@hed-hog/core 0.0.356 → 0.0.359

package/src/oauth/providers/github.provider.ts

@@ -1,16 +1,22 @@
+import { PrismaService } from '@hed-hog/api-prisma';
 import { HttpService } from '@nestjs/axios';
-import { forwardRef, Inject, Injectable } from '@nestjs/common';
+import { BadRequestException, forwardRef, Inject, Injectable } from '@nestjs/common';
+import { buildOAuthConfigFromIntegration } from '../../integration-profile/integration-profile.utils';
 import { SettingService } from '../../setting/setting.service';
 import { BaseOAuthProvider } from './abstract.provider';
 
 @Injectable()
-export class GithubProvider
-  extends BaseOAuthProvider {
+export class GithubProvider extends BaseOAuthProvider {
+
+  private isAbsoluteCallbackPath(value: string) {
+    return /^[a-z][a-z\d+.-]*:/i.test(String(value || '').trim());
+  }
 
   constructor(
     http: HttpService,
     @Inject(forwardRef(() => SettingService))
     private readonly setting: SettingService,
+    private readonly prisma: PrismaService,
   ) {
     super(http);
   }
@@ -19,21 +25,41 @@ export class GithubProvider
     return 'GITHUB';
   }
 
-  async getAuthUrl(callbackPath: string) {
-
+  private async loadConfig() {
     const settings = await this.setting.getSettingValues([
-      'github_client_id',
-      'github_client_secret',
-      'github_scopes',
+      'oauth-github-profile-id',
       'api-url',
     ]);
+    const profileId = Number(settings['oauth-github-profile-id']);
+    if (!profileId) throw new BadRequestException('GitHub OAuth profile not configured.');
+
+    const profile = await this.prisma.integration_profile.findUnique({
+      where: { id: profileId },
+      include: { integration_provider: { select: { slug: true } } },
+    });
+    if (!profile) throw new BadRequestException('GitHub OAuth profile not found.');
+
+    const { clientId, clientSecret } = buildOAuthConfigFromIntegration(
+      profile.integration_provider.slug,
+      profile.config,
+    );
+    return { clientId, clientSecret, apiUrl: String(settings['api-url'] ?? '') };
+  }
+
+  async getAuthUrl(callbackPath: string) {
+    const { clientId, apiUrl } = await this.loadConfig();
+    const settings = await this.setting.getSettingValues(['oauth-github-scopes']);
+    const scopes: string[] = settings['oauth-github-scopes'] ?? ['read:user', 'user:email'];
 
     const fixedCallbackPath = '/oauth/github/callback';
-    const redirectURI = new URL(fixedCallbackPath, settings['api-url']).toString();
-    const scopes = settings['github_scopes'];
-    const type = callbackPath.split('/').pop() || 'login';
+    const redirectURI = this.isAbsoluteCallbackPath(callbackPath)
+      ? callbackPath
+      : new URL(fixedCallbackPath, apiUrl).toString();
+    const type = this.isAbsoluteCallbackPath(callbackPath)
+      ? 'login'
+      : callbackPath.split('/').pop() || 'login';
     const params = new URLSearchParams({
-      client_id: settings['github_client_id'],
+      client_id: clientId,
       redirect_uri: redirectURI,
       scope: scopes.join(' '),
       allow_signup: 'true',
@@ -43,21 +69,18 @@ export class GithubProvider
     return `https://github.com/login/oauth/authorize?${params.toString()}`;
   }
 
-  async getProfile(code: string) {
-    const settings = await this.setting.getSettingValues([
-      'github_client_id',
-      'github_client_secret',
-      'github_scopes',
-      'api-url',
-    ]);
+  async getProfile(code: string, _type?: string, redirectUri?: string) {
+    const { clientId, clientSecret, apiUrl } = await this.loadConfig();
 
     const fixedCallbackPath = '/oauth/github/callback';
-    const redirectURI = new URL(fixedCallbackPath, settings['api-url'].replace(":3200", ":3100")).toString();
+    const redirectURI = redirectUri?.trim()
+      ? redirectUri.trim()
+      : new URL(fixedCallbackPath, apiUrl.replace(':3200', ':3100')).toString();
     const tokenResponse = await this.http.axiosRef.post(
       'https://github.com/login/oauth/access_token',
       {
-        client_id: settings['github_client_id'],
-        client_secret: settings['github_client_secret'],
+        client_id: clientId,
+        client_secret: clientSecret,
         code,
         redirect_uri: redirectURI,
       },
@@ -114,4 +137,4 @@ export class GithubProvider
       },
     };
   }
-}
+}

package/src/oauth/providers/google.provider.ts

@@ -1,5 +1,7 @@
+import { PrismaService } from '@hed-hog/api-prisma';
 import { HttpService } from '@nestjs/axios';
-import { forwardRef, Inject, Injectable } from '@nestjs/common';
+import { BadRequestException, forwardRef, Inject, Injectable } from '@nestjs/common';
+import { buildOAuthConfigFromIntegration } from '../../integration-profile/integration-profile.utils';
 import { SettingService } from '../../setting/setting.service';
 import { BaseOAuthProvider } from './abstract.provider';
 
