@hed-hog/core 0.0.304 → 0.0.305

package/src/oauth/oauth.service.ts

@@ -1,11 +1,14 @@
+import { getLocaleText } from '@hed-hog/api-locale';
 import { PrismaService, user_account_provider_52222e2ecb_enum } from '@hed-hog/api-prisma';
 import {
-  BadRequestException,
-  ConflictException,
-  Inject,
-  Injectable,
-  NotFoundException,
-  forwardRef
+    BadRequestException,
+    ConflictException,
+    Inject,
+    Injectable,
+    Logger,
+    NotFoundException,
+    ServiceUnavailableException,
+    forwardRef
 } from '@nestjs/common';
 import { AuthService } from '../auth/auth.service';
 import { FileService } from '../file/file.service';
@@ -16,6 +19,12 @@ import { TokenService } from '../token/token.service';
 import { USER_AVATAR_UPLOAD_DESTINATION } from '../user/constants/user.constants';
 import { UserService } from '../user/user.service';
 import { OAuthProvider } from './interfaces/OAuthProvider';
+import { OAuthCallbackCoordinatorService } from './oauth-callback-coordinator.service';
+import {
+    OAuthCallbackAlreadyProcessedError,
+    OAuthCallbackInProgressError,
+    OAuthProviderException,
+} from './oauth.errors';
 import { FacebookProvider } from './providers/facebook.provider';
 import { GithubProvider } from './providers/github.provider';
 import { GoogleProvider } from './providers/google.provider';
@@ -36,6 +45,7 @@ type HandleCallbackProps = {
 
 @Injectable()
 export class OAuthService {
+  private readonly logger = new Logger(OAuthService.name);
   private providers: Map<string, OAuthProvider> = new Map();
 
   constructor(
@@ -44,6 +54,7 @@ export class OAuthService {
     microsoft: MicrosoftProvider,
     github: GithubProvider,
     microsoftEntraId: MicrosoftEntraIdProvider,
+    private readonly callbackCoordinator: OAuthCallbackCoordinatorService,
     @Inject(forwardRef(() => AuthService))
     private readonly auth: AuthService,
     private readonly file: FileService,
@@ -77,23 +88,51 @@ export class OAuthService {
     userId,
     email,
   }: HandleCallbackProps) {
-    let profile;
+    try {
+      this.logger.log(
+        `OAuth callback received: provider=${provider} type=${type} locale=${locale} ip=${ipAddress || 'n/a'} hasCode=${code ? 'yes' : 'no'} codeLength=${code?.length ?? 0} userAgent="${this.summarizeUserAgent(userAgent)}"`,
+      );
 
-    if (type !== 'disconnect') {
-      profile = await this.getProvider(provider).getProfile(code, type);
-    }
+      if (type === 'disconnect') {
+        return this.handleDisconnect(res, locale, ipAddress, userAgent, provider, email);
+      }
 
-    console.log('[OAuthService] Callback received for provider:', provider, 'with type:', type, 'and profile:', profile);
+      if (!code) {
+        throw new BadRequestException(
+          getLocaleText(
+            'oauth.callback.codeRequired',
+            locale,
+            'Authorization code is required to complete OAuth authentication.',
+          ),
+        );
+      }
 
-    switch (type) {
-      case 'login':
-        return this.handleLogin(res, locale, ipAddress, userAgent, provider, profile);
-      case 'register':
-        return this.handleRegister(res, locale, ipAddress, userAgent, provider, profile);
-      case 'connect':
-        return this.handleConnect(res, locale, ipAddress, userAgent, provider, profile, userId);
-      case 'disconnect':
-        return this.handleDisconnect(res, locale, ipAddress, userAgent, provider, email);
+      const callbackKey = this.buildCallbackKey(provider, type, code);
+
+      return await this.callbackCoordinator.execute(callbackKey, async () => {
+        const profile = await this.getProvider(provider).getProfile(code, type);
+        const result = await this.finalizeCallback({
+          res,
+          locale,
+          ipAddress,
+          userAgent,
+          provider,
+          type,
+          profile,
+          userId,
+        });
+
+        this.logger.log(
+          `OAuth callback completed: provider=${provider} type=${type} profileEmailPresent=${profile?.email ? 'yes' : 'no'} userId=${userId ?? 'n/a'}`,
+        );
+
+        return result;
+      });
+    } catch (error) {
+      this.logger.warn(
+        `OAuth callback failed before response mapping: provider=${provider} type=${type} message=${error instanceof Error ? error.message : 'unknown error'}`,
+      );
+      throw this.mapCallbackError(locale, provider, type, error);
     }
   }
 
