feat(auth): add Zod validation for OAuth callback endpoints#593
feat(auth): add Zod validation for OAuth callback endpoints#593ramnnn2006 wants to merge 2 commits into
Conversation
Validates code and state query params in /auth/github/callback and /auth/google/callback before any token exchange or DB work happens. Adds oauthCallbackSchema to validators.ts and tests covering missing/ empty code, missing/empty state, and state cookie mismatch scenarios.
|
@ramnnn2006 is attempting to deploy a commit to the Prashantkumar Khatri's projects Team on Vercel. A member of the Team first needs to authorize it. |
github-actions
Bot
added
backend
gssoc:approved
|
Hi @ramnnn2006, Thanks for opening this pull request. This PR has been automatically classified based on the files modified. Applied Labels
Primary Review Area
Reviewer@Harxhit has been identified as the primary reviewer for this pull request. If you have any questions regarding the affected area or implementation details, feel free to reach out to the assigned reviewer. Thank you for your contribution! |
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds Zod-based validation for OAuth callback query parameters (GitHub + Google) and introduces tests to ensure invalid callback requests fail early with consistent 400 responses.
Changes:
- Introduced
oauthCallbackSchemato validatecodeandstateon OAuth callbacks. - Updated GitHub/Google callback routes to use
safeParse()and return structured validation errors. - Added Vitest coverage for invalid callback parameter and OAuth state-cookie scenarios.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| apps/backend/src/validations/auth.validation.ts | Adds a Zod schema for OAuth callback query params. |
| apps/backend/src/routes/auth.ts | Uses the new schema to validate callback querystrings and standardize 400 responses. |
| apps/backend/src/tests/auth-callback.test.ts | Adds regression tests for Zod validation + state cookie enforcement. |
Comments suppressed due to low confidence (1)
apps/backend/src/validations/auth.validation.ts:1
- Schema naming is inconsistent (
oAuthStartSchemavsoauthCallbackSchema). Standardizing on a single convention (e.g.,oauthStartSchema/oauthCallbackSchemaoroAuthStartSchema/oAuthCallbackSchema) will make imports and discoverability more predictable.
import { z } from 'zod';
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| export const oauthCallbackSchema = z.object({ | ||
| code: z.string().min(1, 'Authorization code is required'), | ||
| state: z.string().min(1, 'State parameter is required'), | ||
| }); No newline at end of file |
| app.get('/github/callback', async (request: FastifyRequest<{ Querystring: OAuthCallbackQuery }>, reply: FastifyReply) => { | ||
| //TODO: Add zod validation here | ||
| const { code, state } = request.query; | ||
| const parsed = oauthCallbackSchema.safeParse(request.query); |
| const parsed = oauthCallbackSchema.safeParse(request.query); | ||
| if (!parsed.success) { | ||
| return reply.status(400).send({ error: 'Invalid callback parameters', details: parsed.error.flatten() }); | ||
| } | ||
| const { code, state } = parsed.data; |
CI — All Checks PassedBackend — PASS
Mobile — SKIP
Web — SKIP
Last updated: |
- rename oauthCallbackSchema to oAuthCallbackSchema to match naming convention - add .trim() to code and state fields to reject whitespace-only values - export OAuthCallbackQuery type from auth.validation.ts and remove duplicate local interface
|
@Harxhit could u check , ive resolved the conflictsnow! |
Summary
Adds Zod validation to
/auth/github/callbackand/auth/google/callbacksocodeandstateare validated before any token exchange or DB calls happen. Previously there were scattered manualif (!code)checks, this replaces them with a singlesafeParseat the top of each handler.Closes #539
Type of Change
What Changed
oauthCallbackSchematoauth.validation.tswithcodeandstateas required non-empty stringsauth.tsto use `safnual guardsauth-callback.test.tswith 14 tests covering missing/empty code, missing/empty state, no cookie, and cookie mismatch for bothendpoints
How to Test
pnpm -r run test— 14 new tests in `auth-callbacGET /auth/github/callbackwith nocodeparam — expect 400 withInvalid callback parameterscodeandstatebut nooauth_statevalid or missing OAuth state — possible CSRF attack`Checklist
pnpm -r run typecheck).pnpm -r run test).console.logor debug statements left in the code.Screenshots / Recordings
N/A