@@ -10,6 +12,7 @@ export class GoogleProvider extends BaseOAuthProvider {
     http: HttpService,
     @Inject(forwardRef(() => SettingService))
     private readonly setting: SettingService,
+    private readonly prisma: PrismaService,
   ) {
     super(http);
   }
@@ -18,22 +21,38 @@ export class GoogleProvider extends BaseOAuthProvider {
     return 'GOOGLE';
   }
 
-  async getAuthUrl(callbackPath: string) {
-
+  private async loadConfig() {
     const settings = await this.setting.getSettingValues([
-      'google_client_id',
-      'google_client_secret',
-      'google_scopes',
+      'oauth-google-profile-id',
       'url',
     ]);
+    const profileId = Number(settings['oauth-google-profile-id']);
+    if (!profileId) throw new BadRequestException('Google OAuth profile not configured.');
+
+    const profile = await this.prisma.integration_profile.findUnique({
+      where: { id: profileId },
+      include: { integration_provider: { select: { slug: true } } },
+    });
+    if (!profile) throw new BadRequestException('Google OAuth profile not found.');
+
+    const { clientId, clientSecret } = buildOAuthConfigFromIntegration(
+      profile.integration_provider.slug,
+      profile.config,
+    );
+    return { clientId, clientSecret, baseUrl: String(settings['url'] ?? '') };
+  }
 
-    const redirectURI = new URL(callbackPath, settings['url']).toString();
+  async getAuthUrl(callbackPath: string) {
+    const { clientId, baseUrl } = await this.loadConfig();
+    const settings = await this.setting.getSettingValues(['oauth-google-scopes']);
+    const scopes: string[] = settings['oauth-google-scopes'] ?? ['email', 'profile'];
+    const redirectURI = new URL(callbackPath, baseUrl).toString();
 
     const params = new URLSearchParams({
-      client_id: settings['google_client_id'],
+      client_id: clientId,
       redirect_uri: redirectURI,
       response_type: 'code',
-      scope: (settings['google_scopes'] ?? []).join(' '),
+      scope: scopes.join(' '),
       access_type: 'offline',
       prompt: 'consent',
     });
@@ -41,21 +60,18 @@ export class GoogleProvider extends BaseOAuthProvider {
     return `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
   }
 
-  async getProfile(code: string, type: string) {
+  async getProfile(code: string, type: string, redirectUri?: string) {
+    const { clientId, clientSecret, baseUrl } = await this.loadConfig();
 
-    const settings = await this.setting.getSettingValues([
-      'google_client_id',
-      'google_client_secret',
-      'google_scopes',
-      'url',
-    ]);
+    const resolvedRedirectUri =
+      redirectUri?.trim() || `${baseUrl}/callback/google/${type}`;
 
     const token = await this.fetchToken({
       code,
       url: 'https://oauth2.googleapis.com/token',
-      clientId: settings['google_client_id'],
-      clientSecret: settings['google_client_secret'],
-      redirectUri: `${settings['url']}/callback/google/${type}`,
+      clientId,
+      clientSecret,
+      redirectUri: resolvedRedirectUri,
     });
 
     const basicProfile = await this.fetchProfile(
@@ -66,7 +82,7 @@ export class GoogleProvider extends BaseOAuthProvider {
     const peopleProfile = await this.getGoogleProfileFromAccessToken(
       token.access_token,
     );
-    
+
     return {
       ...basicProfile,
       gender: peopleProfile.gender,

package/src/oauth/providers/microsoft-entra-id.provider.ts

@@ -1,5 +1,7 @@
+import { PrismaService } from '@hed-hog/api-prisma';
 import { HttpService } from '@nestjs/axios';
-import { forwardRef, Inject, Injectable, Logger } from '@nestjs/common';
+import { BadRequestException, forwardRef, Inject, Injectable, Logger } from '@nestjs/common';
+import { buildOAuthConfigFromIntegration } from '../../integration-profile/integration-profile.utils';
 import { SettingService } from '../../setting/setting.service';
 import { BaseOAuthProvider } from './abstract.provider';
 
