emailengine-app 2.68.1 → 2.70.0

package/lib/ui-routes/{oauth-routes.js → oauth-config-routes.js}

@@ -1,26 +1,27 @@
 'use strict';
 
-const Boom = require('@hapi/boom');
+// Admin UI routes for OAuth2 application config (/admin/config/oauth*): listing apps,
+// per-app view/edit/delete, creating apps, adding accounts, provider subscriptions, and
+// app verification. Extracted verbatim from lib/routes-ui.js. AZURE_CLOUDS and the
+// authMethodContext/getPubSubAppsForSelect render helpers move with the routes (only the
+// OAuth app config pages use them).
+
 const Joi = require('joi');
+const util = require('util');
+const Boom = require('@hapi/boom');
 
 const settings = require('../settings');
+const consts = require('../consts');
 const { redis } = require('../db');
-const { oauth2Apps, OAUTH_PROVIDERS, SERVICE_ACCOUNT_PROVIDERS, oauth2ProviderData } = require('../oauth2-apps');
 const getSecret = require('../get-secret');
 const { Account } = require('../account');
-const { oauthCreateSchema, oauthUpdateSchema } = require('../schemas');
-const consts = require('../consts');
+const { oauth2Apps, OAUTH_PROVIDERS, oauth2ProviderData, SERVICE_ACCOUNT_PROVIDERS } = require('../oauth2-apps');
+const { verifyOAuth2App } = require('../oauth/verify-app');
+const { oauthCreateSchema, oauthUpdateSchema, accountIdSchema } = require('../schemas');
+const { throwAsBoom } = require('./route-helpers');
 
 const { DEFAULT_PAGE_SIZE } = consts;
 
-// Microsoft Entra requires 'localhost' rather than '127.0.0.1' in redirect URIs
-function normalizeOutlookRedirectUrl(redirectUrl, provider) {
-    if (provider === 'outlook') {
-        return redirectUrl.replace(/^http:\/\/127\.0\.0\.1\b/i, 'http://localhost');
-    }
-    return redirectUrl;
-}
-
 const AZURE_CLOUDS = [
     {
         id: 'global',
@@ -47,8 +48,35 @@ const AZURE_CLOUDS = [
     }
 ];
 
-function init({ server, call }) {
-    // GET /admin/config/oauth - OAuth applications list
+function init(args) {
+    const { server, call } = args;
+
+    // Render-context booleans for the gmailService authMethod tab selector.
+    // When `locked` is set the selector is shown but cannot be switched - the
+    // authentication method is fixed once an app has been created.
+    function authMethodContext(authMethod, locked) {
+        return {
+            authMethodIsServiceKey: !authMethod || authMethod === 'serviceKey',
+            authMethodIsExternalAccount: authMethod === 'externalAccount',
+            authMethodLocked: !!locked
+        };
+    }
+
+    /**
+     * Fetch the list of Pub/Sub apps and mark the one matching selectedId as selected.
+     * Returns the apps array ready for template rendering.
+     */
+    async function getPubSubAppsForSelect(selectedId) {
+        let result = await oauth2Apps.list(0, 1000, { pubsub: true });
+        let apps = (result && result.apps) || [];
+        for (let app of apps) {
+            if (app.id === selectedId) {
+                app.selected = true;
+            }
+        }
+        return apps;
+    }
+
     server.route({
         method: 'GET',
         path: '/admin/config/oauth',
@@ -108,11 +136,12 @@ function init({ server, call }) {
                     pageTitle: 'OAuth2',
                     menuConfig: true,
                     menuConfigOauth: true,
+                    activeApplications: true,
 
                     newLink: newLink.pathname + newLink.search,
 
                     searchTarget: '/admin/config/oauth',
-                    searchPlaceholder: 'Search for OAuth2 applications...',
+                    searchPlaceholder: 'Search for OAuth2 applications…',
                     query: request.query.query,
 
                     showPaging: data.pages > 1,
@@ -154,7 +183,160 @@ function init({ server, call }) {
         }
     });
 
