Files
calendar/apps/web/modules/settings/developer/oauth-clients-view.tsx
T
+1
Peer RichelsenGitHublauris@cal.com <lauris@cal.com>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>eunjae@cal.com <hey@eunjae.dev>Lauris Skraucissupalarrycubic-dev-ai[bot] <1082092+cubic-dev-ai[bot]@users.noreply.github.com>CarinaWollilauris@cal.com <lauris@cal.com>Morgan
a03722fd7f feat: add OAuth client developer settings page with approval workflow (#25556)
* feat: add OAuth client developer settings page with approval workflow

- Add new developer OAuth page at /settings/developer/oAuth for users to submit OAuth client requests
- Transform admin OAuth page into management dashboard for reviewing/approving submissions
- Add OAuthClientApprovalStatus enum (PENDING, APPROVED, REJECTED) to track submission status
- Add userId and createdAt fields to OAuthClient model for tracking submissions
- Create email notifications for admin (new submission) and user (approval)
- Add sidebar navigation link in developer section below API keys
- Add comprehensive translations for new UI strings
- Create OAuthClientRepository for data access following repository pattern

Co-Authored-By: peer@cal.com <peer@cal.com>

* fix: re-export generateSecret for backward compatibility

Co-Authored-By: peer@cal.com <peer@cal.com>

* feat: make logo mandatory and list items clickable for OAuth clients

Co-Authored-By: peer@cal.com <peer@cal.com>

* fix: add missing translation keys and remove client secret from details dialog

Co-Authored-By: peer@cal.com <peer@cal.com>

* fix: address cubic AI reviewer comments

- Remove duplicate 'there' JSON key in common.json
- Add select clause to findByUserId to avoid exposing clientSecret
- Add @@index([userId]) to OAuthClient model for query performance
- Update migration to include the index

Co-Authored-By: peer@cal.com <peer@cal.com>

* fix: address PR review comments - fix indentation and use useCopy hook

Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>

* fix: change react-dom/server import to fix Turbopack compatibility

Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>

* Revert "fix: change react-dom/server import to fix Turbopack compatibility"

This reverts commit c3e0b709c2d88fd221143cb4ce9cd25bb8c94277.

* fix: use email service pattern for OAuth client notifications

Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>

* fix: add try-catch around email sending to handle Turbopack react-dom/server issue

Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>

* Revert "fix: add try-catch around email sending to handle Turbopack react-dom/server issue"

This reverts commit fc9d47cd773505ebc5ee2696718aad4a8a98be77.

* fix: improve OAuth client UI with skeleton loaders and smaller dialog styling

- Replace 'Loading...' text with proper skeleton loaders in both developer and admin OAuth client views
- Make client_id and copy button smaller in dialogs using size='sm' and text-sm styling
- Add 'client_id' translation key to common.json for proper i18n

Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>

* fix: improve skeleton loader to match actual OAuth client list structure

- Remove divide-y from container and use conditional border-b on rows
- Match the exact structure from oauth-clients-view.tsx L126-160
- Use proper spacing for text elements (mt-1 instead of space-y-2)

Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>

* fix skeleton

* rename the selected oauth client dialog

* fix: address PR feedback - admin auth, dropdown styling, sidebar label

- Add defense-in-depth admin authorization check in updateClientStatus handler
- Fix broken dropdown menu by using DropdownItem with StartIcon prop
- Fix sidebar menu label from 'oAuth' to 'oauth_clients' to match developer view

Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>

* update common.json

* feat: show client secret in approval email for confidential OAuth clients

- Add regenerateSecret method to OAuthClientRepository
- Regenerate secret when admin approves a PENDING confidential client
- Include client secret in approval notification email
- Add one-time warning message about storing the secret securely
- Only regenerate on first approval (not re-approvals)

Co-Authored-By: eunjae@cal.com <hey@eunjae.dev>

* feat: add Website URL field, fix logo styling, show client secret after approval

- Add Website URL field to OAuth client forms (admin and developer views)
- Fix Upload Logo section styling by wrapping in Label div with proper gap
- Display client secret in dialog after admin approves a confidential OAuth client
- Add websiteUrl field to Prisma schema with migration
- Update tRPC handlers and repository to support websiteUrl
- Add translation keys for new UI elements

Co-Authored-By: peer@cal.com <peer@cal.com>

* fix: move clientSecret variable declaration outside if block for proper scoping

Co-Authored-By: peer@cal.com <peer@cal.com>

* refactor: dont expose client secret in emails

* refactor: dont regenerate secret upon status change

* refactor: reuse existing hash function

* refactor: rename admin/oAuth to admin/oauth page

* refactor: deduplicate oauth repositories

* refactor: remove withGlobalPrisma from oauth repository

* refactor: developer oauth page

* refactor: oauth status by default accepted

* refactor: request oauth status when creating

* refactor ux

* fix: address Cubic AI code review feedback

- Add purpose field to plain text email body for accessibility
- Convert NewOAuthClientButton to inline JSX to avoid React anti-pattern
- Trigger re-approval when redirectUri changes for security
- Add e.preventDefault() for Space key to prevent page scroll
- Change default approvalStatus to PENDING for defense-in-depth
- Use oauth_clients translation key for consistency
- Add meaningful alt text to Avatar for accessibility
- Remove onClick from DialogClose to prevent double-run close effects
- Return NOT_FOUND for non-owner delete to prevent resource enumeration

