vynte-infra/calendar
2
0
Fork 0
Code Issues Pull Requests Actions 1.9k Packages Projects Releases Wiki Activity

fix: update wrong oauth tests and parseRequestData util (#19958)

Browse Source 
* update oauth tests

* fix parseRequestData

* add logging

* add fallback

* use ??

* updates

* use parseUrlFormData in saml/callback

* update tests

* fix

* remove log

* update

* any -> unknown

* use HttpErrors

* addressed

* unknown -> any
This commit is contained in:
Benny Joo
2025-03-11 14:01:48 +00:00
committed by GitHub
parent dc3c7b43bf
commit e3e624464d
4 changed files with 80 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/web/app/api/auth/oauth/refreshToken/route.ts
+2 -2
View File
@@ -1,4 +1,4 @@
import { parseRequestData } from "app/api/parseRequestData";
import { parseUrlFormData } from "app/api/parseRequestData";
import jwt from "jsonwebtoken";
import { NextResponse } from "next/server";
import type { NextRequest } from "next/server";
@@ -8,7 +8,7 @@ import { generateSecret } from "@calcom/trpc/server/routers/viewer/oAuth/addClie
import type { OAuthTokenPayload } from "@calcom/types/oauth";
export async function POST(req: NextRequest) {
const { client_id, client_secret, grant_type } = await parseRequestData(req);
const { client_id, client_secret, grant_type } = await parseUrlFormData(req);
if (!client_id || !client_secret) {
return NextResponse.json({ message: "Missing client id or secret" }, { status: 400 });
apps/web/app/api/auth/oauth/token/route.ts
+2 -3
View File
@@ -1,4 +1,4 @@
import { parseRequestData } from "app/api/parseRequestData";
import { parseUrlFormData } from "app/api/parseRequestData";
import jwt from "jsonwebtoken";
import { NextResponse } from "next/server";
import type { NextRequest } from "next/server";
@@ -8,8 +8,7 @@ import { generateSecret } from "@calcom/trpc/server/routers/viewer/oAuth/addClie
import type { OAuthTokenPayload } from "@calcom/types/oauth";
export async function POST(req: NextRequest) {
const { code, client_id, client_secret, grant_type, redirect_uri } = await parseRequestData(req);
const { code, client_id, client_secret, grant_type, redirect_uri } = await parseUrlFormData(req);
if (grant_type !== "authorization_code") {
return NextResponse.json({ message: "grant_type invalid" }, { status: 400 });
}
apps/web/app/api/parseRequestData.ts
+46 -14
View File
@@ -1,19 +1,51 @@
import type { NextRequest } from "next/server";
export async function parseRequestData(req: NextRequest): Promise<Record<string, any>> {
try {
return await req.json();
} catch (error) {
const contentType = req.headers.get("content-type") || "";
// Handle form data requests
if (
contentType.includes("application/x-www-form-urlencoded") ||
contentType.includes("multipart/form-data")
) {
const formData = await req.formData();
return Object.fromEntries(formData.entries());
}
import { HttpError } from "@calcom/lib/http-error";
import logger from "@calcom/lib/logger";
throw new Error(`Unsupported content type: ${contentType}`);
const log = logger.getSubLogger({ prefix: ["[parseRequestData]"] });
export async function parseUrlFormData(req: NextRequest): Promise<Record<string, any>> {
try {
// Read raw text body (because Next.js does NOT parse x-www-form-urlencoded automatically)
const rawBody = await req.text();
const params = new URLSearchParams(rawBody);
return Object.fromEntries(params);
} catch (e) {
log.error(`Invalid Url Form Data: ${e} from path ${req.nextUrl}`);
throw new HttpError({ statusCode: 400, message: "Bad Request (Invalid Url Form Data)" });
}
}
export async function parseMultiFormData(req: NextRequest): Promise<Record<string, any>> {
try {
const formData = await req.formData();
return Object.fromEntries(formData.entries());
} catch (e) {
log.error(`Invalid Multi Form Data: ${e} from path ${req.nextUrl}`);
throw new HttpError({ statusCode: 400, message: "Bad Request (Invalid Multi Form Data)" });
}
}
export async function parseRequestData(req: NextRequest): Promise<Record<string, any>> {
const contentType = req.headers.get("content-type") ?? "application/json";