-    // GET /admin/config/oauth/app/{app} - View OAuth application details
+    // GET /admin/config/oauth/subscriptions - Gmail Pub/Sub subscriptions list
+    server.route({
+        method: 'GET',
+        path: '/admin/config/oauth/subscriptions',
+        async handler(request, h) {
+            try {
+                let data = await oauth2Apps.list(request.query.page - 1, request.query.pageSize, { pubsub: true });
+
+                let gmailSubscriptionTtl = await settings.get('gmailSubscriptionTtl');
+
+                // Compute human-readable expiration for each app
+                // meta.subscriptionExpiration is:
+                //   undefined - no data yet (app predates this feature or ensurePubsub hasn't run)
+                //   null      - indefinite (no TTL set, ensurePubsub confirmed this)
+                //   "Ns"      - TTL in seconds (e.g. "2678400s" for 31 days)
+                let gt = request.app.gt;
+                for (let app of data.apps) {
+                    if (!app.pubSubSubscription) {
+                        app.expirationLabel = '';
+                        continue;
+                    }
+
+                    let meta = app.meta || {};
+                    if (!('subscriptionExpiration' in meta)) {
+                        app.expirationLabel = gt.gettext('Unknown');
+                        continue;
+                    }
+
+                    let seconds = parseInt(meta.subscriptionExpiration, 10);
+                    if (seconds > 0) {
+                        let days = Math.round(seconds / 86400);
+                        app.expirationLabel = util.format(gt.ngettext('%d day', '%d days', days), days);
+                    } else {
+                        app.expirationLabel = gt.gettext('Indefinite');
+                    }
+                }
+
+                let nextPage = false;
+                let prevPage = false;
+
+                let getPagingUrl = page => {
+                    let url = new URL(`admin/config/oauth/subscriptions`, 'http://localhost');
+
+                    if (page) {
+                        url.searchParams.append('page', page);
+                    }
+
+                    if (request.query.pageSize !== DEFAULT_PAGE_SIZE) {
+                        url.searchParams.append('pageSize', request.query.pageSize);
+                    }
+
+                    return url.pathname + url.search;
+                };
+
+                if (data.pages > data.page + 1) {
+                    nextPage = getPagingUrl(data.page + 2);
+                }
+
+                if (data.page > 0) {
+                    prevPage = getPagingUrl(data.page);
+                }
+
+                return h.view(
+                    'config/oauth/subscriptions',
+                    {
+                        pageTitle: 'OAuth2',
+                        menuConfig: true,
+                        menuConfigOauth: true,
+                        activeSubscriptions: true,
+
+                        showPaging: data.pages > 1,
+                        nextPage,
+                        prevPage,
+                        firstPage: data.page === 0,
+                        pageLinks: new Array(data.pages || 1).fill(0).map((z, i) => ({
+                            url: getPagingUrl(i + 1),
+                            title: i + 1,
+                            active: i === data.page
+                        })),
+
+                        apps: data.apps,
+
+                        values: {
+                            gmailSubscriptionTtl: typeof gmailSubscriptionTtl === 'number' ? gmailSubscriptionTtl : ''
+                        }
+                    },
+                    {
+                        layout: 'app'
+                    }
+                );
+            } catch (err) {
+                request.logger.error({ msg: 'Failed to load subscriptions page', err });
+                throwAsBoom(err);
+            }
+        },
+
+        options: {
+            validate: {
+                options: {
+                    stripUnknown: true,
+                    abortEarly: false,
+                    convert: true
+                },
+
+                async failAction(request, h /*, err*/) {
+                    return h.redirect('/admin/config/oauth/subscriptions').takeover();
+                },
+
+                query: Joi.object({
+                    page: Joi.number().integer().min(1).max(1000000).default(1),
+                    pageSize: Joi.number().integer().min(1).max(250).default(DEFAULT_PAGE_SIZE)
+                })
+            }
+        }
+    });
+
+    server.route({
+        method: 'POST',
+        path: '/admin/config/oauth/subscriptions',
+        async handler(request, h) {
+            try {
+                // Joi .empty('').allow(null) ensures this is either null or a number
+                let ttl = request.payload.gmailSubscriptionTtl != null ? request.payload.gmailSubscriptionTtl : null;
+                await settings.set('gmailSubscriptionTtl', ttl);
+
+                await request.flash({ type: 'info', message: 'Configuration updated' });
+                return h.redirect('/admin/config/oauth/subscriptions');
+            } catch (err) {
+                await request.flash({ type: 'danger', message: 'Failed to save settings' });
+                request.logger.error({ msg: 'Failed to save subscription settings', err });
+                return h.redirect('/admin/config/oauth/subscriptions');
+            }
+        },
+        options: {
+            validate: {
+                options: {
+                    stripUnknown: true,
+                    abortEarly: false,
+                    convert: true
+                },
+
+                async failAction(request, h /*, err*/) {
+                    await request.flash({ type: 'danger', message: 'Invalid setting value' });
+                    return h.redirect('/admin/config/oauth/subscriptions').takeover();
+                },
+
+                payload: Joi.object({
+                    gmailSubscriptionTtl: Joi.number().integer().empty('').allow(null).min(0).max(365),
+                    crumb: Joi.string().max(256)
+                })
+            }
+        }
+    });
+
     server.route({
         method: 'GET',
         path: '/admin/config/oauth/app/{app}',
@@ -213,8 +395,10 @@ function init({ server, call }) {
                 app.cloudData = AZURE_CLOUDS.find(entry => entry.id === app.cloud);
             }
 