@@ -119,10 +158,123 @@ export class OAuthService {
     return settings[settingKey].join(',') || '';
   }
 
-  private async handleLogin(res: Response, locale: string, ipAddress: string, userAgent: string, provider: user_account_provider_52222e2ecb_enum, profile: any) {
+  private buildCallbackKey(
+    provider: user_account_provider_52222e2ecb_enum,
+    type: HandleCallbackProps['type'],
+    code: string,
+  ) {
+    return `${String(provider).toLowerCase()}:${type}:${this.security.hashSha256(code)}`;
+  }
+
+  private summarizeUserAgent(userAgent?: string) {
+    if (!userAgent) {
+      return 'n/a';
+    }
+
+    return userAgent.length > 120
+      ? `${userAgent.slice(0, 117)}...`
+      : userAgent;
+  }
+
+  private async finalizeCallback({
+    res,
+    locale,
+    ipAddress,
+    userAgent,
+    provider,
+    type,
+    profile,
+    userId,
+  }: Omit<HandleCallbackProps, 'code' | 'email'> & { profile: any }) {
+    switch (type) {
+      case 'login':
+        return this.handleLogin(res, locale, ipAddress, userAgent, provider, profile);
+      case 'register':
+        return this.handleRegister(res, locale, ipAddress, userAgent, provider, profile);
+      case 'connect':
+        return this.handleConnect(res, locale, ipAddress, userAgent, provider, profile, userId);
+      default:
+        throw new BadRequestException(
+          getLocaleText('oauth.callback.invalidType', locale, 'Unsupported OAuth callback type.'),
+        );
+    }
+  }
+
+  private resolveProfileScopes(provider: user_account_provider_52222e2ecb_enum, profile: any) {
+    if (typeof profile?.oauth_scopes === 'string') {
+      return profile.oauth_scopes;
+    }
+
+    return this.getProviderScopes(provider);
+  }
+
+  private mapCallbackError(
+    locale: string,
+    provider: user_account_provider_52222e2ecb_enum,
+    type: HandleCallbackProps['type'],
+    error: unknown,
+  ) {
+    if (
+      error instanceof BadRequestException ||
+      error instanceof ConflictException ||
+      error instanceof NotFoundException ||
+      error instanceof ServiceUnavailableException
+    ) {
+      return error;
+    }
+
+    if (error instanceof OAuthCallbackAlreadyProcessedError) {
+      return new BadRequestException(
+        getLocaleText(
+          'oauth.callback.alreadyProcessed',
+          locale,
+          'This OAuth callback has already been processed. Start the sign-in flow again.',
+        ),
+      );
+    }
+
+    if (error instanceof OAuthCallbackInProgressError) {
+      return new ConflictException(
+        getLocaleText(
+          'oauth.callback.inProgress',
+          locale,
+          'This OAuth callback is already being processed. Wait a moment and try again.',
+        ),
+      );
+    }
+
+    if (error instanceof OAuthProviderException) {
+      if (error.reason === 'callback_consumed' || error.reason === 'invalid_callback') {
+        return new BadRequestException(getLocaleText('oauth.callback.invalid', locale, error.message));
+      }
+
+      this.logger.warn(
+        `OAuth callback upstream failure: provider=${provider} type=${type} status=${error.status ?? 'unknown'} reason=${error.reason} providerError=${error.providerError ?? 'unknown'} providerCode=${error.providerErrorCode ?? 'n/a'}`,
+      );
+
+      return new ServiceUnavailableException(
+        getLocaleText(
+          'oauth.callback.unavailable',
+          locale,
+          'Unable to complete OAuth authentication right now. Please try again.',
+        ),
+      );
+    }
 
