@hed-hog/core 0.0.384 → 0.0.386

package/src/oauth/oauth.service.ts

@@ -89,12 +89,17 @@ export class OAuthService {
     this.providers.set(linkedin.getProviderType(), linkedin);
   }
 
-  async getAuthUrl(provider: user_account_provider_52222e2ecb_enum, callbackPath: string) {
+  async getAuthUrl(
+    provider: user_account_provider_52222e2ecb_enum,
+    callbackPath: string,
+    flow?: 'login' | 'register' | 'connect',
+    app?: string,
+  ) {
     const enabled = await this.isProviderEnabled(provider);
     if (!enabled) {
       throw new BadRequestException(`OAuth provider ${provider} is not enabled.`);
     }
-    return this.getProvider(provider).getAuthUrl(callbackPath);
+    return this.getProvider(provider).getAuthUrl(callbackPath, flow, app);
   }
 
   async getMobileAuthUrl(
@@ -137,15 +142,16 @@ export class OAuthService {
     flow: 'login' | 'register' | 'connect',
     redirectApp?: string,
   ) {
+    // `self` means "the hub handles it locally"; a resolvable app key means the hub
+    // forwards the callback back to that app (origin-bound).
+    const app = this.sanitizeAppKey(redirectApp) ?? OAuthService.WEB_STATE_SELF_APP;
+
     // Single, flow-less callback per provider: the flow (and the initiating app)
     // travel in the signed state, so only ONE redirect URI needs to be registered
-    // per provider in its OAuth console.
+    // per provider in its OAuth console. `flow`/`app` are forwarded so providers that
+    // need them (e.g. Microsoft Entra ID's backend bounce + `prompt=consent`) can adapt.
     const callbackPath = `/callback/${String(provider)}`;
-    const authUrl = await this.getAuthUrl(provider, callbackPath);
-
-    // Always carry the flow. `self` means "the hub handles it locally"; a resolvable
-    // app key means the hub forwards the callback back to that app (origin-bound).
-    const app = this.sanitizeAppKey(redirectApp) ?? OAuthService.WEB_STATE_SELF_APP;
+    const authUrl = await this.getAuthUrl(provider, callbackPath, flow, app);
 
     const url = new URL(authUrl);
     url.searchParams.set('state', this.buildWebState(app, flow));
@@ -549,6 +555,182 @@ export class OAuthService {
     return record?.redirect_uri ?? null;
   }
 
