fix: errors

Author: annahassel

package.json

@@ -98,7 +98,7 @@
     "serialize-error": "^8.1.0",
     "serialize-javascript": "^6.0.0",
     "tough-cookie": "^4.0.0",
-    "undici": "^5.0.0",
+    "undici": "^5.8.0",
     "uuid": "^8.3.2",
     "yargs": "^17.4.0",
     "zxcvbn": "^4.4.2"

pnpm-lock.yaml

@@ -20,7 +20,7 @@ const appleStrategy = require('../../auth/oauth/strategies/apple');
  * @apiParam (Payload) {String} isStatelessAuth - use stateless JWT tokens when they are optional
  */
 async function upgrade(request) {
-  const { transportRequest, params, query } = request;
+  const { transportRequest, params, query, log } = request;
   const { provider, token, isStatelessAuth } = params;
 
   // fetch settings, otherwise provider is not supported
@@ -39,10 +39,13 @@ async function upgrade(request) {
 
   const credentials = provider === 'apple'
     ? await appleStrategy.upgradeAppleCode({
-      query,
-      providerSettings,
-      code: token,
-      redirectUrl: transportRequest.url.href.replace(/\/upgrade$/, '/apple').replace(/^http:\/\//, 'https://'),
+      log,
+      params: {
+        query,
+        providerSettings,
+        code: token,
+        redirectUrl: transportRequest.url.href.replace(/\/upgrade$/, '/apple').replace(/^http:\/\//, 'https://'),
+      },
     })
     : await profile.call(providerSettings, { token, query });
 

src/actions/oauth/upgrade.js

@@ -111,6 +111,7 @@ async function mserviceVerification({ service, transportRequest }, credentials,
 
   // user is authenticated and profile is attached
   if (user && userId) {
+    // @TODO code?
     throw new Errors.HttpStatusError(412, 'profile is linked');
   }
 

src/auth/oauth/index.js

@@ -4,6 +4,11 @@ const Bluebird = require('bluebird');
 const Boom = require('@hapi/boom');
 const { request: httpRequest } = require('undici');
 
+const {
+  ERROR_OAUTH_APPLE_VALIDATE_CODE,
+  ERROR_OAUTH_APPLE_VERIFY_PROFILE,
+} = require('../../../constants');
+
 // @todo more options from config
 const jwksClient = getJwksClient({
   jwksUri: 'https://appleid.apple.com/auth/keys',
@@ -151,13 +156,24 @@ function getProvider(options, server) {
   };
 }
 
-async function upgradeAppleCode(params) {
+async function upgradeAppleCode({ params, log }) {
   const { providerSettings, code, query, redirectUrl } = params;
   const { profile } = providerSettings.provider;
 
+  let tokenResponse;
+
+  try {
+    tokenResponse = await validateGrantCode(providerSettings, code, redirectUrl);
+  } catch (error) {
+    log.error(Boom.internal(error.body?.error, undefined, error.statusCode));
+
+    throw ERROR_OAUTH_APPLE_VALIDATE_CODE;
+  }
+
+  let credentials;
+
   try {
-    const tokenResponse = await validateGrantCode(providerSettings, code, redirectUrl);
-    const credentials = await profile.call(
+    credentials = await profile.call(
       providerSettings,
       {
         query,
@@ -167,11 +183,13 @@ async function upgradeAppleCode(params) {
       },
       tokenResponse
     );
-
-    return credentials;
   } catch (error) {
-    throw Boom.internal(error.body?.error, undefined, error.statusCode);
+    log.error(Boom.internal(error.body?.error, undefined, error.statusCode));
+
+    throw ERROR_OAUTH_APPLE_VERIFY_PROFILE;
   }
+
+  return credentials;
 }
 
 module.exports = {

src/auth/oauth/strategies/apple.js

@@ -34,6 +34,7 @@ async function formOAuthResponse(ctx, request, credentials) {
   }
 
   if (!account) {
+    // @TODO 403?
     throw new HttpStatusError(500, 'no account when jwt isn\'t present');
   }
 

src/auth/oauth/utils/form-oauth-response.js

@@ -89,6 +89,9 @@ module.exports = exports = {
   ErrorUserNotMember: new HttpStatusError(404, 'username not member of organization'),
   ErrorInvitationExpiredOrUsed: new HttpStatusError(400, 'Invitation has expired or already been used'),
 
+  ERROR_OAUTH_APPLE_VALIDATE_CODE: new HttpStatusError(403, 'Code validation failed'),
+  ERROR_OAUTH_APPLE_VERIFY_PROFILE: new HttpStatusError(403, 'Profile verification failed'),
+
   // actions
   USERS_ACTION_ACTIVATE: 'activate',
   USERS_ACTION_VERIFY_CONTACT: 'verify-contact',
@@ -143,6 +146,9 @@ exports.USERS_JWT_ACCESS_REQUIRED.code = 'E_TKN_ACCESS_TOKEN_REQUIRED';
 exports.USERS_JWT_REFRESH_REQUIRED.code = 'E_TKN_REFRESH_TOKEN_REQUIRED';
 exports.USERS_JWT_STATELESS_REQUIRED.code = 'E_STATELESS_NOT_ENABLED';
 
+exports.ERROR_OAUTH_APPLE_VALIDATE_CODE.code = 'E_VALIDATE_CODE';
+exports.ERROR_OAUTH_APPLE_VERIFY_PROFILE.code = 'E_VERIFY_PROFILE';
+
 exports.SSO_PROVIDERS = [
   exports.USERS_SSO_FACEBOOK_FIELD,
   exports.USERS_SSO_APPLE_FIELD,

src/constants.js

@@ -28,7 +28,7 @@ describe('oauth.upgrade action', function suite() {
     appleStrategyStub
       .withArgs(
         match(
-          (params) => params.code === 'c75da8efcf25f4acb80e51152fead9fad.0.srqty.7-k4X-G9bBesI_9hDFH6Xg'
+          ({ params }) => params.code === 'c75da8efcf25f4acb80e51152fead9fad.0.srqty.7-k4X-G9bBesI_9hDFH6Xg'
             && params.redirectUrl === 'https://ms-users.local/users/oauth/apple'
             && params.providerSettings.appId === 'com.test.app'
         )