@hed-hog/core 0.0.355 → 0.0.358

package/src/oauth/oauth.service.ts

@@ -1,14 +1,14 @@
 import { getLocaleText } from '@hed-hog/api-locale';
-import { PrismaService, user_account_provider_52222e2ecb_enum } from '@hed-hog/api-prisma';
+import { Prisma, PrismaService, user_account_provider_52222e2ecb_enum } from '@hed-hog/api-prisma';
 import {
-  BadRequestException,
-  ConflictException,
-  Inject,
-  Injectable,
-  Logger,
-  NotFoundException,
-  ServiceUnavailableException,
-  forwardRef
+    BadRequestException,
+    ConflictException,
+    Inject,
+    Injectable,
+    Logger,
+    NotFoundException,
+    ServiceUnavailableException,
+    forwardRef
 } from '@nestjs/common';
 import { AuthService } from '../auth/auth.service';
 import { FileService } from '../file/file.service';
@@ -21,9 +21,9 @@ import { UserService } from '../user/user.service';
 import { OAuthProvider } from './interfaces/OAuthProvider';
 import { OAuthCallbackCoordinatorService } from './oauth-callback-coordinator.service';
 import {
-  OAuthCallbackAlreadyProcessedError,
-  OAuthCallbackInProgressError,
-  OAuthProviderException,
+    OAuthCallbackAlreadyProcessedError,
+    OAuthCallbackInProgressError,
+    OAuthProviderException,
 } from './oauth.errors';
 import { FacebookProvider } from './providers/facebook.provider';
 import { GithubProvider } from './providers/github.provider';
@@ -41,12 +41,16 @@ type HandleCallbackProps = {
   type: 'login' | 'register' | 'connect' | 'disconnect';
   userId?: number;
   email?: string;
+  redirectUri?: string;
+  state?: string;
+  includeRefreshTokenInBody?: boolean;
 };
 
 @Injectable()
 export class OAuthService {
   private readonly logger = new Logger(OAuthService.name);
   private providers: Map<string, OAuthProvider> = new Map();
+  private readonly mobileOAuthStateTtlMs = 10 * 60 * 1000;
 
   constructor(
     google: GoogleProvider,
@@ -73,10 +77,36 @@ export class OAuthService {
     this.providers.set(microsoftEntraId.getProviderType(), microsoftEntraId);
   }
 
-  getAuthUrl(provider: user_account_provider_52222e2ecb_enum, callbackPath: string) {
+  async getAuthUrl(provider: user_account_provider_52222e2ecb_enum, callbackPath: string) {
+    const enabled = await this.isProviderEnabled(provider);
+    if (!enabled) {
+      throw new BadRequestException(`OAuth provider ${provider} is not enabled.`);
+    }
     return this.getProvider(provider).getAuthUrl(callbackPath);
   }
 
+  async getMobileAuthUrl(
+    provider: user_account_provider_52222e2ecb_enum,
+    redirectUri: string,
+  ) {
+    const sanitizedRedirectUri = String(redirectUri || '').trim();
+    if (!/^[a-z][a-z\d+.-]*:/i.test(sanitizedRedirectUri)) {
+      throw new BadRequestException('Invalid mobile redirect URI.');
+    }
+
+    const authUrl = await this.getAuthUrl(provider, sanitizedRedirectUri);
+    const flow = 'login';
+    const { token, signature } = await this.issueMobileState(
+      provider,
+      sanitizedRedirectUri,
+      flow,
+    );
+    const url = new URL(authUrl);
+    url.searchParams.set('state', `hhmob.${token}.${signature}.${flow}`);
+
+    return url.toString();
+  }
+
   async handleCallback({
     res,
     locale,
@@ -87,6 +117,9 @@ export class OAuthService {
     type,
     userId,
     email,
+    redirectUri,
+    state,
+    includeRefreshTokenInBody,
   }: HandleCallbackProps) {
     try {
       this.logger.log(
@@ -107,10 +140,23 @@ export class OAuthService {
         );
       }
 
