-buffer": ["safe-buffer@5.1.2", "", {}, "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="],

+    "bl/buffer": ["buffer@5.7.1", "", { "dependencies": { "base64-js": "^1.3.1", "ieee754": "^1.1.13" } }, "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ=="],
+
    "body-parser/debug": ["debug@2.6.9", "", { "dependencies": { "ms": "2.0.0" } }, "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA=="],

    "body-parser/iconv-lite": ["iconv-lite@0.4.24", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3" } }, "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA=="],
@@ -229,7 +229,7 @@ Configure automatic cleanup of old events and data.
 | `CLEANUP_DELETE_FROM_GITEA` | Delete repositories from Gitea | `false` | `true`, `false` |
 | `CLEANUP_DELETE_IF_NOT_IN_GITHUB` | Delete repos not found in GitHub (automatically enables cleanup) | `true` | `true`, `false` |
 | `CLEANUP_ORPHANED_REPO_ACTION` | Action for orphaned repositories. **Note**: `archive` is recommended to preserve backups | `archive` | `skip`, `archive`, `delete` |
-| `CLEANUP_DRY_RUN` | Test mode without actual deletion | `true` | `true`, `false` |
+| `CLEANUP_DRY_RUN` | Test mode without actual deletion | `false` | `true`, `false` |
 | `CLEANUP_PROTECTED_REPOS` | Comma-separated list of protected repository names | - | Comma-separated strings |

 **🛡️ Safety Features (Backup Protection)**:
@@ -242,10 +242,11 @@ Configure automatic cleanup of old events and data.
 - **Regular repositories**: Uses Gitea's native archive feature (PATCH `/repos/{owner}/{repo}` with `archived: true`)
  - Makes repository read-only while preserving all data
 - **Mirror repositories**: Uses rename strategy (Gitea API returns 422 for archiving mirrors)
-  - Renamed with `[ARCHIVED]` prefix for clear identification
+  - Renamed with `archived-` prefix for clear identification
  - Description updated with preservation notice and timestamp
  - Mirror interval set to 8760h (1 year) to minimize sync attempts
  - Repository remains fully accessible and cloneable
+- **Manual Sync Option**: Archived mirrors are still available on the Repositories page with automatic syncs disabled—use the `Manual Sync` action to refresh them on demand.

 ### Execution Settings

@@ -1,7 +1,7 @@
 {
  "name": "gitea-mirror",
  "type": "module",
-  "version": "3.8.5",
+  "version": "3.8.7",
  "engines": {
    "bun": ">=1.2.9"
  },
@@ -46,7 +46,7 @@
    "@astrojs/mdx": "4.3.7",
    "@astrojs/node": "9.5.0",
    "@astrojs/react": "^4.4.0",
-    "@better-auth/sso": "^1.3.28",
+    "@better-auth/sso": "1.4.0-beta.12",
    "@octokit/plugin-throttling": "^11.0.2",
    "@octokit/rest": "^22.0.0",
    "@radix-ui/react-accordion": "^1.2.12",
@@ -74,7 +74,8 @@
    "@types/react-dom": "^19.2.2",
    "astro": "^5.14.8",
    "bcryptjs": "^3.0.2",
-    "better-auth": "^1.3.28",
+    "buffer": "^6.0.3",
+    "better-auth": "1.4.0-beta.12",
    "canvas-confetti": "^1.9.3",
    "class-variance-authority": "^0.7.1",
    "clsx": "^2.1.1",
@@ -110,5 +111,5 @@
    "tsx": "^4.20.6",
    "vitest": "^3.2.4"
  },
-  "packageManager": "bun@1.3.0"
+  "packageManager": "bun@1.2.23"
 }
@@ -9,6 +9,7 @@ import {
  SelectTrigger,
  SelectValue,
 } from "@/components/ui/select";
+import { Switch } from "@/components/ui/switch";
 import {
  Clock,
  Database,
@@ -16,7 +17,8 @@ import {
  Calendar,
  Activity,
  Zap,
-  Info
+  Info,
+  Archive,
 } from "lucide-react";
 import {
  Tooltip,
@@ -120,13 +122,13 @@ export function AutomationSettings({
        </CardTitle>
      </CardHeader>
      
-      <CardContent className="space-y-6">
-        <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
-          {/* Automatic Syncing Section */}
-          <div className="space-y-4 p-4 border border-border rounded-lg bg-card/50">
-            <div className="flex items-center justify-between">
-              <h3 className="text-sm font-medium flex items-center gap-2">
-                <RefreshCw className="h-4 w-4 text-primary" />
+  <CardContent className="space-y-6">
+    <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+      {/* Automatic Syncing Section */}
+      <div className="space-y-4 p-4 border border-border rounded-lg bg-card/50">
+        <div className="flex items-center justify-between">
+          <h3 className="text-sm font-medium flex items-center gap-2">
+            <RefreshCw className="h-4 w-4 text-primary" />
                Automatic Syncing
              </h3>
              {isAutoSavingSchedule && (
@@ -139,6 +141,7 @@ export function AutomationSettings({
                <Checkbox
                  id="enable-auto-mirror"
                  checked={scheduleConfig.enabled}
+                  className="mt-1.25"
                  onCheckedChange={(checked) =>
                    onScheduleChange({ ...scheduleConfig, enabled: !!checked })
                  }
@@ -218,17 +221,17 @@ export function AutomationSettings({
                    Enable automatic syncing to schedule periodic repository updates
                  </div>
                )}
-              </div>
-            </div>
          </div>
+        </div>
+      </div>

-          {/* Database Cleanup Section */}
-          <div className="space-y-4 p-4 border border-border rounded-lg bg-card/50">
-            <div className="flex items-center justify-between">
-              <h3 className="text-sm font-medium flex items-center gap-2">
-                <Database className="h-4 w-4 text-primary" />
-                Database Maintenance
-              </h3>
+      {/* Database Cleanup Section */}
+      <div className="space-y-4 p-4 border border-border rounded-lg bg-card/50">
+        <div className="flex items-center justify-between">
+          <h3 className="text-sm font-medium flex items-center gap-2">
+            <Database className="h-4 w-4 text-primary" />
+            Database Maintenance
+          </h3>
              {isAutoSavingCleanup && (
                <Activity className="h-4 w-4 animate-spin text-muted-foreground" />
              )}
@@ -239,6 +242,7 @@ export function AutomationSettings({
                <Checkbox
                  id="enable-auto-cleanup"
                  checked={cleanupConfig.enabled}
+                  className="mt-1.25"
                  onCheckedChange={(checked) =>
                    onCleanupChange({ ...cleanupConfig, enabled: !!checked })
                  }
@@ -257,8 +261,8 @@ export function AutomationSettings({
              </div>