if (contentType.includes("application/json")) {
try {
return await req.json();
} catch (e) {
log.error(`Invalid JSON: ${e} from path ${req.nextUrl}`);
throw new HttpError({ statusCode: 400, message: "Bad Request (Invalid JSON)" });
}
}
if (contentType.includes("application/x-www-form-urlencoded")) {
return await parseUrlFormData(req);
}
if (contentType.includes("multipart/form-data")) {
return await parseMultiFormData(req);
}
log.error(`Unsupported content type: ${contentType} from path ${req.nextUrl}`);
throw new HttpError({ statusCode: 415, message: `Unsupported Content-Type. Expected ${contentType}` });
}
apps/web/playwright/oauth-provider.e2e.ts
+30 -30
View File
@@ -43,17 +43,17 @@ test.describe("OAuth Provider", () => {
const code = url.searchParams.get("code");
// request token with authorization code
const tokenForm = new URLSearchParams();
tokenForm.append("code", code ?? "");
tokenForm.append("client_id", client.clientId);
tokenForm.append("client_secret", client.orginalSecret);
tokenForm.append("grant_type", "authorization_code");
tokenForm.append("redirect_uri", client.redirectUri);
const tokenResponse = await fetch(`${WEBAPP_URL}/api/auth/oauth/token`, {
body: JSON.stringify({
code,
client_id: client.clientId,
client_secret: client.orginalSecret,
grant_type: "authorization_code",
redirect_uri: client.redirectUri,
}),
body: tokenForm.toString(),
method: "POST",
headers: {
"Content-Type": "application/json",
"Content-Type": "application/x-www-form-urlencoded",
},
});
@@ -74,16 +74,16 @@ test.describe("OAuth Provider", () => {
expect(meData.username.startsWith("test user")).toBe(true);
// request new token with refresh token
const refreshTokenForm = new URLSearchParams();
refreshTokenForm.append("refresh_token", tokenData.refresh_token);
refreshTokenForm.append("client_id", client.clientId);
refreshTokenForm.append("client_secret", client.orginalSecret);
refreshTokenForm.append("grant_type", "refresh_token");
const refreshTokenResponse = await fetch(`${WEBAPP_URL}/api/auth/oauth/refreshToken`, {
body: JSON.stringify({
refresh_token: tokenData.refresh_token,
client_id: client.clientId,
client_secret: client.orginalSecret,
grant_type: "refresh_token",
}),
body: refreshTokenForm.toString(),
method: "POST",
headers: {
"Content-Type": "application/json",
"Content-Type": "application/x-www-form-urlencoded",
},
});
@@ -126,17 +126,17 @@ test.describe("OAuth Provider", () => {
const code = url.searchParams.get("code");
// request token with authorization code
const tokenForm = new URLSearchParams();
tokenForm.append("code", code ?? "");
tokenForm.append("client_id", client.clientId);
tokenForm.append("client_secret", client.orginalSecret);
tokenForm.append("grant_type", "authorization_code");
tokenForm.append("redirect_uri", client.redirectUri);
const tokenResponse = await fetch(`${WEBAPP_URL}/api/auth/oauth/token`, {
body: JSON.stringify({
code,
client_id: client.clientId,
client_secret: client.orginalSecret,
grant_type: "authorization_code",
redirect_uri: client.redirectUri,
}),
body: tokenForm.toString(),
method: "POST",
headers: {
"Content-Type": "application/json",
"Content-Type": "application/x-www-form-urlencoded",
},
});
@@ -157,16 +157,16 @@ test.describe("OAuth Provider", () => {
expect(meData.username).toEqual(`user-id-${user.id}'s Team`);
// request new token with refresh token
const refreshTokenForm = new URLSearchParams();
refreshTokenForm.append("refresh_token", tokenData.refresh_token);
refreshTokenForm.append("client_id", client.clientId);
refreshTokenForm.append("client_secret", client.orginalSecret);
refreshTokenForm.append("grant_type", "refresh_token");
const refreshTokenResponse = await fetch(`${WEBAPP_URL}/api/auth/oauth/refreshToken`, {
body: JSON.stringify({
refresh_token: tokenData.refresh_token,
client_id: client.clientId,
client_secret: client.orginalSecret,
grant_type: "refresh_token",
}),
body: refreshTokenForm.toString(),
method: "POST",
headers: {
"Content-Type": "application/json",
"Content-Type": "application/x-www-form-urlencoded",
},
});