+      if (
+        redirectUri &&
+        !(await this.consumeMobileState(state, provider, redirectUri))
+      ) {
+        throw new BadRequestException(
+          getLocaleText(
+            'oauth.callback.invalidState',
+            locale,
+            'OAuth callback state is invalid or expired. Start the sign-in flow again.',
+          ),
+        );
+      }
+
       const callbackKey = this.buildCallbackKey(provider, type, code);
 
       return await this.callbackCoordinator.execute(callbackKey, async () => {
-        const profile = await this.getProvider(provider).getProfile(code, type);
+        const profile = await this.getProvider(provider).getProfile(code, type, redirectUri);
         const result = await this.finalizeCallback({
           res,
           locale,
@@ -120,6 +166,7 @@ export class OAuthService {
           type,
           profile,
           userId,
+          includeRefreshTokenInBody,
         });
 
         this.logger.log(
@@ -143,19 +190,37 @@ export class OAuthService {
     return prov;
   }
 
-  private async getProviderScopes(provider: user_account_provider_52222e2ecb_enum) {
-    const settingKey = `${String(provider).toLowerCase().replace(/-/g, '_')}_scopes`;
-
-    const settings = await this.setting.getSettingValues([
-      'oauth-mfa',
-      'google_scopes',
-      'facebook_scopes',
-      'github_scopes',
-      'microsoft_scopes',
-      'microsoft_entra_id_scopes',
-    ]);
+  private static readonly PROVIDER_SCOPE_SLUGS: Record<string, string> = {
+    google: 'oauth-google-scopes',
+    facebook: 'oauth-facebook-scopes',
+    github: 'oauth-github-scopes',
+    microsoft: 'oauth-microsoft-scopes',
+    'microsoft-entra-id': 'oauth-microsoft-entra-id-scopes',
+    microsoft_entra_id: 'oauth-microsoft-entra-id-scopes',
+  };
+
+  private static readonly PROVIDER_ENABLED_SLUGS: Record<string, string> = {
+    google: 'oauth-google-enabled',
+    facebook: 'oauth-facebook-enabled',
+    github: 'oauth-github-enabled',
+    microsoft: 'oauth-microsoft-enabled',
+    'microsoft-entra-id': 'oauth-microsoft-entra-id-enabled',
+    microsoft_entra_id: 'oauth-microsoft-entra-id-enabled',
+  };
+
+  async isProviderEnabled(provider: user_account_provider_52222e2ecb_enum): Promise<boolean> {
+    const slug = OAuthService.PROVIDER_ENABLED_SLUGS[String(provider).toLowerCase()];
+    if (!slug) return false;
+    const settings = await this.setting.getSettingValues([slug]);
+    return settings[slug] === true || settings[slug] === 'true';
+  }
 
-    return settings[settingKey].join(',') || '';
+  private async getProviderScopes(provider: user_account_provider_52222e2ecb_enum) {
+    const settingKey = OAuthService.PROVIDER_SCOPE_SLUGS[String(provider).toLowerCase()];
+    if (!settingKey) return '';
+    const settings = await this.setting.getSettingValues([settingKey]);
+    const scopes = settings[settingKey];
+    return Array.isArray(scopes) ? scopes.join(',') : String(scopes ?? '');
   }
 
   private buildCallbackKey(
@@ -176,6 +241,86 @@ export class OAuthService {
       : userAgent;
   }
 
