mirror of
https://github.com/hanzoai/calendar.git
synced 2026-10-30 14:46:43 +00:00
c321a6c07a
* refactor: combine exchange and refresh into token endpoint * refactor: controller error handling * refactor: use snake_case * refactor: use snake_case * refactor: use snake case * refactor: token endpoint accepts application/x-www-form-urlencoded * refactor: token endpoint accepts application/x-www-form-urlencoded * refactor: flat token response data * refactor: error structure * refactor: client_id in the body * fix: address Cubic AI review feedback on OAuth2 endpoints - Fix getClient endpoint to use proper REST API error format instead of OAuth token error format (confidence 9/10) - Add missing space after comma in error format string in token.input.pipe.ts (confidence 9/10) - Support both camelCase and snake_case inputs in authorize endpoint for backward compatibility (confidence 10/10) - Restore legacy /exchange and /refresh endpoints alongside new /token endpoint for backward compatibility (confidence 10/10) - Add OAuth2TokensResponseDto for legacy endpoint wrapped responses - Add OAuth2LegacyExchangeInput and OAuth2LegacyRefreshInput for legacy endpoints Co-Authored-By: unknown <> * fix: address additional Cubic AI feedback on OAuth2 endpoints - Log errors when status code >= 500 in handleClientError (confidence 9/10) - Add Cache-Control: no-store and Pragma: no-cache headers to legacy /exchange and /refresh endpoints (confidence 9/10) Co-Authored-By: unknown <> * docs * Revert "fix: address additional Cubic AI feedback on OAuth2 endpoints" This reverts commit39cc4aa3eb. * Revert "fix: address Cubic AI review feedback on OAuth2 endpoints" This reverts commit97bf593186. * docs * fix: address Cubic AI review feedback on OAuth2 endpoints - Fix getClient to use handleClientError instead of handleTokenError (confidence 10) - Restore legacy /exchange and /refresh endpoints for backward compatibility (confidence 9) - Fix RFC 6749 error format: use human-readable messages in error_description (confidence 9) - Fix errorDescription in OAuthService to use OAUTH_ERROR_REASONS mapping (confidence 9) Co-Authored-By: unknown <> * fix: address additional Cubic AI feedback on OAuth2 endpoints - Fix security issue: Replace 'CALENDSO_ENCRYPTION_KEY is not set' with generic 'Internal server configuration error' message (confidence 10/10) - Fix backward compatibility: Create OAuth2LegacyTokensDto with camelCase properties for legacy /exchange and /refresh endpoints (confidence 9/10) - Skipped: RFC 6749 error field issue (confidence 8/10, below threshold) Co-Authored-By: unknown <> * e2e * Revert "fix: address additional Cubic AI feedback on OAuth2 endpoints" This reverts commita080e93f07. * Revert "fix: address Cubic AI review feedback on OAuth2 endpoints" This reverts commit04986a16c9. * fix: re-apply Cubic AI review feedback on OAuth2 endpoints - Restore OAuth2LegacyExchangeInput and OAuth2LegacyRefreshInput classes - Restore legacy /exchange and /refresh endpoints in OAuth2Controller - Restore OAuth2LegacyTokensDto and OAuth2TokensResponseDto classes - Restore OAUTH_ERROR_DESCRIPTIONS mapping in oauth2-error.service.ts - Restore OAUTH_ERROR_REASONS lookup in OAuthService.ts mapErrorToOAuthError - Fix encryption_key_missing error to not expose internal env var name Addresses Cubic AI feedback with confidence >= 9/10: - Comment 32 (9/10): Legacy endpoints and input classes - Comment 34 (9/10): Error description mapping in OAuthService - Comment 35 (10/10): OAUTH_ERROR_DESCRIPTIONS in error service Skipped (confidence < 9/10): - Comment 33 (8/10): getClient handleTokenError vs handleClientError Co-Authored-By: unknown <> * Revert "fix: re-apply Cubic AI review feedback on OAuth2 endpoints" This reverts commit416bef9c93. * delete unused file * fix: e2e tests * address cubic review * fix: address Cubic AI review feedback on OAuth2 exception filter - Fix header case sensitivity: use lowercase 'x-request-id' instead of 'X-Request-Id' since Express lowercases all