@hed-hog/core 0.0.355 → 0.0.358

package/src/integration-profile/integration-profile.utils.ts

@@ -0,0 +1,173 @@
+import { BadRequestException } from '@nestjs/common';
+import { EnumProvider } from '../file/provider/provider.enum';
+
+type Cfg = Record<string, unknown>;
+
+export function buildMailConfigFromIntegration(
+  providerSlug: string,
+  config: unknown,
+): any {
+  const cfg = (config as Cfg) ?? {};
+
+  switch (providerSlug.toLowerCase()) {
+    case 'smtp':
+      return {
+        global: true,
+        type: 'SMTP' as const,
+        host: String(cfg.host ?? ''),
+        port: Number(cfg.port ?? 587),
+        secure: Boolean(cfg.secure),
+        username: String(cfg.username ?? ''),
+        password: String(cfg.password ?? ''),
+      };
+    case 'gmail':
+      return {
+        global: true,
+        type: 'GMAIL' as const,
+        clientId: String(cfg.client_id ?? ''),
+        clientSecret: String(cfg.client_secret ?? ''),
+        refreshToken: String(cfg.refresh_token ?? ''),
+        from: String(cfg.from_email ?? ''),
+      };
+    case 'ses':
+      return {
+        global: true,
+        type: 'SES' as const,
+        region: String(cfg.region ?? ''),
+        accessKeyId: String(cfg.access_key_id ?? ''),
+        secretAccessKey: String(cfg.secret_access_key ?? ''),
+        from: String(cfg.from_email ?? ''),
+      };
+    default:
+      throw new BadRequestException(`Unsupported mail provider: ${providerSlug}`);
+  }
+}
+
+export function getFromAddress(config: unknown): string {
+  const cfg = (config as Cfg) ?? {};
+  const fromEmail = String(cfg.from_email ?? '');
+  const fromName = String(cfg.from_name ?? '');
+  return fromName ? `${fromName} <${fromEmail}>` : fromEmail;
+}
+
+export function getReplyToAddress(config: unknown): string | undefined {
+  const cfg = (config as Cfg) ?? {};
+  const replyToEmail = String(cfg.reply_to_email ?? '').trim();
+  if (!replyToEmail) return undefined;
+  const replyToName = String(cfg.reply_to_name ?? '').trim();
+  return replyToName ? `${replyToName} <${replyToEmail}>` : replyToEmail;
+}
+
+// ─── Storage utilities ────────────────────────────────────────────────────────
+
+/**
+ * Maps an integration_profile config JSON to the flat settings dict that the
+ * existing provider classes (S3Provider, AzureProvider, etc.) expect.
+ *
+ * integration_provider slugs → EnumProvider:
+ *   local, s3, gcs       → same
+ *   azure-blob           → abs
+ *   s3-compatible        → spaces
+ */
+export function buildStorageConfigFromIntegration(
+  providerSlug: string,
+  config: unknown,
+): Record<string, string> {
+  const cfg = (config as Cfg) ?? {};
+
+  switch (providerSlug.toLowerCase()) {
+    case 'local':
+      return {
+        'storage-local-path': String(cfg.base_path ?? 'storage'),
+      };
+    case 's3':
+      return {
+        'storage-s3-key': String(cfg.access_key_id ?? ''),
+        'storage-s3-secret': String(cfg.secret_access_key ?? ''),
+        'storage-s3-region': String(cfg.region ?? 'us-east-1'),
+        'storage-s3-bucket': String(cfg.bucket ?? ''),
+      };
+    case 'gcs':
+      return {
+        'storage-gcs-keyfile': String(cfg.key_file_json ?? ''),
+        'storage-gcs-bucket': String(cfg.bucket ?? ''),
+      };
+    case 'azure-blob':
+      return {
+        'storage-abs-account': String(cfg.account ?? ''),
+        'storage-abs-key': String(cfg.key ?? ''),
+        'storage-abs-container': String(cfg.container ?? ''),
+      };
+    case 's3-compatible':
+      return {
+        'storage-spaces-key': String(cfg.access_key_id ?? ''),
+        'storage-spaces-secret': String(cfg.secret_access_key ?? ''),
+        'storage-spaces-region': String(cfg.region ?? ''),
+        'storage-spaces-bucket': String(cfg.bucket ?? ''),
+        'storage-spaces-cdn': String(cfg.endpoint ?? ''),
+      };
+    default:
+      throw new BadRequestException(`Unsupported storage provider: ${providerSlug}`);
+  }
+}
+
+/** Maps integration_provider slug to EnumProvider. */
+export function resolveStorageEnumProvider(providerSlug: string): EnumProvider {
+  switch (providerSlug.toLowerCase()) {
+    case 'local': return EnumProvider.LOCAL;
+    case 's3': return EnumProvider.S3;
+    case 'gcs': return EnumProvider.GCS;
+    case 'azure-blob': return EnumProvider.AZURE;
+    case 's3-compatible': return EnumProvider.SPACES;
+    default:
+      throw new BadRequestException(`Unsupported storage provider: ${providerSlug}`);
+  }
+}
+
+/** Maps integration_provider slug to the slug used in the file_provider table. */
+export function resolveFileProviderSlug(providerSlug: string): string {
+  switch (providerSlug.toLowerCase()) {
+    case 'azure-blob': return 'abs';
+    case 's3-compatible': return 'spaces';
+    default: return providerSlug.toLowerCase();
+  }
+}
+
+// ─── AI utilities ─────────────────────────────────────────────────────────────
+
+// ─── OAuth utilities ──────────────────────────────────────────────────────────
+
+/** Maps an integration_profile config JSON to OAuth client credentials. */
+export function buildOAuthConfigFromIntegration(
+  _providerSlug: string,
+  config: unknown,
+): { clientId: string; clientSecret: string; tenantId?: string } {
+  const cfg = (config as Cfg) ?? {};
+  return {
+    clientId: String(cfg.client_id ?? ''),
+    clientSecret: String(cfg.client_secret ?? ''),
+    ...(cfg.tenant_id ? { tenantId: String(cfg.tenant_id) } : {}),
+  };
+}
+
+// ─── AI utilities ─────────────────────────────────────────────────────────────
+
+/** Maps an integration_profile config JSON to the API key and optional org needed by AI providers. */
+export function buildAiConfigFromIntegration(
+  providerSlug: string,
+  config: unknown,
+): { apiKey: string; organization?: string } {
+  const cfg = (config as Cfg) ?? {};
+  switch (providerSlug.toLowerCase()) {
+    case 'openai':
+      return {
+        apiKey: String(cfg.api_key ?? ''),
+        ...(cfg.organization ? { organization: String(cfg.organization) } : {}),
+      };
+    case 'gemini':
+    case 'claude':
+      return { apiKey: String(cfg.api_key ?? '') };
+    default:
+      throw new BadRequestException(`Unsupported AI provider: ${providerSlug}`);
+  }
+}