@@ -11,6 +13,7 @@ export class MicrosoftEntraIdProvider extends BaseOAuthProvider {
     http: HttpService,
     @Inject(forwardRef(() => SettingService))
     private readonly setting: SettingService,
+    private readonly prisma: PrismaService,
   ) {
     super(http);
   }
@@ -32,39 +35,42 @@ export class MicrosoftEntraIdProvider extends BaseOAuthProvider {
     return 'MICROSOFT-ENTRA-ID';
   }
 
-  async getAuthUrl(callbackPath: string) {
+  private async loadConfig() {
     const settings = await this.setting.getSettingValues([
-      'microsoft_entra_id_client_id',
-      'microsoft_entra_id_client_secret',
-      'microsoft_entra_id_scopes',
-      'microsoft_entra_id_tenant_id',
+      'oauth-microsoft-entra-id-profile-id',
       'url',
     ]);
+    const profileId = Number(settings['oauth-microsoft-entra-id-profile-id']);
+    if (!profileId) throw new BadRequestException('Microsoft Entra ID OAuth profile not configured.');
 
-    if (
-      !settings['microsoft_entra_id_client_id'] ||
-      !settings['microsoft_entra_id_client_secret'] ||
-      !settings['microsoft_entra_id_scopes'] ||
-      !settings['microsoft_entra_id_tenant_id'] ||
-      !settings['url']
-    ) {
-      this.logger.error(
-        'Microsoft Entra ID OAuth is missing required settings. Verify client id, client secret, scopes, tenant id, and url.',
-      );
-      throw new Error('Microsoft Entra ID OAuth is not configured properly. Please configure microsoft_entra_id_client_id, microsoft_entra_id_client_secret, microsoft_entra_id_scopes, microsoft_entra_id_tenant_id, and url settings.');
+    const profile = await this.prisma.integration_profile.findUnique({
+      where: { id: profileId },
+      include: { integration_provider: { select: { slug: true } } },
+    });
+    if (!profile) throw new BadRequestException('Microsoft Entra ID OAuth profile not found.');
+
+    const { clientId, clientSecret, tenantId } = buildOAuthConfigFromIntegration(
+      profile.integration_provider.slug,
+      profile.config,
+    );
+    if (!tenantId) {
+      throw new BadRequestException('Microsoft Entra ID OAuth profile is missing tenant_id.');
     }
+    return { clientId, clientSecret, tenantId, baseUrl: String(settings['url'] ?? '') };
+  }
 
-    const tenantId = settings['microsoft_entra_id_tenant_id'];
-    const redirectURI = this.buildRedirectUri(settings['url'], callbackPath);
-    const baseScopes = Array.isArray(settings['microsoft_entra_id_scopes'])
-      ? settings['microsoft_entra_id_scopes']
-      : [];
+  async getAuthUrl(callbackPath: string) {
+    const { clientId, tenantId, baseUrl } = await this.loadConfig();
+    const settings = await this.setting.getSettingValues(['oauth-microsoft-entra-id-scopes']);
+    const baseScopes: string[] = settings['oauth-microsoft-entra-id-scopes'] ?? ['openid', 'profile', 'email'];
     const scopes = baseScopes.includes('offline_access')
       ? baseScopes
       : [...baseScopes, 'offline_access'];
+
+    const redirectURI = this.buildRedirectUri(baseUrl, callbackPath);
     const isConnectFlow = callbackPath.includes('/connect');
     const params = new URLSearchParams({
-      client_id: settings['microsoft_entra_id_client_id'],
+      client_id: clientId,
       redirect_uri: redirectURI,
       response_type: 'code',
       scope: scopes.join(' '),
@@ -75,43 +81,33 @@ export class MicrosoftEntraIdProvider extends BaseOAuthProvider {
       `OAuth auth URL requested: provider=MICROSOFT-ENTRA-ID redirectUri=${redirectURI} hasOfflineAccess=${scopes.includes('offline_access') ? 'yes' : 'no'} connectFlow=${isConnectFlow ? 'yes' : 'no'} tenantConfigured=${tenantId ? 'yes' : 'no'}`,
     );
 
-    // Force consent only for explicit account connect, not for routine login.
     if (isConnectFlow) {
       params.set('prompt', 'consent');
     }
 
-    const authUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize?${params.toString()}`;
-    return authUrl;
+    return `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize?${params.toString()}`;
   }
 