request headers - Redact request body in error logs to prevent exposing sensitive OAuth2 credentials like client_secret, password, and refresh_token Co-Authored-By: unknown <> * docs: api v2 oauth controller docs * chore: remove authorize endpoint * feat: owner can test non accepted OAuth client * fix: remove sensitive data from OAuth2 exception logs Remove Authorization header and userEmail from error logs in OAuth2HttpExceptionFilter to avoid logging sensitive information. Addresses Cubic AI review feedback (confidence 9/10). Co-Authored-By: unknown <> * fix: e2e --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
232 lines
7.1 KiB
TypeScript
232 lines
7.1 KiB
TypeScript
import { randomBytes } from "node:crypto";
|
|
import { OAUTH_ERROR_REASONS } from "@calcom/features/oauth/services/OAuthService";
|
|
import type { PrismaClient } from "@calcom/prisma";
|
|
import { expect } from "@playwright/test";
|
|
import { test } from "../lib/fixtures";
|
|
|
|
test.describe("OAuth authorize - client approval status", () => {
|
|
test.afterEach(async ({ prisma, users }, testInfo) => {
|
|
const testPrefix = `e2e-oauth-authorize-status-${testInfo.testId}-`;
|
|
|
|
await prisma.oAuthClient.deleteMany({
|
|
where: {
|
|
name: {
|
|
startsWith: testPrefix,
|
|
},
|
|
},
|
|
});
|
|
|
|
await users.deleteAll();
|
|
});
|
|
|
|
async function createOAuthClient({
|
|
prisma,
|
|
name,
|
|
status,
|
|
userId,
|
|
}: {
|
|
prisma: PrismaClient;
|
|
name: string;
|
|
status: "PENDING" | "APPROVED" | "REJECTED";
|
|
userId?: number;
|
|
}) {
|
|
const clientId = randomBytes(32).toString("hex");
|
|
|
|
const client = await prisma.oAuthClient.create({
|
|
data: {
|
|
clientId,
|
|
name,
|
|
redirectUri: "https://example.com",
|
|
clientSecret: null,
|
|
clientType: "CONFIDENTIAL",
|
|
status,
|
|
...(userId && { user: { connect: { id: userId } } }),
|
|
},
|
|
});
|
|
|
|
return client;
|
|
}
|
|
|
|
test("PENDING client renders error on authorize page (no redirect)", async ({
|
|
page,
|
|
users,
|
|
prisma,
|
|
}, testInfo) => {
|
|
const user = await users.create({ username: "oauth-authorize-pending" });
|
|
await user.apiLogin();
|
|
|
|
const testPrefix = `e2e-oauth-authorize-status-${testInfo.testId}-`;
|
|
const client = await createOAuthClient({
|
|
prisma,
|
|
name: `${testPrefix}pending-${Date.now()}`,
|
|
status: "PENDING",
|
|
});
|
|
|
|
await page.goto(
|
|
`auth/oauth2/authorize?client_id=${client.clientId}&redirect_uri=${client.redirectUri}&state=1234`
|
|
);
|
|
|
|
await expect(page).not.toHaveURL(/^https:\/\/example\.com/);
|
|
|
|
await expect(page.getByText(OAUTH_ERROR_REASONS["client_not_approved"])).toBeVisible();
|
|
});
|
|
|
|
test("REJECTED client renders error on authorize page (no redirect)", async ({
|
|
page,
|
|
users,
|
|
prisma,
|
|
}, testInfo) => {
|
|
const user = await users.create({ username: "oauth-authorize-rejected" });
|
|
await user.apiLogin();
|
|
|
|
const testPrefix = `e2e-oauth-authorize-status-${testInfo.testId}-`;
|
|
const client = await createOAuthClient({
|
|
prisma,
|
|
name: `${testPrefix}rejected-${Date.now()}`,
|
|
status: "REJECTED",
|
|
});
|
|
|
|
await page.goto(
|
|
`auth/oauth2/authorize?client_id=${client.clientId}&redirect_uri=${client.redirectUri}&state=1234`
|
|
);
|
|
|
|
await expect(page).not.toHaveURL(/^https:\/\/example\.com/);
|
|
|
|
await expect(page.getByText(OAUTH_ERROR_REASONS["client_rejected"])).toBeVisible();
|
|
});
|
|
|
|
test("APPROVED client redirects to redirectUri with code", async ({ page, users, prisma }, testInfo) => {
|
|
const user = await users.create({ username: "oauth-authorize-approved" });
|
|
await user.apiLogin();
|
|
|
|
const testPrefix = `e2e-oauth-authorize-status-${testInfo.testId}-`;
|
|
const client = await createOAuthClient({
|
|
prisma,
|
|
name: `${testPrefix}approved-${Date.now()}`,
|
|
status: "APPROVED",
|
|
});
|
|
|
|
await page.goto(
|
|
`auth/oauth2/authorize?client_id=${client.clientId}&redirect_uri=${client.redirectUri}&state=1234`
|
|
);