-            let isServiceAccount = SERVICE_ACCOUNT_PROVIDERS.has(app.provider);
-            let serviceUrl = (await settings.get('serviceUrl')) || '';
+            // Service account apps scoped for email access (IMAP/SMTP or Gmail/Graph API) can register
+            // accounts directly without an interactive consent flow. Pub/Sub-scoped service apps are for
+            // webhook notifications only, so they must not offer the direct add-account shortcut.
+            let canAddServiceAccount = SERVICE_ACCOUNT_PROVIDERS.has(app.provider) && app.enabled && app.baseScopes !== 'pubsub';
 
             return h.view(
                 'config/oauth/app',
@@ -231,10 +415,13 @@ function init({ server, call }) {
                     baseScopesImap: app.baseScopes === 'imap' || !app.baseScopes,
                     baseScopesPubsub: app.baseScopes === 'pubsub',
 
+                    appShowAuthMethod: app.provider === 'gmailService',
+                    authMethodIsExternalAccount: app.authMethod === 'externalAccount',
+
+                    canAddServiceAccount,
+
                     disabledScopes,
                     isSendOnlyGmail,
-                    isServiceAccount,
-                    serviceUrl,
 
                     providerData
                 },
@@ -263,7 +450,6 @@ function init({ server, call }) {
         }
     });
 
-    // POST /admin/config/oauth/delete - Delete OAuth application
     server.route({
         method: 'POST',
         path: '/admin/config/oauth/delete',
@@ -308,7 +494,119 @@ function init({ server, call }) {
         }
     });
 
