@hed-hog/core 0.0.356 → 0.0.359

package/src/mail/mail.service.ts

@@ -29,6 +29,8 @@ import { UpdateDTO } from './dto/update.dto';
 export class MailService implements OnModuleInit {
   private readonly logger = new Logger(MailService.name);
   private readonly modelName = 'mail';
+  private readonly integrationProfileSettingSlug =
+    'mail-integration-profile-id';
 
   constructor(
     @Inject(forwardRef(() => PrismaService))
@@ -59,11 +61,10 @@ export class MailService implements OnModuleInit {
       },
     });
 
-    void this.syncConfiguredMailFlag();
   }
 
   private isMailConfigSlug(slug: string) {
-    return slug === 'mail-profile-id';
+    return slug === this.integrationProfileSettingSlug;
   }
 
   private isSettingEnabled(value: unknown) {
@@ -72,8 +73,10 @@ export class MailService implements OnModuleInit {
 
   private async syncConfiguredMailFlag() {
     try {
-      const settings = await this.setting.getSettingValues(['mail-profile-id']);
-      const profileId = settings['mail-profile-id'];
+      const settings = await this.setting.getSettingValues([
+        this.integrationProfileSettingSlug,
+      ]);
+      const profileId = settings[this.integrationProfileSettingSlug];
 
       if (!profileId || Number(profileId) <= 0) {
         await this.setting.setValue('configured-mail', 'false');
@@ -101,7 +104,7 @@ export class MailService implements OnModuleInit {
   /**
    * Reload mail configuration from database and update MailMainService.
    * When profileId is provided, that profile is used directly.
-   * Otherwise the global `mail-profile-id` setting is read.
+    * Otherwise the global integration profile setting is read.
    * Returns the active from address and the built config object.
    */
   async reloadConfig(profileId?: number): Promise<{ success: boolean; provider: string; from: string; config: any }> {
@@ -109,8 +112,10 @@ export class MailService implements OnModuleInit {
       let resolvedProfileId = profileId;
 
       if (!resolvedProfileId) {
-        const settings = await this.setting.getSettingValues(['mail-profile-id']);
-        resolvedProfileId = Number(settings['mail-profile-id']);
+        const settings = await this.setting.getSettingValues([
+          this.integrationProfileSettingSlug,
+        ]);
+        resolvedProfileId = Number(settings[this.integrationProfileSettingSlug]);
       }
 
       if (!resolvedProfileId || resolvedProfileId <= 0) {

package/src/mcp/guards/mcp-auth.guard.ts

@@ -38,7 +38,7 @@ export class McpAuthGuard implements CanActivate {
   private async verifyApiKey(request: Request, token: string): Promise<boolean> {
     const hash = this.security.hashWithPepper(token);
     const apiKey = await this.prisma.mcp_api_key.findFirst({
-      where: { token_hash: hash, revoked_at: null },
+      where: { token_hash: hash, type: 'mcp', revoked_at: null },
     });
 
     if (!apiKey) {

package/src/mcp/mcp-api-key.controller.ts

@@ -27,9 +27,9 @@ export class McpApiKeyController {
   @Post()
   create(
     @User() { id }: { id: number },
-    @Body() body: { name: string },
+    @Body() body: { name: string; type?: 'mcp' | 'api' },
   ) {
-    return this.mcpApiKeyService.create(id, body.name);
+    return this.mcpApiKeyService.create(id, body.name, body.type);
   }
 
   @Delete(':id')

package/src/mcp/mcp-api-key.service.ts

@@ -18,6 +18,7 @@ export class McpApiKeyService {
       select: {
         id: true,
         name: true,
+        type: true,
         token_prefix: true,
         last_used_at: true,
         expires_at: true,
@@ -27,8 +28,9 @@ export class McpApiKeyService {
     });
   }
 