-    console.log('[OAuthService] Handling login for provider:', provider);
+    this.logger.error(
+      `Unexpected OAuth callback failure: provider=${provider} type=${type} error=${error instanceof Error ? error.message : 'unknown'}`,
+    );
 
+    return new ServiceUnavailableException(
+      getLocaleText(
+        'oauth.callback.unavailable',
+        locale,
+        'Unable to complete OAuth authentication right now. Please try again.',
+      ),
+    );
+  }
+
+  private async handleLogin(res: Response, locale: string, ipAddress: string, userAgent: string, provider: user_account_provider_52222e2ecb_enum, profile: any) {
     const userAccount = await this.prisma.user_account.findFirst({
       where: {
         provider: String(provider).toLowerCase().replace(/-/g, '_') as user_account_provider_52222e2ecb_enum,
@@ -133,8 +285,6 @@ export class OAuthService {
       },
     });
 
-    console.log('[OAuthService] Found user account:', userAccount);
-
     if (!userAccount) {
       const userIdentifier = await this.prisma.user_identifier.findFirst({
         where: {
@@ -153,7 +303,7 @@ export class OAuthService {
     } else {
       if (profile.oauth_tokens?.refresh_token) {
         const encryptedRefreshToken = this.security.encrypt(profile.oauth_tokens.refresh_token);
-        const scopes = await this.getProviderScopes(provider);
+        const scopes = await this.resolveProfileScopes(provider, profile);
         await this.prisma.user_account.update({
           where: { id: userAccount.id },
           data: {
@@ -193,7 +343,7 @@ export class OAuthService {
     }
 
     const encryptedRefreshToken = profile.oauth_tokens.refresh_token ? this.security.encrypt(profile.oauth_tokens.refresh_token) : null;
-    const scopes = await this.getProviderScopes(provider);
+    const scopes = await this.resolveProfileScopes(provider, profile);
 
     const settings = await this.setting.getSettingValues([
       'oauth-role-assignment',
@@ -289,14 +439,14 @@ export class OAuthService {
     }
 
     const encryptedRefreshToken = profile.oauth_tokens.refresh_token ? this.security.encrypt(profile.oauth_tokens.refresh_token) : null;
-    const scopes = await this.getProviderScopes(provider);
+    const scopes = await this.resolveProfileScopes(provider, profile);
     await this.prisma.user_account.create({
       data: {
         user_id: userId,
         provider: String(provider).toLowerCase().replace(/-/g, '_') as user_account_provider_52222e2ecb_enum,
         provider_user_id: profile.id,
         email: profile.email,
-        refresh_token: Buffer.from(encryptedRefreshToken),
+        refresh_token: encryptedRefreshToken ? Buffer.from(encryptedRefreshToken) : null,
         token_expires_at: profile.oauth_tokens?.expires_in
           ? new Date(Date.now() + profile.oauth_tokens.expires_in * 1000)
           : null,

package/src/oauth/providers/abstract.provider.ts

@@ -1,6 +1,7 @@
 import { HttpService } from '@nestjs/axios';
 import { lastValueFrom } from 'rxjs';
 import { OAuthProvider } from '../interfaces/OAuthProvider';
+import { OAuthProviderException } from '../oauth.errors';
 