package/src/mail/mail.module.ts

@@ -15,52 +15,71 @@ import { MailService } from './mail.service';
       inject: [PrismaService],
       useFactory: async (prisma: PrismaService) => {
         try {
-          const profileIdSetting = await prisma.setting.findUnique({
-            where: { slug: 'mail-profile-id' },
-            select: { value: true },
+          const profileSettings = await prisma.setting.findMany({
+            where: {
+              slug: {
+                in: ['mail-integration-profile-id'],
+              },
+            },
+            select: { slug: true, value: true },
           });
 
-          const profileId = Number(profileIdSetting?.value);
+          const profileSettingsMap = new Map(
+            profileSettings.map((item) => [item.slug, item.value]),
+          );
+
+          const profileId = Number(
+            profileSettingsMap.get('mail-integration-profile-id'),
+          );
 
           if (!profileId || profileId <= 0) {
             return { global: true, type: 'SMTP', host: 'localhost', port: 1025, secure: false, username: '', password: '' } as MailModuleOptions;
           }
 
-          const profile = await prisma.mail_profile.findUnique({
+          const profile = await (prisma as any).integration_profile.findUnique({
             where: { id: profileId },
+            include: {
+              integration_provider: { select: { slug: true } },
+              integration_type: { select: { slug: true } },
+            },
           });
 
           if (!profile) {
             return { global: true, type: 'SMTP', host: 'localhost', port: 1025, secure: false, username: '', password: '' } as MailModuleOptions;
           }
 
+          if (profile.integration_type?.slug !== 'email') {
+            return { global: true, type: 'SMTP', host: 'localhost', port: 1025, secure: false, username: '', password: '' } as MailModuleOptions;
+          }
+
+          const cfg = (profile.config as Record<string, unknown>) ?? {};
           const base: MailModuleOptions = { global: true } as MailModuleOptions;
 