-  async create(userId: number, name: string) {
-    const rawToken = 'hedhog_mcp_' + this.security.randomOpaque(36);
+  async create(userId: number, name: string, type: 'mcp' | 'api' = 'mcp') {
+    const prefix = type === 'api' ? 'hedhog_api_' : 'hedhog_mcp_';
+    const rawToken = prefix + this.security.randomOpaque(36);
     const tokenHash = this.security.hashWithPepper(rawToken);
     const tokenPrefix = rawToken.substring(0, 16);
 
@@ -36,12 +38,14 @@ export class McpApiKeyService {
       data: {
         user_id: userId,
         name,
+        type,
         token_hash: tokenHash,
         token_prefix: tokenPrefix,
       },
       select: {
         id: true,
         name: true,
+        type: true,
         token_prefix: true,
         created_at: true,
       },

package/src/mcp/mcp.module.ts

@@ -37,7 +37,6 @@ import { CoreEventWebhooksMcpTools } from './tools/core-event-webhooks.mcp-tools
 import { CoreFilesMcpTools } from './tools/core-files.mcp-tools';
 import { CoreIntegrationEventsMcpTools } from './tools/core-integration-events.mcp-tools';
 import { CoreMailMcpTools } from './tools/core-mail.mcp-tools';
-import { CoreMailProfileMcpTools } from './tools/core-mail-profile.mcp-tools';
 import { CoreMailSentMcpTools } from './tools/core-mail-sent.mcp-tools';
 import { CoreMcpChatMcpTools } from './tools/core-mcp-chat.mcp-tools';
 import { CoreMenusMcpTools } from './tools/core-menus.mcp-tools';
@@ -98,7 +97,6 @@ import { AccessLogModule } from '../access-log/access-log.module';
     CoreSessionsMcpTools,
     CoreFilesMcpTools,
     CoreMailMcpTools,
-    CoreMailProfileMcpTools,
     CoreMailSentMcpTools,
     CoreNotificationsMcpTools,
     CoreDashboardMcpTools,
@@ -110,6 +108,6 @@ import { AccessLogModule } from '../access-log/access-log.module';
     CoreMcpChatMcpTools,
     CoreSystemMcpTools,
   ],
-  exports: [McpRegistryService, McpServerService],
+  exports: [McpRegistryService, McpServerService, McpApiKeyService],
 })
 export class McpModule {}

package/src/oauth/interfaces/OAuthProvider.ts

@@ -1,5 +1,5 @@
 export interface OAuthProvider {
   getAuthUrl(callbackPath: string): Promise<string>;
-  getProfile(code: string, type?: string): Promise<any>;
+  getProfile(code: string, type?: string, redirectUri?: string): Promise<any>;
   getProviderType(): string;
 }

package/src/oauth/oauth.controller.ts

@@ -87,6 +87,21 @@ export class OAuthController {
   }
 
 
+  @Public()
+  @Get(':provider/mobile/auth-url')
+  async mobileAuthUrl(
+    @Param('provider') provider: string,
+    @Query('redirectUri') redirectUri: string,
+  ) {
+    const authUrl = await this.service.getMobileAuthUrl(
+      provider as user_account_provider_52222e2ecb_enum,
+      redirectUri,
+    );
+
+    return { authUrl };
+  }
+
+
   @Public()
   @Get(':provider/register')
   async register(@Param('provider') provider: string, @Res() res) {
@@ -101,7 +116,7 @@ export class OAuthController {
   @Public()
   @Get(':provider/connect')
   async connect(@Param('provider') provider: string, @Res() res) {
-    const url = this.service.getAuthUrl(
+    const url = await this.service.getAuthUrl(
       provider as user_account_provider_52222e2ecb_enum,
       `/callback/${provider}/connect`,
     );
@@ -121,6 +136,8 @@ export class OAuthController {
     @Headers('x-forwarded-host') forwardedHost: string,
     @Param('provider') provider: string,
     @Query('code') code: string,
+    @Query('state') state: string,
+    @Query('redirectUri') redirectUri: string,
     @Res({ passthrough: true }) res,
   ) {
     this.logOAuthRequest('callback-login', provider, {
@@ -133,7 +150,18 @@ export class OAuthController {
       code,
     });
 
