From 1bd5d552c15d4aa1f72f447d276db5459554a83e Mon Sep 17 00:00:00 2001
From: Adarsh <79656108+StealthIQ@users.noreply.github.com>
Date: Sat, 21 Feb 2026 15:30:37 +0530
Subject: [PATCH] fix: extract email from id_token for Codex OAuth to allow
 multiple accounts (#97)

- Parse JWT id_token to extract email in mapTokens function
- Allows database to distinguish between different Codex accounts
- Fixes issue where adding 3rd+ Codex account would update existing connection instead of creating new one
---
 src/lib/oauth/providers/codex.ts | 26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/src/lib/oauth/providers/codex.ts b/src/lib/oauth/providers/codex.ts
index ba37fe2152..d856bf9895 100644
--- a/src/lib/oauth/providers/codex.ts
+++ b/src/lib/oauth/providers/codex.ts
@@ -44,10 +44,24 @@ export const codex = {
 
     return await response.json();
   },
-  mapTokens: (tokens) => ({
-    accessToken: tokens.access_token,
-    refreshToken: tokens.refresh_token,
-    idToken: tokens.id_token,
-    expiresIn: tokens.expires_in,
-  }),
+  mapTokens: (tokens) => {
+    // Extract email from id_token JWT to distinguish between accounts
+    let email = null;
+    if (tokens.id_token) {
+      try {
+        const payload = tokens.id_token.split(".")[1];
+        const decoded = JSON.parse(Buffer.from(payload, "base64").toString());
+        email = decoded.email || null;
+      } catch {
+        // Ignore JWT parsing errors
+      }
+    }
+    return {
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token,
+      idToken: tokens.id_token,
+      expiresIn: tokens.expires_in,
+      email,
+    };
+  },
 };