-          switch (profile.provider) {
-            case 'GMAIL':
+          switch (profile.integration_provider.slug) {
+            case 'gmail':
               return Object.assign(base, {
                 type: 'GMAIL',
-                clientId: profile.gmail_client_id ?? '',
-                clientSecret: profile.gmail_client_secret ?? '',
-                refreshToken: profile.gmail_refresh_token ?? '',
-                from: profile.from_email,
+                clientId: String(cfg.client_id ?? ''),
+                clientSecret: String(cfg.client_secret ?? ''),
+                refreshToken: String(cfg.refresh_token ?? ''),
+                from: String(cfg.from_email ?? ''),
               });
-            case 'SMTP':
+            case 'smtp':
               return Object.assign(base, {
                 type: 'SMTP',
-                host: profile.smtp_host ?? 'localhost',
-                port: profile.smtp_port ?? 1025,
-                secure: profile.smtp_secure ?? false,
-                username: profile.smtp_username ?? '',
-                password: profile.smtp_password ?? '',
+                host: String(cfg.host ?? 'localhost'),
+                port: Number(cfg.port ?? 1025),
+                secure: Boolean(cfg.secure),
+                username: String(cfg.username ?? ''),
+                password: String(cfg.password ?? ''),
               });
-            case 'SES':
+            case 'ses':
               return Object.assign(base, {
                 type: 'SES',
-                region: profile.ses_region ?? '',
-                accessKeyId: profile.ses_access_key_id ?? '',
-                secretAccessKey: profile.ses_secret_access_key ?? '',
-                from: profile.from_email,
+                region: String(cfg.region ?? ''),
+                accessKeyId: String(cfg.access_key_id ?? ''),
+                secretAccessKey: String(cfg.secret_access_key ?? ''),
+                from: String(cfg.from_email ?? ''),
               });
             default:
               return { global: true, type: 'SMTP', host: 'localhost', port: 1025, secure: false, username: '', password: '' } as MailModuleOptions;

package/src/mail/mail.service.ts

@@ -13,6 +13,10 @@ import {
   OnModuleInit,
 } from '@nestjs/common';
 import * as Handlebars from 'handlebars';
+import {
+  buildMailConfigFromIntegration,
+  getFromAddress,
+} from '../integration-profile/integration-profile.utils';
 import { IntegrationDeveloperApiService } from '../integration/services/integration-developer-api.service';
 import { SettingService } from '../setting/setting.service';
 import { CreateDTO } from './dto/create.dto';
@@ -25,6 +29,8 @@ import { UpdateDTO } from './dto/update.dto';
 export class MailService implements OnModuleInit {
   private readonly logger = new Logger(MailService.name);
   private readonly modelName = 'mail';
+  private readonly integrationProfileSettingSlug =
+    'mail-integration-profile-id';
 
   constructor(
     @Inject(forwardRef(() => PrismaService))
@@ -55,11 +61,10 @@ export class MailService implements OnModuleInit {
       },
     });
 
-    void this.syncConfiguredMailFlag();
   }
 
   private isMailConfigSlug(slug: string) {
-    return slug === 'mail-profile-id';
+    return slug === this.integrationProfileSettingSlug;
   }
 
   private isSettingEnabled(value: unknown) {
@@ -68,8 +73,10 @@ export class MailService implements OnModuleInit {
 
   private async syncConfiguredMailFlag() {
     try {
-      const settings = await this.setting.getSettingValues(['mail-profile-id']);
-      const profileId = settings['mail-profile-id'];
+      const settings = await this.setting.getSettingValues([
+        this.integrationProfileSettingSlug,
+      ]);
+      const profileId = settings[this.integrationProfileSettingSlug];
 
       if (!profileId || Number(profileId) <= 0) {
         await this.setting.setValue('configured-mail', 'false');
@@ -96,89 +103,58 @@ export class MailService implements OnModuleInit {
 
   /**
    * Reload mail configuration from database and update MailMainService.
+   * When profileId is provided, that profile is used directly.
+    * Otherwise the global integration profile setting is read.
    * Returns the active from address and the built config object.
    */
-  async reloadConfig(): Promise<{ success: boolean; provider: string; from: string; config: any }> {
+  async reloadConfig(profileId?: number): Promise<{ success: boolean; provider: string; from: string; config: any }> {
     try {
-      const settings = await this.setting.getSettingValues(['mail-profile-id']);
-      const profileId = Number(settings['mail-profile-id']);
+      let resolvedProfileId = profileId;
+
+      if (!resolvedProfileId) {
+        const settings = await this.setting.getSettingValues([
+          this.integrationProfileSettingSlug,
+        ]);
+        resolvedProfileId = Number(settings[this.integrationProfileSettingSlug]);
+      }
 