+  private async issueMobileState(
+    provider: user_account_provider_52222e2ecb_enum,
+    redirectUri: string,
+    flow: 'login' | 'register' | 'connect',
+  ) {
+    const token = this.security.randomOpaque(24);
+    const signature = this.security.signHmacSha256(`oauth-mobile-state:${token}`);
+    const tokenHash = this.security.hashSha256(token);
+    const expiresAt = new Date(Date.now() + this.mobileOAuthStateTtlMs);
+
+    await this.prisma.$executeRaw(
+      Prisma.sql`
+        INSERT INTO oauth_mobile_state_token (
+          token_hash,
+          provider,
+          redirect_uri,
+          flow_type,
+          expires_at,
+          created_at
+        ) VALUES (
+          ${tokenHash},
+          ${String(provider).toLowerCase()},
+          ${redirectUri},
+          ${flow},
+          ${expiresAt},
+          NOW()
+        )
+      `,
+    );
+
+    return { token, signature };
+  }
+
+  private async consumeMobileState(
+    encodedState: string | undefined,
+    provider: user_account_provider_52222e2ecb_enum,
+    redirectUri: string,
+  ) {
+    if (!encodedState || !encodedState.startsWith('hhmob.')) {
+      return false;
+    }
+
+    const parts = encodedState.split('.');
+    const stateToken = parts[1];
+    const signature = parts[2];
+    const flow = parts[3] as 'login' | 'register' | 'connect' | undefined;
+
+    if (!stateToken || !signature || !flow) {
+      return false;
+    }
+
+    if (!['login', 'register', 'connect'].includes(flow)) {
+      return false;
+    }
+
+    const hasValidSignature = this.security.verifyHmacSha256(
+      `oauth-mobile-state:${stateToken}`,
+      signature,
+    );
+    if (!hasValidSignature) {
+      return false;
+    }
+
+    const tokenHash = this.security.hashSha256(stateToken);
+    const consumedRows = await this.prisma.$executeRaw(
+      Prisma.sql`
+        UPDATE oauth_mobile_state_token
+        SET consumed_at = NOW()
+        WHERE token_hash = ${tokenHash}
+          AND provider = ${String(provider).toLowerCase()}
+          AND redirect_uri = ${redirectUri}
+          AND flow_type = ${flow}
+          AND expires_at > NOW()
+          AND consumed_at IS NULL
+      `,
+    );
+
+    return Number(consumedRows) > 0;
+  }
+
   private async finalizeCallback({
     res,
     locale,
@@ -185,14 +330,15 @@ export class OAuthService {
     type,
     profile,
     userId,
-  }: Omit<HandleCallbackProps, 'code' | 'email'> & { profile: any }) {
+    includeRefreshTokenInBody,
+  }: Omit<HandleCallbackProps, 'code' | 'email' | 'redirectUri' | 'state'> & { profile: any }) {
     switch (type) {
       case 'login':
-        return this.handleLogin(res, locale, ipAddress, userAgent, provider, profile);
+        return this.handleLogin(res, locale, ipAddress, userAgent, provider, profile, includeRefreshTokenInBody);
       case 'register':
-        return this.handleRegister(res, locale, ipAddress, userAgent, provider, profile);
+        return this.handleRegister(res, locale, ipAddress, userAgent, provider, profile, includeRefreshTokenInBody);
       case 'connect':
-        return this.handleConnect(res, locale, ipAddress, userAgent, provider, profile, userId);
+        return this.handleConnect(res, locale, ipAddress, userAgent, provider, profile, userId, includeRefreshTokenInBody);
       default:
         throw new BadRequestException(
           getLocaleText('oauth.callback.invalidType', locale, 'Unsupported OAuth callback type.'),
@@ -200,6 +346,18 @@ export class OAuthService {
     }
   }
 
+  private formatAuthResponse(
+    accessToken: string,
+    refreshToken: string,
+    includeRefreshTokenInBody?: boolean,
+  ) {
+    if (includeRefreshTokenInBody) {
+      return { accessToken, refreshToken };
+    }
+
+    return { accessToken };
+  }
+
   private resolveProfileScopes(provider: user_account_provider_52222e2ecb_enum, profile: any) {
     if (typeof profile?.oauth_scopes === 'string') {
       return profile.oauth_scopes;
@@ -274,7 +432,7 @@ export class OAuthService {
     );
   }
 