 export abstract class BaseOAuthProvider implements OAuthProvider {
   constructor(protected readonly http: HttpService) {}
@@ -47,4 +48,67 @@ export abstract class BaseOAuthProvider implements OAuthProvider {
     );
     return response.data;
   }
+
+  protected mapProviderError(provider: string, error: any) {
+    const providerError = this.extractProviderError(error);
+    const providerErrorCode = this.extractProviderErrorCode(error);
+    const status = error?.response?.status;
+
+    if (this.isConsumedAuthorizationCodeError(error)) {
+      return new OAuthProviderException(
+        provider,
+        'callback_consumed',
+        'OAuth callback is no longer valid. Start the sign-in flow again.',
+        status,
+        providerError,
+        providerErrorCode,
+      );
+    }
+
+    if (this.isInvalidAuthorizationCodeError(error)) {
+      return new OAuthProviderException(
+        provider,
+        'invalid_callback',
+        'OAuth callback is invalid or expired. Start the sign-in flow again.',
+        status,
+        providerError,
+        providerErrorCode,
+      );
+    }
+
+    return new OAuthProviderException(
+      provider,
+      'upstream_failure',
+      `Unable to complete ${provider} OAuth authentication.`,
+      status,
+      providerError,
+      providerErrorCode,
+    );
+  }
+
+  protected extractProviderError(error: any) {
+    return error?.response?.data?.error || error?.code || 'unknown_error';
+  }
+
+  protected extractProviderErrorCode(error: any) {
+    const description = String(error?.response?.data?.error_description || '');
+    const match = description.match(/AADSTS\d+/i);
+    return match?.[0] || undefined;
+  }
+
+  protected isConsumedAuthorizationCodeError(error: any) {
+    const providerError = this.extractProviderError(error);
+    const description = String(error?.response?.data?.error_description || '');
+
+    return (
+      providerError === 'invalid_grant' &&
+      /(AADSTS54005|already redeemed|already been redeemed|authorization code was already redeemed)/i.test(
+        description,
+      )
+    );
+  }
+
+  protected isInvalidAuthorizationCodeError(error: any) {
+    return this.extractProviderError(error) === 'invalid_grant';
+  }
 }

package/src/oauth/providers/microsoft-entra-id.provider.ts

@@ -1,10 +1,12 @@
 import { HttpService } from '@nestjs/axios';
-import { forwardRef, Inject, Injectable } from '@nestjs/common';
+import { forwardRef, Inject, Injectable, Logger } from '@nestjs/common';
 import { SettingService } from '../../setting/setting.service';
 import { BaseOAuthProvider } from './abstract.provider';
 
 @Injectable()
 export class MicrosoftEntraIdProvider extends BaseOAuthProvider {
+  private readonly logger = new Logger(MicrosoftEntraIdProvider.name);
+
   constructor(
     http: HttpService,
     @Inject(forwardRef(() => SettingService))
@@ -13,6 +15,19 @@ export class MicrosoftEntraIdProvider extends BaseOAuthProvider {
     super(http);
   }
 
+  private normalizeBaseUrl(url: string) {
+    return String(url).trim().replace(/\/+$/, '');
+  }
+
+  private buildRedirectUri(baseUrl: string, callbackPath: string) {
+    const normalizedBaseUrl = this.normalizeBaseUrl(baseUrl);
+    const normalizedCallbackPath = callbackPath.startsWith('/')
+      ? callbackPath
+      : `/${callbackPath}`;
+
+    return new URL(normalizedCallbackPath, `${normalizedBaseUrl}/`).toString();
+  }
+
   getProviderType() {
     return 'MICROSOFT-ENTRA-ID';
   }
@@ -33,82 +48,103 @@ export class MicrosoftEntraIdProvider extends BaseOAuthProvider {
       !settings['microsoft_entra_id_tenant_id'] ||
       !settings['url']
     ) {
+      this.logger.error(
+        'Microsoft Entra ID OAuth is missing required settings. Verify client id, client secret, scopes, tenant id, and url.',
+      );
       throw new Error('Microsoft Entra ID OAuth is not configured properly. Please configure microsoft_entra_id_client_id, microsoft_entra_id_client_secret, microsoft_entra_id_scopes, microsoft_entra_id_tenant_id, and url settings.');
     }
 