-  async getProfile(code: string, type: string): Promise<any> {
-    let redirectUri = '';
+  async getProfile(code: string, type: string, redirectUri?: string): Promise<any> {
+    let resolvedRedirectUri = '';
 
     try {
-      const settings = await this.setting.getSettingValues([
-        'microsoft_entra_id_client_id',
-        'microsoft_entra_id_client_secret',
-        'microsoft_entra_id_scopes',
-        'microsoft_entra_id_tenant_id',
-        'url',
-      ]);
-      const tenantId = settings['microsoft_entra_id_tenant_id'];
-      const scopes = settings['microsoft_entra_id_scopes'] ?? [];
-      redirectUri = this.buildRedirectUri(
-        settings['url'],
-        `/callback/microsoft-entra-id/${type}`,
-      );
+      const { clientId, clientSecret, tenantId, baseUrl } = await this.loadConfig();
+      const settings = await this.setting.getSettingValues(['oauth-microsoft-entra-id-scopes']);
+      const scopes: string[] = settings['oauth-microsoft-entra-id-scopes'] ?? [];
+      resolvedRedirectUri =
+        redirectUri?.trim() || this.buildRedirectUri(baseUrl, `/callback/microsoft-entra-id/${type}`);
 
       this.logger.log(
-        `OAuth token exchange started: provider=MICROSOFT-ENTRA-ID type=${type} redirectUri=${redirectUri} hasCode=${code ? 'yes' : 'no'} codeLength=${code?.length ?? 0}`,
+        `OAuth token exchange started: provider=MICROSOFT-ENTRA-ID type=${type} redirectUri=${resolvedRedirectUri} hasCode=${code ? 'yes' : 'no'} codeLength=${code?.length ?? 0}`,
       );
 
       const token = await this.fetchToken({
         code,
         url: `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`,
-        clientId: settings['microsoft_entra_id_client_id'],
-        clientSecret: settings['microsoft_entra_id_client_secret'],
-        redirectUri,
+        clientId,
+        clientSecret,
+        redirectUri: resolvedRedirectUri,
       });
 
       const profile = await this.fetchProfile(
@@ -141,7 +137,7 @@ export class MicrosoftEntraIdProvider extends BaseOAuthProvider {
       const mappedError = this.mapProviderError('Microsoft Entra ID', error);
 
       this.logger.warn(
-        `OAuth callback failed: provider=MICROSOFT-ENTRA-ID status=${mappedError.status ?? 'unknown'} error=${mappedError.providerError ?? 'unknown'} providerCode=${mappedError.providerErrorCode ?? 'n/a'} reason=${mappedError.reason} redirectUri=${redirectUri || 'unresolved'}`,
+        `OAuth callback failed: provider=MICROSOFT-ENTRA-ID status=${mappedError.status ?? 'unknown'} error=${mappedError.providerError ?? 'unknown'} providerCode=${mappedError.providerErrorCode ?? 'n/a'} reason=${mappedError.reason} redirectUri=${resolvedRedirectUri || 'unresolved'}`,
       );
 
       throw mappedError;

package/src/oauth/providers/microsoft.provider.ts

@@ -1,16 +1,18 @@
+import { PrismaService } from '@hed-hog/api-prisma';
 import { HttpService } from '@nestjs/axios';
-import { forwardRef, Inject, Injectable } from '@nestjs/common';
+import { BadRequestException, forwardRef, Inject, Injectable } from '@nestjs/common';
+import { buildOAuthConfigFromIntegration } from '../../integration-profile/integration-profile.utils';
 import { SettingService } from '../../setting/setting.service';
 import { BaseOAuthProvider } from './abstract.provider';
 
 @Injectable()
-export class MicrosoftProvider
-  extends BaseOAuthProvider  {
+export class MicrosoftProvider extends BaseOAuthProvider {
 
   constructor(
     http: HttpService,
     @Inject(forwardRef(() => SettingService))
     private readonly setting: SettingService,
+    private readonly prisma: PrismaService,
   ) {
     super(http);
   }
@@ -19,19 +21,35 @@ export class MicrosoftProvider
     return 'MICROSOFT';
   }
 
