feat(connectors): handle authorization callback parameters in each connector respectively (#1166)

* feat(connectors): handle authorization callback parameters in each connector respectively

packages/connector-alipay-native/src/index.test.ts

@@ -78,6 +78,12 @@ describe('getAccessToken', () => {
     expect(accessToken).toEqual('access_token');
   });
 
+  it('throw General error if auth_code not provided in input', async () => {
+    await expect(alipayNativeMethods.getUserInfo({})).rejects.toMatchError(
+      new ConnectorError(ConnectorErrorCodes.General, '{}')
+    );
+  });
+
   it('should throw when accessToken is empty', async () => {
     nock(alipayEndpointUrl.origin)
       .post(alipayEndpointUrl.pathname)

packages/connector-alipay-native/src/index.ts

@@ -42,8 +42,6 @@ import { signingParameters } from './utils';
 
 export type { AlipayNativeConfig } from './types';
 
-const dataGuard = z.object({ auth_code: z.string() });
-
 export default class AlipayNativeConnector implements SocialConnector {
   public metadata: ConnectorMetadata = defaultMetadata;
 
@@ -106,7 +104,7 @@ export default class AlipayNativeConnector implements SocialConnector {
   };
 
   public getUserInfo: GetUserInfo = async (data) => {
-    const { auth_code } = dataGuard.parse(data);
+    const { auth_code } = await this.authorizationCallbackHandler(data);
     const config = await this.getConfig(this.metadata.id);
     const { accessToken } = await this.getAccessToken(auth_code, config);
 
@@ -164,4 +162,16 @@ export default class AlipayNativeConnector implements SocialConnector {
     );
     assert(!sub_code, new ConnectorError(ConnectorErrorCodes.General, msg));
   };
+
+  private readonly authorizationCallbackHandler = async (parameterObject: unknown) => {
+    const dataGuard = z.object({ auth_code: z.string() });
+
+    const result = dataGuard.safeParse(parameterObject);
+
+    if (!result.success) {
+      throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(parameterObject));
+    }
+
+    return result.data;
+  };
 }

packages/connector-alipay/src/index.test.ts

@@ -153,6 +153,12 @@ describe('getUserInfo', () => {
     expect(avatar).toEqual('https://www.alipay.com/xxx.jpg');
   });
 
+  it('throw General error if auth_code not provided in input', async () => {
+    await expect(alipayMethods.getUserInfo({})).rejects.toMatchError(
+      new ConnectorError(ConnectorErrorCodes.General, '{}')
+    );
+  });
+
   it('should throw SocialAccessTokenInvalid with code 20001', async () => {
     nock(alipayEndpointUrl.origin)
       .post(alipayEndpointUrl.pathname)

packages/connector-alipay/src/index.ts

@@ -41,8 +41,6 @@ import { signingParameters } from './utils';
 
 export type { AlipayConfig } from './types';
 
-const dataGuard = z.object({ auth_code: z.string() });
-
 export default class AlipayConnector implements SocialConnector {
   public metadata: ConnectorMetadata = defaultMetadata;
 
@@ -112,7 +110,7 @@ export default class AlipayConnector implements SocialConnector {
   };
 
   public getUserInfo: GetUserInfo = async (data) => {
-    const { auth_code } = dataGuard.parse(data);
+    const { auth_code } = await this.authorizationCallbackHandler(data);
     const config = await this.getConfig(this.metadata.id);
     const { accessToken } = await this.getAccessToken(auth_code, config);
 
@@ -170,4 +168,16 @@ export default class AlipayConnector implements SocialConnector {
     );
     assert(!sub_code, new ConnectorError(ConnectorErrorCodes.General, msg));
   };
+
+  private readonly authorizationCallbackHandler = async (parameterObject: unknown) => {
+    const dataGuard = z.object({ auth_code: z.string() });
+
+    const result = dataGuard.safeParse(parameterObject);
+
+    if (!result.success) {
+      throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(parameterObject));
+    }
+
+    return result.data;
+  };
 }

packages/connector-apple/jest.config.ts

@@ -2,6 +2,7 @@ import { Config, merge } from '@silverhand/jest-config';
 
 const config: Config.InitialOptions = merge({
   testEnvironment: 'node',
+  setupFilesAfterEnv: ['jest-matcher-specific-error'],
 });
 
 export default config;

packages/connector-apple/package.json

@@ -40,6 +40,7 @@
     "@types/node": "^16.3.1",
     "eslint": "^8.10.0",
     "jest": "^27.5.1",
+    "jest-matcher-specific-error": "^1.0.0",
     "lint-staged": "^13.0.0",
     "nock": "^13.2.2",
     "prettier": "^2.3.2",

packages/connector-apple/src/index.test.ts

@@ -1,4 +1,4 @@
-import { GetConnectorConfig } from '@logto/connector-types';
+import { ConnectorError, ConnectorErrorCodes, GetConnectorConfig } from '@logto/connector-types';
 import { jwtVerify } from 'jose';
 
 import AppleConnector from '.';
@@ -63,7 +63,9 @@ describe('getUserInfo', () => {
   });
 
   it('should throw if id token is missing', async () => {
-    await expect(appleMethods.getUserInfo({})).rejects.toThrowError();
+    await expect(appleMethods.getUserInfo({})).rejects.toMatchError(
+      new ConnectorError(ConnectorErrorCodes.General, '{}')
+    );
   });
 
