@hed-hog/core 0.0.355 → 0.0.358

package/src/oauth/providers/microsoft-entra-id.provider.ts

@@ -1,5 +1,7 @@
+import { PrismaService } from '@hed-hog/api-prisma';
 import { HttpService } from '@nestjs/axios';
-import { forwardRef, Inject, Injectable, Logger } from '@nestjs/common';
+import { BadRequestException, forwardRef, Inject, Injectable, Logger } from '@nestjs/common';
+import { buildOAuthConfigFromIntegration } from '../../integration-profile/integration-profile.utils';
 import { SettingService } from '../../setting/setting.service';
 import { BaseOAuthProvider } from './abstract.provider';
 
@@ -11,6 +13,7 @@ export class MicrosoftEntraIdProvider extends BaseOAuthProvider {
     http: HttpService,
     @Inject(forwardRef(() => SettingService))
     private readonly setting: SettingService,
+    private readonly prisma: PrismaService,
   ) {
     super(http);
   }
@@ -32,39 +35,42 @@ export class MicrosoftEntraIdProvider extends BaseOAuthProvider {
     return 'MICROSOFT-ENTRA-ID';
   }
 
-  async getAuthUrl(callbackPath: string) {
+  private async loadConfig() {
     const settings = await this.setting.getSettingValues([
-      'microsoft_entra_id_client_id',
-      'microsoft_entra_id_client_secret',
-      'microsoft_entra_id_scopes',
-      'microsoft_entra_id_tenant_id',
+      'oauth-microsoft-entra-id-profile-id',
       'url',
     ]);
+    const profileId = Number(settings['oauth-microsoft-entra-id-profile-id']);
+    if (!profileId) throw new BadRequestException('Microsoft Entra ID OAuth profile not configured.');
 
-    if (
-      !settings['microsoft_entra_id_client_id'] ||
-      !settings['microsoft_entra_id_client_secret'] ||
-      !settings['microsoft_entra_id_scopes'] ||
-      !settings['microsoft_entra_id_tenant_id'] ||
-      !settings['url']
-    ) {
-      this.logger.error(
-        'Microsoft Entra ID OAuth is missing required settings. Verify client id, client secret, scopes, tenant id, and url.',
-      );
-      throw new Error('Microsoft Entra ID OAuth is not configured properly. Please configure microsoft_entra_id_client_id, microsoft_entra_id_client_secret, microsoft_entra_id_scopes, microsoft_entra_id_tenant_id, and url settings.');
+    const profile = await this.prisma.integration_profile.findUnique({
+      where: { id: profileId },
+      include: { integration_provider: { select: { slug: true } } },
+    });
+    if (!profile) throw new BadRequestException('Microsoft Entra ID OAuth profile not found.');
+
+    const { clientId, clientSecret, tenantId } = buildOAuthConfigFromIntegration(
+      profile.integration_provider.slug,
+      profile.config,
+    );
+    if (!tenantId) {
+      throw new BadRequestException('Microsoft Entra ID OAuth profile is missing tenant_id.');
     }
+    return { clientId, clientSecret, tenantId, baseUrl: String(settings['url'] ?? '') };
+  }
 
-    const tenantId = settings['microsoft_entra_id_tenant_id'];
-    const redirectURI = this.buildRedirectUri(settings['url'], callbackPath);
-    const baseScopes = Array.isArray(settings['microsoft_entra_id_scopes'])
-      ? settings['microsoft_entra_id_scopes']
-      : [];
+  async getAuthUrl(callbackPath: string) {
+    const { clientId, tenantId, baseUrl } = await this.loadConfig();
+    const settings = await this.setting.getSettingValues(['oauth-microsoft-entra-id-scopes']);
+    const baseScopes: string[] = settings['oauth-microsoft-entra-id-scopes'] ?? ['openid', 'profile', 'email'];
     const scopes = baseScopes.includes('offline_access')
       ? baseScopes
       : [...baseScopes, 'offline_access'];
+
+    const redirectURI = this.buildRedirectUri(baseUrl, callbackPath);
     const isConnectFlow = callbackPath.includes('/connect');
     const params = new URLSearchParams({
-      client_id: settings['microsoft_entra_id_client_id'],
+      client_id: clientId,
       redirect_uri: redirectURI,
       response_type: 'code',
       scope: scopes.join(' '),
@@ -75,43 +81,33 @@ export class MicrosoftEntraIdProvider extends BaseOAuthProvider {
       `OAuth auth URL requested: provider=MICROSOFT-ENTRA-ID redirectUri=${redirectURI} hasOfflineAccess=${scopes.includes('offline_access') ? 'yes' : 'no'} connectFlow=${isConnectFlow ? 'yes' : 'no'} tenantConfigured=${tenantId ? 'yes' : 'no'}`,
     );
 