              {cleanupConfig.enabled && (
-                <div className="ml-6 space-y-3">
-                  <div>
+                <div className="ml-6 space-y-5">
+                  <div className="space-y-2">
                    <Label htmlFor="retention-period" className="text-sm flex items-center gap-2">
                      Data retention period
                      <TooltipProvider>
@@ -275,35 +279,36 @@ export function AutomationSettings({
                        </Tooltip>
                      </TooltipProvider>
                    </Label>
-                    <Select
-                      value={cleanupConfig.retentionDays.toString()}
-                      onValueChange={(value) =>
-                        onCleanupChange({
-                          ...cleanupConfig,
-                          retentionDays: parseInt(value, 10),
-                        })
-                      }
-                    >
-                      <SelectTrigger id="retention-period" className="mt-1.5">
-                        <SelectValue />
-                      </SelectTrigger>
-                      <SelectContent>
-                        {retentionPeriods.map((option) => (
-                          <SelectItem
-                            key={option.value}
-                            value={option.value.toString()}
-                          >
-                            {option.label}
-                          </SelectItem>
-                        ))}
-                      </SelectContent>
-                    </Select>
-                    {cleanupConfig.enabled && (
-                      <p className="text-xs text-muted-foreground mt-1">
+                    <div className="flex items-center gap-3 mt-1.5">
+                      <Select
+                        value={cleanupConfig.retentionDays.toString()}
+                        onValueChange={(value) =>
+                          onCleanupChange({
+                            ...cleanupConfig,
+                            retentionDays: parseInt(value, 10),
+                          })
+                        }
+                      >
+                        <SelectTrigger id="retention-period" className="w-40">
+                          <SelectValue />
+                        </SelectTrigger>
+                        <SelectContent>
+                          {retentionPeriods.map((option) => (
+                            <SelectItem
+                              key={option.value}
+                              value={option.value.toString()}
+                            >
+                              {option.label}
+                            </SelectItem>
+                          ))}
+                        </SelectContent>
+                      </Select>
+                      <p className="text-xs text-muted-foreground">
                        Cleanup runs {getCleanupFrequencyText(cleanupConfig.retentionDays)}
                      </p>
-                    )}
+                    </div>
                  </div>
+
                </div>
              )}