-    // GET /admin/config/oauth/new - New OAuth application form
+    server.route({
+        method: 'POST',
+        path: '/admin/config/oauth/app/{app}/add-account',
+        async handler(request, h) {
+            const appId = request.params.app;
+            try {
+                const app = await oauth2Apps.get(appId);
+                if (!app) {
+                    let error = Boom.boomify(new Error('Application was not found.'), { statusCode: 404 });
+                    throw error;
+                }
+
+                // Direct account registration is only valid for email-scoped service account apps. Interactive
+                // providers must use the hosted consent flow, and Pub/Sub-scoped apps grant no mailbox access.
+                if (!SERVICE_ACCOUNT_PROVIDERS.has(app.provider) || !app.enabled || app.baseScopes === 'pubsub') {
+                    let error = Boom.boomify(new Error('This application can not register accounts directly.'), { statusCode: 400 });
+                    throw error;
+                }
+
+                let accountData = {
+                    account: request.payload.account || null,
+                    email: request.payload.email,
+                    oauth2: {
+                        provider: app.id,
+                        auth: {
+                            user: request.payload.email
+                        }
+                    }
+                };
+
+                if (request.payload.name) {
+                    accountData.name = request.payload.name;
+                }
+
+                const accountObject = new Account({ redis, call, secret: await getSecret() });
+                const result = await accountObject.create(accountData);
+
+                await request.flash({ type: 'info', message: `Account ${result.state === 'existing' ? 'updated' : 'added'}` });
+
+                return h.redirect(`/admin/accounts/${result.account}`);
+            } catch (err) {
+                request.logger.error({ msg: 'Failed to register service account', err, app: appId, remoteAddress: request.app.ip });
+                await request.flash({ type: 'danger', message: `Failed to add account${err.message ? `: ${err.message}` : ''}` });
+                return h.redirect(`/admin/config/oauth/app/${appId}`);
+            }
+        },
+        options: {
+            validate: {
+                options: {
+                    stripUnknown: true,
+                    abortEarly: false,
+                    convert: true
+                },
+
+                async failAction(request, h, err) {
+                    request.logger.error({ msg: 'Failed to register service account', err, app: request.params.app });
+                    await request.flash({ type: 'danger', message: `Failed to add account. Provide a valid email address.` });
+                    return h.redirect(`/admin/config/oauth/app/${request.params.app}`).takeover();
+                },
+
+                params: Joi.object({
+                    app: Joi.string().empty('').max(255).example('gmail').label('Provider').required()
+                }),
+
+                payload: Joi.object({
+                    account: accountIdSchema.default(null),
+                    name: Joi.string().empty('').max(256).example('John Smith').description('Account Name'),
+                    email: Joi.string().email().required().example('user@example.com').label('Email').description('Mailbox email address')
+                })
+            }
+        }
+    });
+
+    server.route({
+        method: 'POST',
+        path: '/admin/config/oauth/verify/{app}',
+        async handler(request, h) {
+            try {
+                return await verifyOAuth2App(request.params.app, {
+                    account: request.payload.account,
+                    testConnection: request.payload.testConnection
+                });
+            } catch (err) {
+                request.logger.error({ msg: 'Failed to verify OAuth2 application', err, app: request.params.app });
+                return h.response({ error: err.message, code: err.code || null }).code(err.statusCode || 500);
+            }
+        },
+        options: {
+            validate: {
+                options: {
+                    stripUnknown: true,
+                    abortEarly: false,
+                    convert: true
+                },
+
+                async failAction(request, h, err) {
+                    request.logger.error({ msg: 'Invalid verify request', err, app: request.params.app });
+                    return h.response({ error: 'Invalid request' }).code(400).takeover();
+                },
+
+                params: Joi.object({
+                    app: Joi.string().empty('').max(255).required().label('Provider')
+                }),
+
+                payload: Joi.object({
+                    crumb: Joi.string().optional(),
+                    account: Joi.string().trim().empty('').max(256).optional(),
+                    testConnection: Joi.boolean().truthy('Y', 'true', '1', 'on').falsy('N', 'false', 0, '').default(true)
+                })
+            }
+        }
+    });
+
     server.route({
         method: 'GET',
         path: '/admin/config/oauth/new',
@@ -317,9 +615,10 @@ function init({ server, call }) {
             let providerData = oauth2ProviderData(provider);
 
             let serviceUrl = await settings.get('serviceUrl');
-            let defaultRedirectUrl = normalizeOutlookRedirectUrl(`${serviceUrl}/oauth`, provider);
-
-            let pubSubApps = await oauth2Apps.list(0, 1000, { pubsub: true });
+            let defaultRedirectUrl = `${serviceUrl}/oauth`;
+            if (provider === 'outlook') {
+                defaultRedirectUrl = defaultRedirectUrl.replace(/^http:\/\/127\.0\.0\.1\b/i, 'http://localhost');
+            }
 
             return h.view(
                 'config/oauth/new',
@@ -338,7 +637,9 @@ function init({ server, call }) {
                     baseScopesApi: false,
                     baseScopesPubsub: false,
 
-                    pubSubApps: pubSubApps && pubSubApps.apps,
+                    ...authMethodContext('serviceKey'),
+
+                    pubSubApps: await getPubSubAppsForSelect(null),
 
                     azureClouds: structuredClone(AZURE_CLOUDS).map(entry => {
                         if (entry.id === 'global') {
@@ -349,10 +650,11 @@ function init({ server, call }) {
 
                     values: {
                         provider,
-                        ...(provider !== 'outlookService' ? { redirectUrl: defaultRedirectUrl } : {})
+                        redirectUrl: defaultRedirectUrl,
+                        authMethod: 'serviceKey'
                     },
 
-                    authorityCommon: provider !== 'outlookService'
+                    authorityCommon: true
                 },
                 {
                     layout: 'app'
@@ -383,7 +685,6 @@ function init({ server, call }) {
         }
     });
 