-    return this.service.handleCallback({ res, locale, ipAddress, userAgent, provider: provider as user_account_provider_52222e2ecb_enum, code, type: 'login' });
+    return this.service.handleCallback({
+      res,
+      locale,
+      ipAddress,
+      userAgent,
+      provider: provider as user_account_provider_52222e2ecb_enum,
+      code,
+      state,
+      type: 'login',
+      redirectUri,
+      includeRefreshTokenInBody: Boolean(redirectUri),
+    });
   }
 
 

package/src/oauth/oauth.service.ts

@@ -1,14 +1,14 @@
 import { getLocaleText } from '@hed-hog/api-locale';
-import { PrismaService, user_account_provider_52222e2ecb_enum } from '@hed-hog/api-prisma';
+import { Prisma, PrismaService, user_account_provider_52222e2ecb_enum } from '@hed-hog/api-prisma';
 import {
-  BadRequestException,
-  ConflictException,
-  Inject,
-  Injectable,
-  Logger,
-  NotFoundException,
-  ServiceUnavailableException,
-  forwardRef
+    BadRequestException,
+    ConflictException,
+    Inject,
+    Injectable,
+    Logger,
+    NotFoundException,
+    ServiceUnavailableException,
+    forwardRef
 } from '@nestjs/common';
 import { AuthService } from '../auth/auth.service';
 import { FileService } from '../file/file.service';
@@ -21,9 +21,9 @@ import { UserService } from '../user/user.service';
 import { OAuthProvider } from './interfaces/OAuthProvider';
 import { OAuthCallbackCoordinatorService } from './oauth-callback-coordinator.service';
 import {
-  OAuthCallbackAlreadyProcessedError,
-  OAuthCallbackInProgressError,
-  OAuthProviderException,
+    OAuthCallbackAlreadyProcessedError,
+    OAuthCallbackInProgressError,
+    OAuthProviderException,
 } from './oauth.errors';
 import { FacebookProvider } from './providers/facebook.provider';
 import { GithubProvider } from './providers/github.provider';
@@ -41,12 +41,16 @@ type HandleCallbackProps = {
   type: 'login' | 'register' | 'connect' | 'disconnect';
   userId?: number;
   email?: string;
+  redirectUri?: string;
+  state?: string;
+  includeRefreshTokenInBody?: boolean;
 };
 
 @Injectable()
 export class OAuthService {
   private readonly logger = new Logger(OAuthService.name);
   private providers: Map<string, OAuthProvider> = new Map();
+  private readonly mobileOAuthStateTtlMs = 10 * 60 * 1000;
 
   constructor(
     google: GoogleProvider,
@@ -73,10 +77,36 @@ export class OAuthService {
     this.providers.set(microsoftEntraId.getProviderType(), microsoftEntraId);
   }
 
-  getAuthUrl(provider: user_account_provider_52222e2ecb_enum, callbackPath: string) {
+  async getAuthUrl(provider: user_account_provider_52222e2ecb_enum, callbackPath: string) {
+    const enabled = await this.isProviderEnabled(provider);
+    if (!enabled) {
+      throw new BadRequestException(`OAuth provider ${provider} is not enabled.`);
+    }
     return this.getProvider(provider).getAuthUrl(callbackPath);
   }
 
