Skip to content

OAuth credential sync and app integration enhancements#4

Open
akshayutture-augment wants to merge 1 commit into
oauth-security-basefrom
oauth-security-enhanced
Open

OAuth credential sync and app integration enhancements#4
akshayutture-augment wants to merge 1 commit into
oauth-security-basefrom
oauth-security-enhanced

Conversation

@akshayutture-augment

@akshayutture-augment akshayutture-augment commented Nov 17, 2025

Copy link
Copy Markdown

No description provided.

…11059)

* Add credential sync .env variables

* Add webhook to send app credentials

* Upsert credentials when webhook called

* Refresh oauth token from a specific endpoint

* Pass appSlug

* Add credential encryption

* Move oauth helps into a folder

* Create parse token response wrapper

* Add OAuth helpers to apps

* Clean up

* Refactor `appDirName` to `appSlug`

* Address feedback

* Change to safe parse

* Remove console.log

---------

Co-authored-by: Syed Ali Shahbaz <52925846+alishaz-polymath@users.noreply.github.com>
Co-authored-by: Omar López <zomars@me.com>

@augmentcode augmentcode Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review completed. 3 suggestions posted.

Comment augment review to trigger a new review at any time.

const minimumTokenResponseSchema = z.object({
access_token: z.string(),
// Assume that any property with a number is the expiry
[z.string().toString()]: z.number(),

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Zod object uses computed keys like [z.string().toString()], which will create a literal key like "[object Object]" rather than validating arbitrary properties; consider using z.object({ access_token: z.string() }).catchall(z.unknown()) (or a dedicated schema extension) to handle extra fields (including numeric expiry).

🤖 Was this useful? React with 👍 or 👎

}

if (!refreshTokenResponse.data.refresh_token) {
refreshTokenResponse.data.refresh_token = "refresh_token";

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Setting refresh_token to the literal string "refresh_token" when it’s missing will corrupt stored credentials; consider preserving the existing refresh token from storage or avoiding overwriting it when not returned.

🤖 Was this useful? React with 👍 or 👎

appSlug,
}),
});
return response;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This function returns heterogeneous types: a fetch Response in the sync path and the raw result of refreshFunction() otherwise. Downstream code (e.g., expecting res.data) can break when the sync path returns a Response without .data. Consider normalizing the return shape (e.g., always returning parsed JSON tokens).

🤖 Was this useful? React with 👍 or 👎

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants