chore: Add credential sync secret when requesting a token (#13907)

* Rename .env variables

* Remove instances of old variable names

* Add credential sync secret to request for new token

* Update invalid secret message

Co-authored-by: Keith Williams <keithwillcode@gmail.com>

---------

Co-authored-by: Keith Williams <keithwillcode@gmail.com>

.env.example

@@ -294,9 +294,9 @@ E2E_TEST_CALCOM_GCAL_KEYS=
 # Used for self-hosters that are implementing Cal.com into their applications that already have certain integrations
 # Under settings/admin/apps ensure that all app secrets are set the same as the parent application
 # You can use: `openssl rand -base64 32` to generate one
-CALCOM_WEBHOOK_SECRET=""
+CALCOM_CREDENTIAL_SYNC_SECRET=""
 # This is the header name that will be used to verify the webhook secret. Should be in lowercase
-CALCOM_WEBHOOK_HEADER_NAME="calcom-webhook-secret"
+CALCOM_CREDENTIAL_SYNC_SECRET_HEADER_NAME="calcom-webhook-secret"
 CALCOM_CREDENTIAL_SYNC_ENDPOINT=""
 # Key should match on Cal.com and your application
 # must be 24 bytes for AES256 encryption algorithm

apps/web/pages/api/webhook/app-credential.ts

@@ -2,6 +2,7 @@ import type { NextApiRequest, NextApiResponse } from "next";
 import z from "zod";
 
 import { appStoreMetadata } from "@calcom/app-store/appStoreMetaData";
+import { CREDENTIAL_SYNC_SECRET, CREDENTIAL_SYNC_SECRET_HEADER_NAME } from "@calcom/lib/constants";
 import { APP_CREDENTIAL_SHARING_ENABLED } from "@calcom/lib/constants";
 import { symmetricDecrypt } from "@calcom/lib/crypto";
 import prisma from "@calcom/prisma";
@@ -19,11 +20,8 @@ export default async function handler(req: NextApiRequest, res: NextApiResponse)
     return res.status(403).json({ message: "Credential sharing is not enabled" });
   }
 
-  if (
-    req.headers[process.env.CALCOM_WEBHOOK_HEADER_NAME || "calcom-webhook-secret"] !==
-    process.env.CALCOM_WEBHOOK_SECRET
-  ) {
-    return res.status(403).json({ message: "Invalid webhook secret" });
+  if (req.headers[CREDENTIAL_SYNC_SECRET_HEADER_NAME] !== CREDENTIAL_SYNC_SECRET) {
+    return res.status(403).json({ message: "Invalid credential sync secret" });
   }
 
   const reqBody = appCredentialWebhookRequestBodySchema.parse(req.body);

packages/app-store/_utils/oauth/refreshOAuthTokens.ts

@@ -1,13 +1,25 @@
-import { APP_CREDENTIAL_SHARING_ENABLED } from "@calcom/lib/constants";
+import {
+  APP_CREDENTIAL_SHARING_ENABLED,
+  CREDENTIAL_SYNC_SECRET,
+  CREDENTIAL_SYNC_SECRET_HEADER_NAME,
+} from "@calcom/lib/constants";
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 const refreshOAuthTokens = async (refreshFunction: () => any, appSlug: string, userId: number | null) => {
   // Check that app syncing is enabled and that the credential belongs to a user
-  if (APP_CREDENTIAL_SHARING_ENABLED && process.env.CALCOM_CREDENTIAL_SYNC_ENDPOINT && userId) {
+  if (
+    APP_CREDENTIAL_SHARING_ENABLED &&
+    process.env.CALCOM_CREDENTIAL_SYNC_ENDPOINT &&
+    CREDENTIAL_SYNC_SECRET &&
+    userId
+  ) {
     // Customize the payload based on what your endpoint requires
     // The response should only contain the access token and expiry date
     const response = await fetch(process.env.CALCOM_CREDENTIAL_SYNC_ENDPOINT, {
       method: "POST",
+      headers: {
+        [CREDENTIAL_SYNC_SECRET_HEADER_NAME]: CREDENTIAL_SYNC_SECRET,
+      },
       body: new URLSearchParams({
         calcomUserId: userId.toString(),
         appSlug,

packages/lib/constants.ts

@@ -106,8 +106,10 @@ export const ORGANIZATION_MIN_SEATS = 30;
 export const IS_MAILHOG_ENABLED = process.env.E2E_TEST_MAILHOG_ENABLED === "1";
 export const CALCOM_VERSION = process.env.NEXT_PUBLIC_CALCOM_VERSION as string;
 
-export const APP_CREDENTIAL_SHARING_ENABLED =
-  process.env.CALCOM_WEBHOOK_SECRET && process.env.CALCOM_APP_CREDENTIAL_ENCRYPTION_KEY;
+export const CREDENTIAL_SYNC_SECRET = process.env.CALCOM_CREDENTIAL_SYNC_SECRET;
+export const CREDENTIAL_SYNC_SECRET_HEADER_NAME =
+  process.env.CALCOM_CREDENTIAL_SYNC_SECRET_HEADER_NAME || "calcom-credential-sync-secret";
+export const APP_CREDENTIAL_SHARING_ENABLED = CREDENTIAL_SYNC_SECRET && CREDENTIAL_SYNC_SECRET_HEADER_NAME;
 
 export const DEFAULT_LIGHT_BRAND_COLOR = "#292929";
 export const DEFAULT_DARK_BRAND_COLOR = "#fafafa";

turbo.json

@@ -222,14 +222,14 @@
     "BUILD_ID",
     "CALCOM_APP_CREDENTIAL_ENCRYPTION_KEY",
     "CALCOM_CREDENTIAL_SYNC_ENDPOINT",
+    "CALCOM_CREDENTIAL_SYNC_SECRET",
+    "CALCOM_CREDENTIAL_SYNC_SECRET_HEADER_NAME",
     "CALCOM_ENV",
     "CALCOM_LICENSE_KEY",
     "CALCOM_QA_EMAIL",
     "CALCOM_QA_PASSWORD",
     "CALCOM_TELEMETRY_DISABLED",
-    "CALCOM_WEBHOOK_HEADER_NAME",
     "CALENDSO_ENCRYPTION_KEY",
-    "CALCOM_WEBHOOK_SECRET",
     "CI",
     "CLOSECOM_API_KEY",
     "CRON_API_KEY",