app/controllers/api/account.php (1)

1956-1965: Consider extracting the callback URL construction logic into a helper function.

This exact pattern for building a protocol-aware base URL with port handling is duplicated across multiple OAuth2 endpoints (lines 1294-1303, 1371-1378, 1407-1414, 1457-1465, 1990-1998). Extracting this into a helper function would improve maintainability and reduce the risk of inconsistencies.

Example refactor:

private function buildCallbackBase(Request $request): string {
    $protocol = System::getEnv('_APP_OPTIONS_FORCE_HTTPS') === 'disabled' ? 'http' : 'https';
    $port = $request->getPort();
    $callbackBase = $protocol . '://' . $request->getHostname();
    
    if ($protocol === 'https' && $port !== '443') {
        $callbackBase .= ':' . $port;
    } elseif ($protocol === 'http' && $port !== '80') {
        $callbackBase .= ':' . $port;
    }
    
    return $callbackBase;
}

Then use:

$callbackBase = $this->buildCallbackBase($request);
$callback = $callbackBase . '/v1/account/sessions/oauth2/callback/' . $provider . '/' . $project->getId();

Note: There's also an inconsistency at line 1991 where a similar check uses == instead of === for the FORCE_HTTPS comparison. Consider standardizing to === across the file.

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro