merge: feat(auth): implement GitHub OAuth to distribute API rate limits across authenticated users (#5744)

## Description

This PR introduces GitHub OAuth authentication to reduce dependency on
the application's global Personal Access Token (PAT) and prevent
rate-limit exhaustion under high traffic.

Authenticated users can now sign in with GitHub, allowing
dashboard-related GitHub API requests to be performed using their
personal OAuth access token. The existing server PAT is retained as a
fallback for unauthenticated users and README SVG generation endpoints.

## Solution

Implemented GitHub OAuth authentication using NextAuth.

- Authentication Flow
- Added Sign in with GitHub functionality.
- Users can authenticate via GitHub OAuth.
- GitHub access tokens are stored securely in the session/JWT.
- Dashboard requests automatically use the authenticated user's token.
- Unauthenticated requests continue using the server PAT as a fallback.

Fixes #3679 

## Pillar

- [x] 🎨 Pillar 1 — New Theme Design
- [x] 📐 Pillar 2 — Geometric SVG Improvement
- [x] 🛠️ Other (Bug fix, refactoring, docs)

## Checklist before requesting a review:

- [x] I have read the `CONTRIBUTING.md` file.
- [x] I have tested these changes locally
(`localhost:3000/api/streak?user=YOUR_USERNAME`).
- [x] I have run `npm run format` and `npm run lint` locally and
resolved all errors (CI will fail otherwise).
- [x] My commits follow the Conventional Commits format (e.g.,
`feat(themes): ...`, `fix(calculate): ...`).
- [x] I have updated `README.md` if I added a new theme or URL
parameter.
- [x] I have started the repo.
- [ ] I have made sure that i have only one commit to merge in this PR.
- [x] The SVG output matches the CommitPulse "premium quality" aesthetic
standard (no raw elements, smooth animations, correct fonts).
- [x] (Recommended) I joined the CommitPulse Discord community for
contributor discussions, mentorship, and faster PR support.

Author: JhaSourav07

.env.local.example

@@ -13,6 +13,14 @@ MONGODB_URI=mongodb+srv://<username>:<password>@cluster0.mongodb.net/commitpulse
 # Generate at: https://github.com/settings/tokens (No scopes required)
 GITHUB_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 
+# GitHub OAuth App (https://github.com/settings/developers)
+# Callback URL: http://localhost:3000/api/auth/callback/github
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=
+
+# Generate with: openssl rand -base64 32
+AUTH_SECRET=
+
 # Required for encrypting stored third-party API tokens.
 # Use a unique random secret with at least 32 characters.
 ENCRYPTION_KEY=

app/(root)/dashboard/[username]/page.tsx

@@ -1,6 +1,8 @@
 import type { Metadata } from 'next';
 import DashboardClient from '@/components/dashboard/DashboardClient';
 import { getFullDashboardData, fetchUserProfile, fetchUserRepos } from '@/lib/github';
+import { getUserGitHubToken } from '@/lib/githubtoken';
+
 import type { RepoActivityInfo } from '@/types/dashboard';
 import { notFound, redirect } from 'next/navigation';
 import { resolveDashboardPeriod } from '@/utils/dashboardPeriod';
@@ -90,6 +92,7 @@ export default async function DashboardPage({
     from: resolvedSearchParams?.from,
     to: resolvedSearchParams?.to,
   });
+  const userToken = await getUserGitHubToken();
 
   let data;
 
@@ -99,13 +102,15 @@ export default async function DashboardPage({
       from: period.from,
       to: period.to,
       rangeLabel: period.label,
+      token: userToken,
     });
   } catch (error) {
     if (error instanceof Error && error.message.includes('not found')) {
       let fallbackProfile;
       try {
         fallbackProfile = await fetchUserProfile(username, {
           bypassCache,
+          token: userToken,
         });
       } catch {
         return notFound();
@@ -120,7 +125,7 @@ export default async function DashboardPage({
 
   let allRepos: RepoActivityInfo[] = [];
   try {
-    const reposData = await fetchUserRepos(username, { bypassCache });
+    const reposData = await fetchUserRepos(username, { bypassCache, token: userToken });
     allRepos = reposData.map((r) => ({
       name: r.name,
       url: `https://github.com/${username}/${r.name}`,
@@ -136,6 +141,7 @@ export default async function DashboardPage({
     try {
       compareData = await getFullDashboardData(compareUsername, {
         bypassCache,
+        token: userToken,
       });
     } catch {
       compareData = null;

app/(root)/dashboard/[username]/wrapped/page.tsx

@@ -2,6 +2,7 @@ import { notFound } from 'next/navigation';
 import type { Metadata } from 'next';
 import GithubWrapped from '@/components/dashboard/GithubWrapped';
 import { getFullDashboardData, getWrappedData } from '@/lib/github';
+import { getUserGitHubToken } from '@/lib/githubtoken';
 
 export async function generateMetadata({
   params,
@@ -25,6 +26,7 @@ export default async function WrappedPage({
   const { username } = await params;
   const resolvedSearchParams = await searchParams;
   const targetYear = resolvedSearchParams?.year || new Date().getFullYear().toString();
+  const userToken = await getUserGitHubToken();
 