-      if (!profileId || profileId <= 0) {
+      if (!resolvedProfileId || resolvedProfileId <= 0) {
         throw new BadRequestException('No mail profile configured. Set a mail profile in the Mail settings.');
       }
 
-      const profile = await this.prismaService.mail_profile.findUnique({
-        where: { id: profileId },
+      const profile = await this.prismaService.integration_profile.findUnique({
+        where: { id: resolvedProfileId },
+        include: {
+          integration_provider: { select: { slug: true } },
+          integration_type: { select: { slug: true } },
+        },
       });
 
       if (!profile) {
         throw new NotFoundException(`Mail profile with id ${profileId} not found.`);
       }
 
-      const config = this.buildMailConfig(profile);
+      if (profile.integration_type?.slug !== 'email') {
+        throw new BadRequestException(
+          `Integration profile ${resolvedProfileId} is not an email profile.`,
+        );
+      }
+
+      const providerSlug = profile.integration_provider.slug;
+      const config = buildMailConfigFromIntegration(providerSlug, profile.config);
 
       this.mailMainService.setConfig(config);
-      this.logger.log(`Mail configuration reloaded from profile "${profile.name}" (${profile.provider})`);
+      this.logger.log(`Mail configuration reloaded from profile "${profile.name}" (${providerSlug})`);
 
-      const from = profile.from_name
-        ? `${profile.from_name} <${profile.from_email}>`
-        : profile.from_email;
+      const from = getFromAddress(profile.config);
 
-      return { success: true, provider: profile.provider, from, config };
+      return { success: true, provider: providerSlug, from, config };
     } catch (error) {
       this.logger.error('Error reloading mail configuration:', error);
       throw error;
     }
   }
 
-  private buildMailConfig(profile: {
-    provider: string;
-    from_email: string;
-    smtp_host?: string | null;
-    smtp_port?: number | null;
-    smtp_secure?: boolean | null;
-    smtp_username?: string | null;
-    smtp_password?: string | null;
-    gmail_client_id?: string | null;
-    gmail_client_secret?: string | null;
-    gmail_refresh_token?: string | null;
-    ses_access_key_id?: string | null;
-    ses_secret_access_key?: string | null;
-    ses_region?: string | null;
-  }): any {
-    switch (profile.provider) {
-      case 'GMAIL':
-        return {
-          global: true,
-          type: 'GMAIL' as const,
-          clientId: profile.gmail_client_id ?? '',
-          clientSecret: profile.gmail_client_secret ?? '',
-          refreshToken: profile.gmail_refresh_token ?? '',
-          from: profile.from_email,
-        };
-      case 'SMTP':
-        return {
-          global: true,
-          type: 'SMTP' as const,
-          host: profile.smtp_host ?? '',
-          port: profile.smtp_port ?? 587,
-          secure: profile.smtp_secure ?? false,
-          username: profile.smtp_username ?? '',
-          password: profile.smtp_password ?? '',
-        };
-      case 'SES':
-        return {
-          global: true,
-          type: 'SES' as const,
-          region: profile.ses_region ?? '',
-          accessKeyId: profile.ses_access_key_id ?? '',
-          secretAccessKey: profile.ses_secret_access_key ?? '',
-          from: profile.from_email,
-        };
-      default:
-        throw new BadRequestException(`Invalid mail provider: ${profile.provider}`);
-    }
-  }
 
   async list(locale: string, paginationParams: PaginationDTO) {
     const result = await this.localeService.listModelWithLocale(

package/src/mcp/guards/mcp-auth.guard.ts

@@ -38,7 +38,7 @@ export class McpAuthGuard implements CanActivate {
   private async verifyApiKey(request: Request, token: string): Promise<boolean> {
     const hash = this.security.hashWithPepper(token);
     const apiKey = await this.prisma.mcp_api_key.findFirst({
-      where: { token_hash: hash, revoked_at: null },
+      where: { token_hash: hash, type: 'mcp', revoked_at: null },
     });
 
     if (!apiKey) {

package/src/mcp/mcp-api-key.controller.ts

@@ -27,9 +27,9 @@ export class McpApiKeyController {
   @Post()
   create(
     @User() { id }: { id: number },
-    @Body() body: { name: string },
+    @Body() body: { name: string; type?: 'mcp' | 'api' },
   ) {
-    return this.mcpApiKeyService.create(id, body.name);
+    return this.mcpApiKeyService.create(id, body.name, body.type);
   }
 