-    // Force consent only for explicit account connect, not for routine login.
     if (isConnectFlow) {
       params.set('prompt', 'consent');
     }
 
-    const authUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize?${params.toString()}`;
-    return authUrl;
+    return `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize?${params.toString()}`;
   }
 
-  async getProfile(code: string, type: string): Promise<any> {
-    let redirectUri = '';
+  async getProfile(code: string, type: string, redirectUri?: string): Promise<any> {
+    let resolvedRedirectUri = '';
 
     try {
-      const settings = await this.setting.getSettingValues([
-        'microsoft_entra_id_client_id',
-        'microsoft_entra_id_client_secret',
-        'microsoft_entra_id_scopes',
-        'microsoft_entra_id_tenant_id',
-        'url',
-      ]);
-      const tenantId = settings['microsoft_entra_id_tenant_id'];
-      const scopes = settings['microsoft_entra_id_scopes'] ?? [];
-      redirectUri = this.buildRedirectUri(
-        settings['url'],
-        `/callback/microsoft-entra-id/${type}`,
-      );
+      const { clientId, clientSecret, tenantId, baseUrl } = await this.loadConfig();
+      const settings = await this.setting.getSettingValues(['oauth-microsoft-entra-id-scopes']);
+      const scopes: string[] = settings['oauth-microsoft-entra-id-scopes'] ?? [];
+      resolvedRedirectUri =
+        redirectUri?.trim() || this.buildRedirectUri(baseUrl, `/callback/microsoft-entra-id/${type}`);
 
       this.logger.log(
-        `OAuth token exchange started: provider=MICROSOFT-ENTRA-ID type=${type} redirectUri=${redirectUri} hasCode=${code ? 'yes' : 'no'} codeLength=${code?.length ?? 0}`,
+        `OAuth token exchange started: provider=MICROSOFT-ENTRA-ID type=${type} redirectUri=${resolvedRedirectUri} hasCode=${code ? 'yes' : 'no'} codeLength=${code?.length ?? 0}`,
       );
 
       const token = await this.fetchToken({
         code,
         url: `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`,
-        clientId: settings['microsoft_entra_id_client_id'],
-        clientSecret: settings['microsoft_entra_id_client_secret'],
-        redirectUri,
+        clientId,
+        clientSecret,
+        redirectUri: resolvedRedirectUri,
       });
 
       const profile = await this.fetchProfile(
@@ -141,7 +137,7 @@ export class MicrosoftEntraIdProvider extends BaseOAuthProvider {
       const mappedError = this.mapProviderError('Microsoft Entra ID', error);
 
       this.logger.warn(
-        `OAuth callback failed: provider=MICROSOFT-ENTRA-ID status=${mappedError.status ?? 'unknown'} error=${mappedError.providerError ?? 'unknown'} providerCode=${mappedError.providerErrorCode ?? 'n/a'} reason=${mappedError.reason} redirectUri=${redirectUri || 'unresolved'}`,
+        `OAuth callback failed: provider=MICROSOFT-ENTRA-ID status=${mappedError.status ?? 'unknown'} error=${mappedError.providerError ?? 'unknown'} providerCode=${mappedError.providerErrorCode ?? 'n/a'} reason=${mappedError.reason} redirectUri=${resolvedRedirectUri || 'unresolved'}`,
       );
 
       throw mappedError;

package/src/oauth/providers/microsoft.provider.ts

@@ -1,16 +1,18 @@
+import { PrismaService } from '@hed-hog/api-prisma';
 import { HttpService } from '@nestjs/axios';
-import { forwardRef, Inject, Injectable } from '@nestjs/common';
+import { BadRequestException, forwardRef, Inject, Injectable } from '@nestjs/common';
+import { buildOAuthConfigFromIntegration } from '../../integration-profile/integration-profile.utils';
 import { SettingService } from '../../setting/setting.service';
 import { BaseOAuthProvider } from './abstract.provider';
 
 @Injectable()
-export class MicrosoftProvider
-  extends BaseOAuthProvider  {
+export class MicrosoftProvider extends BaseOAuthProvider {
 
   constructor(
     http: HttpService,
     @Inject(forwardRef(() => SettingService))
     private readonly setting: SettingService,
+    private readonly prisma: PrismaService,
   ) {
     super(http);
   }
@@ -19,19 +21,35 @@ export class MicrosoftProvider
     return 'MICROSOFT';
   }
 