Co-Authored-By: unknown <>

* common.json file

* refactor: delete all prisma migrations

* refactor: have just 1 prisma migration

* revert: some devin changes

* fix: typecheck

* test: owner OAuth crud

* test: admin OAuth approval / rejection

* fix: address Cubic AI review feedback (confidence 9/10 issues)

- schema.prisma: Remove @default("") from purpose field to make it required
- schema.prisma: Use UTC-aware timezone expression for createdAt default
- OAuthClientFormFields.tsx: Localize redirect URI placeholder using t()
- common.json: Add redirect_uri_placeholder translation key

Co-Authored-By: unknown <>

* cubic changes

* refactor: dont log sensitive info and rethrow error

* cubic feedback

* refactor: make oauth client purpose optional

* refactor: admin/oauth not allowed if not logged in

* refactor: admin view skeleton

* refactor: rename state

* refactor: get rid of redundant mapping

* refactor: remove redundant handler

* refactor: remove redundant handler

* refactor: re-usable new oauth client button

* refactor: dialogs

* refactor: modals

* refactor: handler names, dialog, skeleton

* fix: purpose being null

* refactor: rename handler and delete old oauth admin page

* fix: purpose in submission

* refactor: handler names

* refactor: rename

* refactor: update handler

* refactor: rename approvalStatus -> status

* refactor: simplify modal

* refactor: name

* dont require repproval if redirectUri changes

* fix: remove integration sync index creation

* refactor: require re-approval if redirectUri updated

* fix: flaky e2e test

* fix: flaky e2e test

* fix: flaky e2e test

* fix: remove duplicate common.json keys

* refactor: replace team@cal.com with SUPPORT_MAIL_ADDRESS

* refactor: generate client secret on handler level

* fix: authorization code only available to approved clients

* refactor: cubic review dont display exclamation

* refactor: cubic review website_url in common json

* fix: dont default in ui to approved status

* refactor: optiona logo in schema create handler

* fix: tests

* fix: tests

* fix: /authorize redirect if client not approved or show error

* test: authorize page with invalid client id

* refactor: dont allow refreshing tokens unless approved client

* fix: flaky e2e test

* fix: flaky e2e test

* fix: flaky e2e test

* fix: flaky e2e test

* fix: flaky e2e test

* fix: flaky e2e test

* chore: warn that pending client is not usable

* fix: approve and reject buttons

* fix: /authorize show error if client not approved

* refactor: info message about editing oauth client and status

* change info alert to warning

* try to fix ci test

* debug: failing e2e test

* fix: improve session propagation in oauth-client-admin E2E test

- Add navigateToAdminOAuthPage helper that waits for listClients API call
- If the API call doesn't arrive (session issue), reload page to force session refresh
- This fixes the CI flakiness where admin page wasn't loading due to session not having ADMIN role

Co-Authored-By: lauris@cal.com <lauris@cal.com>

* fix: register waitForResponse before navigating in E2E test

- Register the listClients waitForResponse promise BEFORE page.goto()
- This ensures the response isn't missed during page load
- Also register the promise before reload in the catch block

Co-Authored-By: lauris@cal.com <lauris@cal.com>

* fix: rename oAuth folder to oauth for case-sensitive filesystems

The admin OAuth page route was at /settings/admin/oAuth (capital A) but the
code references /settings/admin/oauth (lowercase). This caused 404 errors
on case-sensitive filesystems (Linux).

Also improved the E2E test navigation helper to retry with delays if the
admin page doesn't load immediately, handling session propagation timing.

Co-Authored-By: lauris@cal.com <lauris@cal.com>

* test style

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: eunjae@cal.com <hey@eunjae.dev>
Co-authored-by: Lauris Skraucis <lauris.skraucis@gmail.com>
Co-authored-by: supalarry <laurisskraucis@gmail.com>
Co-authored-by: cubic-dev-ai[bot] <1082092+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: CarinaWolli <wollencarina@gmail.com>
Co-authored-by: lauris@cal.com <lauris@cal.com>
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
2026-01-21 12:23:51 -03:00