@@ -334,13 +339,108 @@ export function AutomationSettings({
                ) : (
                  <div className="text-xs text-muted-foreground">
                    Enable automatic cleanup to optimize database storage
-                  </div>
-                )}
              </div>
-            </div>
+            )}
          </div>
        </div>
-      </CardContent>
+      </div>
+
+      {/* Repository Cleanup Section */}
+      <div className="space-y-4 p-4 border border-border rounded-lg bg-card/50 md:col-span-2">
+        <div className="flex items-center justify-between">
+          <h3 className="text-sm font-medium flex items-center gap-2">
+            <Archive className="h-4 w-4 text-primary" />
+            Repository Cleanup (orphaned mirrors)
+          </h3>
+          {isAutoSavingCleanup && (
+            <Activity className="h-4 w-4 animate-spin text-muted-foreground" />
+          )}
+        </div>
+
+        <div className="space-y-4">
+          <div className="flex items-start space-x-3">
+            <Checkbox
+              id="cleanup-handle-orphans"
+              checked={Boolean(cleanupConfig.deleteIfNotInGitHub)}
+              className="mt-1.25"
+              onCheckedChange={(checked) =>
+                onCleanupChange({
+                  ...cleanupConfig,
+                  deleteIfNotInGitHub: Boolean(checked),
+                })
+              }
+            />
+            <div className="space-y-0.5 flex-1">
+              <Label
+                htmlFor="cleanup-handle-orphans"
+                className="text-sm font-normal cursor-pointer"
+              >
+                Handle orphaned repositories automatically
+              </Label>
+              <p className="text-xs text-muted-foreground">
+                Keep your Gitea backups when GitHub repos disappear. Archive is the safest option—it preserves data and disables automatic syncs.
+              </p>
+            </div>
+          </div>
+
+          {cleanupConfig.deleteIfNotInGitHub && (
+            <div className="space-y-3 ml-6">
+              <div className="space-y-1">
+                <Label htmlFor="cleanup-orphaned-action" className="text-sm font-medium">
+                  Action for orphaned repositories
+                </Label>
+                <Select
+                  value={cleanupConfig.orphanedRepoAction ?? "archive"}
+                  onValueChange={(value) =>
+                    onCleanupChange({
+                      ...cleanupConfig,
+                      orphanedRepoAction: value as DatabaseCleanupConfig["orphanedRepoAction"],
+                    })
+                  }
+                >
+                  <SelectTrigger id="cleanup-orphaned-action">
+                    <SelectValue />
+                  </SelectTrigger>
+                  <SelectContent>
+                    <SelectItem value="archive">Archive (preserve data)</SelectItem>
+                    <SelectItem value="skip">Skip (leave as-is)</SelectItem>
+                    <SelectItem value="delete">Delete from Gitea</SelectItem>
+                  </SelectContent>
+                </Select>
+                <p className="text-xs text-muted-foreground">
+                  Archive renames mirror backups with an <code>archived-</code> prefix and disables automatic syncs—use Manual Sync when you want to refresh.
+                </p>
+              </div>
+
+              <div className="flex items-center justify-between">
+                <div className="space-y-0.5">
+                  <Label
+                    htmlFor="cleanup-dry-run"
+                    className="text-sm font-normal cursor-pointer"
+                  >
+                    Dry run (log only)
+                  </Label>
+                  <p className="text-xs text-muted-foreground max-w-xl">
+                    When enabled, cleanup logs the planned action without modifying repositories.
+                  </p>
+                </div>
+                <Switch
+                  id="cleanup-dry-run"
+                  checked={Boolean(cleanupConfig.dryRun)}
+                  onCheckedChange={(checked) =>
+                    onCleanupChange({
+                      ...cleanupConfig,
+                      dryRun: Boolean(checked),
+                    })
+                  }
+                />
+              </div>
+            </div>
+          )}
+        </div>
+      </div>
+    </div>
+  </CardContent>
    </Card>
  );
-}
+}
@@ -56,6 +56,11 @@ export function ConfigTabs() {
    cleanupConfig: {
      enabled: false, // Don't set defaults here - will be loaded from API  
      retentionDays: 0, // Will be replaced with actual value from API
+      deleteIfNotInGitHub: true,
+      orphanedRepoAction: "archive",
+      dryRun: false,
+      deleteFromGitea: false,
+      protectedRepos: [],
    },
    mirrorOptions: {
      mirrorReleases: false,
@@ -1,201 +0,0 @@
-import { Card, CardContent } from "@/components/ui/card";
-import { Checkbox } from "../ui/checkbox";
-import type { DatabaseCleanupConfig } from "@/types/config";
-import { formatDate } from "@/lib/utils";
-import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from "../ui/select";
-import { RefreshCw, Database } from "lucide-react";
-
-interface DatabaseCleanupConfigFormProps {
-  config: DatabaseCleanupConfig;
-  setConfig: React.Dispatch<React.SetStateAction<DatabaseCleanupConfig>>;
-  onAutoSave?: (config: DatabaseCleanupConfig) => void;
-  isAutoSaving?: boolean;
-}
-
-
-// Helper to calculate cleanup interval in hours (should match backend logic)
-function calculateCleanupInterval(retentionSeconds: number): number {
-  const retentionDays = retentionSeconds / (24 * 60 * 60);
-  if (retentionDays <= 1) {
-    return 6;
-  } else if (retentionDays <= 3) {
-    return 12;
-  } else if (retentionDays <= 7) {
-    return 24;
-  } else if (retentionDays <= 30) {
-    return 48;
-  } else {
-    return 168;
-  }
-}
-
-export function DatabaseCleanupConfigForm({
-  config,
-  setConfig,
-  onAutoSave,
-  isAutoSaving = false,
-}: DatabaseCleanupConfigFormProps) {
-  // Optimistically update nextRun when enabled or retention changes
-  const handleChange = (
-    e: React.ChangeEvent<HTMLInputElement | HTMLSelectElement>
-  ) => {
-    const { name, value, type } = e.target;
-    let newConfig = {
-      ...config,
-      [name]: type === "checkbox" ? (e.target as HTMLInputElement).checked : value,
-    };
-
-    // If enabling or changing retention, recalculate nextRun
-    if (
-      (name === "enabled" && (e.target as HTMLInputElement).checked) ||
-      (name === "retentionDays" && config.enabled)
-    ) {
-      const now = new Date();
-      const retentionSeconds =
-        name === "retentionDays"
-          ? Number(value)
-          : Number(newConfig.retentionDays);
-      const intervalHours = calculateCleanupInterval(retentionSeconds);
-      const nextRun = new Date(now.getTime() + intervalHours * 60 * 60 * 1000);
-      newConfig = {
-        ...newConfig,
-        nextRun,
-      };
-    }
-    // If disabling, clear nextRun
-    if (name === "enabled" && !(e.target as HTMLInputElement).checked) {
-      newConfig = {
-        ...newConfig,
-        nextRun: undefined,
-      };
-    }
-
-    setConfig(newConfig);
-    if (onAutoSave) {
-      onAutoSave(newConfig);
-    }
-  };
-
-  // Predefined retention periods (in seconds, like schedule intervals)
-  const retentionOptions: { value: number; label: string }[] = [
-    { value: 86400, label: "1 day" },        // 24 * 60 * 60
-    { value: 259200, label: "3 days" },      // 3 * 24 * 60 * 60
-    { value: 604800, label: "7 days" },      // 7 * 24 * 60 * 60
-    { value: 1209600, label: "14 days" },    // 14 * 24 * 60 * 60
-    { value: 2592000, label: "30 days" },    // 30 * 24 * 60 * 60
-    { value: 5184000, label: "60 days" },    // 60 * 24 * 60 * 60
-    { value: 7776000, label: "90 days" },    // 90 * 24 * 60 * 60
-  ];
-
-  return (
-    <Card className="self-start">
-      <CardContent className="pt-6 relative">
-        {isAutoSaving && (
-          <div className="absolute top-4 right-4 flex items-center text-sm text-muted-foreground">
-            <RefreshCw className="h-3 w-3 animate-spin mr-1" />
-            <span className="text-xs">Auto-saving...</span>
-          </div>
-        )}
-        <div className="flex flex-col gap-y-4">
-          <div className="flex items-center">
-            <Checkbox
-              id="cleanup-enabled"
-              name="enabled"
-              checked={config.enabled}
-              onCheckedChange={(checked) =>
-                handleChange({
-                  target: {
-                    name: "enabled",
-                    type: "checkbox",
-                    checked: Boolean(checked),
-                    value: "",
-                  },
-                } as React.ChangeEvent<HTMLInputElement>)
-              }
-            />
-            <label
-              htmlFor="cleanup-enabled"
-              className="select-none ml-2 block text-sm font-medium"
-            >
-              <div className="flex items-center gap-2">
-                <Database className="h-4 w-4" />
-                Enable Automatic Database Cleanup
-              </div>
-            </label>
-          </div>
-
-          {config.enabled && (
-            <div>
-              <label className="block text-sm font-medium mb-2">
-                Data Retention Period
-              </label>
-
-              <Select
-                name="retentionDays"
-                value={String(config.retentionDays)}
-                onValueChange={(value) =>
-                  handleChange({
-                    target: { name: "retentionDays", value },
-                  } as React.ChangeEvent<HTMLInputElement>)
-                }
-              >
-                <SelectTrigger className="w-full border border-input dark:bg-background dark:hover:bg-background">
-                  <SelectValue placeholder="Select retention period" />
-                </SelectTrigger>
-                <SelectContent className="bg-background text-foreground border border-input shadow-sm">
-                  {retentionOptions.map((option) => (
-                    <SelectItem
-                      key={option.value}
-                      value={option.value.toString()}
-                      className="cursor-pointer text-sm px-3 py-2 hover:bg-accent focus:bg-accent focus:text-accent-foreground"
-                    >
-                      {option.label}
-                    </SelectItem>
-                  ))}
-                </SelectContent>
-              </Select>
-
-              <p className="text-xs text-muted-foreground mt-1">
-                Activities and events older than this period will be automatically deleted.
-              </p>
-              <div className="mt-2 p-2 bg-muted/50 rounded-md">
-                <p className="text-xs text-muted-foreground">
-                  <strong>Cleanup Frequency:</strong> The cleanup process runs automatically at optimal intervals:
-                  shorter retention periods trigger more frequent cleanups, longer periods trigger less frequent cleanups.
-                </p>
-              </div>
-            </div>
-          )}
-
-          <div className="flex gap-x-4">
-            <div className="flex-1">
-              <label className="block text-sm font-medium mb-1">Last Cleanup</label>
-              <div className="text-sm">
-                {config.lastRun ? formatDate(config.lastRun) : "Never"}
-              </div>
-            </div>
-
-            {config.enabled && (
-              <div className="flex-1">
-                <label className="block text-sm font-medium mb-1">Next Cleanup</label>
-                <div className="text-sm">
-                  {config.nextRun
-                    ? formatDate(config.nextRun)
-                    : config.enabled
-                      ? "Calculating..."
-                      : "Never"}
-                </div>
-              </div>
-            )}
-          </div>
-        </div>
-      </CardContent>
-    </Card>
-  );
-}
@@ -1,47 +0,0 @@
-import React from 'react';
-import { ScheduleConfigForm } from './ScheduleConfigForm';
-import { DatabaseCleanupConfigForm } from './DatabaseCleanupConfigForm';
-import { Separator } from '../ui/separator';
-import type { ScheduleConfig, DatabaseCleanupConfig } from '@/types/config';
-
-interface ScheduleAndCleanupFormProps {
-  scheduleConfig: ScheduleConfig;
-  cleanupConfig: DatabaseCleanupConfig;
-  setScheduleConfig: (update: ScheduleConfig | ((prev: ScheduleConfig) => ScheduleConfig)) => void;
-  setCleanupConfig: (update: DatabaseCleanupConfig | ((prev: DatabaseCleanupConfig) => DatabaseCleanupConfig)) => void;
-  onAutoSaveSchedule?: (config: ScheduleConfig) => Promise<void>;
-  onAutoSaveCleanup?: (config: DatabaseCleanupConfig) => Promise<void>;
-  isAutoSavingSchedule?: boolean;
-  isAutoSavingCleanup?: boolean;
-}
-
-export function ScheduleAndCleanupForm({
-  scheduleConfig,
-  cleanupConfig,
-  setScheduleConfig,
-  setCleanupConfig,
-  onAutoSaveSchedule,
-  onAutoSaveCleanup,
-  isAutoSavingSchedule,
-  isAutoSavingCleanup,
-}: ScheduleAndCleanupFormProps) {
-  return (
-    <div className="space-y-6">
-      <ScheduleConfigForm
-        config={scheduleConfig}
-        setConfig={setScheduleConfig}
-        onAutoSave={onAutoSaveSchedule}
-        isAutoSaving={isAutoSavingSchedule}
-      />
-      
-      <Separator />
-      
-      <DatabaseCleanupConfigForm
-        config={cleanupConfig}
-        setConfig={setCleanupConfig}
-        onAutoSave={onAutoSaveCleanup}
-        isAutoSaving={isAutoSavingCleanup}
-      />
-    </div>
-  );
-}
@@ -320,7 +320,7 @@ export default function Repository() {
    