-  async getAuthUrl(callbackPath: string) {
-
+  private async loadConfig() {
     const settings = await this.setting.getSettingValues([
-      'microsoft_client_id',
-      'microsoft_client_secret',
-      'microsoft_scopes',
+      'oauth-microsoft-profile-id',
       'url',
     ]);
+    const profileId = Number(settings['oauth-microsoft-profile-id']);
+    if (!profileId) throw new BadRequestException('Microsoft OAuth profile not configured.');
+
+    const profile = await this.prisma.integration_profile.findUnique({
+      where: { id: profileId },
+      include: { integration_provider: { select: { slug: true } } },
+    });
+    if (!profile) throw new BadRequestException('Microsoft OAuth profile not found.');
+
+    const { clientId, clientSecret, tenantId } = buildOAuthConfigFromIntegration(
+      profile.integration_provider.slug,
+      profile.config,
+    );
+    return { clientId, clientSecret, tenantId, baseUrl: String(settings['url'] ?? '') };
+  }
+
+  async getAuthUrl(callbackPath: string) {
+    const { clientId, baseUrl } = await this.loadConfig();
+    const settings = await this.setting.getSettingValues(['oauth-microsoft-scopes']);
+    const scopes: string[] = settings['oauth-microsoft-scopes'] ?? ['openid', 'profile', 'email'];
+    const redirectURI = new URL(callbackPath, baseUrl).toString();
 
-    const redirectURI = new URL(callbackPath, settings['url']).toString();
-    const scopes = settings['microsoft_scopes']
     const params = new URLSearchParams({
-      client_id: settings['microsoft_client_id'],
+      client_id: clientId,
       redirect_uri: redirectURI,
       response_type: 'code',
       scope: scopes.join(' '),
@@ -42,21 +60,18 @@ export class MicrosoftProvider
     return `https://login.microsoftonline.com/common/oauth2/v2.0/authorize?${params}`;
   }
 
-  async getProfile(code: string, type: string): Promise<any> {
+  async getProfile(code: string, type: string, redirectUri?: string): Promise<any> {
+    const { clientId, clientSecret, baseUrl } = await this.loadConfig();
 
-    const settings = await this.setting.getSettingValues([
-      'microsoft_client_id',
-      'microsoft_client_secret',
-      'microsoft_scopes',
-      'url',
-    ]);
+    const resolvedRedirectUri =
+      redirectUri?.trim() || `${baseUrl}/callback/microsoft/${type}`;
 
     const token = await this.fetchToken({
       code,
       url: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
-      clientId: settings['microsoft_client_id'],
-      clientSecret: settings['microsoft_client_secret'],
-      redirectUri: `${settings['url']}/callback/microsoft/${type}`,
+      clientId,
+      clientSecret,
+      redirectUri: resolvedRedirectUri,
     });
 
     const profile = await this.fetchProfile(

package/src/profile/profile.controller.ts

@@ -1,4 +1,4 @@
-import { Role, User } from '@hed-hog/api';
+import { NoRole, User } from '@hed-hog/api';
 import { Locale } from '@hed-hog/api-locale';
 import { Body, Controller, Delete, Get, Headers, Ip, Param, ParseIntPipe, Post, Put, UploadedFile, UseInterceptors } from '@nestjs/common';
 import { FileInterceptor } from '@nestjs/platform-express';
@@ -19,7 +19,7 @@ import { VerifyMfaTotpDto } from './dto/verify-mfa-totp.dto';
 import { VerifyWebAuthnRegistrationDto } from './dto/verify-webauthn-registration.dto';
 import { VerifyWebAuthnDto } from './dto/verify-webauthn.dto';
 import { ProfileService } from './profile.service';
-@Role()
+@NoRole()
 @Controller('profile')
 export class ProfileController {
 

package/src/security/security.service.ts

@@ -2,7 +2,15 @@ import { getLocaleText } from '@hed-hog/api-locale';
 import { BadRequestException, Injectable } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import * as argon2 from 'argon2';
-import { createCipheriv, createDecipheriv, createHash, randomBytes, scryptSync } from 'crypto';
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  createHmac,
+  randomBytes,
+  scryptSync,
+  timingSafeEqual,
+} from 'crypto';
 
 @Injectable()
 export class SecurityService {
@@ -31,6 +39,31 @@ export class SecurityService {
     return createHash('sha256').update(value).digest('base64url');
   }
 
+  signHmacSha256(value: string, secret?: string): string {
+    const signingSecret = secret || this.getJwtSecret();
+    return createHmac('sha256', signingSecret).update(value).digest('base64url');
+  }
+
+  verifyHmacSha256(value: string, signature: string, secret?: string): boolean {
+    if (!signature) {
+      return false;
+    }
+
+    try {
+      const expected = this.signHmacSha256(value, secret);
+      const expectedBuffer = Buffer.from(expected);
+      const providedBuffer = Buffer.from(signature);
+
+      if (expectedBuffer.length !== providedBuffer.length) {
+        return false;
+      }
+
+      return timingSafeEqual(expectedBuffer, providedBuffer);
+    } catch {
+      return false;
+    }
+  }
+
   hashArgon2(value: string, pepper?: string): Promise<string> {
     return argon2.hash(this.getValueWithPepper(value, pepper));
   }