+1

![cubic-dev-ai[bot] <1082092+cubic-dev-ai[bot]@users.noreply.github.com>](/assets/img/avatar_default.png)



![Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>](/assets/img/avatar_default.png)



Peer Richelsen
GitHub
lauris@cal.com <lauris@cal.com>
Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
eunjae@cal.com <hey@eunjae.dev>
Lauris Skraucis
supalarry
cubic-dev-ai[bot] <1082092+cubic-dev-ai[bot]@users.noreply.github.com>
CarinaWolli
lauris@cal.com <lauris@cal.com>
Morgan
a03722fd7f
* feat: add OAuth client developer settings page with approval workflow - Add new developer OAuth page at /settings/developer/oAuth for users to submit OAuth client requests - Transform admin OAuth page into management dashboard for reviewing/approving submissions - Add OAuthClientApprovalStatus enum (PENDING, APPROVED, REJECTED) to track submission status - Add userId and createdAt fields to OAuthClient model for tracking submissions - Create email notifications for admin (new submission) and user (approval) - Add sidebar navigation link in developer section below API keys - Add comprehensive translations for new UI strings - Create OAuthClientRepository for data access following repository pattern Co-Authored-By: peer@cal.com <peer@cal.com> * fix: re-export generateSecret for backward compatibility Co-Authored-By: peer@cal.com <peer@cal.com> * feat: make logo mandatory and list items clickable for OAuth clients Co-Authored-By: peer@cal.com <peer@cal.com> * fix: add missing translation keys and remove client secret from details dialog Co-Authored-By: peer@cal.com <peer@cal.com> * fix: address cubic AI reviewer comments - Remove duplicate 'there' JSON key in common.json - Add select clause to findByUserId to avoid exposing clientSecret - Add @@index([userId]) to OAuthClient model for query performance - Update migration to include the index Co-Authored-By: peer@cal.com <peer@cal.com> * fix: address PR review comments - fix indentation and use useCopy hook Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * fix: change react-dom/server import to fix Turbopack compatibility Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * Revert "fix: change react-dom/server import to fix Turbopack compatibility" This reverts commit c3e0b709c2d88fd221143cb4ce9cd25bb8c94277. * fix: use email service pattern for OAuth client notifications Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * fix: add try-catch around email sending to handle Turbopack react-dom/server issue Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * Revert "fix: add try-catch around email sending to handle Turbopack react-dom/server issue" This reverts commit fc9d47cd773505ebc5ee2696718aad4a8a98be77. * fix: improve OAuth client UI with skeleton loaders and smaller dialog styling - Replace 'Loading...' text with proper skeleton loaders in both developer and admin OAuth client views - Make client_id and copy button smaller in dialogs using size='sm' and text-sm styling - Add 'client_id' translation key to common.json for proper i18n Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * fix: improve skeleton loader to match actual OAuth client list structure - Remove divide-y from container and use conditional border-b on rows - Match the exact structure from oauth-clients-view.tsx L126-160 - Use proper spacing for text elements (mt-1 instead of space-y-2) Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * fix skeleton * rename the selected oauth client dialog * fix: address PR feedback - admin auth, dropdown styling, sidebar label - Add defense-in-depth admin authorization check in updateClientStatus handler - Fix broken dropdown menu by using DropdownItem with StartIcon prop - Fix sidebar menu label from 'oAuth' to 'oauth_clients' to match developer view Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * update common.json * feat: show client secret in approval email for confidential OAuth clients - Add regenerateSecret method to OAuthClientRepository - Regenerate secret when admin approves