    const selectedRepos = repositories.filter(repo => repo.id && selectedRepoIds.has(repo.id));
    const eligibleRepos = selectedRepos.filter(
-      repo => repo.status === "mirrored" || repo.status === "synced"
+      repo => ["mirrored", "synced", "archived"].includes(repo.status)
    );

    if (eligibleRepos.length === 0) {
@@ -90,7 +90,7 @@ export default function RepositoryTable({
    }

    // Only provide Gitea links for repositories that have been or are being mirrored
-    const validStatuses = ['mirroring', 'mirrored', 'syncing', 'synced'];
+    const validStatuses = ['mirroring', 'mirrored', 'syncing', 'synced', 'archived'];
    if (!validStatuses.includes(repository.status)) {
      return null;
    }
@@ -820,8 +820,8 @@ function RepoActionButton({
    primaryLabel = "Retry";
    primaryIcon = <RotateCcw className="h-4 w-4" />;
    primaryOnClick = onRetry;
-  } else if (["mirrored", "synced", "syncing"].includes(repo.status)) {
-    primaryLabel = "Sync";
+  } else if (["mirrored", "synced", "syncing", "archived"].includes(repo.status)) {
+    primaryLabel = repo.status === "archived" ? "Manual Sync" : "Sync";
    primaryIcon = <RefreshCw className="h-4 w-4" />;
    primaryOnClick = onSync;
    primaryDisabled ||= repo.status === "syncing";
@@ -889,4 +889,4 @@ function RepoActionButton({
      </DropdownMenuContent>
    </DropdownMenu>
  );
-}
+}
@@ -1,3 +1,4 @@
+import "@/lib/polyfills/buffer";
 import { createAuthClient } from "better-auth/react";
 import { oidcClient } from "better-auth/client/plugins";
 import { ssoClient } from "@better-auth/sso/client";
@@ -60,4 +61,4 @@ export type Session = BetterAuthSession & {
 };
 export type AuthUser = BetterAuthUser & {
  username?: string | null;
-};
+};
@@ -171,4 +171,4 @@ export const auth = betterAuth({
 });

 // Export type for use in other parts of the app
-export type Auth = typeof auth;
+export type Auth = typeof auth;
@@ -94,7 +94,7 @@ export const cleanupConfigSchema = z.object({
  deleteFromGitea: z.boolean().default(false),
  deleteIfNotInGitHub: z.boolean().default(true),
  protectedRepos: z.array(z.string()).default([]),
-  dryRun: z.boolean().default(true),
+  dryRun: z.boolean().default(false),
  orphanedRepoAction: z
    .enum(["skip", "archive", "delete"])
    .default("archive"),
@@ -169,7 +169,7 @@ function parseEnvConfig(): EnvConfig {
      deleteFromGitea: process.env.CLEANUP_DELETE_FROM_GITEA === 'true',
      deleteIfNotInGitHub: process.env.CLEANUP_DELETE_IF_NOT_IN_GITHUB === 'true',
      protectedRepos,
-      dryRun: process.env.CLEANUP_DRY_RUN === 'true',
+      dryRun: process.env.CLEANUP_DRY_RUN === 'true' ? true : process.env.CLEANUP_DRY_RUN === 'false' ? false : false,
      orphanedRepoAction: process.env.CLEANUP_ORPHANED_REPO_ACTION as 'skip' | 'archive' | 'delete',
      batchSize: process.env.CLEANUP_BATCH_SIZE ? parseInt(process.env.CLEANUP_BATCH_SIZE, 10) : undefined,
      pauseBetweenDeletes: process.env.CLEANUP_PAUSE_BETWEEN_DELETES ? parseInt(process.env.CLEANUP_PAUSE_BETWEEN_DELETES, 10) : undefined,
@@ -2436,7 +2436,11 @@ export async function archiveGiteaRepo(
      const currentName = repoResponse.data.name;
      
      // Skip if already marked as archived
-      if (currentName.startsWith('[ARCHIVED]')) {
+      const normalizedName = currentName.toLowerCase();
+      if (
+        currentName.startsWith('[ARCHIVED]') ||
+        normalizedName.startsWith('archived-')
+      ) {
        console.log(`[Archive] Repository ${owner}/${repo} already marked as archived. Skipping.`);
        return;
      }
@@ -2495,17 +2499,17 @@ export async function archiveGiteaRepo(
        await httpPatch(
          `${client.url}/api/v1/repos/${owner}/${archivedName}`,
          {
-            mirror_interval: "8760h", // 1 year - minimizes sync attempts
+            mirror_interval: "0h", // Disable automatic syncing; manual sync is still available
          },
          {
            Authorization: `token ${client.token}`,
            'Content-Type': 'application/json',
          }
        );
-        console.log(`[Archive] Reduced sync frequency for ${owner}/${archivedName} to yearly`);
+        console.log(`[Archive] Disabled automatic syncs for ${owner}/${archivedName}; manual sync only`);
      } catch (intervalError) {
        // Non-critical - repo is still preserved even if we can't change interval
-        console.debug(`[Archive] Could not update mirror interval (non-critical):`, intervalError);
+        console.debug(`[Archive] Could not disable mirror interval (non-critical):`, intervalError);
      }
    } else {
      // For non-mirror repositories, use Gitea's native archive feature
@@ -0,0 +1,5 @@
+import { Buffer } from "buffer";
+
+if (typeof globalThis !== "undefined" && (globalThis as any).Buffer === undefined) {
+  (globalThis as any).Buffer = Buffer;
+}
@@ -69,7 +69,20 @@ async function identifyOrphanedRepositories(config: any): Promise<any[]> {
    