-  private async handleLogin(res: Response, locale: string, ipAddress: string, userAgent: string, provider: user_account_provider_52222e2ecb_enum, profile: any) {
+  private async handleLogin(res: Response, locale: string, ipAddress: string, userAgent: string, provider: user_account_provider_52222e2ecb_enum, profile: any, includeRefreshTokenInBody?: boolean) {
     const userAccount = await this.prisma.user_account.findFirst({
       where: {
         provider: String(provider).toLowerCase().replace(/-/g, '_') as user_account_provider_52222e2ecb_enum,
@@ -324,11 +482,11 @@ export class OAuthService {
       );
 
       await this.token.setRefreshTokenCookie(locale, res, refreshToken, session.expires_at);
-      return { accessToken };
+      return this.formatAuthResponse(accessToken, refreshToken, includeRefreshTokenInBody);
     }
   }
 
-  private async handleRegister(res: Response, locale: string, ipAddress: string, userAgent: string, provider: user_account_provider_52222e2ecb_enum, profile: any) {
+  private async handleRegister(res: Response, locale: string, ipAddress: string, userAgent: string, provider: user_account_provider_52222e2ecb_enum, profile: any, includeRefreshTokenInBody?: boolean) {
     const existingUser = await this.prisma.user_identifier.findFirst({
       where: {
         type: 'email',
@@ -415,7 +573,7 @@ export class OAuthService {
       userAgent
     );
     await this.token.setRefreshTokenCookie(locale, res, refreshToken, session.expires_at);
-    return { accessToken };
+    return this.formatAuthResponse(accessToken, refreshToken, includeRefreshTokenInBody);
   }
 
   private async handleConnect(
@@ -426,6 +584,7 @@ export class OAuthService {
     provider: user_account_provider_52222e2ecb_enum,
     profile: any,
     userId: number,
+    includeRefreshTokenInBody?: boolean,
   ) {
     const existingAccount = await this.prisma.user_account.findFirst({
       where: {
@@ -482,7 +641,7 @@ export class OAuthService {
     await this.user.registerUserActivity(userId, 'oauth-connect');
     const { accessToken, refreshToken, session } = await this.auth.getAuthenticationPayload(locale, user.id, ipAddress, userAgent);
     await this.token.setRefreshTokenCookie(locale, res, refreshToken, session.expires_at);
-    return { accessToken };
+    return this.formatAuthResponse(accessToken, refreshToken, includeRefreshTokenInBody);
   }
 
   private async handleDisconnect(res: Response, locale: string, ipAddress: string, userAgent: string, provider: user_account_provider_52222e2ecb_enum, email: string) {

package/src/oauth/providers/abstract.provider.ts

@@ -7,7 +7,7 @@ export abstract class BaseOAuthProvider implements OAuthProvider {
   constructor(protected readonly http: HttpService) {}
 
   abstract getAuthUrl(callbackPath: string): Promise<string>;
-  abstract getProfile(code: string, type?: string): Promise<any>;
+  abstract getProfile(code: string, type?: string, redirectUri?: string): Promise<any>;
   abstract getProviderType(): string;
 
   protected async fetchToken({

package/src/oauth/providers/facebook.provider.ts

@@ -1,16 +1,18 @@
+import { PrismaService } from '@hed-hog/api-prisma';
 import { HttpService } from '@nestjs/axios';
-import { forwardRef, Inject, Injectable } from '@nestjs/common';
+import { BadRequestException, forwardRef, Inject, Injectable } from '@nestjs/common';
+import { buildOAuthConfigFromIntegration } from '../../integration-profile/integration-profile.utils';
 import { SettingService } from '../../setting/setting.service';
 import { BaseOAuthProvider } from './abstract.provider';
 