a PENDING confidential client - Include client secret in approval notification email - Add one-time warning message about storing the secret securely - Only regenerate on first approval (not re-approvals) Co-Authored-By: eunjae@cal.com <hey@eunjae.dev> * feat: add Website URL field, fix logo styling, show client secret after approval - Add Website URL field to OAuth client forms (admin and developer views) - Fix Upload Logo section styling by wrapping in Label div with proper gap - Display client secret in dialog after admin approves a confidential OAuth client - Add websiteUrl field to Prisma schema with migration - Update tRPC handlers and repository to support websiteUrl - Add translation keys for new UI elements Co-Authored-By: peer@cal.com <peer@cal.com> * fix: move clientSecret variable declaration outside if block for proper scoping Co-Authored-By: peer@cal.com <peer@cal.com> * refactor: dont expose client secret in emails * refactor: dont regenerate secret upon status change * refactor: reuse existing hash function * refactor: rename admin/oAuth to admin/oauth page * refactor: deduplicate oauth repositories * refactor: remove withGlobalPrisma from oauth repository * refactor: developer oauth page * refactor: oauth status by default accepted * refactor: request oauth status when creating * refactor ux * fix: address Cubic AI code review feedback - Add purpose field to plain text email body for accessibility - Convert NewOAuthClientButton to inline JSX to avoid React anti-pattern - Trigger re-approval when redirectUri changes for security - Add e.preventDefault() for Space key to prevent page scroll - Change default approvalStatus to PENDING for defense-in-depth - Use oauth_clients translation key for consistency - Add meaningful alt text to Avatar for accessibility - Remove onClick from DialogClose to prevent double-run close effects - Return NOT_FOUND for non-owner delete to prevent resource enumeration Co-Authored-By: unknown <> * common.json file * refactor: delete all prisma migrations * refactor: have just 1 prisma migration * revert: some devin changes * fix: typecheck * test: owner OAuth crud * test: admin OAuth approval / rejection * fix: address Cubic AI review feedback (confidence 9/10 issues) - schema.prisma: Remove @default("") from purpose field to make it required - schema.prisma: Use UTC-aware timezone expression for createdAt default - OAuthClientFormFields.tsx: Localize redirect URI placeholder using t() - common.json: Add redirect_uri_placeholder translation key Co-Authored-By: unknown <> * cubic changes * refactor: dont log sensitive info and rethrow error * cubic feedback * refactor: make oauth client purpose optional * refactor: admin/oauth not allowed if not logged in * refactor: admin view skeleton * refactor: rename state * refactor: get rid of redundant mapping * refactor: remove redundant handler * refactor: remove redundant handler * refactor: re-usable new oauth client button * refactor: dialogs * refactor: modals * refactor: handler names, dialog, skeleton * fix: purpose being null * refactor: rename handler and delete old oauth admin page * fix: purpose in submission * refactor: handler names * refactor: rename * refactor: update handler * refactor: rename approvalStatus -> status * refactor: simplify modal * refactor: name * dont require repproval if redirectUri changes * fix: remove integration sync index creation * refactor: require re-approval if redirectUri updated * fix: flaky e2e test * fix: flaky e2e test * fix: flaky e2e test * fix: remove duplicate common.json keys * refactor: replace team@cal.com with SUPPORT_MAIL_ADDRESS * refactor: generate client secret on handler level * fix: authorization code only available to approved clients * refactor: cubic review dont display exclamation * refactor: cubic review website_url in common json * fix: dont default in ui to approved status * refactor: optiona logo in schema create handler * fix: tests * fix: tests * fix: /authorize redirect if client not approved