docs: OAuth client redirectUri with wildcard character (#18267)

apps/api/v2/src/lib/is-origin-allowed/is-origin-allowed.spec.ts

@@ -41,6 +41,18 @@ describe("isOriginAllowed", () => {
       const origin = "https://sub.mydomain.com/path/to/resource";
       expect(isOriginAllowed(origin, allowedOrigins)).toBe(true);
     });
+
+    it("should handle patterns with wildcard for routes correctly", () => {
+      const allowedOrigins = ["https://domain.com/*"];
+      const origin = "https://domain.com/dashboard";
+      expect(isOriginAllowed(origin, allowedOrigins)).toBe(true);
+    });
+
+    it("should handle patterns with wildcard for root route correctly", () => {
+      const allowedOrigins = ["https://domain.com*"];
+      const origin = "https://domain.com";
+      expect(isOriginAllowed(origin, allowedOrigins)).toBe(true);
+    });
   });
 
   describe("is not allowed", () => {

apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.ts

@@ -179,7 +179,7 @@ export class ApiAuthStrategy extends PassportStrategy(BaseStrategy, "api-auth")
 
     if (origin && !isOriginAllowed(origin, client.redirectUris)) {
       throw new UnauthorizedException(
-        `Invalid request origin - please open https://app.cal.com/settings/platform and add the origin '${origin}' to the 'Redirect uris' of your OAuth client.`
+        `Invalid request origin - please open https://app.cal.com/settings/platform and add the origin '${origin}' to the 'Redirect uris' of your OAuth client with ID '${client.id}'`
       );
     }
 

docs/platform/quickstart.mdx

@@ -14,7 +14,7 @@ Once your account is created, the next step is to create an OAuth client. This a
 1. After logging in using provided credentials, open OAuth clients settings page [https://app.cal.com/settings/platform/oauth-clients/create](https://app.cal.com/settings/platform/oauth-clients/create)
 2. Add an OAuth client.
     1. Name: anything is fine. You can use your company name or your website.
-    2. Redirect URIs: Used to validate internal requests origin and allow redirections on your platform when needed. You can enable any URI of your company’s domain (e.g. cal.com in our case).
+    2. Redirect URIs: Used to validate origin of requests - your website's URLs from which atoms are allowed to make requests to our API. Supports wildcard syntax where "*" would support any origin, and "*app.com" would support "example.app.com", and "https//example.com*" where it would support any origin from that domain.
     3. Booking, reschedule and cancel URLs: URLs of pages where users land after a successful booking or if they want to reschedule or cancel a booking. We will pass information in the URL when redirecting to your pages and you will use our hooks and components to implement the pages. See [this guide](/platform/booking-redirects).
     4. Permissions - most likely you need all enabled:
         1. Event type: event type is a user event that others can book. For example, Alice is a language teacher and she has an event type “30 minutes Italian lesson” that others can then book.