+  async getMobileAuthUrl(
+    provider: user_account_provider_52222e2ecb_enum,
+    redirectUri: string,
+  ) {
+    const sanitizedRedirectUri = String(redirectUri || '').trim();
+    if (!/^[a-z][a-z\d+.-]*:/i.test(sanitizedRedirectUri)) {
+      throw new BadRequestException('Invalid mobile redirect URI.');
+    }
+
+    const authUrl = await this.getAuthUrl(provider, sanitizedRedirectUri);
+    const flow = 'login';
+    const { token, signature } = await this.issueMobileState(
+      provider,
+      sanitizedRedirectUri,
+      flow,
+    );
+    const url = new URL(authUrl);
+    url.searchParams.set('state', `hhmob.${token}.${signature}.${flow}`);
+
+    return url.toString();
+  }
+
   async handleCallback({
     res,
     locale,
@@ -87,6 +117,9 @@ export class OAuthService {
     type,
     userId,
     email,
+    redirectUri,
+    state,
+    includeRefreshTokenInBody,
   }: HandleCallbackProps) {
     try {
       this.logger.log(
@@ -107,10 +140,23 @@ export class OAuthService {
         );
       }
 
+      if (
+        redirectUri &&
+        !(await this.consumeMobileState(state, provider, redirectUri))
+      ) {
+        throw new BadRequestException(
+          getLocaleText(
+            'oauth.callback.invalidState',
+            locale,
+            'OAuth callback state is invalid or expired. Start the sign-in flow again.',
+          ),
+        );
+      }
+
       const callbackKey = this.buildCallbackKey(provider, type, code);
 
       return await this.callbackCoordinator.execute(callbackKey, async () => {
-        const profile = await this.getProvider(provider).getProfile(code, type);
+        const profile = await this.getProvider(provider).getProfile(code, type, redirectUri);
         const result = await this.finalizeCallback({
           res,
           locale,
@@ -120,6 +166,7 @@ export class OAuthService {
           type,
           profile,
           userId,
+          includeRefreshTokenInBody,
         });
 
         this.logger.log(
@@ -143,19 +190,37 @@ export class OAuthService {
     return prov;
   }
 
-  private async getProviderScopes(provider: user_account_provider_52222e2ecb_enum) {
-    const settingKey = `${String(provider).toLowerCase().replace(/-/g, '_')}_scopes`;
-
-    const settings = await this.setting.getSettingValues([
-      'oauth-mfa',
-      'google_scopes',
-      'facebook_scopes',
-      'github_scopes',
-      'microsoft_scopes',
-      'microsoft_entra_id_scopes',
-    ]);
+  private static readonly PROVIDER_SCOPE_SLUGS: Record<string, string> = {
+    google: 'oauth-google-scopes',
+    facebook: 'oauth-facebook-scopes',
+    github: 'oauth-github-scopes',
+    microsoft: 'oauth-microsoft-scopes',
+    'microsoft-entra-id': 'oauth-microsoft-entra-id-scopes',
+    microsoft_entra_id: 'oauth-microsoft-entra-id-scopes',
+  };
+
+  private static readonly PROVIDER_ENABLED_SLUGS: Record<string, string> = {
+    google: 'oauth-google-enabled',
+    facebook: 'oauth-facebook-enabled',
+    github: 'oauth-github-enabled',
+    microsoft: 'oauth-microsoft-enabled',
+    'microsoft-entra-id': 'oauth-microsoft-entra-id-enabled',
+    microsoft_entra_id: 'oauth-microsoft-entra-id-enabled',
+  };
+
+  async isProviderEnabled(provider: user_account_provider_52222e2ecb_enum): Promise<boolean> {
+    const slug = OAuthService.PROVIDER_ENABLED_SLUGS[String(provider).toLowerCase()];
+    if (!slug) return false;
+    const settings = await this.setting.getSettingValues([slug]);
+    return settings[slug] === true || settings[slug] === 'true';
+  }
 
-    return settings[settingKey].join(',') || '';
+  private async getProviderScopes(provider: user_account_provider_52222e2ecb_enum) {
+    const settingKey = OAuthService.PROVIDER_SCOPE_SLUGS[String(provider).toLowerCase()];
+    if (!settingKey) return '';
+    const settings = await this.setting.getSettingValues([settingKey]);
+    const scopes = settings[settingKey];
+    return Array.isArray(scopes) ? scopes.join(',') : String(scopes ?? '');
   }
 
   private buildCallbackKey(
@@ -176,6 +241,86 @@ export class OAuthService {
       : userAgent;
   }
 