     const tenantId = settings['microsoft_entra_id_tenant_id'];
-    const redirectURI = new URL(callbackPath, settings['url']).toString();
-    const scopes = settings['microsoft_entra_id_scopes'];
+    const redirectURI = this.buildRedirectUri(settings['url'], callbackPath);
+    const baseScopes = Array.isArray(settings['microsoft_entra_id_scopes'])
+      ? settings['microsoft_entra_id_scopes']
+      : [];
+    const scopes = baseScopes.includes('offline_access')
+      ? baseScopes
+      : [...baseScopes, 'offline_access'];
+    const isConnectFlow = callbackPath.includes('/connect');
     const params = new URLSearchParams({
       client_id: settings['microsoft_entra_id_client_id'],
       redirect_uri: redirectURI,
       response_type: 'code',
       scope: scopes.join(' '),
       response_mode: 'query',
-      prompt: 'consent',
     });
 
-    const authUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize?${params.toString()}`;
-    console.log('[MicrosoftEntraIdProvider] Generated auth URL:', authUrl);
+    this.logger.log(
+      `OAuth auth URL requested: provider=MICROSOFT-ENTRA-ID redirectUri=${redirectURI} hasOfflineAccess=${scopes.includes('offline_access') ? 'yes' : 'no'} connectFlow=${isConnectFlow ? 'yes' : 'no'} tenantConfigured=${tenantId ? 'yes' : 'no'}`,
+    );
+
+    // Force consent only for explicit account connect, not for routine login.
+    if (isConnectFlow) {
+      params.set('prompt', 'consent');
+    }
 
+    const authUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize?${params.toString()}`;
     return authUrl;
   }
 
   async getProfile(code: string, type: string): Promise<any> {
+    let redirectUri = '';
 
-    console.log('[MicrosoftEntraIdProvider] Fetching profile with code:', code, 'and type:', type);
     try {
-    const settings = await this.setting.getSettingValues([
-      'microsoft_entra_id_client_id',
-      'microsoft_entra_id_client_secret',
-      'microsoft_entra_id_scopes',
-      'microsoft_entra_id_tenant_id',
-      'url',
-    ]);
-    const tenantId = settings['microsoft_entra_id_tenant_id'];
+      const settings = await this.setting.getSettingValues([
+        'microsoft_entra_id_client_id',
+        'microsoft_entra_id_client_secret',
+        'microsoft_entra_id_scopes',
+        'microsoft_entra_id_tenant_id',
+        'url',
+      ]);
+      const tenantId = settings['microsoft_entra_id_tenant_id'];
+      const scopes = settings['microsoft_entra_id_scopes'] ?? [];
+      redirectUri = this.buildRedirectUri(
+        settings['url'],
+        `/callback/microsoft-entra-id/${type}`,
+      );
 
-    console.log({
-      url: `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`,
-      clientId: settings['microsoft_entra_id_client_id'],
-      clientSecret: settings['microsoft_entra_id_client_secret'],
-      redirectUri: `${settings['url']}/callback/microsoft-entra-id/${type}`,
-    })
-
-    const token = await this.fetchToken({
-      code,
-      url: `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`,
-      clientId: settings['microsoft_entra_id_client_id'],
-      clientSecret: settings['microsoft_entra_id_client_secret'],
-      redirectUri: `${settings['url']}/callback/microsoft-entra-id/${type}`,
-    });
-    console.log('[MicrosoftEntraIdProvider] Fetched token:', token);
+      this.logger.log(
+        `OAuth token exchange started: provider=MICROSOFT-ENTRA-ID type=${type} redirectUri=${redirectUri} hasCode=${code ? 'yes' : 'no'} codeLength=${code?.length ?? 0}`,
+      );
 
-    const profile = await this.fetchProfile(
-      token.access_token,
-      'https://graph.microsoft.com/v1.0/me',
-    );
+      const token = await this.fetchToken({
+        code,
+        url: `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`,
+        clientId: settings['microsoft_entra_id_client_id'],
+        clientSecret: settings['microsoft_entra_id_client_secret'],
+        redirectUri,
+      });
 