   @Delete(':id')

package/src/mcp/mcp-api-key.service.ts

@@ -18,6 +18,7 @@ export class McpApiKeyService {
       select: {
         id: true,
         name: true,
+        type: true,
         token_prefix: true,
         last_used_at: true,
         expires_at: true,
@@ -27,8 +28,9 @@ export class McpApiKeyService {
     });
   }
 
-  async create(userId: number, name: string) {
-    const rawToken = 'hedhog_mcp_' + this.security.randomOpaque(36);
+  async create(userId: number, name: string, type: 'mcp' | 'api' = 'mcp') {
+    const prefix = type === 'api' ? 'hedhog_api_' : 'hedhog_mcp_';
+    const rawToken = prefix + this.security.randomOpaque(36);
     const tokenHash = this.security.hashWithPepper(rawToken);
     const tokenPrefix = rawToken.substring(0, 16);
 
@@ -36,12 +38,14 @@ export class McpApiKeyService {
       data: {
         user_id: userId,
         name,
+        type,
         token_hash: tokenHash,
         token_prefix: tokenPrefix,
       },
       select: {
         id: true,
         name: true,
+        type: true,
         token_prefix: true,
         created_at: true,
       },

package/src/mcp/mcp.module.ts

@@ -6,8 +6,8 @@ import { AiModule } from '../ai/ai.module';
 import { SystemModule } from '../core/system.module';
 import { DashboardModule } from '../dashboard/dashboard.module';
 import { FileModule } from '../file/file.module';
+import { IntegrationProfileModule } from '../integration-profile/integration-profile.module';
 import { MailModule } from '../mail/mail.module';
-import { MailProfileModule } from '../mail-profile/mail-profile.module';
 import { MailSentModule } from '../mail-sent/mail-sent.module';
 import { McpChatService } from '../mcp-chat/mcp-chat.service';
 import { MenuModule } from '../menu/menu.module';
@@ -37,7 +37,6 @@ import { CoreEventWebhooksMcpTools } from './tools/core-event-webhooks.mcp-tools
 import { CoreFilesMcpTools } from './tools/core-files.mcp-tools';
 import { CoreIntegrationEventsMcpTools } from './tools/core-integration-events.mcp-tools';
 import { CoreMailMcpTools } from './tools/core-mail.mcp-tools';
-import { CoreMailProfileMcpTools } from './tools/core-mail-profile.mcp-tools';
 import { CoreMailSentMcpTools } from './tools/core-mail-sent.mcp-tools';
 import { CoreMcpChatMcpTools } from './tools/core-mcp-chat.mcp-tools';
 import { CoreMenusMcpTools } from './tools/core-menus.mcp-tools';
@@ -69,7 +68,7 @@ import { AccessLogModule } from '../access-log/access-log.module';
     forwardRef(() => ScreenModule),
     forwardRef(() => FileModule),
     forwardRef(() => MailModule),
-    forwardRef(() => MailProfileModule),
+    forwardRef(() => IntegrationProfileModule),
     forwardRef(() => MailSentModule),
     forwardRef(() => SessionModule),
     forwardRef(() => NotificationModule),
@@ -98,7 +97,6 @@ import { AccessLogModule } from '../access-log/access-log.module';
     CoreSessionsMcpTools,
     CoreFilesMcpTools,
     CoreMailMcpTools,
-    CoreMailProfileMcpTools,
     CoreMailSentMcpTools,
     CoreNotificationsMcpTools,
     CoreDashboardMcpTools,
@@ -110,6 +108,6 @@ import { AccessLogModule } from '../access-log/access-log.module';
     CoreMcpChatMcpTools,
     CoreSystemMcpTools,
   ],
-  exports: [McpRegistryService, McpServerService],
+  exports: [McpRegistryService, McpServerService, McpApiKeyService],
 })
 export class McpModule {}

package/src/mcp-chat/mcp-chat.service.ts

@@ -11,6 +11,7 @@ import {
     NotFoundException,
 } from '@nestjs/common';
 import axios from 'axios';
+import { buildAiConfigFromIntegration } from '../integration-profile/integration-profile.utils';
 import { McpRegistryService, McpToolEntry } from '../mcp/mcp-registry.service';
 import { McpContext } from '../mcp/types/mcp-context.type';
 import { SettingService } from '../setting/setting.service';
@@ -772,30 +773,32 @@ export class McpChatService {
   }
 
