| … | … | @@ -0,0 +1,191 @@ |
| 1 | /** |
| 2 | * Google Calendar API routes — OAuth flow + calendar management. |
| 3 | */ |
| 4 | |
| 5 | import crypto from 'bare-crypto' |
| 6 | import { json, notFound, redirect } from '../response.js' |
| 7 | import { requireAuth } from './auth-helpers.js' |
| 8 | import { readJson } from '../response.js' |
| 9 | |
| 10 | export function registerGcalRoutes (router, server) { |
| 11 | const gcal = server.gcal |
| 12 | |
| 13 | // Get OAuth2 authorization URL |
| 14 | router.get('/api/gcal/auth-url', async (req, res) => { |
| 15 | const auth = await requireAuth(req, server, 'write') |
| 16 | const providerId = await getProviderIdForUser(server, auth.userId) |
| 17 | if (!providerId) return json(res, { error: 'No provider profile' }, 403) |
| 18 | |
| 19 | // Generate CSRF nonce |
| 20 | const nonce = crypto.randomBytes(16).toString('hex') |
| 21 | const state = Buffer.from(JSON.stringify({ providerId, nonce })).toString('base64url') |
| 22 | |
| 23 | // Store nonce for validation (5-min TTL) |
| 24 | await server.db.put(`gcal:state:${nonce}`, { |
| 25 | providerId, |
| 26 | createdAt: Date.now() |
| 27 | }) |
| 28 | |
| 29 | // Build redirect URI from request host |
| 30 | const host = req.headers.host || 'localhost:4050' |
| 31 | const protocol = req.headers['x-forwarded-proto'] || 'http' |
| 32 | const redirectUri = `${protocol}://${host}${server.pathPrefix}/api/gcal/callback` |
| 33 | |
| 34 | const url = gcal.getAuthUrl(redirectUri, state) |
| 35 | json(res, { url }) |
| 36 | }) |
| 37 | |
| 38 | // OAuth2 callback — Google redirects here |
| 39 | router.get('/api/gcal/callback', async (req, res) => { |
| 40 | const url = new URL('http://x' + req.url) |
| 41 | const code = url.searchParams.get('code') |
| 42 | const stateParam = url.searchParams.get('state') |
| 43 | const error = url.searchParams.get('error') |
| 44 | |
| 45 | if (error) { |
| 46 | return redirect(res, `${server.pathPrefix}/dashboard/settings?gcal=error&reason=${error}`) |
| 47 | } |
| 48 | |
| 49 | if (!code || !stateParam) { |
| 50 | return redirect(res, `${server.pathPrefix}/dashboard/settings?gcal=error&reason=missing_params`) |
| 51 | } |
| 52 | |
| 53 | // Decode and validate state |
| 54 | let state |
| 55 | try { |
| 56 | state = JSON.parse(Buffer.from(stateParam, 'base64url').toString()) |
| 57 | } catch { |
| 58 | return redirect(res, `${server.pathPrefix}/dashboard/settings?gcal=error&reason=invalid_state`) |
| 59 | } |
| 60 | |
| 61 | const { providerId, nonce } = state |
| 62 | |
| 63 | // Validate CSRF nonce |
| 64 | const nonceEntry = await server.db.get(`gcal:state:${nonce}`) |
| 65 | if (!nonceEntry) { |
| 66 | return redirect(res, `${server.pathPrefix}/dashboard/settings?gcal=error&reason=expired_state`) |
| 67 | } |
| 68 | |
| 69 | // Check nonce age (5 min max) |
| 70 | if (Date.now() - nonceEntry.value.createdAt > 5 * 60 * 1000) { |
| 71 | await server.db.del(`gcal:state:${nonce}`) |
| 72 | return redirect(res, `${server.pathPrefix}/dashboard/settings?gcal=error&reason=expired_state`) |
| 73 | } |
| 74 | |
| 75 | // Consume nonce |
| 76 | await server.db.del(`gcal:state:${nonce}`) |
| 77 | |
| 78 | // Exchange code for tokens |
| 79 | const host = req.headers.host || 'localhost:4050' |
| 80 | const protocol = req.headers['x-forwarded-proto'] || 'http' |
| 81 | const redirectUri = `${protocol}://${host}${server.pathPrefix}/api/gcal/callback` |
| 82 | |
| 83 | try { |
| 84 | const tokens = await gcal.exchangeCode(code, redirectUri) |
| 85 | |
| 86 | // Store tokens |
| 87 | await server.db.put(`gcal:provider:${providerId}`, { |
| 88 | connected: true, |
| 89 | accessToken: tokens.accessToken, |
| 90 | refreshToken: tokens.refreshToken, |
| 91 | tokenExpiry: Date.now() + (tokens.expiresIn * 1000), |
| 92 | calendarIds: ['primary'], |
| 93 | connectedAt: Date.now() |
| 94 | }) |
| 95 | |