    // Only identify repositories as orphaned if we successfully accessed GitHub
    // This prevents false positives when GitHub is down or account is inaccessible
-    const orphanedRepos = dbRepos.filter(repo => !githubRepoFullNames.has(repo.fullName));
+    const orphanedRepos = dbRepos.filter(repo => {
+      const isOrphaned = !githubRepoFullNames.has(repo.fullName);
+      if (!isOrphaned) {
+        return false;
+      }
+
+      // Skip repositories we've already archived/preserved
+      if (repo.status === 'archived' || repo.isArchived) {
+        console.log(`[Repository Cleanup] Skipping ${repo.fullName} - already archived`);
+        return false;
+      }
+
+      return true;
+    });
    
    if (orphanedRepos.length > 0) {
      console.log(`[Repository Cleanup] Found ${orphanedRepos.length} orphaned repositories for user ${userId}`);
@@ -98,7 +111,12 @@ async function handleOrphanedRepository(
    console.log(`[Repository Cleanup] Skipping orphaned repository ${repoFullName}`);
    return;
  }
-  
+
+  if (repo.status === 'archived' || repo.isArchived) {
+    console.log(`[Repository Cleanup] Repository ${repoFullName} already archived; skipping additional actions`);
+    return;
+  }
+
  if (dryRun) {
    console.log(`[Repository Cleanup] DRY RUN: Would ${action} orphaned repository ${repoFullName}`);
    return;
@@ -260,7 +278,7 @@ async function runRepositoryCleanup(config: any): Promise<{
    
    // Process orphaned repositories
    const action = cleanupConfig.orphanedRepoAction || 'archive';
-    const dryRun = cleanupConfig.dryRun ?? true;
+    const dryRun = cleanupConfig.dryRun ?? false;
    const batchSize = cleanupConfig.batchSize || 10;
    const pauseBetweenDeletes = cleanupConfig.pauseBetweenDeletes || 2000;
    