   // 1. Fetch data safely.
   // If this fails, the error will bubble up to the nearest error.tsx file.
@@ -33,8 +35,8 @@ export default async function WrappedPage({
 
   try {
     [dashboardData, wrappedData] = await Promise.all([
-      getFullDashboardData(username),
-      getWrappedData(username, targetYear),
+      getFullDashboardData(username, { token: userToken }),
+      getWrappedData(username, targetYear, { token: userToken }),
     ]);
   } catch (error) {
     console.error('[Wrapped] Failed to load wrapped data:', error);

app/(root)/dashboard/org/[orgname]/page.tsx

@@ -12,6 +12,7 @@ import Heatmap from '@/components/dashboard/Heatmap';
 import AIInsights from '@/components/dashboard/AIInsights';
 import Achievements from '@/components/dashboard/Achievements';
 import { getOrgDashboardData, buildCommitClock, generateAchievements } from '@/lib/github';
+import { getUserGitHubToken } from '@/lib/githubtoken';
 
 export const revalidate = 3600; // Cache for 1 hour
 
@@ -53,11 +54,12 @@ export default async function OrgDashboardPage({
   const { orgname } = await params;
   const refreshParams = await searchParams;
   const bypassCache = refreshParams?.refresh === 'true';
+  const userToken = await getUserGitHubToken();
 
   let data;
 
   try {
-    data = await getOrgDashboardData(orgname, { bypassCache });
+    data = await getOrgDashboardData(orgname, { bypassCache, token: userToken });
   } catch (error) {
     console.error(error);
     return notFound();

app/api/Auth/Nextauthgithub/route.ts

@@ -0,0 +1,3 @@
+import { handlers } from '@/auth';
+
+export const { GET, POST } = handlers;

app/api/achievements/route.ts

@@ -10,6 +10,7 @@ import type {
   AchievementData,
   AchievementsResponse,
 } from '@/types/achievements';
+import { getUserGitHubToken } from '@/lib/githubtoken';
 
 const ACHIEVEMENT_DEFS: AchievementDef[] = [
   // 🔥 Contribution
@@ -555,7 +556,8 @@ export async function GET(request: Request) {
   }
 
   try {
-    const dashboardData = await getFullDashboardData(username);
+    const userToken = await getUserGitHubToken();
+    const dashboardData = await getFullDashboardData(username, { token: userToken });
 
     const { profile, stats, languages } = dashboardData;
     const totalStars = profile.stats.stars;

app/api/ci-analytics/route.test.ts

@@ -48,6 +48,6 @@ describe('GET /api/ci-analytics', () => {
     const response = await GET(new Request('http://localhost/api/ci-analytics?username=octocat'));
 
     expect(response.status).toBe(200);
-    expect(fetchCIAnalytics).toHaveBeenCalledWith('octocat');
+    expect(fetchCIAnalytics).toHaveBeenCalledWith('octocat', undefined);
   });
 });

app/api/ci-analytics/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server';
 import { fetchCIAnalytics } from '@/services/github/ci-analytics';
+import { getUserGitHubToken } from '@/lib/githubtoken';
 import { validateGitHubUsername } from '@/lib/validations';
 import { RateLimiter } from '@/lib/rate-limit';
 
@@ -25,7 +26,8 @@ export async function GET(request: Request) {
   }
 
   try {
-    const data = await fetchCIAnalytics(username);
+    const userToken = await getUserGitHubToken();
+    const data = await fetchCIAnalytics(username, userToken);
     return NextResponse.json(data);
   } catch (error: unknown) {
     console.error('Error fetching CI analytics:', error);

app/api/compare/route.mouse-interactivity.test.ts

@@ -42,8 +42,20 @@ describe('ApiCompareRoute Tests', () => {
     expect(json.user1.profile.username).toBe('testuser');
     expect(json.user2.profile.username).toBe('testuser');
     expect(getFullDashboardData).toHaveBeenCalledTimes(2);
-    expect(getFullDashboardData).toHaveBeenNthCalledWith(1, 'octocat');
-    expect(getFullDashboardData).toHaveBeenNthCalledWith(2, 'defunkt');
+    expect(getFullDashboardData).toHaveBeenNthCalledWith(
+      1,
+      'octocat',
+      expect.objectContaining({
+        token: undefined,
+      })
+    );
+    expect(getFullDashboardData).toHaveBeenNthCalledWith(
+      2,
+      'defunkt',
+      expect.objectContaining({
+        token: undefined,
+      })
+    );
   });
 
   it('returns 404 Not Found when a user does not exist on GitHub', async () => {
@@ -88,7 +100,7 @@ describe('ApiCompareRoute Tests', () => {
   it('returns 502 Bad Gateway on unexpected upstream API failures', async () => {
     vi.mocked(getFullDashboardData).mockRejectedValueOnce(new Error('Unexpected network crash'));
 
-    const request = makeRequest({ user1: 'octocat', user2: 'defunkt' });
+    const request = makeRequest({ user1: 'octocat', user2: 'defunkt', token: 'sometoken' });
     const response = await GET(request);
 
     expect(response.status).toBe(502);

app/api/compare/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server';
 import { getFullDashboardData } from '@/lib/github';
+import { getUserGitHubToken } from '@/lib/githubtoken';
 import { compareParamsSchema } from '@/lib/validations';
 import crypto from 'crypto';
 
@@ -65,9 +66,10 @@ export async function GET(request: Request) {
   const { user1, user2 } = parseResult.data;
 
   try {
+    const userToken = await getUserGitHubToken();
     const [result1, result2] = await Promise.allSettled([
-      getFullDashboardData(user1),
-      getFullDashboardData(user2),
+      getFullDashboardData(user1, { token: userToken }),
+      getFullDashboardData(user2, { token: userToken }),
     ]);
 
     if (result1.status === 'rejected') {