| 96 | redirect(res, `${server.pathPrefix}/dashboard/settings?gcal=connected`) |
| 97 | } catch (err) { |
| 98 | console.error('[GCal] Token exchange failed:', err.message) |
| 99 | redirect(res, `${server.pathPrefix}/dashboard/settings?gcal=error&reason=token_exchange_failed`) |
| 100 | } |
| 101 | }) |
| 102 | |
| 103 | // Get connection status |
| 104 | router.get('/api/gcal/status', async (req, res) => { |
| 105 | const auth = await requireAuth(req, server, 'write') |
| 106 | const providerId = await getProviderIdForUser(server, auth.userId) |
| 107 | if (!providerId) return json(res, { connected: false }) |
| 108 | |
| 109 | const entry = await server.db.get(`gcal:provider:${providerId}`) |
| 110 | if (!entry || !entry.value.connected) { |
| 111 | return json(res, { connected: false }) |
| 112 | } |
| 113 | |
| 114 | json(res, { |
| 115 | connected: true, |
| 116 | calendarIds: entry.value.calendarIds || ['primary'], |
| 117 | connectedAt: entry.value.connectedAt |
| 118 | }) |
| 119 | }) |
| 120 | |
| 121 | // List available calendars from Google |
| 122 | router.get('/api/gcal/calendars', async (req, res) => { |
| 123 | const auth = await requireAuth(req, server, 'write') |
| 124 | const providerId = await getProviderIdForUser(server, auth.userId) |
| 125 | if (!providerId) return json(res, { error: 'No provider profile' }, 403) |
| 126 | |
| 127 | const accessToken = await gcal.getValidToken(server.db, providerId) |
| 128 | if (!accessToken) return json(res, { error: 'Not connected to Google Calendar' }, 400) |
| 129 | |
| 130 | try { |
| 131 | const calendars = await gcal.fetchCalendarList(accessToken) |
| 132 | json(res, calendars) |
| 133 | } catch (err) { |
| 134 | json(res, { error: err.message }, 500) |
| 135 | } |
| 136 | }) |
| 137 | |
| 138 | // Update selected calendars |
| 139 | router.put('/api/gcal/calendars', async (req, res) => { |
| 140 | const auth = await requireAuth(req, server, 'write') |
| 141 | const providerId = await getProviderIdForUser(server, auth.userId) |
| 142 | if (!providerId) return json(res, { error: 'No provider profile' }, 403) |
| 143 | |
| 144 | const body = await readJson(req) |
| 145 | const { calendarIds } = body |
| 146 | |
| 147 | if (!Array.isArray(calendarIds) || calendarIds.length === 0) { |
| 148 | return json(res, { error: 'calendarIds array required' }, 400) |
| 149 | } |
| 150 | |
| 151 | const entry = await server.db.get(`gcal:provider:${providerId}`) |
| 152 | if (!entry || !entry.value.connected) { |
| 153 | return json(res, { error: 'Not connected' }, 400) |
| 154 | } |
| 155 | |
| 156 | entry.value.calendarIds = calendarIds |
| 157 | await server.db.put(`gcal:provider:${providerId}`, entry.value) |
| 158 | |
| 159 | // Clear cache (calendar selection changed) |
| 160 | const delKeys = [] |
| 161 | for await (const e of server.db.createReadStream({ |
| 162 | gte: `gcal:cache:${providerId}:`, |
| 163 | lte: `gcal:cache:${providerId}:~` |
| 164 | })) { |
| 165 | delKeys.push(e.key) |
| 166 | } |
| 167 | for (const key of delKeys) await server.db.del(key) |
| 168 | |
| 169 | json(res, { ok: true, calendarIds }) |
| 170 | }) |
| 171 | |
| 172 | // Disconnect Google Calendar |
| 173 | router.delete('/api/gcal/disconnect', async (req, res) => { |
| 174 | const auth = await requireAuth(req, server, 'write') |
| 175 | const providerId = await getProviderIdForUser(server, auth.userId) |
| 176 | if (!providerId) return json(res, { error: 'No provider profile' }, 403) |
| 177 | |
| 178 | await gcal.disconnect(server.db, providerId) |
| 179 | json(res, { ok: true }) |
| 180 | }) |
| 181 | } |
| 182 | |
| 183 | async function getProviderIdForUser (server, userId) { |
| 184 | for await (const entry of server.db.createReadStream({ |
| 185 | gte: 'provider:', |
| 186 | lte: 'provider:~' |
| 187 | })) { |
| 188 | if (entry.value.userId === userId) return entry.value.id |
| 189 | } |
| 190 | return null |
| 191 | } |