From 1f845944acad26580cffc298c1ed9c4d8fe75d0d Mon Sep 17 00:00:00 2001 From: Joe Au-Yeung <65426560+joeauyeung@users.noreply.github.com> Date: Mon, 4 Mar 2024 14:02:48 -0500 Subject: [PATCH] chore: Add credential sync secret when requesting a token (#13907) * Rename .env variables * Remove instances of old variable names * Add credential sync secret to request for new token * Update invalid secret message Co-authored-by: Keith Williams --------- Co-authored-by: Keith Williams --- .env.example | 4 ++-- apps/web/pages/api/webhook/app-credential.ts | 8 +++----- .../app-store/_utils/oauth/refreshOAuthTokens.ts | 16 ++++++++++++++-- packages/lib/constants.ts | 6 ++++-- turbo.json | 4 ++-- 5 files changed, 25 insertions(+), 13 deletions(-) diff --git a/.env.example b/.env.example index dca083387a..17f4d19cc4 100644 --- a/.env.example +++ b/.env.example @@ -294,9 +294,9 @@ E2E_TEST_CALCOM_GCAL_KEYS= # Used for self-hosters that are implementing Cal.com into their applications that already have certain integrations # Under settings/admin/apps ensure that all app secrets are set the same as the parent application # You can use: `openssl rand -base64 32` to generate one -CALCOM_WEBHOOK_SECRET="" +CALCOM_CREDENTIAL_SYNC_SECRET="" # This is the header name that will be used to verify the webhook secret. Should be in lowercase -CALCOM_WEBHOOK_HEADER_NAME="calcom-webhook-secret" +CALCOM_CREDENTIAL_SYNC_SECRET_HEADER_NAME="calcom-webhook-secret" CALCOM_CREDENTIAL_SYNC_ENDPOINT="" # Key should match on Cal.com and your application # must be 24 bytes for AES256 encryption algorithm diff --git a/apps/web/pages/api/webhook/app-credential.ts b/apps/web/pages/api/webhook/app-credential.ts index e0ed83a696..cf12409688 100644 --- a/apps/web/pages/api/webhook/app-credential.ts +++ b/apps/web/pages/api/webhook/app-credential.ts @@ -2,6 +2,7 @@ import type { NextApiRequest, NextApiResponse } from "next"; import z from "zod"; import { appStoreMetadata } from "@calcom/app-store/appStoreMetaData"; +import { CREDENTIAL_SYNC_SECRET, CREDENTIAL_SYNC_SECRET_HEADER_NAME } from "@calcom/lib/constants"; import { APP_CREDENTIAL_SHARING_ENABLED } from "@calcom/lib/constants"; import { symmetricDecrypt } from "@calcom/lib/crypto"; import prisma from "@calcom/prisma"; @@ -19,11 +20,8 @@ export default async function handler(req: NextApiRequest, res: NextApiResponse) return res.status(403).json({ message: "Credential sharing is not enabled" }); } - if ( - req.headers[process.env.CALCOM_WEBHOOK_HEADER_NAME || "calcom-webhook-secret"] !== - process.env.CALCOM_WEBHOOK_SECRET - ) { - return res.status(403).json({ message: "Invalid webhook secret" }); + if (req.headers[CREDENTIAL_SYNC_SECRET_HEADER_NAME] !== CREDENTIAL_SYNC_SECRET) { + return res.status(403).json({ message: "Invalid credential sync secret" }); } const reqBody = appCredentialWebhookRequestBodySchema.parse(req.body); diff --git a/packages/app-store/_utils/oauth/refreshOAuthTokens.ts b/packages/app-store/_utils/oauth/refreshOAuthTokens.ts index 999ada5245..00f99b88d9 100644 --- a/packages/app-store/_utils/oauth/refreshOAuthTokens.ts +++ b/packages/app-store/_utils/oauth/refreshOAuthTokens.ts @@ -1,13 +1,25 @@ -import { APP_CREDENTIAL_SHARING_ENABLED } from "@calcom/lib/constants"; +import { + APP_CREDENTIAL_SHARING_ENABLED, + CREDENTIAL_SYNC_SECRET, + CREDENTIAL_SYNC_SECRET_HEADER_NAME, +} from "@calcom/lib/constants"; // eslint-disable-next-line @typescript-eslint/no-explicit-any const refreshOAuthTokens = async (refreshFunction: () => any, appSlug: string, userId: number | null) => { // Check that app syncing is enabled and that the credential belongs to a user - if (APP_CREDENTIAL_SHARING_ENABLED && process.env.CALCOM_CREDENTIAL_SYNC_ENDPOINT && userId) { + if ( + APP_CREDENTIAL_SHARING_ENABLED && + process.env.CALCOM_CREDENTIAL_SYNC_ENDPOINT && + CREDENTIAL_SYNC_SECRET && + userId + ) { // Customize the payload based on what your endpoint requires // The response should only contain the access token and expiry date const response = await fetch(process.env.CALCOM_CREDENTIAL_SYNC_ENDPOINT, { method: "POST", + headers: { + [CREDENTIAL_SYNC_SECRET_HEADER_NAME]: CREDENTIAL_SYNC_SECRET, + }, body: new URLSearchParams({ calcomUserId: userId.toString(), appSlug, diff --git a/packages/lib/constants.ts b/packages/lib/constants.ts index c602801cf0..bf251817a2 100644 --- a/packages/lib/constants.ts +++ b/packages/lib/constants.ts @@ -106,8 +106,10 @@ export const ORGANIZATION_MIN_SEATS = 30; export const IS_MAILHOG_ENABLED = process.env.E2E_TEST_MAILHOG_ENABLED === "1"; export const CALCOM_VERSION = process.env.NEXT_PUBLIC_CALCOM_VERSION as string; -export const APP_CREDENTIAL_SHARING_ENABLED = - process.env.CALCOM_WEBHOOK_SECRET && process.env.CALCOM_APP_CREDENTIAL_ENCRYPTION_KEY; +export const CREDENTIAL_SYNC_SECRET = process.env.CALCOM_CREDENTIAL_SYNC_SECRET; +export const CREDENTIAL_SYNC_SECRET_HEADER_NAME = + process.env.CALCOM_CREDENTIAL_SYNC_SECRET_HEADER_NAME || "calcom-credential-sync-secret"; +export const APP_CREDENTIAL_SHARING_ENABLED = CREDENTIAL_SYNC_SECRET && CREDENTIAL_SYNC_SECRET_HEADER_NAME; export const DEFAULT_LIGHT_BRAND_COLOR = "#292929"; export const DEFAULT_DARK_BRAND_COLOR = "#fafafa"; diff --git a/turbo.json b/turbo.json index 694ab7f9fb..d3cc392b98 100644 --- a/turbo.json +++ b/turbo.json @@ -222,14 +222,14 @@ "BUILD_ID", "CALCOM_APP_CREDENTIAL_ENCRYPTION_KEY", "CALCOM_CREDENTIAL_SYNC_ENDPOINT", + "CALCOM_CREDENTIAL_SYNC_SECRET", + "CALCOM_CREDENTIAL_SYNC_SECRET_HEADER_NAME", "CALCOM_ENV", "CALCOM_LICENSE_KEY", "CALCOM_QA_EMAIL", "CALCOM_QA_PASSWORD", "CALCOM_TELEMETRY_DISABLED", - "CALCOM_WEBHOOK_HEADER_NAME", "CALENDSO_ENCRYPTION_KEY", - "CALCOM_WEBHOOK_SECRET", "CI", "CLOSECOM_API_KEY", "CRON_API_KEY",