Fix Auth Backend, Vercel Routing, and CORS

[Kaushal-15]

Fixed critical production issues where auth routes were returning 404/500 and HTML responses.

1. vercel.json: Added routing for /auth to backend and SPA catch-all.
2. server.js: Enhanced CORS to allow localhost ports and Vercel app domains.
3. passport-config.js: Removed hardcoded port 5000, now uses GOOGLE_CALLBACK_URL or dynamic port.
4. routes/auth.js: check-username now accepts name or username and explicitly sets content-type to JSON to prevent HTML leakage.

---

PR created automatically by Jules for task 13648496639504608932 started by @Kaushal-15

Summary by CodeRabbit

Release Notes

• Bug Fixes

  • OAuth callback URL now dynamically adapts to environment configuration

• New Features

  • Added environment-driven CORS and frontend URL configuration
  • Extended username parameter handling from multiple sources
  • Standardized JSON response headers for API consistency
  • Enhanced authentication routing setup

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
learning-ai	Ready	Preview, Comment	Feb 4, 2026 4:05pm

[coderabbitai]

📝 Walkthrough

Walkthrough

The changes modernize backend configuration by introducing environment-driven defaults for Google OAuth callback URLs and CORS origins, extending username parameter sources in authentication routes, and adjusting Vercel routing to properly proxy authentication requests and serve the frontend index file.

Changes

Cohort / File(s)	Summary
OAuth & CORS Configuration app/Backend/config/passport-config.js, app/Backend/server.js	Replaced hardcoded callback/origin URLs with dynamic environment-aware defaults. Passport now computes Google OAuth callback from PORT variable; server implements custom CORS origin callback supporting localhost, .vercel.app domains, and FRONTEND_URL environment variable.
Authentication Route Handler app/Backend/routes/auth.js	Extended username extraction to check req.query.name and req.body.name alongside existing username parameter sources. Added explicit application/json Content-Type header to checkUsernameHandler response.
Deployment Routing vercel.json	Added auth route proxy ("/auth/(.*)" → /app/Backend/server.js), inserted filesystem handler route, and added catch-all route to serve frontend index.html for unmatched paths.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🐰✨ Hop! The backend now bends to the wind,
With ports and origins set to spin,
OAuth flows dynamic and Vercel routes neat,
A deployment symphony, oh how sweet! 🎭

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Fix Auth Backend, Vercel Routing, and CORS' directly addresses the main changes: authentication backend improvements, Vercel routing configuration, and CORS enhancement across multiple files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix-auth-backend-vercel-13648496639504608932

Important

Action Needed: IP Allowlist Update

If your organization protects your Git platform with IP whitelisting, please add the new CodeRabbit IP address to your allowlist:

• ✨ 136.113.208.247/32 (new)
• 34.170.211.100/32
• 35.222.179.152/32

Reviews will stop working after February 8, 2026 if the new IP is not added to your allowlist.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@app/Backend/server.js`:
- Around line 82-84: Normalize the FRONTEND_URL before pushing into
allowedOrigins to avoid trailing-slash mismatches: read
process.env.FRONTEND_URL, trim surrounding whitespace and remove any trailing
slashes (e.g. using a regexp like .replace(/\/+$/, '')), then push the
normalized value into allowedOrigins instead of the raw value; update the code
around the allowedOrigins push that references process.env.FRONTEND_URL to use
this normalized variable.

🧹 Nitpick comments (1)

app/Backend/server.js (1)

92-103: Consider tightening the .vercel.app wildcard in production.

Allowing any *.vercel.app origin is broader than necessary and weakens the CORS boundary. Prefer an explicit allowlist (e.g., env-driven list of known preview/prod domains) to reduce exposure.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Normalize FRONTEND_URL to avoid trailing-slash mismatches.

If FRONTEND_URL ends with /, origin comparisons will fail in production. Consider trimming.

💡 Proposed fix

 if (process.env.FRONTEND_URL) {
-  allowedOrigins.push(process.env.FRONTEND_URL);
+  allowedOrigins.push(process.env.FRONTEND_URL.replace(/\/$/, ''));
 }

🤖 Prompt for AI Agents

In `@app/Backend/server.js` around lines 82 - 84, Normalize the FRONTEND_URL
before pushing into allowedOrigins to avoid trailing-slash mismatches: read
process.env.FRONTEND_URL, trim surrounding whitespace and remove any trailing
slashes (e.g. using a regexp like .replace(/\/+$/, '')), then push the
normalized value into allowedOrigins instead of the raw value; update the code
around the allowedOrigins push that references process.env.FRONTEND_URL to use
this normalized variable.