remove auth

[zhangjun]

This pull request removes all support for the legacy 21st.dev authentication system from both the main and renderer processes. The codebase is refactored to eliminate related authentication flows, UI gating, and analytics user identification, and to ensure all authentication-related IPC handlers are either removed or made into no-ops. The app now loads directly without requiring user authentication, and all code paths that previously checked for or enforced authentication have been removed or disabled.

Authentication system removal:

• Removed all code related to initializing, handling, and enforcing 21st.dev authentication in src/main/index.ts, including the handleAuthCode function, deep link handling for /auth, and the /auth/callback HTTP endpoint. The AuthManager is no longer auto-initialized, and the app no longer tracks user authentication state or sets authentication cookies. [1] [2] [3] [4]
• All authentication-related IPC handlers in src/main/windows/main.ts are now no-ops or return null/false, and the code for showing the login page or updating user info via IPC has been removed. [1] [2] [3]

App loading and UI changes:

• The main window now loads the app directly without checking authentication state or showing a login page. All gating logic and login page loading have been removed from the window creation flow. [1] [2] [3]

Analytics and user identification:

• Removed user identification and related analytics calls that depended on authentication, both in the main process and in the renderer (identify and setSubscriptionPlan calls). [1] [2] [3]

API and token handling:

• All IPC and main process code for retrieving and passing authentication tokens (e.g., for signed fetches) has been removed or disabled; API requests no longer include the X-Desktop-Token header. [1] [2] [3]

Codebase cleanup:

• Removed unused imports and code related to the legacy authentication system throughout the codebase, and updated module exports to reflect the removal of 21st.dev authentication. [1] [2]

Summary by CodeRabbit

• New Features

  • The app now opens directly to the main experience without requiring a login screen.
  • MCP OAuth callback links continue to be supported through the updated callback route.

• Bug Fixes

  • Simplified authentication and account handling across desktop app startup and window loading.
  • Network requests no longer depend on desktop authentication tokens.
  • Analytics initialization no longer identifies users based on saved account sessions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9512b038-569c-47f7-a7fb-20d90a93567a

📥 Commits

Reviewing files that changed from the base of the PR and between 9f1bc76 and f7cc65d.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• src/main/index.ts
• src/main/windows/main.ts
• src/renderer/App.tsx

---

📝 Walkthrough

Walkthrough

Authentication initialization, account-auth deep links, token signing, and login gating are removed. MCP callback handling remains, windows load the main renderer directly, and analytics no longer identifies users from saved sessions.

Changes

Authentication Flow Simplification

Layer / File(s)	Summary
Bootstrap and callback routing src/main/index.ts	Auth-manager bootstrapping and account-auth deep-link handling are removed; MCP callbacks remain, the callback route becomes /callback, and analytics starts without saved-session identification.
Main-process auth and window flow src/main/windows/main.ts	Auth IPC handlers are simplified or disabled, proxy requests no longer add X-Desktop-Token, login-page helpers are removed, and windows bypass the authentication gate.
Renderer analytics initialization src/renderer/App.tsx	User identification through the desktop API is removed while analytics initialization and opt-out synchronization remain.

Estimated code review effort: 4 (Complex) | ~45 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title correctly captures the primary change: removing authentication support.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch remove-auth

---

_{Comment @coderabbitai help to get the list of available commands.}