+  /** TTL for the short web-ref bounce token (Entra). Short: it briefly holds an encrypted profile. */
+  private readonly webRefTokenTtlMs = 2 * 60 * 1000;
+
+  /**
+   * Server-side bounce for providers whose authorization `code` is too large to
+   * safely ride a front-end app URL (Microsoft Entra ID). Exchanges the code here
+   * (once, under the callback lock), stores the resulting profile encrypted under
+   * an opaque single-use `ref`, and returns that `ref`. The app later redeems it via
+   * `redeemWebRef`, so the giant code never reaches a front-end ingress.
+   */
+  async beginWebRefCallback({
+    provider,
+    code,
+    state,
+    flow,
+    appOrigin,
+  }: {
+    provider: user_account_provider_52222e2ecb_enum;
+    code: string;
+    state?: string;
+    flow: 'login' | 'register' | 'connect';
+    appOrigin: string | null;
+  }): Promise<string> {
+    if (!code) {
+      throw new BadRequestException('Authorization code is required.');
+    }
+
+    // Match the redirect_uri used at authorize time (the API callback).
+    const settings = await this.setting.getSettingValues(['api-url']);
+    const apiRedirectUri = new URL(
+      '/oauth/microsoft-entra-id/callback',
+      String(settings['api-url'] ?? ''),
+    ).toString();
+
+    const callbackKey = this.buildCallbackKey(provider, flow, code);
+    const profile = await this.callbackCoordinator.execute(callbackKey, async () =>
+      this.getProvider(provider).getProfile(code, flow, apiRedirectUri),
+    );
+
+    const token = this.security.randomOpaque(24);
+    const signature = this.security.signHmacSha256(`oauth-web-ref:${token}`);
+    const tokenHash = this.security.hashSha256(token);
+    const expiresAt = new Date(Date.now() + this.webRefTokenTtlMs);
+    const profileEnc = this.security.encrypt(JSON.stringify(profile));
+
+    await this.prisma.$executeRaw(
+      Prisma.sql`
+        INSERT INTO oauth_web_ref_token (
+          token_hash, provider, flow_type, app_origin, profile_enc, expires_at, created_at
+        ) VALUES (
+          ${tokenHash},
+          ${String(provider).toLowerCase()},
+          ${flow},
+          ${appOrigin},
+          ${profileEnc},
+          ${expiresAt},
+          NOW()
+        )
+      `,
+    );
+
+    return `${token}.${signature}`;
+  }
+
+  /**
+   * Redeems a `ref` issued by `beginWebRefCallback`: single-use consume, origin-bind
+   * to the initiating app, then finalize the flow (sets the refresh cookie via `res`
+   * and returns `{ accessToken }`) — byte-for-byte the same response as `callback/login`.
+   */
+  async redeemWebRef({
+    res,
+    ref,
+    provider,
+    locale,
+    ipAddress,
+    userAgent,
+    userId,
+    requestOrigin,
+    requestReferer,
+  }: {
+    res: Response;
+    ref: string;
+    provider: user_account_provider_52222e2ecb_enum;
+    locale: string;
+    ipAddress: string;
+    userAgent: string;
+    userId?: number;
+    requestOrigin?: string;
+    requestReferer?: string;
+  }) {
+    const parts = String(ref ?? '').split('.');
+    const token = parts[0];
+    const signature = parts[1];
+
+    if (!token || !signature) {
+      throw new BadRequestException(
+        getLocaleText('oauth.callback.invalidState', locale, 'OAuth reference is invalid or expired. Start the sign-in flow again.'),
+      );
+    }
+
+    if (!this.security.verifyHmacSha256(`oauth-web-ref:${token}`, signature)) {
+      throw new BadRequestException(
+        getLocaleText('oauth.callback.invalidState', locale, 'OAuth reference is invalid or expired. Start the sign-in flow again.'),
+      );
+    }
+
+    const tokenHash = this.security.hashSha256(token);
+    const rows = await this.prisma.$queryRaw<
+      Array<{ profile_enc: string; flow_type: string; app_origin: string | null }>
+    >(
+      Prisma.sql`
+        UPDATE oauth_web_ref_token
+        SET consumed_at = NOW()
+        WHERE token_hash = ${tokenHash}
+          AND provider = ${String(provider).toLowerCase()}
+          AND expires_at > NOW()
+          AND consumed_at IS NULL
+        RETURNING profile_enc, flow_type, app_origin
+      `,
+    );
+
+    const row = rows[0];
+    if (!row) {
+      throw new BadRequestException(
+        getLocaleText('oauth.callback.alreadyProcessed', locale, 'This OAuth callback was already processed. Start the sign-in flow again.'),
+      );
+    }
+
+    const flow = row.flow_type as 'login' | 'register' | 'connect';
+
+    // Origin-bind at redeem (the backend callback's Origin was Microsoft, so the
+    // usual handleCallback binding can't run there). Skip only when no app origin
+    // was recorded (the hub's own "self" flow).
+    if (row.app_origin) {
+      const expectedOrigin = this.normalizeOrigin(row.app_origin);
+      const boundOrigin =
+        this.normalizeOrigin(requestOrigin) ?? this.normalizeOrigin(requestReferer);
+      if (!boundOrigin || expectedOrigin !== boundOrigin) {
+        throw new BadRequestException(
+          getLocaleText('oauth.callback.invalidState', locale, 'OAuth callback origin is invalid. Start the sign-in flow again.'),
+        );
+      }
+    }
+
+    if (flow === 'connect' && !userId) {
+      throw new BadRequestException(
+        getLocaleText('oauth.callback.invalidState', locale, 'OAuth reference is invalid or expired. Start the sign-in flow again.'),
+      );
+    }
+
+    let profile: any;
+    try {
+      profile = JSON.parse(this.security.decrypt(row.profile_enc));
+    } catch {
+      throw new BadRequestException(
+        getLocaleText('oauth.callback.invalidState', locale, 'OAuth reference is invalid or expired. Start the sign-in flow again.'),
+      );
+    }
+
+    try {
+      return await this.finalizeCallback({
+        res,
+        locale,
+        ipAddress,
+        userAgent,
+        provider,
+        type: flow,
+        profile,
+        userId,
+        includeRefreshTokenInBody: false,
+      });
+    } catch (error) {
+      throw this.mapCallbackError(locale, provider, flow, error);
+    }
+  }
+
   private async finalizeCallback({
     res,
     locale,

package/src/oauth/providers/microsoft-entra-id.provider.ts

@@ -35,10 +35,22 @@ export class MicrosoftEntraIdProvider extends BaseOAuthProvider {
     return 'MICROSOFT-ENTRA-ID';
   }
 
+  // Fixed API callback used by the web flow so the ~2KB Entra `code` is received
+  // and exchanged server-side (never forwarded into a front-end app URL).
+  private static readonly API_CALLBACK_PATH = '/oauth/microsoft-entra-id/callback';
+
+  // Apps whose front-end callback pages know how to redeem the server-side bounce
+  // `ref`. Only these use the API bounce; every other web app (and mobile) keeps the
+  // legacy front-end redirect, so this change is additive and non-regressing. Add an
+  // app here once its callback pages handle `?ref=`. `self` is the hub (admin), which
+  // initiates Entra without a `redirectApp` and thus resolves to the sentinel `self`.
+  private static readonly API_BOUNCE_APPS = new Set(['class', 'self', 'training', 'partners']);
+
   private async loadConfig() {
     const settings = await this.setting.getSettingValues([
       'oauth-microsoft-entra-id-profile-id',
       'url',
+      'api-url',
     ]);
     const profileSlug = String(settings['oauth-microsoft-entra-id-profile-id'] ?? '').trim();
     if (!profileSlug) throw new BadRequestException('Microsoft Entra ID OAuth profile not configured.');
@@ -56,19 +68,47 @@ export class MicrosoftEntraIdProvider extends BaseOAuthProvider {
     if (!tenantId) {
       throw new BadRequestException('Microsoft Entra ID OAuth profile is missing tenant_id.');
     }
-    return { clientId, clientSecret, tenantId, baseUrl: String(settings['url'] ?? '') };
+    return {
+      clientId,
+      clientSecret,
+      tenantId,
+      baseUrl: String(settings['url'] ?? ''),
+      apiUrl: String(settings['api-url'] ?? ''),
+    };
   }
 