 @Injectable()
-export class FacebookProvider
-  extends BaseOAuthProvider {
+export class FacebookProvider extends BaseOAuthProvider {
 
   constructor(
     http: HttpService,
     @Inject(forwardRef(() => SettingService))
     private readonly setting: SettingService,
+    private readonly prisma: PrismaService,
   ) {
     super(http);
   }
@@ -19,42 +21,56 @@ export class FacebookProvider
     return 'FACEBOOK';
   }
 
-  async getAuthUrl(callbackPath: string) {
+  private async loadConfig() {
     const settings = await this.setting.getSettingValues([
-      'facebook_client_id',
-      'facebook_client_secret',
-      'facebook_scopes',
+      'oauth-facebook-profile-id',
       'url',
     ]);
+    const profileId = Number(settings['oauth-facebook-profile-id']);
+    if (!profileId) throw new BadRequestException('Facebook OAuth profile not configured.');
+
+    const profile = await this.prisma.integration_profile.findUnique({
+      where: { id: profileId },
+      include: { integration_provider: { select: { slug: true } } },
+    });
+    if (!profile) throw new BadRequestException('Facebook OAuth profile not found.');
+
+    const { clientId, clientSecret } = buildOAuthConfigFromIntegration(
+      profile.integration_provider.slug,
+      profile.config,
+    );
+    return { clientId, clientSecret, baseUrl: String(settings['url'] ?? '') };
+  }
 
-    const redirectURI = new URL(callbackPath, settings['url']).toString();
+  async getAuthUrl(callbackPath: string) {
+    const { clientId, baseUrl } = await this.loadConfig();
+    const settings = await this.setting.getSettingValues(['oauth-facebook-scopes']);
+    const scopes: string[] = settings['oauth-facebook-scopes'] ?? ['email'];
+    const redirectURI = new URL(callbackPath, baseUrl).toString();
 
     const params = new URLSearchParams({
-      client_id: settings['facebook_client_id'],
+      client_id: clientId,
       redirect_uri: redirectURI,
       response_type: 'code',
-      scope: (settings['facebook_scopes'] ?? ['email']).join(','),
+      scope: scopes.join(','),
       auth_type: 'rerequest',
     });
 
     return `https://www.facebook.com/v17.0/dialog/oauth?${params}`;
   }
 
-  async getProfile(code: string, type: string): Promise<any> {
+  async getProfile(code: string, type: string, redirectUri?: string): Promise<any> {
+    const { clientId, clientSecret, baseUrl } = await this.loadConfig();
 
-    const settings = await this.setting.getSettingValues([
-      'facebook_client_id',
-      'facebook_client_secret',
-      'facebook_scopes',
-      'url',
-    ]);
+    const resolvedRedirectUri =
+      redirectUri?.trim() || `${baseUrl}/oauth/facebook/callback/${type}`;
 
     const token = await this.fetchToken({
       code,
       url: 'https://graph.facebook.com/v17.0/oauth/access_token',
-      clientId: settings['facebook_client_id'],
-      clientSecret: settings['facebook_client_secret'],
-      redirectUri: `${settings['url']}/oauth/facebook/callback/${type}`,
+      clientId,
+      clientSecret,
+      redirectUri: resolvedRedirectUri,
     });
     const profile = await this.fetchProfile(
       token.access_token,

package/src/oauth/providers/github.provider.ts

@@ -1,16 +1,22 @@
+import { PrismaService } from '@hed-hog/api-prisma';
 import { HttpService } from '@nestjs/axios';
-import { forwardRef, Inject, Injectable } from '@nestjs/common';
+import { BadRequestException, forwardRef, Inject, Injectable } from '@nestjs/common';
+import { buildOAuthConfigFromIntegration } from '../../integration-profile/integration-profile.utils';
 import { SettingService } from '../../setting/setting.service';
 import { BaseOAuthProvider } from './abstract.provider';
 