   private async getProviderKey(): Promise<{ provider: 'openai' | 'gemini'; apiKey: string }> {
-    const settings = await this.setting.getSettingValues([
-      'mcp-ai-provider',
-      'ai-openai-api-key',
-      'ai-gemini-api-key',
-    ]);
-    const provider = ((settings['mcp-ai-provider'] as string) || 'openai') as 'openai' | 'gemini';
+    const settings = await this.setting.getSettingValues(['mcp-ai-profile-id']);
+    const profileId = Number(settings['mcp-ai-profile-id']);
 
-    if (provider === 'gemini') {
-      const key = settings['ai-gemini-api-key'] as string;
-      if (!key) {
-        throw new BadRequestException(
-          'Gemini API key is not configured. Please set it in Settings → AI → Gemini API Key.',
-        );
-      }
-      return { provider: 'gemini', apiKey: key };
-    }
-
-    const key = settings['ai-openai-api-key'] as string;
-    if (!key) {
+    if (!profileId) {
       throw new BadRequestException(
-        'OpenAI API key is not configured. Please set it in Settings → AI → OpenAI API Key.',
+        'No MCP AI profile configured. Select one in Settings → MCP.',
       );
     }
-    return { provider: 'openai', apiKey: key };
+
+    const profile = await this.prisma.integration_profile.findUnique({
+      where: { id: profileId },
+      include: { integration_provider: { select: { slug: true } } },
+    });
+
+    if (!profile) {
+      throw new BadRequestException(`MCP AI profile ${profileId} not found.`);
+    }
+
+    const providerSlug = profile.integration_provider.slug;
+    const { apiKey } = buildAiConfigFromIntegration(providerSlug, profile.config);
+
+    if (!apiKey) {
+      throw new BadRequestException(`MCP AI profile ${profileId} has no API key configured.`);
+    }
+
+    return { provider: providerSlug === 'gemini' ? 'gemini' : 'openai', apiKey };
   }
 
   private async buildOpenAiTools(

package/src/oauth/interfaces/OAuthProvider.ts

@@ -1,5 +1,5 @@
 export interface OAuthProvider {
   getAuthUrl(callbackPath: string): Promise<string>;
-  getProfile(code: string, type?: string): Promise<any>;
+  getProfile(code: string, type?: string, redirectUri?: string): Promise<any>;
   getProviderType(): string;
 }

package/src/oauth/oauth.controller.ts

@@ -87,6 +87,21 @@ export class OAuthController {
   }
 
 
+  @Public()
+  @Get(':provider/mobile/auth-url')
+  async mobileAuthUrl(
+    @Param('provider') provider: string,
+    @Query('redirectUri') redirectUri: string,
+  ) {
+    const authUrl = await this.service.getMobileAuthUrl(
+      provider as user_account_provider_52222e2ecb_enum,
+      redirectUri,
+    );
+
+    return { authUrl };
+  }
+
+
   @Public()
   @Get(':provider/register')
   async register(@Param('provider') provider: string, @Res() res) {
@@ -101,7 +116,7 @@ export class OAuthController {
   @Public()
   @Get(':provider/connect')
   async connect(@Param('provider') provider: string, @Res() res) {
-    const url = this.service.getAuthUrl(
+    const url = await this.service.getAuthUrl(
       provider as user_account_provider_52222e2ecb_enum,
       `/callback/${provider}/connect`,
     );
@@ -121,6 +136,8 @@ export class OAuthController {
     @Headers('x-forwarded-host') forwardedHost: string,
     @Param('provider') provider: string,
     @Query('code') code: string,
+    @Query('state') state: string,
+    @Query('redirectUri') redirectUri: string,
     @Res({ passthrough: true }) res,
   ) {
     this.logOAuthRequest('callback-login', provider, {
@@ -133,7 +150,18 @@ export class OAuthController {
       code,
     });
 
-    return this.service.handleCallback({ res, locale, ipAddress, userAgent, provider: provider as user_account_provider_52222e2ecb_enum, code, type: 'login' });
+    return this.service.handleCallback({
+      res,
+      locale,
+      ipAddress,
+      userAgent,
+      provider: provider as user_account_provider_52222e2ecb_enum,
+      code,
+      state,
+      type: 'login',
+      redirectUri,
+      includeRefreshTokenInBody: Boolean(redirectUri),
+    });
   }