+  private async issueMobileState(
+    provider: user_account_provider_52222e2ecb_enum,
+    redirectUri: string,
+    flow: 'login' | 'register' | 'connect',
+  ) {
+    const token = this.security.randomOpaque(24);
+    const signature = this.security.signHmacSha256(`oauth-mobile-state:${token}`);
+    const tokenHash = this.security.hashSha256(token);
+    const expiresAt = new Date(Date.now() + this.mobileOAuthStateTtlMs);
+
+    await this.prisma.$executeRaw(
+      Prisma.sql`
+        INSERT INTO oauth_mobile_state_token (
+          token_hash,
+          provider,
+          redirect_uri,
+          flow_type,
+          expires_at,
+          created_at
+        ) VALUES (
+          ${tokenHash},
+          ${String(provider).toLowerCase()},
+          ${redirectUri},
+          ${flow},
+          ${expiresAt},
+          NOW()
+        )
+      `,
+    );
+
+    return { token, signature };
+  }
+
+  private async consumeMobileState(
+    encodedState: string | undefined,
+    provider: user_account_provider_52222e2ecb_enum,
+    redirectUri: string,
+  ) {
+    if (!encodedState || !encodedState.startsWith('hhmob.')) {
+      return false;
+    }
+
+    const parts = encodedState.split('.');
+    const stateToken = parts[1];
+    const signature = parts[2];
+    const flow = parts[3] as 'login' | 'register' | 'connect' | undefined;
+
+    if (!stateToken || !signature || !flow) {
+      return false;
+    }
+
+    if (!['login', 'register', 'connect'].includes(flow)) {
+      return false;
+    }
+
+    const hasValidSignature = this.security.verifyHmacSha256(
+      `oauth-mobile-state:${stateToken}`,
+      signature,
+    );
+    if (!hasValidSignature) {
+      return false;
+    }
+
+    const tokenHash = this.security.hashSha256(stateToken);
+    const consumedRows = await this.prisma.$executeRaw(
+      Prisma.sql`
+        UPDATE oauth_mobile_state_token
+        SET consumed_at = NOW()
+        WHERE token_hash = ${tokenHash}
+          AND provider = ${String(provider).toLowerCase()}
+          AND redirect_uri = ${redirectUri}
+          AND flow_type = ${flow}
+          AND expires_at > NOW()
+          AND consumed_at IS NULL
+      `,
+    );
+
+    return Number(consumedRows) > 0;
+  }
+
   private async finalizeCallback({
     res,
     locale,
@@ -185,14 +330,15 @@ export class OAuthService {
     type,
     profile,
     userId,
-  }: Omit<HandleCallbackProps, 'code' | 'email'> & { profile: any }) {
+    includeRefreshTokenInBody,
+  }: Omit<HandleCallbackProps, 'code' | 'email' | 'redirectUri' | 'state'> & { profile: any }) {
     switch (type) {
       case 'login':
-        return this.handleLogin(res, locale, ipAddress, userAgent, provider, profile);
+        return this.handleLogin(res, locale, ipAddress, userAgent, provider, profile, includeRefreshTokenInBody);
       case 'register':
-        return this.handleRegister(res, locale, ipAddress, userAgent, provider, profile);
+        return this.handleRegister(res, locale, ipAddress, userAgent, provider, profile, includeRefreshTokenInBody);
       case 'connect':
-        return this.handleConnect(res, locale, ipAddress, userAgent, provider, profile, userId);
+        return this.handleConnect(res, locale, ipAddress, userAgent, provider, profile, userId, includeRefreshTokenInBody);
       default:
         throw new BadRequestException(
           getLocaleText('oauth.callback.invalidType', locale, 'Unsupported OAuth callback type.'),
@@ -200,6 +346,18 @@ export class OAuthService {
     }
   }
 
