vynte-infra/plunk
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: Add additional verification in Oauth controllers

Browse Source
This commit is contained in:
Dries Augustyns
2025-12-08 15:29:04 +01:00
parent fc535a558f
commit 53ecda9f7a
3 changed files with 44 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/controllers/Oauth/Github.ts
+22 -4
View File
@@ -40,6 +40,10 @@ export class Github {
}
const {code} = req.query;
if (!code || typeof code !== 'string') {
return res.redirect(DASHBOARD_URI + '/auth/login?message=Invalid OAuth callback');
}
const data = new URLSearchParams({
client_id: GITHUB_OAUTH_CLIENT,
client_secret: GITHUB_OAUTH_SECRET,
@@ -47,19 +51,33 @@ export class Github {
redirect_uri: `${API_URI}/oauth/github/callback`,
});
const {access_token, token_type} = await fetch('https://github.com/login/oauth/access_token', {
const tokenResponse = await fetch('https://github.com/login/oauth/access_token', {
method: 'POST',
headers: {'Content-type': 'application/x-www-form-urlencoded', 'Accept': 'application/json'},
body: data,
}).then(res => res.json());
if (!tokenResponse.access_token || !tokenResponse.token_type) {
return res.redirect(DASHBOARD_URI + '/auth/login?message=Failed to authenticate with GitHub');
}
const emails = await fetch(`https://api.github.com/user/emails`, {
headers: {Authorization: `${token_type} ${access_token}`},
headers: {Authorization: `${tokenResponse.token_type} ${tokenResponse.access_token}`},
}).then(res => res.json());
const email = emails.find((e: {primary: boolean; email: string}) => e.primary).email;
if (!Array.isArray(emails) || emails.length === 0) {
return res.redirect(DASHBOARD_URI + '/auth/login?message=Failed to retrieve emails from GitHub');
}
let user = await UserService.email(email as string);
const primaryEmail = emails.find((e: {primary: boolean; email: string}) => e.primary);
if (!primaryEmail || !primaryEmail.email || typeof primaryEmail.email !== 'string') {
return res.redirect(DASHBOARD_URI + '/auth/login?message=Failed to retrieve primary email from GitHub');
}
const email = primaryEmail.email;
let user = await UserService.email(email);
let isNewUser = false;
if (!user) {
apps/api/src/controllers/Oauth/Google.ts
+18 -4
View File
@@ -35,6 +35,10 @@ export class Google {
}
const {code} = req.query;
if (!code || typeof code !== 'string') {
return res.redirect(DASHBOARD_URI + '/auth/login?message=Invalid OAuth callback');
}
const data = new URLSearchParams({
client_id: GOOGLE_OAUTH_CLIENT,
client_secret: GOOGLE_OAUTH_SECRET,
@@ -43,15 +47,25 @@ export class Google {
grant_type: 'authorization_code',
});
const {access_token} = await fetch('https://oauth2.googleapis.com/token', {
const tokenResponse = await fetch('https://oauth2.googleapis.com/token', {
method: 'POST',
headers: {'Content-type': 'application/x-www-form-urlencoded'},
body: data,
}).then(res => res.json());
const {email} = await fetch(`https://www.googleapis.com/oauth2/v3/userinfo?access_token=${access_token}`).then(
res => res.json(),
);
if (!tokenResponse.access_token) {
return res.redirect(DASHBOARD_URI + '/auth/login?message=Failed to authenticate with Google');
}
const userInfoResponse = await fetch(
`https://www.googleapis.com/oauth2/v3/userinfo?access_token=${tokenResponse.access_token}`,
).then(res => res.json());
if (!userInfoResponse.email || typeof userInfoResponse.email !== 'string') {
return res.redirect(DASHBOARD_URI + '/auth/login?message=Failed to retrieve email from Google');
}
const email = userInfoResponse.email;
let user = await UserService.email(email);
let isNewUser = false;