@@ -0,0 +1,56 @@
+import { describe, expect, it } from "bun:test";
+import { normalizeOidcProviderConfig, OidcConfigError } from "./oidc-config";
+
+const issuer = "https://auth.example.com";
+
+describe("normalizeOidcProviderConfig", () => {
+  it("returns provided endpoints when complete", async () => {
+    const result = await normalizeOidcProviderConfig(issuer, {
+      clientId: "client",
+      clientSecret: "secret",
+      authorizationEndpoint: "https://auth.example.com/auth",
+      tokenEndpoint: "https://auth.example.com/token",
+      jwksEndpoint: "https://auth.example.com/jwks",
+      userInfoEndpoint: "https://auth.example.com/userinfo",
+      scopes: ["openid", "email"],
+      pkce: false,
+    }, async () => {
+      throw new Error("fetch should not be called when endpoints are provided");
+    });
+
+    expect(result.oidcConfig.authorizationEndpoint).toBe("https://auth.example.com/auth");
+    expect(result.oidcConfig.tokenEndpoint).toBe("https://auth.example.com/token");
+    expect(result.oidcConfig.jwksEndpoint).toBe("https://auth.example.com/jwks");
+    expect(result.oidcConfig.userInfoEndpoint).toBe("https://auth.example.com/userinfo");
+    expect(result.oidcConfig.scopes).toEqual(["openid", "email"]);
+    expect(result.oidcConfig.pkce).toBe(false);
+  });
+
+  it("derives missing fields from discovery", async () => {
+    const fetchMock = async () =>
+      new Response(JSON.stringify({
+        authorization_endpoint: "https://auth.example.com/auth",
+        token_endpoint: "https://auth.example.com/token",
+        jwks_uri: "https://auth.example.com/jwks",
+        userinfo_endpoint: "https://auth.example.com/userinfo",
+        scopes_supported: ["openid", "email", "profile"],
+      }));
+
+    const result = await normalizeOidcProviderConfig(issuer, {
+      clientId: "client",
+      clientSecret: "secret",
+    }, fetchMock);
+
+    expect(result.oidcConfig.authorizationEndpoint).toBe("https://auth.example.com/auth");
+    expect(result.oidcConfig.tokenEndpoint).toBe("https://auth.example.com/token");
+    expect(result.oidcConfig.jwksEndpoint).toBe("https://auth.example.com/jwks");
+    expect(result.oidcConfig.userInfoEndpoint).toBe("https://auth.example.com/userinfo");
+    expect(result.oidcConfig.scopes).toEqual(["openid", "email", "profile"]);
+  });
+
+  it("throws for invalid issuer URL", async () => {
+    await expect(
+      normalizeOidcProviderConfig("not-a-url", {}),
+    ).rejects.toBeInstanceOf(OidcConfigError);
+  });
+});
@@ -0,0 +1,202 @@
+import { z } from "zod";
+
+const DEFAULT_SCOPES = ["openid", "email", "profile"] as const;
+const DISCOVERY_TIMEOUT_MS = 10000;
+
+const discoverySchema = z.object({
+  issuer: z.string().url().optional(),
+  authorization_endpoint: z.string().url().optional(),
+  token_endpoint: z.string().url().optional(),
+  userinfo_endpoint: z.string().url().optional(),
+  jwks_uri: z.string().url().optional(),
+  scopes_supported: z.array(z.string()).optional(),
+});
+
+export class OidcConfigError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "OidcConfigError";
+  }
+}
+
+export type RawOidcConfig = {
+  clientId?: string;
+  clientSecret?: string;
+  authorizationEndpoint?: string;
+  tokenEndpoint?: string;
+  jwksEndpoint?: string;
+  userInfoEndpoint?: string;
+  discoveryEndpoint?: string;
+  scopes?: string[];
+  pkce?: boolean;
+  mapping?: ProviderMapping;
+};
+
+export type ProviderMapping = {
+  id: string;
+  email: string;
+  emailVerified?: string;
+  name?: string;
+  image?: string;
+  firstName?: string;
+  lastName?: string;
+};
+
+export type NormalizedOidcConfig = {
+  oidcConfig: {
+    clientId?: string;
+    clientSecret?: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    jwksEndpoint?: string;
+    userInfoEndpoint?: string;
+    discoveryEndpoint: string;
+    scopes: string[];
+    pkce: boolean;
+  };
+  mapping: ProviderMapping;
+};
+
+type FetchFn = typeof fetch;
+
+function cleanUrl(value: string | undefined, field: string): string | undefined {
+  if (!value || typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  if (!trimmed) return undefined;
+  try {
+    return new URL(trimmed).toString();
+  } catch {
+    throw new OidcConfigError(`Invalid ${field} URL: ${value}`);
+  }
+}
+
+function sanitizeScopes(scopes: string[] | undefined, fallback: readonly string[]): string[] {
+  const candidates = Array.isArray(scopes) ? scopes : [];
+  const sanitized = candidates
+    .map(scope => scope?.trim())
+    .filter((scope): scope is string => Boolean(scope));
+
+  if (sanitized.length === 0) {
+    return [...fallback];
+  }
+
+  return Array.from(new Set(sanitized));
+}
+
+async function fetchDiscoveryDocument(url: string, fetchFn: FetchFn): Promise<z.infer<typeof discoverySchema>> {
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), DISCOVERY_TIMEOUT_MS);
+
+  try {
+    const response = await fetchFn(url, {
+      signal: controller.signal,
+      headers: { Accept: "application/json" },
+    });
+
+    if (!response.ok) {
+      throw new OidcConfigError(`OIDC discovery request failed (${response.status} ${response.statusText})`);
+    }
+
+    let payload: unknown;
+    try {
+      payload = await response.json();
+    } catch {
+      throw new OidcConfigError("OIDC discovery response is not valid JSON");
+    }
+
+    const parsed = discoverySchema.parse(payload);
+    if (!parsed.authorization_endpoint || !parsed.token_endpoint) {
+      throw new OidcConfigError("OIDC discovery document is missing required endpoints");
+    }
+    return parsed;
+  } catch (error) {
+    if (error instanceof OidcConfigError) {
+      throw error;
+    }
+    if (error instanceof Error && error.name === "AbortError") {
+      throw new OidcConfigError(`OIDC discovery timed out after ${DISCOVERY_TIMEOUT_MS / 1000}s`);
+    }
+    throw new OidcConfigError(`Failed to fetch OIDC discovery document: ${error instanceof Error ? error.message : "unknown error"}`);
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
+
+export async function normalizeOidcProviderConfig(
+  issuer: string,
+  rawConfig: RawOidcConfig,
+  fetchFn: FetchFn = fetch,
+): Promise<NormalizedOidcConfig> {
+  if (!issuer || typeof issuer !== "string") {
+    throw new OidcConfigError("Issuer is required");
+  }
+
+  let normalizedIssuer: string;
+  try {
+    const issuerUrl = new URL(issuer.trim());
+    normalizedIssuer = issuerUrl.toString().replace(/\/$/, "");
+  } catch {
+    throw new OidcConfigError(`Invalid issuer URL: ${issuer}`);
+  }
+
+  const discoveryEndpoint = cleanUrl(
+    rawConfig.discoveryEndpoint,
+    "discovery endpoint",
+  ) ?? `${normalizedIssuer}/.well-known/openid-configuration`;
+
+  const authorizationEndpoint = cleanUrl(rawConfig.authorizationEndpoint, "authorization endpoint");
+  const tokenEndpoint = cleanUrl(rawConfig.tokenEndpoint, "token endpoint");
+  const jwksEndpoint = cleanUrl(rawConfig.jwksEndpoint, "JWKS endpoint");
+  const userInfoEndpoint = cleanUrl(rawConfig.userInfoEndpoint, "userinfo endpoint");
+  const providedScopes = Array.isArray(rawConfig.scopes) ? rawConfig.scopes : undefined;
+  let scopes = sanitizeScopes(providedScopes, DEFAULT_SCOPES);
+
+  const shouldFetchDiscovery =
+    !authorizationEndpoint ||
+    !tokenEndpoint ||
+    !jwksEndpoint ||
+    !userInfoEndpoint ||
+    !providedScopes ||
+    providedScopes.length === 0;
+
+  let resolvedAuthorization = authorizationEndpoint;
+  let resolvedToken = tokenEndpoint;
+  let resolvedJwks = jwksEndpoint;
+  let resolvedUserInfo = userInfoEndpoint;
+
+  if (shouldFetchDiscovery) {
+    const discovery = await fetchDiscoveryDocument(discoveryEndpoint, fetchFn);
+    resolvedAuthorization = resolvedAuthorization ?? discovery.authorization_endpoint;
+    resolvedToken = resolvedToken ?? discovery.token_endpoint;
+    resolvedJwks = resolvedJwks ?? discovery.jwks_uri;
+    resolvedUserInfo = resolvedUserInfo ?? discovery.userinfo_endpoint;
+    if (!providedScopes || providedScopes.length === 0) {
+      scopes = sanitizeScopes(discovery.scopes_supported, DEFAULT_SCOPES);
+    }
+  }
+
+  if (!resolvedAuthorization || !resolvedToken) {
+    throw new OidcConfigError("OIDC configuration must include authorization and token endpoints");
+  }
+
+  return {
+    oidcConfig: {
+      clientId: rawConfig.clientId,
+      clientSecret: rawConfig.clientSecret,
+      authorizationEndpoint: resolvedAuthorization,
+      tokenEndpoint: resolvedToken,
+      jwksEndpoint: resolvedJwks,
+      userInfoEndpoint: resolvedUserInfo,
+      discoveryEndpoint,
+      scopes,
+      pkce: rawConfig.pkce !== false,
+    },
+    mapping: rawConfig.mapping ?? {
+      id: "sub",
+      email: "email",
+      emailVerified: "email_verified",
+      name: "name",
+      image: "picture",
+    },
+  };
+}
@@ -100,6 +100,13 @@ export async function createDefaultConfig({ userId, envOverrides = {} }: Default
    cleanupConfig: {
      enabled: cleanupEnabled,
      retentionDays: cleanupRetentionDays,
+      deleteFromGitea: false,
+      deleteIfNotInGitHub: true,
+      protectedRepos: [],
+      dryRun: false,
+      orphanedRepoAction: "archive",
+      batchSize: 10,
+      pauseBetweenDeletes: 2000,
      lastRun: null,
      nextRun: cleanupEnabled ? new Date(Date.now() + getCleanupInterval(cleanupRetentionDays) * 1000) : null,
    },
@@ -123,4 +130,4 @@ function getCleanupInterval(retentionSeconds: number): number {
  if (days <= 7) return 86400; // 24 hours
  if (days <= 30) return 172800; // 48 hours
  return 604800; // 1 week
-}
+}
@@ -225,16 +225,26 @@ export function mapDbScheduleToUi(dbSchedule: DbScheduleConfig): any {
 * Maps UI cleanup config to database schema
 */
 export function mapUiCleanupToDb(uiCleanup: any): DbCleanupConfig {
+  const parsedRetention =
+    typeof uiCleanup.retentionDays === "string"
+      ? parseInt(uiCleanup.retentionDays, 10)
+      : uiCleanup.retentionDays;
+  const retentionSeconds = Number.isFinite(parsedRetention)
+    ? parsedRetention
+    : 604800;
+
  return {
-    enabled: uiCleanup.enabled || false,
-    retentionDays: uiCleanup.retentionDays || 604800, // Default to 7 days
-    deleteFromGitea: false,
-    deleteIfNotInGitHub: true,
-    protectedRepos: [],
-    dryRun: true,
-    orphanedRepoAction: "archive",
-    batchSize: 10,
-    pauseBetweenDeletes: 2000,
+    enabled: Boolean(uiCleanup.enabled),
+    retentionDays: retentionSeconds,
+    deleteFromGitea: uiCleanup.deleteFromGitea ?? false,
+    deleteIfNotInGitHub: uiCleanup.deleteIfNotInGitHub ?? true,
+    protectedRepos: uiCleanup.protectedRepos ?? [],
+    dryRun: uiCleanup.dryRun ?? false,
+    orphanedRepoAction: (uiCleanup.orphanedRepoAction as DbCleanupConfig["orphanedRepoAction"]) || "archive",
+    batchSize: uiCleanup.batchSize ?? 10,
+    pauseBetweenDeletes: uiCleanup.pauseBetweenDeletes ?? 2000,
+    lastRun: uiCleanup.lastRun ?? null,
+    nextRun: uiCleanup.nextRun ?? null,
  };
 }