+  private formatAuthResponse(
+    accessToken: string,
+    refreshToken: string,
+    includeRefreshTokenInBody?: boolean,
+  ) {
+    if (includeRefreshTokenInBody) {
+      return { accessToken, refreshToken };
+    }
+
+    return { accessToken };
+  }
+
   private resolveProfileScopes(provider: user_account_provider_52222e2ecb_enum, profile: any) {
     if (typeof profile?.oauth_scopes === 'string') {
       return profile.oauth_scopes;
@@ -274,7 +432,7 @@ export class OAuthService {
     );
   }
 
-  private async handleLogin(res: Response, locale: string, ipAddress: string, userAgent: string, provider: user_account_provider_52222e2ecb_enum, profile: any) {
+  private async handleLogin(res: Response, locale: string, ipAddress: string, userAgent: string, provider: user_account_provider_52222e2ecb_enum, profile: any, includeRefreshTokenInBody?: boolean) {
     const userAccount = await this.prisma.user_account.findFirst({
       where: {
         provider: String(provider).toLowerCase().replace(/-/g, '_') as user_account_provider_52222e2ecb_enum,
@@ -324,11 +482,11 @@ export class OAuthService {
       );
 
       await this.token.setRefreshTokenCookie(locale, res, refreshToken, session.expires_at);
-      return { accessToken };
+      return this.formatAuthResponse(accessToken, refreshToken, includeRefreshTokenInBody);
     }
   }
 
-  private async handleRegister(res: Response, locale: string, ipAddress: string, userAgent: string, provider: user_account_provider_52222e2ecb_enum, profile: any) {
+  private async handleRegister(res: Response, locale: string, ipAddress: string, userAgent: string, provider: user_account_provider_52222e2ecb_enum, profile: any, includeRefreshTokenInBody?: boolean) {
     const existingUser = await this.prisma.user_identifier.findFirst({
       where: {
         type: 'email',
@@ -415,7 +573,7 @@ export class OAuthService {
       userAgent
     );
     await this.token.setRefreshTokenCookie(locale, res, refreshToken, session.expires_at);
-    return { accessToken };
+    return this.formatAuthResponse(accessToken, refreshToken, includeRefreshTokenInBody);
   }
 
   private async handleConnect(
@@ -426,6 +584,7 @@ export class OAuthService {
     provider: user_account_provider_52222e2ecb_enum,
     profile: any,
     userId: number,
+    includeRefreshTokenInBody?: boolean,
   ) {
     const existingAccount = await this.prisma.user_account.findFirst({
       where: {
@@ -482,7 +641,7 @@ export class OAuthService {
     await this.user.registerUserActivity(userId, 'oauth-connect');
     const { accessToken, refreshToken, session } = await this.auth.getAuthenticationPayload(locale, user.id, ipAddress, userAgent);
     await this.token.setRefreshTokenCookie(locale, res, refreshToken, session.expires_at);
-    return { accessToken };
+    return this.formatAuthResponse(accessToken, refreshToken, includeRefreshTokenInBody);
   }
 
   private async handleDisconnect(res: Response, locale: string, ipAddress: string, userAgent: string, provider: user_account_provider_52222e2ecb_enum, email: string) {

package/src/oauth/providers/abstract.provider.ts

@@ -7,7 +7,7 @@ export abstract class BaseOAuthProvider implements OAuthProvider {
   constructor(protected readonly http: HttpService) {}
 
   abstract getAuthUrl(callbackPath: string): Promise<string>;
-  abstract getProfile(code: string, type?: string): Promise<any>;
+  abstract getProfile(code: string, type?: string, redirectUri?: string): Promise<any>;
   abstract getProviderType(): string;
 