-    console.log('[MicrosoftEntraIdProvider] Fetched profile:', profile);
-
-    const pictureUrl = 'https://graph.microsoft.com/v1.0/me/photo/$value';
-    return {
-      id: profile.id,
-      email: profile.mail || profile.userPrincipalName,
-      name: profile.displayName,
-      picture: pictureUrl,
-      oauth_tokens: {
-        access_token: token.access_token,
-        refresh_token: token.refresh_token,
-        expires_in: token.expires_in,
-        token_type: token.token_type,
-      },
-    };
-
-  } catch (err: any) {
-  console.log('URL:', err?.config?.url);
-  console.log('STATUS:', err?.response?.status);
-  console.log('DATA:', err?.response?.data);
-  throw err;
-}
+      const profile = await this.fetchProfile(
+        token.access_token,
+        'https://graph.microsoft.com/v1.0/me',
+      );
+
+      this.logger.log(
+        `OAuth profile fetched: provider=MICROSOFT-ENTRA-ID type=${type} profileIdPresent=${profile?.id ? 'yes' : 'no'} emailPresent=${profile?.mail || profile?.userPrincipalName ? 'yes' : 'no'}`,
+      );
+
+      const pictureUrl = 'https://graph.microsoft.com/v1.0/me/photo/$value';
+      return {
+        id: profile.id,
+        email: profile.mail || profile.userPrincipalName,
+        name: profile.displayName,
+        picture: pictureUrl,
+        oauth_scopes: scopes.join(','),
+        oauth_tokens: {
+          access_token: token.access_token,
+          refresh_token: token.refresh_token,
+          expires_in: token.expires_in,
+          token_type: token.token_type,
+        },
+      };
+    } catch (error: any) {
+      const mappedError = this.mapProviderError('Microsoft Entra ID', error);
+
+      this.logger.warn(
+        `OAuth callback failed: provider=MICROSOFT-ENTRA-ID status=${mappedError.status ?? 'unknown'} error=${mappedError.providerError ?? 'unknown'} providerCode=${mappedError.providerErrorCode ?? 'n/a'} reason=${mappedError.reason} redirectUri=${redirectUri || 'unresolved'}`,
+      );
+
+      throw mappedError;
+    }
   }
 }

package/src/security/security.service.ts

@@ -59,14 +59,7 @@ export class SecurityService {
   }
 
   encrypt(value: string, secret?: string): string {
-
-    console.log('Encrypting:', {
-      value,
-      secret
-    });
-
-    const encryptionSecret = secret || this.configService.get('ENCRYPTION_SECRET');
-    if (!encryptionSecret) throw new Error('Missing encryption secret');
+    const encryptionSecret = this.resolveEncryptionSecret(secret);
     const salt = randomBytes(16);
     const key = scryptSync(encryptionSecret, salt, 32);
     const iv = randomBytes(12);
@@ -84,8 +77,7 @@ export class SecurityService {
   
   decrypt(encryptedValue: string, secret?: string): string {
     try {
-      const encryptionSecret = secret || this.configService.get('ENCRYPTION_SECRET');
-      if (!encryptionSecret) throw new Error('Missing encryption secret');
+      const encryptionSecret = this.resolveEncryptionSecret(secret);
       
       const parts = encryptedValue.split(':');
       if (parts.length !== 4) {
@@ -106,6 +98,16 @@ export class SecurityService {
     }
   }
 
+  private resolveEncryptionSecret(secret?: string): string {
+    const encryptionSecret = secret || this.configService.get<string>('ENCRYPTION_SECRET');
+
+    if (!encryptionSecret || !String(encryptionSecret).trim()) {
+      throw new Error('ENCRYPTION_SECRET is not configured.');
+    }
+
+    return encryptionSecret;
+  }
+
   generateCode(length: number): string {
 
     return Array.from(crypto.getRandomValues(new Uint8Array(length || 6)))