012d819557
## Summary Consolidates three separate PRs (#18260, #18261, #18262) into a single unified branch with all review feedback addressed: ### New features - **ApplicationRegistration entity** — server-level registration for OAuth apps with encrypted server variables - **OAuth 2.0 server** — authorization code, client credentials, refresh token grants with PKCE support - **OAuth discovery endpoint** — `.well-known/oauth-authorization-server` metadata - **Frontend UI** — app registration details page with credential management, redirect URI editing, and server variable configuration - **CLI integration** — `twenty dev` auto-registers apps and stores OAuth credentials locally - **Authorize consent screen** — OAuth consent page at `/authorize` showing requested scopes ### Review feedback addressed **Renames (PR #18260):** - `appRegistration` → `applicationRegistration` (entity, tables, files, imports, GraphQL types) - `appRegistrationVariable` → `applicationRegistrationVariable` - `clientId` → `oAuthClientId`, `clientSecretHash` → `oAuthClientSecretHash`, `redirectUris` → `oAuthRedirectUris`, `scopes` → `oAuthScopes` **Security fixes (PR #18261):** - Fixed redirect URI validation bypass when `oAuthRedirectUris` is an empty array - Fixed workspace isolation in `clientCredentialsGrant` — now uses `find()` with explicit handling for multiple installations - Added error logging in refresh token `catch` block instead of silently swallowing **Code quality (PR #18262):** - Split `VersionDistributionEntry` into its own file (one export per file) - Split GraphQL queries and mutations into individual files with a shared fragment - Removed unused `OAuth` entry from `AuthProviderEnum` - Added loading state to `handleRotateSecret` - Removed 27 narration-style comments from test files - Added proper guards (`PublicEndpointGuard`, `NoPermissionGuard`) to controllers and resolvers ## Test plan - [ ] Verify `twenty dev` registers an app and stores OAuth credentials - [ ] Test OAuth authorization code flow end-to-end (authorize → token → API call) - [ ] Test client credentials grant - [ ] Verify redirect URI validation rejects requests when no URIs are registered - [ ] Verify app registration detail page renders correctly - [ ] Test secret rotation with loading state - [ ] Verify server variable editing and saving - [ ] Run `npx nx database:reset twenty-server` to validate migration Closes #18260, #18261, #18262 Made with [Cursor](https://cursor.com) --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
88 lines
2.4 KiB
TypeScript
88 lines
2.4 KiB
TypeScript
import gql from 'graphql-tag';
|
|
import { type CommonResponseBody } from 'test/integration/metadata/types/common-response-body.type';
|
|
import { warnIfErrorButNotExpectedToFail } from 'test/integration/metadata/utils/warn-if-error-but-not-expected-to-fail.util';
|
|
import { warnIfNoErrorButExpectedToFail } from 'test/integration/metadata/utils/warn-if-no-error-but-expected-to-fail.util';
|
|
import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
|
|
|
|
import { type AvailableWorkspacesAndAccessTokensDTO } from 'src/engine/core-modules/auth/dto/available-workspaces-and-access-tokens.dto';
|
|
import { type UserCredentialsInput } from 'src/engine/core-modules/auth/dto/user-credentials.input';
|
|
|
|
type SignUpUtilArgs = {
|
|
input: UserCredentialsInput;
|
|
expectToFail?: boolean;
|
|
};
|
|
|
|
export const signUp = async ({
|
|
input,
|
|
expectToFail,
|
|
}: SignUpUtilArgs): CommonResponseBody<{
|
|
signUp: AvailableWorkspacesAndAccessTokensDTO;
|
|
}> => {
|
|
const mutation = gql`
|
|
mutation SignUp(
|
|
$email: String!
|
|
$password: String!
|
|
$captchaToken: String
|
|
) {
|
|
signUp(email: $email, password: $password, captchaToken: $captchaToken) {
|
|
tokens {
|
|
accessOrWorkspaceAgnosticToken {
|
|
token
|
|
expiresAt
|
|
}
|
|
refreshToken {
|
|
token
|
|
expiresAt
|
|
}
|
|
}
|
|
availableWorkspaces {
|
|
availableWorkspacesForSignIn {
|
|
id
|
|
displayName
|
|
logo
|
|
workspaceUrls {
|
|
customUrl
|
|
subdomainUrl
|
|
}
|
|
}
|
|
availableWorkspacesForSignUp {
|
|
id
|
|
displayName
|
|
logo
|
|
workspaceUrls {
|
|
customUrl
|
|
subdomainUrl
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
`;
|
|
|
|
const response = await makeMetadataAPIRequest(
|
|
{
|
|
query: mutation,
|
|
variables: {
|
|
...input,
|
|
},
|
|
},
|
|
undefined, // Public endpoint - no authentication required
|
|
);
|
|
|
|
if (expectToFail === true) {
|
|
warnIfNoErrorButExpectedToFail({
|
|
response,
|
|
errorMessage: 'Sign up should have failed but did not',
|
|
});
|
|
}
|
|
|
|
if (expectToFail === false) {
|
|
warnIfErrorButNotExpectedToFail({
|
|
response,
|
|
errorMessage: 'Sign up has failed but should not',
|
|
});
|
|
}
|
|
|
|
return { data: response.body.data, errors: response.body.errors };
|
|
};
|