   protected async fetchToken({

package/src/oauth/providers/facebook.provider.ts

@@ -1,16 +1,18 @@
+import { PrismaService } from '@hed-hog/api-prisma';
 import { HttpService } from '@nestjs/axios';
-import { forwardRef, Inject, Injectable } from '@nestjs/common';
+import { BadRequestException, forwardRef, Inject, Injectable } from '@nestjs/common';
+import { buildOAuthConfigFromIntegration } from '../../integration-profile/integration-profile.utils';
 import { SettingService } from '../../setting/setting.service';
 import { BaseOAuthProvider } from './abstract.provider';
 
 @Injectable()
-export class FacebookProvider
-  extends BaseOAuthProvider {
+export class FacebookProvider extends BaseOAuthProvider {
 
   constructor(
     http: HttpService,
     @Inject(forwardRef(() => SettingService))
     private readonly setting: SettingService,
+    private readonly prisma: PrismaService,
   ) {
     super(http);
   }
@@ -19,42 +21,56 @@ export class FacebookProvider
     return 'FACEBOOK';
   }
 
-  async getAuthUrl(callbackPath: string) {
+  private async loadConfig() {
     const settings = await this.setting.getSettingValues([
-      'facebook_client_id',
-      'facebook_client_secret',
-      'facebook_scopes',
+      'oauth-facebook-profile-id',
       'url',
     ]);
+    const profileId = Number(settings['oauth-facebook-profile-id']);
+    if (!profileId) throw new BadRequestException('Facebook OAuth profile not configured.');
+
+    const profile = await this.prisma.integration_profile.findUnique({
+      where: { id: profileId },
+      include: { integration_provider: { select: { slug: true } } },
+    });
+    if (!profile) throw new BadRequestException('Facebook OAuth profile not found.');
+
+    const { clientId, clientSecret } = buildOAuthConfigFromIntegration(
+      profile.integration_provider.slug,
+      profile.config,
+    );
+    return { clientId, clientSecret, baseUrl: String(settings['url'] ?? '') };
+  }
 
-    const redirectURI = new URL(callbackPath, settings['url']).toString();
+  async getAuthUrl(callbackPath: string) {
+    const { clientId, baseUrl } = await this.loadConfig();
+    const settings = await this.setting.getSettingValues(['oauth-facebook-scopes']);
+    const scopes: string[] = settings['oauth-facebook-scopes'] ?? ['email'];
+    const redirectURI = new URL(callbackPath, baseUrl).toString();
 
     const params = new URLSearchParams({
-      client_id: settings['facebook_client_id'],
+      client_id: clientId,
       redirect_uri: redirectURI,
       response_type: 'code',
-      scope: (settings['facebook_scopes'] ?? ['email']).join(','),
+      scope: scopes.join(','),
       auth_type: 'rerequest',
     });
 
     return `https://www.facebook.com/v17.0/dialog/oauth?${params}`;
   }
 
-  async getProfile(code: string, type: string): Promise<any> {
+  async getProfile(code: string, type: string, redirectUri?: string): Promise<any> {
+    const { clientId, clientSecret, baseUrl } = await this.loadConfig();
 
-    const settings = await this.setting.getSettingValues([
-      'facebook_client_id',
-      'facebook_client_secret',
-      'facebook_scopes',
-      'url',
-    ]);
+    const resolvedRedirectUri =
+      redirectUri?.trim() || `${baseUrl}/oauth/facebook/callback/${type}`;
 
     const token = await this.fetchToken({
       code,
       url: 'https://graph.facebook.com/v17.0/oauth/access_token',
-      clientId: settings['facebook_client_id'],
-      clientSecret: settings['facebook_client_secret'],
-      redirectUri: `${settings['url']}/oauth/facebook/callback/${type}`,
+      clientId,
+      clientSecret,
+      redirectUri: resolvedRedirectUri,
     });
     const profile = await this.fetchProfile(
       token.access_token,