mirror of
https://github.com/yu-i-i/overleaf-cep.git
synced 2026-11-12 21:23:45 +01:00
Lucie GermainandClaude Opus 5
9cf4fa8bf5
* [web] gracefully handle failed oauth token exchange for reference managers Mendeley/ReadCube redirect back to /:ref_provider/oauth/token-exchange with `error` and `error_description` instead of `code` when a user declines consent. completeAuth forwarded the whole query string on to third-party-references, whose strict zod schema (d8c1679bb08) accepts only oauth_token, oauth_verifier and code, so the exchange failed and the user got a 500. The same forwarding also sent `state` on every callback, success or failure. `state` is web's own CSRF token and is never read by third-party-references, so it tripped the log-only schema on every single token exchange, and would have broken linking outright under REQ_VALIDATION_MODE=enforce. Forward only the credentials the exchange needs, and show a translated notification in the Reference managers section rather than erroring. Validate ref_provider against the known providers so the provider name can be interpolated into the message without reflecting a URL segment. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * [web] fix providerName argument and validate before deriving refProvider Address Copilot review on #36377: - The token-exchange failure handler passed `false` positionally into the `providerName` slot of _redirectWithLinkingError, so a failed exchange would have rendered "your false account". Pass providerName and an explicit false. - _getRefProviderBackendKey(req) ran before parseReq, so refProvider was derived from raw, unvalidated req.params. Parse first and derive from the validated params via _toRefProviderBackendKey; _getRefProviderBackendKey now delegates to it so the other handlers are unchanged. The completeAuth tests kept their assertions inside ctx.res.callback without awaiting the controller, so the callback fired after the test had already returned and the assertions were never enforced — which is why the suite was green with the providerName bug in it. Await the controller and assert inline. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * [web] add logOnly to the completeAuth schema and guard the provider lookup logOnly returns the raw input on a schema failure, so ref_provider can be an arbitrary URL segment. Check it against the display-name table rather than trusting the schema: unknown providers 404 in both validation modes, and providerName is guaranteed non-null for the rest of the handler. Also covers the schema half under REQ_VALIDATION_MODE=enforce, so dropping ref_provider from completeAuthSchema fails a test rather than passing unnoticed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> GitOrigin-RevId: b98eb5414fe8b672f44aab8c3690f7637d434cd2