[bug] connect.ts uses randomBytes without importing it, and parseGoogleState is misnamed for a GitHub-only flow

[MehtabSandhu11]

Description

There are two bugs in apps/backend/src/routes/connect.ts that are currently
present in the codebase:

Bug 1 — randomBytes is used but never imported (runtime crash)

At the bottom of the file, generateState() calls randomBytes:

function generateState(): string {
  return randomBytes(32).toString('hex');
}

However, the top of the file only imports from fastify:

import type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';

There is no import { randomBytes } from 'crypto'. This means any request
to GET /connect/github will throw a ReferenceError: randomBytes is not defined
at runtime and crash the connect flow entirely.

Bug 2 — parseGoogleState is used in the GitHub connect callback

The helper function used to decode the OAuth state in the GitHub callback is
named parseGoogleState, but it is exclusively used in the GitHub OAuth flow —
Google connect does not exist in this file at all:

const decodedState = parseGoogleState(state); // called inside /github/callback

This is misleading to any developer reading or maintaining this code and could
cause confusion about which flow the function belongs to.

Expected Behaviour

• GET /connect/github should generate a valid state without crashing.
• The state-parsing helper should be named accurately to reflect its use in the
  GitHub connect flow (e.g. parseOAuthState or parseConnectState).

Proposed Fix

Bug 1 — Add the missing import at the top of the file:

import { randomBytes } from 'crypto';

Bug 2 — Rename parseGoogleState to parseOAuthState (or parseConnectState)
and update the single call site in /github/callback to match.

Files to Touch

• apps/backend/src/routes/connect.ts

[MehtabSandhu11]

@Harxhit Please assign this issue to me in accordance with your policy

[Midoriya-w]

Hey @Harxhit! I'd love to work on this under GSSoC 2026.
Both fixes are clear:

Add import { randomBytes } from 'crypto'; at the top of connect.ts
Rename parseGoogleState → parseOAuthState and update the single call site in /github/callback

Only apps/backend/src/routes/connect.ts will be touched. Can I get assigned?

[Harxhit]

@MehtabSandhu11 I have assigned this issue to you.