-    // POST /admin/config/oauth/new - Create OAuth application
     server.route({
         method: 'POST',
         path: '/admin/config/oauth/new',
@@ -428,9 +729,10 @@ function init({ server, call }) {
                 let providerData = oauth2ProviderData(provider);
 
                 let serviceUrl = await settings.get('serviceUrl');
-                let defaultRedirectUrl = normalizeOutlookRedirectUrl(`${serviceUrl}/oauth`, provider);
-
-                let pubSubApps = await oauth2Apps.list(0, 1000, { pubsub: true });
+                let defaultRedirectUrl = `${serviceUrl}/oauth`;
+                if (provider === 'outlook') {
+                    defaultRedirectUrl = defaultRedirectUrl.replace(/^http:\/\/127\.0\.0\.1\b/i, 'http://localhost');
+                }
 
                 return h.view(
                     'config/oauth/new',
@@ -445,20 +747,14 @@ function init({ server, call }) {
                         providerData,
                         defaultRedirectUrl,
 
-                        pubSubApps:
-                            pubSubApps &&
-                            pubSubApps.apps &&
-                            pubSubApps.apps.map(app => {
-                                if (app.id === request.payload.pubSubApp) {
-                                    app.selected = true;
-                                }
-                                return app;
-                            }),
+                        pubSubApps: await getPubSubAppsForSelect(request.payload.pubSubApp),
 
                         baseScopesApi: baseScopes === 'api',
                         baseScopesImap: baseScopes === 'imap' || !baseScopes,
                         baseScopesPubsub: baseScopes === 'pubsub',
 
+                        ...authMethodContext(request.payload.authMethod),
+
                         azureClouds: structuredClone(AZURE_CLOUDS).map(entry => {
                             entry.selected = request.payload.cloud === entry.id;
                             return entry;
@@ -505,9 +801,10 @@ function init({ server, call }) {
                     let providerData = oauth2ProviderData(provider);
 
                     let serviceUrl = await settings.get('serviceUrl');
-                    let defaultRedirectUrl = normalizeOutlookRedirectUrl(`${serviceUrl}/oauth`, provider);
-
-                    let pubSubApps = await oauth2Apps.list(0, 1000, { pubsub: true });
+                    let defaultRedirectUrl = `${serviceUrl}/oauth`;
+                    if (provider === 'outlook') {
+                        defaultRedirectUrl = defaultRedirectUrl.replace(/^http:\/\/127\.0\.0\.1\b/i, 'http://localhost');
+                    }
 
                     return h
                         .view(
@@ -523,20 +820,14 @@ function init({ server, call }) {
                                 providerData,
                                 defaultRedirectUrl,
 
-                                pubSubApps:
-                                    pubSubApps &&
-                                    pubSubApps.apps &&
-                                    pubSubApps.apps.map(app => {
-                                        if (app.id === request.payload.pubSubApp) {
-                                            app.selected = true;
-                                        }
-                                        return app;
-                                    }),
+                                pubSubApps: await getPubSubAppsForSelect(request.payload.pubSubApp),
 
                                 baseScopesApi: baseScopes === 'api',
                                 baseScopesImap: baseScopes === 'imap' || !baseScopes,
                                 baseScopesPubsub: baseScopes === 'pubsub',
 
+                                ...authMethodContext(request.payload.authMethod),
+
                                 azureClouds: structuredClone(AZURE_CLOUDS).map(entry => {
                                     entry.selected = request.payload.cloud === entry.id;
                                     return entry;
@@ -561,7 +852,6 @@ function init({ server, call }) {
         }
     });
 
-    // GET /admin/config/oauth/edit/{app} - Edit OAuth application form
     server.route({
         method: 'GET',
         path: '/admin/config/oauth/edit/{app}',
@@ -574,19 +864,21 @@ function init({ server, call }) {
 
             let providerData = oauth2ProviderData(appData.provider, appData.cloud);
             let serviceUrl = await settings.get('serviceUrl');
-            let defaultRedirectUrl = normalizeOutlookRedirectUrl(`${serviceUrl}/oauth`, providerData.provider);
+            let defaultRedirectUrl = `${serviceUrl}/oauth`;
+            if (providerData.provider === 'outlook') {
+                defaultRedirectUrl = defaultRedirectUrl.replace(/^http:\/\/127\.0\.0\.1\b/i, 'http://localhost');
+            }
 
             let values = Object.assign({}, appData, {
                 clientSecret: '',
                 serviceKey: '',
+                externalAccount: '',
                 extraScopes: [].concat(appData.extraScopes || []).join('\n'),
                 skipScopes: [].concat(appData.skipScopes || []).join('\n'),
 
                 tenant: appData.authority && !['common', 'organizations', 'consumers'].includes(appData.authority) ? appData.authority : ''
             });
 
