fix(oauth): isolate follow token from auth token to prevent scope overwrite

[Ridanshi]

Problem

The GitHub login flow and GitHub connect/follow flow both persisted OAuth tokens into the same OAuthToken record keyed by:

(userId, 'github')

despite requiring different permission scopes.

Login flow (auth.ts)

Stored tokens with:

read:user user:email

Connect flow (connect.ts)

Stored tokens with:

user:follow

Because both flows used Prisma upsert on the same (userId, platform) key, whichever flow executed last silently overwrote the previous token.

In practice:

• reconnecting GitHub follow destroyed login-scoped tokens,
• re-authentication destroyed follow-scoped tokens,
• and users silently lost GitHub follow capability after logging in again.

---

Root Cause

OAuthToken is uniquely keyed by:

@@unique([userId, platform])

Both flows persisted tokens using:

platform = 'github'

This created a deterministic overwrite lifecycle where:

• auth tokens and follow tokens competed for the same record,
• OAuth scope ownership became ambiguous,
• and follow functionality broke later during GitHub API calls.

The issue was difficult to diagnose because:

• authentication continued succeeding,
• token persistence succeeded,
• failures only surfaced later during follow operations.

---

Fix

Implemented deterministic scope-safe token isolation.

Scope Handling Strategy

The authentication flow and follow-capable flow now use separate platform keys:

Flow	Platform Key	Scope
Login (auth.ts)	github	read:user user:email
Connect (connect.ts)	github_follow	user:follow

This completely prevents cross-flow token overwrites.

No schema migration was required because:

• platform is already a free-form string,
• and the existing unique constraint naturally supports separate capability-specific records.

---

Changes

apps/backend/src/routes/connect.ts

• introduced:

  GITHUB_FOLLOW_PLATFORM = 'github_follow'

• follow-capable tokens now persist using:

  platform = 'github_follow'

• updated all related upsert logic to use the dedicated follow token key

apps/backend/src/routes/follow.ts

• GitHub follow token lookups now resolve:

  github -> github_follow

• non-GitHub platforms remain unchanged
• existing follow behavior preserved

apps/backend/src/routes/auth.ts

• no changes required
• authentication flow continues using:

  platform = 'github'

---

Backward Compatibility

• Existing authentication tokens remain fully valid
• No data migration required
• No existing records are deleted or modified
• Users with older overwritten follow tokens may reconnect GitHub once to repopulate the dedicated follow token record

The updated structure also creates a clean pattern for future scope-specific OAuth integrations:

{platform}_{purpose}

---

Tests

Added comprehensive regression coverage in:

apps/backend/src/__tests__/oauth-scope.test.ts

Coverage includes:

• GitHub connect token persistence
• isolation between auth and follow tokens
• repeated login cycles
• repeated reconnect cycles
• follow capability preservation after re-authentication
• encrypted token persistence
• GitHub follow lookup behavior
• backward compatibility behavior
• non-GitHub platform handling
• missing follow token behavior

---

Result

• Follow-capable GitHub tokens are no longer overwritten by login flows
• OAuth scope ownership is now explicit and deterministic
• Re-authentication no longer removes follow capability
• Existing authentication behavior remains unchanged
• Future OAuth scope expansion is now safer and easier to maintain

Fixes #225

[ShantKhatri]

@Ridanshi Allow some time to review this PR.