184 lines
6.0 KiB
TypeScript

"use client";
import { useState } from "react";
import { useLocale } from "@calcom/lib/hooks/useLocale";
import { trpc } from "@calcom/trpc/react";
import { EmptyScreen } from "@calcom/ui/components/empty-screen";
import { showToast } from "@calcom/ui/components/toast";
import SettingsHeader from "@calcom/features/settings/appDir/SettingsHeader";
import type { OAuthClientCreateFormValues } from "../oauth/create/OAuthClientCreateModal";
import { OAuthClientCreateDialog } from "../oauth/create/OAuthClientCreateModal";
import { OAuthClientPreviewDialog } from "../oauth/create/OAuthClientPreviewDialog";
import { OAuthClientDetailsDialog, type OAuthClientDetails } from "../oauth/view/OAuthClientDetailsDialog";
import { OAuthClientsList } from "../oauth/OAuthClientsList";
import { NewOAuthClientButton } from "../oauth/create/NewOAuthClientButton";
import { OAuthClientsSkeleton } from "./oauth-clients-skeleton";
const OAuthClientsView = () => {
const { t } = useLocale();
const utils = trpc.useUtils();
const [isCreatingClient, setIsCreatingClient] = useState(false);
const [submittedClient, setSubmittedClient] = useState<OAuthClientDetails | null>(null);
const [selectedClient, setSelectedClient] = useState<OAuthClientDetails | null>(null);
const { data: oAuthClients, isLoading } = trpc.viewer.oAuth.listUserClients.useQuery();
const submitForReviewMutation = trpc.viewer.oAuth.submitClientForReview.useMutation({
onSuccess: async (data) => {
setSubmittedClient({
clientId: data.clientId,
name: data.name,
purpose: data.purpose ?? "",
clientSecret: data.clientSecret,
status: data.status,
isPkceEnabled: data.isPkceEnabled,
});
showToast(t("oauth_client_submitted"), "success");
utils.viewer.oAuth.listUserClients.invalidate();
},
onError: (error) => {
showToast(`${t("oauth_client_submit_error")}: ${error.message}`, "error");
},
});
const deleteClientMutation = trpc.viewer.oAuth.deleteClient.useMutation({
onSuccess: async () => {
showToast(t("oauth_client_deletion_message"), "success");
setSelectedClient(null);
utils.viewer.oAuth.listUserClients.invalidate();
},
onError: (error) => {
showToast(error.message || t("error"), "error");
},
});
const updateClientMutation = trpc.viewer.oAuth.updateClient.useMutation({
onSuccess: async (data) => {
showToast(t("oauth_client_updated_successfully"), "success");
setSelectedClient((prev) => {
if (!prev) return prev;
if (prev.clientId !== data.clientId) return prev;
return {
...prev,
name: data.name,
purpose: data.purpose,
redirectUri: data.redirectUri,
websiteUrl: data.websiteUrl,
logo: data.logo,
status: data.status,
rejectionReason: data.rejectionReason,
};
});
utils.viewer.oAuth.listUserClients.invalidate();
},
onError: (error) => {
showToast(`${t("updating_oauth_client_error")}: ${error.message}`, "error");
},
});
const handleSubmit = (values: OAuthClientCreateFormValues) => {
submitForReviewMutation.mutate({
name: values.name,
purpose: values.purpose,
redirectUri: values.redirectUri,
websiteUrl: values.websiteUrl,
logo: values.logo,
enablePkce: values.enablePkce,
});
};
const handleCloseCreateDialog = () => {
setIsCreatingClient(false);
setSubmittedClient(null);
};
const handleCloseDetailsDialog = () => {
setSelectedClient(null);
};
if (isLoading) {
return <OAuthClientsSkeleton />;
}
const newOAuthClientButton = (
<NewOAuthClientButton dataTestId="open-oauth-client-create-dialog" onClick={() => setIsCreatingClient(true)} />
);
return (
<SettingsHeader
title={t("oauth_clients")}
description={t("oauth_clients_description")}
CTA={newOAuthClientButton}>
{oAuthClients && oAuthClients.length > 0 ? (
<OAuthClientsList
clients={oAuthClients.map((client) => ({
clientId: client.clientId,
name: client.name,
purpose: client.purpose,
redirectUri: client.redirectUri,
websiteUrl: client.websiteUrl,
logo: client.logo,
status: client.status,
rejectionReason: client.rejectionReason,
clientType: client.clientType,
}))}
onSelectClient={(client) => setSelectedClient(client)}
/>
) : (
<EmptyScreen
Icon="key"
headline={t("no_oauth_clients")}
description={t("no_oauth_clients_description")}
buttonRaw={newOAuthClientButton}
/>
)}
{submittedClient ? (
<OAuthClientPreviewDialog
open={isCreatingClient}
onOpenChange={setIsCreatingClient}
title={t("oauth_client_submitted")}
description={t("oauth_client_submitted_description")}
client={submittedClient}
onClose={handleCloseCreateDialog}
/>
) : (
<OAuthClientCreateDialog
open={isCreatingClient}
onOpenChange={setIsCreatingClient}
isSubmitting={submitForReviewMutation.isPending}
onSubmit={handleSubmit}
onClose={handleCloseCreateDialog}
/>
)}
<OAuthClientDetailsDialog
open={Boolean(selectedClient)}
onOpenChange={(open) => !open && handleCloseDetailsDialog()}
client={selectedClient}
onUpdate={(values) => {
updateClientMutation.mutate({
clientId: values.clientId,
name: values.name,
purpose: values.purpose,
redirectUri: values.redirectUri,
websiteUrl: values.websiteUrl,
logo: values.logo,
});
}}
onDelete={(clientId) => {
deleteClientMutation.mutate({ clientId });
}}
isUpdatePending={updateClientMutation.isPending}
isDeletePending={deleteClientMutation.isPending}
/>
</SettingsHeader>
);
};
export default OAuthClientsView;