-            let pubSubApps = await oauth2Apps.list(0, 1000, { pubsub: true });
-
             return h.view(
                 'config/oauth/edit',
                 {
@@ -602,16 +894,11 @@ function init({ server, call }) {
 
                     hasClientSecret: !!appData.clientSecret,
                     hasServiceKey: !!appData.serviceKey,
+                    hasExternalAccount: !!appData.externalAccount,
 
-                    pubSubApps:
-                        pubSubApps &&
-                        pubSubApps.apps &&
-                        pubSubApps.apps.map(app => {
-                            if (app.id === values.pubSubApp) {
-                                app.selected = true;
-                            }
-                            return app;
-                        }),
+                    ...authMethodContext(appData.authMethod, !!appData.serviceKey || !!appData.externalAccount),
+
+                    pubSubApps: await getPubSubAppsForSelect(values.pubSubApp),
 
                     values,
 
@@ -654,7 +941,6 @@ function init({ server, call }) {
         }
     });
 
-    // POST /admin/config/oauth/edit - Update OAuth application
     server.route({
         method: 'POST',
         path: '/admin/config/oauth/edit',
@@ -700,9 +986,10 @@ function init({ server, call }) {
                 let providerData = oauth2ProviderData(appData.provider, appData.cloud);
 
                 let serviceUrl = await settings.get('serviceUrl');
-                let defaultRedirectUrl = normalizeOutlookRedirectUrl(`${serviceUrl}/oauth`, appData.provider);
-
-                let pubSubApps = await oauth2Apps.list(0, 1000, { pubsub: true });
+                let defaultRedirectUrl = `${serviceUrl}/oauth`;
+                if (appData.provider === 'outlook') {
+                    defaultRedirectUrl = defaultRedirectUrl.replace(/^http:\/\/127\.0\.0\.1\b/i, 'http://localhost');
+                }
 
                 return h.view(
                     'config/oauth/edit',
@@ -718,16 +1005,11 @@ function init({ server, call }) {
 
                         hasClientSecret: !!appData.clientSecret,
                         hasServiceKey: !!appData.serviceKey,
+                        hasExternalAccount: !!appData.externalAccount,
+
+                        ...authMethodContext(appData.authMethod, !!appData.serviceKey || !!appData.externalAccount),
 
-                        pubSubApps:
-                            pubSubApps &&
-                            pubSubApps.apps &&
-                            pubSubApps.apps.map(app => {
-                                if (app.id === request.payload.pubSubApp) {
-                                    app.selected = true;
-                                }
-                                return app;
-                            }),
+                        pubSubApps: await getPubSubAppsForSelect(request.payload.pubSubApp),
 
                         baseScopesApi: request.payload.baseScopes === 'api',
                         baseScopesImap: request.payload.baseScopes === 'imap' || !request.payload.baseScopes,
@@ -786,9 +1068,10 @@ function init({ server, call }) {
                     let providerData = oauth2ProviderData(provider);
 
                     let serviceUrl = await settings.get('serviceUrl');
-                    let defaultRedirectUrl = normalizeOutlookRedirectUrl(`${serviceUrl}/oauth`, provider);
-
-                    let pubSubApps = await oauth2Apps.list(0, 1000, { pubsub: true });
+                    let defaultRedirectUrl = `${serviceUrl}/oauth`;
+                    if (provider === 'outlook') {
+                        defaultRedirectUrl = defaultRedirectUrl.replace(/^http:\/\/127\.0\.0\.1\b/i, 'http://localhost');
+                    }
 
                     return h
                         .view(
@@ -806,16 +1089,11 @@ function init({ server, call }) {
 
                                 hasClientSecret: !!appData.clientSecret,
                                 hasServiceKey: !!appData.serviceKey,
+                                hasExternalAccount: !!appData.externalAccount,
+
+                                ...authMethodContext(request.payload.authMethod),
 
-                                pubSubApps:
-                                    pubSubApps &&
-                                    pubSubApps.apps &&
-                                    pubSubApps.apps.map(app => {
-                                        if (app.id === request.payload.pubSubApp) {
-                                            app.selected = true;
-                                        }
-                                        return app;
-                                    }),
+                                pubSubApps: await getPubSubAppsForSelect(request.payload.pubSubApp),
 
                                 baseScopesApi: request.payload.baseScopes === 'api',
                                 baseScopesImap: request.payload.baseScopes === 'imap' || !request.payload.baseScopes,