or show error * test: authorize page with invalid client id * refactor: dont allow refreshing tokens unless approved client * fix: flaky e2e test * fix: flaky e2e test * fix: flaky e2e test * fix: flaky e2e test * fix: flaky e2e test * fix: flaky e2e test * chore: warn that pending client is not usable * fix: approve and reject buttons * fix: /authorize show error if client not approved * refactor: info message about editing oauth client and status * change info alert to warning * try to fix ci test * debug: failing e2e test * fix: improve session propagation in oauth-client-admin E2E test - Add navigateToAdminOAuthPage helper that waits for listClients API call - If the API call doesn't arrive (session issue), reload page to force session refresh - This fixes the CI flakiness where admin page wasn't loading due to session not having ADMIN role Co-Authored-By: lauris@cal.com <lauris@cal.com> * fix: register waitForResponse before navigating in E2E test - Register the listClients waitForResponse promise BEFORE page.goto() - This ensures the response isn't missed during page load - Also register the promise before reload in the catch block Co-Authored-By: lauris@cal.com <lauris@cal.com> * fix: rename oAuth folder to oauth for case-sensitive filesystems The admin OAuth page route was at /settings/admin/oAuth (capital A) but the code references /settings/admin/oauth (lowercase). This caused 404 errors on case-sensitive filesystems (Linux). Also improved the E2E test navigation helper to retry with delays if the admin page doesn't load immediately, handling session propagation timing. Co-Authored-By: lauris@cal.com <lauris@cal.com> * test style --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: eunjae@cal.com <hey@eunjae.dev> Co-authored-by: Lauris Skraucis <lauris.skraucis@gmail.com> Co-authored-by: supalarry <laurisskraucis@gmail.com> Co-authored-by: cubic-dev-ai[bot] <1082092+cubic-dev-ai[bot]@users.noreply.github.com> Co-authored-by: CarinaWolli <wollencarina@gmail.com> Co-authored-by: lauris@cal.com <lauris@cal.com> Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
184 lines
6.0 KiB
TypeScript
184 lines
6.0 KiB
TypeScript
"use client";
|
|
|
|
import { useState } from "react";
|
|
import { useLocale } from "@calcom/lib/hooks/useLocale";
|
|
import { trpc } from "@calcom/trpc/react";
|
|
import { EmptyScreen } from "@calcom/ui/components/empty-screen";
|
|
import { showToast } from "@calcom/ui/components/toast";
|
|
import SettingsHeader from "@calcom/features/settings/appDir/SettingsHeader";
|
|
|
|
import type { OAuthClientCreateFormValues } from "../oauth/create/OAuthClientCreateModal";
|
|
import { OAuthClientCreateDialog } from "../oauth/create/OAuthClientCreateModal";
|
|
import { OAuthClientPreviewDialog } from "../oauth/create/OAuthClientPreviewDialog";
|
|
import { OAuthClientDetailsDialog, type OAuthClientDetails } from "../oauth/view/OAuthClientDetailsDialog";
|
|
import { OAuthClientsList } from "../oauth/OAuthClientsList";
|
|
import { NewOAuthClientButton } from "../oauth/create/NewOAuthClientButton";
|
|
|
|
import { OAuthClientsSkeleton } from "./oauth-clients-skeleton";
|
|
|
|
const OAuthClientsView = () => {
|
|
const { t } = useLocale();
|
|
const utils = trpc.useUtils();
|
|
const [isCreatingClient, setIsCreatingClient] = useState(false);
|
|
const [submittedClient, setSubmittedClient] = useState<OAuthClientDetails | null>(null);
|
|
const [selectedClient, setSelectedClient] = useState<OAuthClientDetails | null>(null);
|
|
|
|
const { data: oAuthClients, isLoading } = trpc.viewer.oAuth.listUserClients.useQuery();
|
|
|
|
const submitForReviewMutation = trpc.viewer.oAuth.submitClientForReview.useMutation({
|
|
onSuccess: async (data) => {
|
|
setSubmittedClient({
|
|
clientId: data.clientId,
|
|
name: data.name,
|
|
purpose: data.purpose ?? "",
|
|
clientSecret: data.clientSecret,
|
|
status: data.status,
|
|
isPkceEnabled: data.isPkceEnabled,
|
|
});
|
|
showToast(t("oauth_client_submitted"), "success");
|
|