-  async getAuthUrl(callbackPath: string) {
-
+  private async loadConfig() {
     const settings = await this.setting.getSettingValues([
-      'microsoft_client_id',
-      'microsoft_client_secret',
-      'microsoft_scopes',
+      'oauth-microsoft-profile-id',
       'url',
     ]);
+    const profileId = Number(settings['oauth-microsoft-profile-id']);
+    if (!profileId) throw new BadRequestException('Microsoft OAuth profile not configured.');
+
+    const profile = await this.prisma.integration_profile.findUnique({
+      where: { id: profileId },
+      include: { integration_provider: { select: { slug: true } } },
+    });
+    if (!profile) throw new BadRequestException('Microsoft OAuth profile not found.');
+
+    const { clientId, clientSecret, tenantId } = buildOAuthConfigFromIntegration(
+      profile.integration_provider.slug,
+      profile.config,
+    );
+    return { clientId, clientSecret, tenantId, baseUrl: String(settings['url'] ?? '') };
+  }
+
+  async getAuthUrl(callbackPath: string) {
+    const { clientId, baseUrl } = await this.loadConfig();
+    const settings = await this.setting.getSettingValues(['oauth-microsoft-scopes']);
+    const scopes: string[] = settings['oauth-microsoft-scopes'] ?? ['openid', 'profile', 'email'];
+    const redirectURI = new URL(callbackPath, baseUrl).toString();
 
-    const redirectURI = new URL(callbackPath, settings['url']).toString();
-    const scopes = settings['microsoft_scopes']
     const params = new URLSearchParams({
-      client_id: settings['microsoft_client_id'],
+      client_id: clientId,
       redirect_uri: redirectURI,
       response_type: 'code',
       scope: scopes.join(' '),
@@ -42,21 +60,18 @@ export class MicrosoftProvider
     return `https://login.microsoftonline.com/common/oauth2/v2.0/authorize?${params}`;
   }
 
-  async getProfile(code: string, type: string): Promise<any> {
+  async getProfile(code: string, type: string, redirectUri?: string): Promise<any> {
+    const { clientId, clientSecret, baseUrl } = await this.loadConfig();
 
-    const settings = await this.setting.getSettingValues([
-      'microsoft_client_id',
-      'microsoft_client_secret',
-      'microsoft_scopes',
-      'url',
-    ]);
+    const resolvedRedirectUri =
+      redirectUri?.trim() || `${baseUrl}/callback/microsoft/${type}`;
 
     const token = await this.fetchToken({
       code,
       url: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
-      clientId: settings['microsoft_client_id'],
-      clientSecret: settings['microsoft_client_secret'],
-      redirectUri: `${settings['url']}/callback/microsoft/${type}`,
+      clientId,
+      clientSecret,
+      redirectUri: resolvedRedirectUri,
     });
 
     const profile = await this.fetchProfile(

package/src/profile/profile.controller.ts

@@ -1,4 +1,4 @@
-import { Role, User } from '@hed-hog/api';
+import { NoRole, User } from '@hed-hog/api';
 import { Locale } from '@hed-hog/api-locale';
 import { Body, Controller, Delete, Get, Headers, Ip, Param, ParseIntPipe, Post, Put, UploadedFile, UseInterceptors } from '@nestjs/common';
 import { FileInterceptor } from '@nestjs/platform-express';
@@ -19,7 +19,7 @@ import { VerifyMfaTotpDto } from './dto/verify-mfa-totp.dto';
 import { VerifyWebAuthnRegistrationDto } from './dto/verify-webauthn-registration.dto';
 import { VerifyWebAuthnDto } from './dto/verify-webauthn.dto';
 import { ProfileService } from './profile.service';
-@Role()
+@NoRole()
 @Controller('profile')
 export class ProfileController {
 

package/src/security/security.service.ts

@@ -2,7 +2,15 @@ import { getLocaleText } from '@hed-hog/api-locale';
 import { BadRequestException, Injectable } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import * as argon2 from 'argon2';
-import { createCipheriv, createDecipheriv, createHash, randomBytes, scryptSync } from 'crypto';
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  createHmac,
+  randomBytes,
+  scryptSync,
+  timingSafeEqual,
+} from 'crypto';
 
 @Injectable()
 export class SecurityService {
@@ -31,6 +39,31 @@ export class SecurityService {
     return createHash('sha256').update(value).digest('base64url');
   }
 
+  signHmacSha256(value: string, secret?: string): string {
+    const signingSecret = secret || this.getJwtSecret();
+    return createHmac('sha256', signingSecret).update(value).digest('base64url');
+  }
+
+  verifyHmacSha256(value: string, signature: string, secret?: string): boolean {
+    if (!signature) {
+      return false;
+    }
+
+    try {
+      const expected = this.signHmacSha256(value, secret);
+      const expectedBuffer = Buffer.from(expected);
+      const providedBuffer = Buffer.from(signature);
+
+      if (expectedBuffer.length !== providedBuffer.length) {
+        return false;
+      }
+
+      return timingSafeEqual(expectedBuffer, providedBuffer);
+    } catch {
+      return false;
+    }
+  }
+
   hashArgon2(value: string, pepper?: string): Promise<string> {
     return argon2.hash(this.getValueWithPepper(value, pepper));
   }