-  async getAuthUrl(callbackPath: string) {
-    const { clientId, tenantId, baseUrl } = await this.loadConfig();
+  /** Absolute redirect URI the web flow registers/exchanges against (the API). */
+  private buildApiRedirectUri(apiUrl: string) {
+    if (!String(apiUrl).trim()) {
+      throw new BadRequestException(
+        'Microsoft Entra ID OAuth requires the `api-url` setting for the web callback.',
+      );
+    }
+    return this.buildRedirectUri(apiUrl, MicrosoftEntraIdProvider.API_CALLBACK_PATH);
+  }
+
+  async getAuthUrl(
+    callbackPath: string,
+    flow?: 'login' | 'register' | 'connect',
+    app?: string,
+  ) {
+    const { clientId, tenantId, baseUrl, apiUrl } = await this.loadConfig();
     const settings = await this.setting.getSettingValues(['oauth-microsoft-entra-id-scopes']);
     const baseScopes: string[] = settings['oauth-microsoft-entra-id-scopes'] ?? ['openid', 'profile', 'email'];
     const scopes = baseScopes.includes('offline_access')
       ? baseScopes
       : [...baseScopes, 'offline_access'];
 
-    const redirectURI = this.buildRedirectUri(baseUrl, callbackPath);
-    const isConnectFlow = callbackPath.includes('/connect');
+    // Only apps that can redeem a `ref` bounce through the API (where the ~2KB code
+    // is exchanged server-side); every other web app and mobile keep the front-end
+    // callback, so this stays additive and non-regressing.
+    const useApiBounce = !!app && MicrosoftEntraIdProvider.API_BOUNCE_APPS.has(app);
+    const redirectURI = useApiBounce
+      ? this.buildApiRedirectUri(apiUrl)
+      : this.buildRedirectUri(baseUrl, callbackPath);
+    const isConnectFlow = useApiBounce
+      ? flow === 'connect'
+      : callbackPath.includes('/connect');
     const params = new URLSearchParams({
       client_id: clientId,
       redirect_uri: redirectURI,

package/src/webhook-integration/webhook-integration.service.ts

@@ -610,6 +610,10 @@ export class WebhookIntegrationService {
       body,
       remoteIp,
       webhookHeaders: normalizeJsonObject(headers) || {},
+      // `rawBody` is stashed onto the request by the API's global body-parser `verify`
+      // callback (apps/api/src/main.ts); typed loosely here since this package doesn't
+      // own that Express.Request augmentation.
+      webhookRawBody: (req as Request & { rawBody?: Buffer }).rawBody,
       startedAt,
     });
   }
@@ -625,10 +629,18 @@ export class WebhookIntegrationService {
     body: any;
     remoteIp: string | null;
     webhookHeaders: Record<string, unknown>;
+    webhookRawBody?: Buffer;
     startedAt: number;
   }) {
-    const { integration, uuid, body, remoteIp, webhookHeaders, startedAt } =
-      input;
+    const {
+      integration,
+      uuid,
+      body,
+      remoteIp,
+      webhookHeaders,
+      webhookRawBody,
+      startedAt,
+    } = input;
     const actionLogs: ActionExecutionLog[] = [];
 
     try {
@@ -639,6 +651,7 @@ export class WebhookIntegrationService {
         try {
           const result = await this.executeAction(action, body, {
             webhookHeaders,
+            webhookRawBody,
             remoteIp,
             publicUuid: uuid,
             integrationId: integration.id,
@@ -811,6 +824,7 @@ export class WebhookIntegrationService {
     body: any,
     context?: {
       webhookHeaders?: Record<string, unknown>;
+      webhookRawBody?: Buffer;
       remoteIp?: string | null;
       publicUuid?: string;
       integrationId?: number;
@@ -1138,6 +1152,7 @@ export class WebhookIntegrationService {
     body: any,
     context?: {
       webhookHeaders?: Record<string, unknown>;
+      webhookRawBody?: Buffer;
       remoteIp?: string | null;
       publicUuid?: string;
       integrationId?: number;
@@ -1172,6 +1187,7 @@ export class WebhookIntegrationService {
       result = await this.commandRegistry.dispatch(slug, renderedParams, {
         webhookBody: body,
         webhookHeaders: context?.webhookHeaders,
+        webhookRawBody: context?.webhookRawBody,
         remoteIp: context?.remoteIp,
         publicUuid: context?.publicUuid,
         integrationId: context?.integrationId,