utils.viewer.oAuth.listUserClients.invalidate();
|
|
},
|
|
onError: (error) => {
|
|
showToast(`${t("oauth_client_submit_error")}: ${error.message}`, "error");
|
|
},
|
|
});
|
|
|
|
const deleteClientMutation = trpc.viewer.oAuth.deleteClient.useMutation({
|
|
onSuccess: async () => {
|
|
showToast(t("oauth_client_deletion_message"), "success");
|
|
setSelectedClient(null);
|
|
utils.viewer.oAuth.listUserClients.invalidate();
|
|
},
|
|
onError: (error) => {
|
|
showToast(error.message || t("error"), "error");
|
|
},
|
|
});
|
|
|
|
const updateClientMutation = trpc.viewer.oAuth.updateClient.useMutation({
|
|
onSuccess: async (data) => {
|
|
showToast(t("oauth_client_updated_successfully"), "success");
|
|
|
|
setSelectedClient((prev) => {
|
|
if (!prev) return prev;
|
|
if (prev.clientId !== data.clientId) return prev;
|
|
return {
|
|
...prev,
|
|
name: data.name,
|
|
purpose: data.purpose,
|
|
redirectUri: data.redirectUri,
|
|
websiteUrl: data.websiteUrl,
|
|
logo: data.logo,
|
|
status: data.status,
|
|
rejectionReason: data.rejectionReason,
|
|
};
|
|
});
|
|
|
|
utils.viewer.oAuth.listUserClients.invalidate();
|
|
},
|
|
onError: (error) => {
|
|
showToast(`${t("updating_oauth_client_error")}: ${error.message}`, "error");
|
|
},
|
|
});
|
|
|
|
const handleSubmit = (values: OAuthClientCreateFormValues) => {
|
|
submitForReviewMutation.mutate({
|
|
name: values.name,
|
|
purpose: values.purpose,
|
|
redirectUri: values.redirectUri,
|
|
websiteUrl: values.websiteUrl,
|
|
logo: values.logo,
|
|
enablePkce: values.enablePkce,
|
|
});
|
|
};
|
|
|
|
const handleCloseCreateDialog = () => {
|
|
setIsCreatingClient(false);
|
|
setSubmittedClient(null);
|
|
};
|
|
|
|
const handleCloseDetailsDialog = () => {
|
|
setSelectedClient(null);
|
|
};
|
|
|
|
if (isLoading) {
|
|
return <OAuthClientsSkeleton />;
|
|
}
|
|
|
|
const newOAuthClientButton = (
|
|
<NewOAuthClientButton dataTestId="open-oauth-client-create-dialog" onClick={() => setIsCreatingClient(true)} />
|
|
);
|
|
|
|
return (
|
|
<SettingsHeader
|
|
title={t("oauth_clients")}
|
|
description={t("oauth_clients_description")}
|
|
CTA={newOAuthClientButton}>
|
|
{oAuthClients && oAuthClients.length > 0 ? (
|
|
<OAuthClientsList
|
|
clients={oAuthClients.map((client) => ({
|
|
clientId: client.clientId,
|
|
name: client.name,
|
|
purpose: client.purpose,
|
|
redirectUri: client.redirectUri,
|
|
websiteUrl: client.websiteUrl,
|
|
logo: client.logo,
|
|
status: client.status,
|
|
rejectionReason: client.rejectionReason,
|
|
clientType: client.clientType,
|
|
}))}
|
|
onSelectClient={(client) => setSelectedClient(client)}
|
|
/>
|
|
) : (
|
|
<EmptyScreen
|
|
Icon="key"
|
|
headline={t("no_oauth_clients")}
|
|
description={t("no_oauth_clients_description")}
|
|
buttonRaw={newOAuthClientButton}
|
|
/>
|
|
)}
|
|
|
|
{submittedClient ? (
|
|
<OAuthClientPreviewDialog
|
|
open={isCreatingClient}
|
|
onOpenChange={setIsCreatingClient}
|
|
title={t("oauth_client_submitted")}
|
|
description={t("oauth_client_submitted_description")}
|
|
client={submittedClient}
|
|
onClose={handleCloseCreateDialog}
|
|
/>
|
|
) : (
|
|
<OAuthClientCreateDialog
|
|
open={isCreatingClient}
|
|
onOpenChange={setIsCreatingClient}
|
|
isSubmitting={submitForReviewMutation.isPending}
|
|
onSubmit={handleSubmit}
|
|
onClose={handleCloseCreateDialog}
|
|
/>
|
|
)}
|
|
|
|
<OAuthClientDetailsDialog
|
|
open={Boolean(selectedClient)}
|
|
onOpenChange={(open) => !open && handleCloseDetailsDialog()}
|
|
client={selectedClient}
|
|
onUpdate={(values) => {
|
|
updateClientMutation.mutate({
|
|
clientId: values.clientId,
|
|
name: values.name,
|
|
purpose: values.purpose,
|
|
redirectUri: values.redirectUri,
|
|
websiteUrl: values.websiteUrl,
|
|
logo: values.logo,
|
|
});
|
|
}}
|
|
onDelete={(clientId) => {
|
|
deleteClientMutation.mutate({ clientId });
|
|
}}
|
|
isUpdatePending={updateClientMutation.isPending}
|
|
isDeletePending={deleteClientMutation.isPending}
|
|
/>
|
|
</SettingsHeader>
|
|
);
|
|
};
|
|
|
|
export default OAuthClientsView;
|