@@ -253,9 +263,16 @@ export function mapDbCleanupToUi(dbCleanup: DbCleanupConfig): any {
  }

  return {
-    enabled: dbCleanup.enabled || false,
-    retentionDays: dbCleanup.retentionDays || 604800, // Use actual value from DB or default to 7 days
-    lastRun: dbCleanup.lastRun || null,
-    nextRun: dbCleanup.nextRun || null,
+    enabled: dbCleanup.enabled ?? false,
+    retentionDays: dbCleanup.retentionDays ?? 604800,
+    deleteFromGitea: dbCleanup.deleteFromGitea ?? false,
+    deleteIfNotInGitHub: dbCleanup.deleteIfNotInGitHub ?? true,
+    protectedRepos: dbCleanup.protectedRepos ?? [],
+    dryRun: dbCleanup.dryRun ?? false,
+    orphanedRepoAction: dbCleanup.orphanedRepoAction ?? "archive",
+    batchSize: dbCleanup.batchSize ?? 10,
+    pauseBetweenDeletes: dbCleanup.pauseBetweenDeletes ?? 2000,
+    lastRun: dbCleanup.lastRun ?? null,
+    nextRun: dbCleanup.nextRun ?? null,
  };
 }
@@ -2,6 +2,10 @@ import type { APIContext } from "astro";
 import { createSecureErrorResponse } from "@/lib/utils";
 import { requireAuth } from "@/lib/utils/auth-helpers";
 import { auth } from "@/lib/auth";
+import { db, ssoProviders } from "@/lib/db";
+import { eq } from "drizzle-orm";
+import { nanoid } from "nanoid";
+import { normalizeOidcProviderConfig, OidcConfigError } from "@/lib/sso/oidc-config";

 // POST /api/auth/sso/register - Register a new SSO provider using Better Auth
 export async function POST(context: APIContext) {
@@ -104,43 +108,37 @@ export async function POST(context: APIContext) {
        userInfoEndpoint,
        scopes,
        pkce = true,
-        mapping = {
-          id: "sub",
-          email: "email",
-          emailVerified: "email_verified",
-          name: "name",
-          image: "picture",
-        }
+        mapping,
      } = body;

-      // Use provided scopes or default if not specified
-      const finalScopes = scopes || ["openid", "email", "profile"];
+      try {
+        const normalized = await normalizeOidcProviderConfig(validatedIssuer, {
+          clientId,
+          clientSecret,
+          authorizationEndpoint,
+          tokenEndpoint,
+          jwksEndpoint,
+          userInfoEndpoint,
+          discoveryEndpoint,
+          scopes,
+          pkce,
+          mapping,
+        });

-      // Validate endpoint URLs if provided
-      const validateUrl = (url: string | undefined, name: string): string | undefined => {
-        if (!url) return undefined;
-        if (typeof url !== 'string' || url.trim() === '') return undefined;
-        try {
-          const validatedUrl = new URL(url.trim());
-          return validatedUrl.toString();
-        } catch (e) {
-          console.warn(`Invalid ${name} URL: ${url}, skipping`);
-          return undefined;
+        registrationBody.oidcConfig = normalized.oidcConfig;
+        registrationBody.mapping = normalized.mapping;
+      } catch (error) {
+        if (error instanceof OidcConfigError) {
+          return new Response(
+            JSON.stringify({ error: error.message }),
+            {
+              status: 400,
+              headers: { "Content-Type": "application/json" },
+            }
+          );
        }
-      };
-
-      registrationBody.oidcConfig = {
-        clientId: clientId || undefined,
-        clientSecret: clientSecret || undefined,
-        authorizationEndpoint: validateUrl(authorizationEndpoint, 'authorization endpoint'),
-        tokenEndpoint: validateUrl(tokenEndpoint, 'token endpoint'),
-        jwksEndpoint: validateUrl(jwksEndpoint, 'JWKS endpoint'),
-        discoveryEndpoint: validateUrl(discoveryEndpoint, 'discovery endpoint'),
-        userInfoEndpoint: validateUrl(userInfoEndpoint, 'userinfo endpoint'),
-        scopes: finalScopes,
-        pkce,
-      };
-      registrationBody.mapping = mapping;
+        throw error;
+      }
    }

    // Get the user's auth headers to make the request
@@ -168,7 +166,52 @@ export async function POST(context: APIContext) {
    }

    const result = await response.json();
-    
+
+    // Mirror provider entry into local SSO table for UI listing
+    try {
+      const existing = await db
+        .select()
+        .from(ssoProviders)
+        .where(eq(ssoProviders.providerId, registrationBody.providerId))
+        .limit(1);
+
+      const values: any = {
+        issuer: registrationBody.issuer,
+        domain: registrationBody.domain,
+        organizationId: registrationBody.organizationId,
+        updatedAt: new Date(),
+      };
+
+      if (registrationBody.oidcConfig) {
+        values.oidcConfig = JSON.stringify({
+          ...registrationBody.oidcConfig,
+          mapping: registrationBody.mapping,
+        });
+      }
+
+      if (existing.length > 0) {
+        await db
+          .update(ssoProviders)
+          .set(values)
+          .where(eq(ssoProviders.id, existing[0].id));
+      } else {
+        await db.insert(ssoProviders).values({
+          id: nanoid(),
+          issuer: registrationBody.issuer,
+          domain: registrationBody.domain,
+          oidcConfig: JSON.stringify({
+            ...registrationBody.oidcConfig,
+            mapping: registrationBody.mapping,
+          }),
+          userId: user.id,
+          providerId: registrationBody.providerId,
+          organizationId: registrationBody.organizationId,
+        });
+      }
+    } catch (mirroringError) {
+      console.warn("Failed to mirror SSO provider to local DB:", mirroringError);
+    }
+
    return new Response(JSON.stringify(result), {
      status: 201,
      headers: { "Content-Type": "application/json" },
@@ -199,4 +242,4 @@ export async function GET(context: APIContext) {
  } catch (error) {
    return createSecureErrorResponse(error, "SSO provider listing");
  }
-}
+}
@@ -4,6 +4,7 @@ import { requireAuth } from "@/lib/utils/auth-helpers";
 import { db, ssoProviders } from "@/lib/db";
 import { nanoid } from "nanoid";
 import { eq } from "drizzle-orm";
+import { normalizeOidcProviderConfig, OidcConfigError, type RawOidcConfig } from "@/lib/sso/oidc-config";

 // GET /api/sso/providers - List all SSO providers
 export async function GET(context: APIContext) {
@@ -45,10 +46,12 @@ export async function POST(context: APIContext) {
      tokenEndpoint,
      jwksEndpoint,
      userInfoEndpoint,
+      discoveryEndpoint,
      mapping,
      providerId,
      organizationId,
      scopes,
+      pkce,
    } = body;

    // Validate required fields
@@ -79,22 +82,51 @@ export async function POST(context: APIContext) {
      );
    }

