feat(server): add invalid oauth callback code error handling (#10603)

close CLOUD-130

packages/backend/server/src/plugins/oauth/controller.ts

@@ -3,7 +3,9 @@ import {
   Controller,
   HttpCode,
   HttpStatus,
+  Logger,
   Post,
+  type RawBodyRequest,
   Req,
   Res,
 } from '@nestjs/common';
@@ -27,6 +29,8 @@ import { OAuthService } from './service';
 
 @Controller('/api/oauth')
 export class OAuthController {
+  private readonly logger = new Logger(OAuthController.name);
+
   constructor(
     private readonly auth: AuthService,
     private readonly oauth: OAuthService,
@@ -69,7 +73,7 @@ export class OAuthController {
   @Post('/callback')
   @HttpCode(HttpStatus.OK)
   async callback(
-    @Req() req: Request,
+    @Req() req: RawBodyRequest<Request>,
     @Res() res: Response,
     @Body('code') code?: string,
     @Body('state') stateStr?: string
@@ -102,7 +106,20 @@ export class OAuthController {
       throw new UnknownOauthProvider({ name: state.provider ?? 'unknown' });
     }
 
-    const tokens = await provider.getToken(code);
+    let tokens: Tokens;
+    try {
+      tokens = await provider.getToken(code);
+    } catch (err) {
+      let rayBodyString = '';
+      if (req.rawBody) {
+        // only log the first 4096 bytes of the raw body
+        rayBodyString = req.rawBody.subarray(0, 4096).toString('utf-8');
+      }
+      this.logger.warn(
+        `Error getting oauth token for ${state.provider}, callback code: ${code}, stateStr: ${stateStr}, rawBody: ${rayBodyString}, error: ${err}`
+      );
+      throw err;
+    }
     const externAccount = await provider.getUser(tokens.accessToken);
     const user = await this.loginFromOauth(
       state.provider,

packages/backend/server/src/plugins/oauth/providers/github.ts

@@ -1,6 +1,6 @@
 import { Injectable } from '@nestjs/common';
 
-import { Config, URLHelper } from '../../../base';
+import { Config, InvalidOauthCallbackCode, URLHelper } from '../../../base';
 import { OAuthProviderName } from '../config';
 import { AutoRegisteredOAuthProvider } from '../register';
 
@@ -64,10 +64,12 @@ export class GithubOAuthProvider extends AutoRegisteredOAuthProvider {
         scope: ghToken.scope,
       };
     } else {
+      const body = await response.text();
+      if (response.status < 500) {
+        throw new InvalidOauthCallbackCode({ status: response.status, body });
+      }
       throw new Error(
-        `Server responded with non-success code ${
-          response.status
-        }, ${JSON.stringify(await response.json())}`
+        `Server responded with non-success status ${response.status}, body: ${body}`
       );
     }
   }

packages/backend/server/src/plugins/oauth/providers/google.ts

@@ -1,6 +1,6 @@
 import { Injectable } from '@nestjs/common';
 
-import { Config, URLHelper } from '../../../base';
+import { Config, InvalidOauthCallbackCode, URLHelper } from '../../../base';
 import { OAuthProviderName } from '../config';
 import { AutoRegisteredOAuthProvider } from '../register';
 
@@ -69,10 +69,12 @@ export class GoogleOAuthProvider extends AutoRegisteredOAuthProvider {
         scope: ghToken.scope,
       };
     } else {
+      const body = await response.text();
+      if (response.status < 500) {
+        throw new InvalidOauthCallbackCode({ status: response.status, body });
+      }
       throw new Error(
-        `Server responded with non-success code ${
-          response.status
-        }, ${JSON.stringify(await response.json())}`
+        `Server responded with non-success status ${response.status}, body: ${body}`
       );
     }
   }