|
|
|
|
await page.waitForSelector('[data-testid="allow-button"]');
|
|
await page.getByTestId("allow-button").click();
|
|
|
|
await page.waitForFunction(() => {
|
|
return window.location.href.startsWith("https://example.com");
|
|
});
|
|
|
|
await expect(page).toHaveURL(/^https:\/\/example\.com/);
|
|
|
|
const url = new URL(page.url());
|
|
expect(url.searchParams.get("code")).toBeTruthy();
|
|
expect(url.searchParams.get("state")).toBe("1234");
|
|
expect(url.searchParams.get("error")).toBeNull();
|
|
});
|
|
|
|
test("redirect_uri mismatch renders error on authorize page (no redirect)", async ({
|
|
page,
|
|
users,
|
|
prisma,
|
|
}, testInfo) => {
|
|
const user = await users.create({ username: "oauth-authorize-redirect-uri-mismatch" });
|
|
await user.apiLogin();
|
|
|
|
const testPrefix = `e2e-oauth-authorize-status-${testInfo.testId}-`;
|
|
const client = await createOAuthClient({
|
|
prisma,
|
|
name: `${testPrefix}mismatch-${Date.now()}`,
|
|
status: "APPROVED",
|
|
});
|
|
|
|
const mismatchedRedirectUri = "https://example.com/mismatch";
|
|
|
|
await page.goto(
|
|
`auth/oauth2/authorize?client_id=${client.clientId}&redirect_uri=${encodeURIComponent(
|
|
mismatchedRedirectUri
|
|
)}&state=1234`
|
|
);
|
|
|
|
await expect(page).toHaveURL(/\/auth\/oauth2\/authorize/);
|
|
await expect(page.getByText(OAUTH_ERROR_REASONS["redirect_uri_mismatch"])).toBeVisible();
|
|
});
|
|
|
|
test("invalid client_id renders error on authorize page (no redirect)", async ({ page, users }) => {
|
|
const user = await users.create({ username: "oauth-authorize-invalid-client" });
|
|
await user.apiLogin();
|
|
|
|
const invalidClientId = "invalid-client-id-" + Date.now();
|
|
const redirectUri = "https://example.com";
|
|
|
|
await page.goto(
|
|
`auth/oauth2/authorize?client_id=${invalidClientId}&redirect_uri=${encodeURIComponent(
|
|
redirectUri
|
|
)}&state=1234`
|
|
);
|
|
|
|
await expect(page).toHaveURL(/\/auth\/oauth2\/authorize/);
|
|
await expect(page.getByText(OAUTH_ERROR_REASONS["client_not_found"])).toBeVisible();
|
|
});
|
|
|
|
test("PENDING client owned by logged-in user allows authorization", async ({
|
|
page,
|
|
users,
|
|
prisma,
|
|
}, testInfo) => {
|
|
const user = await users.create({ username: "oauth-authorize-pending-owner" });
|
|
await user.apiLogin();
|
|
|
|
const testPrefix = `e2e-oauth-authorize-status-${testInfo.testId}-`;
|
|
const client = await createOAuthClient({
|
|
prisma,
|
|
name: `${testPrefix}pending-owner-${Date.now()}`,
|
|
status: "PENDING",
|
|
userId: user.id,
|
|
});
|
|
|
|
await page.goto(
|
|
`auth/oauth2/authorize?client_id=${client.clientId}&redirect_uri=${client.redirectUri}&state=1234`
|
|
);
|
|
|
|
await page.waitForSelector('[data-testid="allow-button"]');
|
|
await page.getByTestId("allow-button").click();
|
|
|
|
await page.waitForFunction(() => {
|
|
return window.location.href.startsWith("https://example.com");
|
|
});
|
|
|
|
await expect(page).toHaveURL(/^https:\/\/example\.com/);
|
|
|
|
const url = new URL(page.url());
|
|
expect(url.searchParams.get("code")).toBeTruthy();
|
|
expect(url.searchParams.get("state")).toBe("1234");
|
|
expect(url.searchParams.get("error")).toBeNull();
|
|
});
|
|
|
|
test("REJECTED client owned by logged-in user blocks authorization", async ({
|
|
page,
|
|
users,
|
|
prisma,
|
|
}, testInfo) => {
|
|
const user = await users.create({ username: "oauth-authorize-rejected-owner" });
|
|
await user.apiLogin();
|
|
|
|
const testPrefix = `e2e-oauth-authorize-status-${testInfo.testId}-`;
|
|
const client = await createOAuthClient({
|
|
prisma,
|
|
name: `${testPrefix}rejected-owner-${Date.now()}`,
|
|
status: "REJECTED",
|
|
userId: user.id,
|
|
});
|
|
|
|
await page.goto(
|
|
`auth/oauth2/authorize?client_id=${client.clientId}&redirect_uri=${client.redirectUri}&state=1234`
|
|
);
|
|
|
|
await expect(page).not.toHaveURL(/^https:\/\/example\.com/);
|
|
|
|
await expect(page.getByText(OAUTH_ERROR_REASONS["client_rejected"])).toBeVisible();
|
|
});
|
|
});
|