 @Injectable()
-export class GithubProvider
-  extends BaseOAuthProvider {
+export class GithubProvider extends BaseOAuthProvider {
+
+  private isAbsoluteCallbackPath(value: string) {
+    return /^[a-z][a-z\d+.-]*:/i.test(String(value || '').trim());
+  }
 
   constructor(
     http: HttpService,
     @Inject(forwardRef(() => SettingService))
     private readonly setting: SettingService,
+    private readonly prisma: PrismaService,
   ) {
     super(http);
   }
@@ -19,21 +25,41 @@ export class GithubProvider
     return 'GITHUB';
   }
 
-  async getAuthUrl(callbackPath: string) {
-
+  private async loadConfig() {
     const settings = await this.setting.getSettingValues([
-      'github_client_id',
-      'github_client_secret',
-      'github_scopes',
+      'oauth-github-profile-id',
       'api-url',
     ]);
+    const profileId = Number(settings['oauth-github-profile-id']);
+    if (!profileId) throw new BadRequestException('GitHub OAuth profile not configured.');
+
+    const profile = await this.prisma.integration_profile.findUnique({
+      where: { id: profileId },
+      include: { integration_provider: { select: { slug: true } } },
+    });
+    if (!profile) throw new BadRequestException('GitHub OAuth profile not found.');
+
+    const { clientId, clientSecret } = buildOAuthConfigFromIntegration(
+      profile.integration_provider.slug,
+      profile.config,
+    );
+    return { clientId, clientSecret, apiUrl: String(settings['api-url'] ?? '') };
+  }
+
+  async getAuthUrl(callbackPath: string) {
+    const { clientId, apiUrl } = await this.loadConfig();
+    const settings = await this.setting.getSettingValues(['oauth-github-scopes']);
+    const scopes: string[] = settings['oauth-github-scopes'] ?? ['read:user', 'user:email'];
 
     const fixedCallbackPath = '/oauth/github/callback';
-    const redirectURI = new URL(fixedCallbackPath, settings['api-url']).toString();
-    const scopes = settings['github_scopes'];
-    const type = callbackPath.split('/').pop() || 'login';
+    const redirectURI = this.isAbsoluteCallbackPath(callbackPath)
+      ? callbackPath
+      : new URL(fixedCallbackPath, apiUrl).toString();
+    const type = this.isAbsoluteCallbackPath(callbackPath)
+      ? 'login'
+      : callbackPath.split('/').pop() || 'login';
     const params = new URLSearchParams({
-      client_id: settings['github_client_id'],
+      client_id: clientId,
       redirect_uri: redirectURI,
       scope: scopes.join(' '),
       allow_signup: 'true',
@@ -43,21 +69,18 @@ export class GithubProvider
     return `https://github.com/login/oauth/authorize?${params.toString()}`;
   }
 
-  async getProfile(code: string) {
-    const settings = await this.setting.getSettingValues([
-      'github_client_id',
-      'github_client_secret',
-      'github_scopes',
-      'api-url',
-    ]);
+  async getProfile(code: string, _type?: string, redirectUri?: string) {
+    const { clientId, clientSecret, apiUrl } = await this.loadConfig();
 
     const fixedCallbackPath = '/oauth/github/callback';
-    const redirectURI = new URL(fixedCallbackPath, settings['api-url'].replace(":3200", ":3100")).toString();
+    const redirectURI = redirectUri?.trim()
+      ? redirectUri.trim()
+      : new URL(fixedCallbackPath, apiUrl.replace(':3200', ':3100')).toString();
     const tokenResponse = await this.http.axiosRef.post(
       'https://github.com/login/oauth/access_token',
       {
-        client_id: settings['github_client_id'],
-        client_secret: settings['github_client_secret'],
+        client_id: clientId,
+        client_secret: clientSecret,
         code,
         redirect_uri: redirectURI,
       },
@@ -114,4 +137,4 @@ export class GithubProvider
       },
     };
   }
-}
+}

package/src/oauth/providers/google.provider.ts

@@ -1,5 +1,7 @@
+import { PrismaService } from '@hed-hog/api-prisma';
 import { HttpService } from '@nestjs/axios';
-import { forwardRef, Inject, Injectable } from '@nestjs/common';
+import { BadRequestException, forwardRef, Inject, Injectable } from '@nestjs/common';
+import { buildOAuthConfigFromIntegration } from '../../integration-profile/integration-profile.utils';
 import { SettingService } from '../../setting/setting.service';
 import { BaseOAuthProvider } from './abstract.provider';
 