-    // Create OIDC config object
-    const oidcConfig = {
-      clientId,
-      clientSecret,
-      authorizationEndpoint,
-      tokenEndpoint,
-      jwksEndpoint,
-      userInfoEndpoint,
-      scopes: scopes || ["openid", "email", "profile"],
-      mapping: mapping || {
-        id: "sub",
-        email: "email",
-        emailVerified: "email_verified",
-        name: "name",
-        image: "picture",
-      },
+    // Clean issuer URL (remove trailing slash); validate format
+    let cleanIssuer = issuer;
+    try {
+      const issuerUrl = new URL(issuer.toString().trim());
+      cleanIssuer = issuerUrl.toString().replace(/\/$/, "");
+    } catch {
+      return new Response(
+        JSON.stringify({ error: `Invalid issuer URL format: ${issuer}` }),
+        {
+          status: 400,
+          headers: { "Content-Type": "application/json" },
+        }
+      );
+    }
+
+    let normalized;
+    try {
+      normalized = await normalizeOidcProviderConfig(cleanIssuer, {
+        clientId,
+        clientSecret,
+        authorizationEndpoint,
+        tokenEndpoint,
+        jwksEndpoint,
+        userInfoEndpoint,
+        discoveryEndpoint,
+        scopes,
+        pkce,
+        mapping,
+      });
+    } catch (error) {
+      if (error instanceof OidcConfigError) {
+        return new Response(
+          JSON.stringify({ error: error.message }),
+          {
+            status: 400,
+            headers: { "Content-Type": "application/json" },
+          }
+        );
+      }
+      throw error;
+    }
+
+    const storedOidcConfig = {
+      ...normalized.oidcConfig,
+      mapping: normalized.mapping,
    };

    // Insert new provider
@@ -102,9 +134,9 @@ export async function POST(context: APIContext) {
      .insert(ssoProviders)
      .values({
        id: nanoid(),
-        issuer,
+        issuer: cleanIssuer,
        domain,
-        oidcConfig: JSON.stringify(oidcConfig),
+        oidcConfig: JSON.stringify(storedOidcConfig),
        userId: user.id,
        providerId,
        organizationId,
@@ -156,7 +188,9 @@ export async function PUT(context: APIContext) {
      tokenEndpoint,
      jwksEndpoint,
      userInfoEndpoint,
+      discoveryEndpoint,
      scopes,
+      pkce,
      organizationId,
    } = body;

@@ -179,26 +213,62 @@ export async function PUT(context: APIContext) {

    // Parse existing config
    const existingConfig = JSON.parse(existingProvider.oidcConfig);
+    const effectiveIssuer = issuer || existingProvider.issuer;

-    // Create updated OIDC config
-    const updatedOidcConfig = {
-      ...existingConfig,
-      clientId: clientId || existingConfig.clientId,
-      clientSecret: clientSecret || existingConfig.clientSecret,
-      authorizationEndpoint: authorizationEndpoint || existingConfig.authorizationEndpoint,
-      tokenEndpoint: tokenEndpoint || existingConfig.tokenEndpoint,
-      jwksEndpoint: jwksEndpoint || existingConfig.jwksEndpoint,
-      userInfoEndpoint: userInfoEndpoint || existingConfig.userInfoEndpoint,
-      scopes: scopes || existingConfig.scopes || ["openid", "email", "profile"],
+    let cleanIssuer = effectiveIssuer;
+    try {
+      const issuerUrl = new URL(effectiveIssuer.toString().trim());
+      cleanIssuer = issuerUrl.toString().replace(/\/$/, "");
+    } catch {
+      return new Response(
+        JSON.stringify({ error: `Invalid issuer URL format: ${effectiveIssuer}` }),
+        {
+          status: 400,
+          headers: { "Content-Type": "application/json" },
+        }
+      );
+    }
+
+    const mergedConfig: RawOidcConfig = {
+      clientId: clientId ?? existingConfig.clientId,
+      clientSecret: clientSecret ?? existingConfig.clientSecret,
+      authorizationEndpoint: authorizationEndpoint ?? existingConfig.authorizationEndpoint,
+      tokenEndpoint: tokenEndpoint ?? existingConfig.tokenEndpoint,
+      jwksEndpoint: jwksEndpoint ?? existingConfig.jwksEndpoint,
+      userInfoEndpoint: userInfoEndpoint ?? existingConfig.userInfoEndpoint,
+      discoveryEndpoint: discoveryEndpoint ?? existingConfig.discoveryEndpoint,
+      scopes: scopes ?? existingConfig.scopes,
+      pkce: pkce ?? existingConfig.pkce,
+      mapping: existingConfig.mapping,
+    };
+
+    let normalized;
+    try {
+      normalized = await normalizeOidcProviderConfig(cleanIssuer, mergedConfig);
+    } catch (error) {
+      if (error instanceof OidcConfigError) {
+        return new Response(
+          JSON.stringify({ error: error.message }),
+          {
+            status: 400,
+            headers: { "Content-Type": "application/json" },
+          }
+        );
+      }
+      throw error;
+    }
+
+    const storedOidcConfig = {
+      ...normalized.oidcConfig,
+      mapping: normalized.mapping,
    };

-    // Update provider
    const [updatedProvider] = await db
      .update(ssoProviders)
      .set({
-        issuer: issuer || existingProvider.issuer,
+        issuer: cleanIssuer,
        domain: domain || existingProvider.domain,
-        oidcConfig: JSON.stringify(updatedOidcConfig),
+        oidcConfig: JSON.stringify(storedOidcConfig),
        organizationId: organizationId !== undefined ? organizationId : existingProvider.organizationId,
        updatedAt: new Date(),
      })
@@ -259,4 +329,4 @@ export async function DELETE(context: APIContext) {
  } catch (error) {
    return createSecureErrorResponse(error, "SSO providers API");
  }
-}
+}
@@ -25,6 +25,13 @@ export interface ScheduleConfig {
 export interface DatabaseCleanupConfig {
  enabled: boolean;
  retentionDays: number; // Actually stores seconds, but keeping the name for compatibility
+  deleteIfNotInGitHub: boolean;
+  orphanedRepoAction: "skip" | "archive" | "delete";
+  dryRun: boolean;
+  deleteFromGitea?: boolean;
+  protectedRepos?: string[];
+  batchSize?: number;
+  pauseBetweenDeletes?: number;
  lastRun?: Date;
  nextRun?: Date;
 }
Author	SHA1	Message	Date
Arunavo Ray	79e0086a72	sso: polyfill buffer for browser	2025-10-22 18:13:36 +05:30
Arunavo Ray	dc340666ef	v3.8.7	2025-10-22 17:54:25 +05:30
ARUNAVO RAY	8b50a07c68	Merge pull request #124 from RayLabsHQ/fix/sso-stability Fix/sso stability	2025-10-22 17:54:01 +05:30
Arunavo Ray	7dab4fb1d5	sso: drop legacy migration helper	2025-10-22 16:34:37 +05:30
Arunavo Ray	847823bbf8	sso: normalize provider config via discovery	2025-10-22 16:33:33 +05:30
Arunavo Ray	e4e54722cf	auth: bump better auth beta	2025-10-22 16:28:59 +05:30
Arunavo Ray	1eddbad908	v3.8.6	2025-10-22 14:56:05 +05:30
ARUNAVO RAY	a7083beff5	Merge pull request #123 from RayLabsHQ/issue-84-archive-loop-fix Issue 84 archive loop fix	2025-10-22 14:55:25 +05:30
Arunavo Ray	b21cd0b866	ui: align cleanup retention controls	2025-10-22 14:49:09 +05:30
Arunavo Ray	df644be769	cleanup: improve orphaned repo handling	2025-10-22 14:41:54 +05:30
Arunavo Ray	204869fa3e	downgraded bun	2025-10-22 13:46:30 +05:30