@@ -10,6 +12,7 @@ export class GoogleProvider extends BaseOAuthProvider {
     http: HttpService,
     @Inject(forwardRef(() => SettingService))
     private readonly setting: SettingService,
+    private readonly prisma: PrismaService,
   ) {
     super(http);
   }
@@ -18,22 +21,38 @@ export class GoogleProvider extends BaseOAuthProvider {
     return 'GOOGLE';
   }
 
-  async getAuthUrl(callbackPath: string) {
-
+  private async loadConfig() {
     const settings = await this.setting.getSettingValues([
-      'google_client_id',
-      'google_client_secret',
-      'google_scopes',
+      'oauth-google-profile-id',
       'url',
     ]);
+    const profileId = Number(settings['oauth-google-profile-id']);
+    if (!profileId) throw new BadRequestException('Google OAuth profile not configured.');
+
+    const profile = await this.prisma.integration_profile.findUnique({
+      where: { id: profileId },
+      include: { integration_provider: { select: { slug: true } } },
+    });
+    if (!profile) throw new BadRequestException('Google OAuth profile not found.');
+
+    const { clientId, clientSecret } = buildOAuthConfigFromIntegration(
+      profile.integration_provider.slug,
+      profile.config,
+    );
+    return { clientId, clientSecret, baseUrl: String(settings['url'] ?? '') };
+  }
 
-    const redirectURI = new URL(callbackPath, settings['url']).toString();
+  async getAuthUrl(callbackPath: string) {
+    const { clientId, baseUrl } = await this.loadConfig();
+    const settings = await this.setting.getSettingValues(['oauth-google-scopes']);
+    const scopes: string[] = settings['oauth-google-scopes'] ?? ['email', 'profile'];
+    const redirectURI = new URL(callbackPath, baseUrl).toString();
 
     const params = new URLSearchParams({
-      client_id: settings['google_client_id'],
+      client_id: clientId,
       redirect_uri: redirectURI,
       response_type: 'code',
-      scope: (settings['google_scopes'] ?? []).join(' '),
+      scope: scopes.join(' '),
       access_type: 'offline',
       prompt: 'consent',
     });
@@ -41,21 +60,18 @@ export class GoogleProvider extends BaseOAuthProvider {
     return `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
   }
 
-  async getProfile(code: string, type: string) {
+  async getProfile(code: string, type: string, redirectUri?: string) {
+    const { clientId, clientSecret, baseUrl } = await this.loadConfig();
 
-    const settings = await this.setting.getSettingValues([
-      'google_client_id',
-      'google_client_secret',
-      'google_scopes',
-      'url',
-    ]);
+    const resolvedRedirectUri =
+      redirectUri?.trim() || `${baseUrl}/callback/google/${type}`;
 
     const token = await this.fetchToken({
       code,
       url: 'https://oauth2.googleapis.com/token',
-      clientId: settings['google_client_id'],
-      clientSecret: settings['google_client_secret'],
-      redirectUri: `${settings['url']}/callback/google/${type}`,
+      clientId,
+      clientSecret,
+      redirectUri: resolvedRedirectUri,
     });
 
     const basicProfile = await this.fetchProfile(
@@ -66,7 +82,7 @@ export class GoogleProvider extends BaseOAuthProvider {
     const peopleProfile = await this.getGoogleProfileFromAccessToken(
       token.access_token,
     );
-    
+
     return {
       ...basicProfile,
       gender: peopleProfile.gender,