   it('should throw if verify id token failed', async () => {
@@ -71,7 +73,9 @@ describe('getUserInfo', () => {
     mockJwtVerify.mockImplementationOnce(() => {
       throw new Error('jwtVerify failed');
     });
-    await expect(appleMethods.getUserInfo({ idToken: 'idToken' })).rejects.toThrowError();
+    await expect(appleMethods.getUserInfo({ id_token: 'id_token' })).rejects.toMatchError(
+      new ConnectorError(ConnectorErrorCodes.SocialIdTokenInvalid)
+    );
   });
 
   it('should throw if the id token payload does not contains sub', async () => {
@@ -79,6 +83,8 @@ describe('getUserInfo', () => {
     mockJwtVerify.mockImplementationOnce(() => ({
       payload: { iat: 123_456 },
     }));
-    await expect(appleMethods.getUserInfo({ idToken: 'idToken' })).rejects.toThrowError();
+    await expect(appleMethods.getUserInfo({ id_token: 'id_token' })).rejects.toMatchError(
+      new ConnectorError(ConnectorErrorCodes.SocialIdTokenInvalid)
+    );
   });
 });

packages/connector-apple/src/index.ts

@@ -44,7 +44,7 @@ export default class AppleConnector implements SocialConnector {
   };
 
   public getUserInfo: GetUserInfo = async (data) => {
-    const { id_token: idToken } = dataGuard.parse(data);
+    const { id_token: idToken } = await this.authorizationCallbackHandler(data);
 
     if (!idToken) {
       throw new ConnectorError(ConnectorErrorCodes.SocialIdTokenInvalid);
@@ -69,4 +69,14 @@ export default class AppleConnector implements SocialConnector {
       throw new ConnectorError(ConnectorErrorCodes.SocialIdTokenInvalid);
     }
   };
+
+  private readonly authorizationCallbackHandler = async (parameterObject: unknown) => {
+    const result = dataGuard.safeParse(parameterObject);
+
+    if (!result.success) {
+      throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(parameterObject));
+    }
+
+    return result.data;
+  };
 }

packages/connector-apple/tsconfig.json

@@ -1,7 +1,7 @@
 {
   "extends": "./tsconfig.base",
   "compilerOptions": {
-    "types": ["node", "jest"]
+    "types": ["node", "jest", "jest-matcher-specific-error"]
   },
   "include": ["src", "jest.config.ts"]
 }

packages/connector-facebook/src/index.test.ts

@@ -152,6 +152,55 @@ describe('facebook connector', () => {
       ).rejects.toMatchError(new ConnectorError(ConnectorErrorCodes.SocialAccessTokenInvalid));
     });
 
+    it('throws AuthorizationFailed error if error is access_denied', async () => {
+      const avatar = 'https://github.com/images/error/octocat_happy.gif';
+      nock(userInfoEndpoint)
+        .get('')
+        .query({ fields })
+        .reply(200, {
+          id: '1234567890',
+          name: 'monalisa octocat',
+          email: 'octocat@facebook.com',
+          picture: { data: { url: avatar } },
+        });
+      await expect(
+        facebookMethods.getUserInfo({
+          error: 'access_denied',
+          error_code: 200,
+          error_description: 'Permissions error.',
+          error_reason: 'user_denied',
+        })
+      ).rejects.toMatchError(
+        new ConnectorError(ConnectorErrorCodes.AuthorizationFailed, 'Permissions error.')
+      );
+    });
+
+    it('throws General error if error is not access_denied', async () => {
+      const avatar = 'https://github.com/images/error/octocat_happy.gif';
+      nock(userInfoEndpoint)
+        .get('')
+        .query({ fields })
+        .reply(200, {
+          id: '1234567890',
+          name: 'monalisa octocat',
+          email: 'octocat@facebook.com',
+          picture: { data: { url: avatar } },
+        });
+      await expect(
+        facebookMethods.getUserInfo({
+          error: 'general_error',
+          error_code: 200,
+          error_description: 'General error encountered.',
+          error_reason: 'user_denied',
+        })
+      ).rejects.toMatchError(
+        new ConnectorError(
+          ConnectorErrorCodes.General,
+          '{"error":"general_error","error_code":200,"error_description":"General error encountered.","error_reason":"user_denied"}'
+        )
+      );
+    });
+
     it('throws unrecognized error', async () => {
       nock(userInfoEndpoint).get('').reply(500);
       await expect(

packages/connector-facebook/src/index.ts

@@ -26,6 +26,7 @@ import {
   defaultTimeout,
 } from './constant';
 import {
+  authorizationCallbackErrorGuard,
   facebookConfigGuard,
   accessTokenResponseGuard,
   FacebookConfig,
@@ -88,7 +89,7 @@ export default class FacebookConnector implements SocialConnector {
   };
 
   public getUserInfo: GetUserInfo = async (data) => {
-    const { code, redirectUri } = codeWithRedirectDataGuard.parse(data);
+    const { code, redirectUri } = await this.authorizationCallbackHandler(data);
     const { accessToken } = await this.getAccessToken(code, redirectUri);
 
     try {
@@ -123,4 +124,27 @@ export default class FacebookConnector implements SocialConnector {
       throw error;
     }
   };
+
+  private readonly authorizationCallbackHandler = async (parameterObject: unknown) => {
+    const result = codeWithRedirectDataGuard.safeParse(parameterObject);
+
+    if (result.success) {
+      return result.data;
+    }
+
+    const parsedError = authorizationCallbackErrorGuard.safeParse(parameterObject);
+
+    if (!parsedError.success) {
+      throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(parameterObject));
+    }
+
+    if (parsedError.data.error === 'access_denied') {
+      throw new ConnectorError(
+        ConnectorErrorCodes.AuthorizationFailed,
+        parsedError.data.error_description
+      );
+    }
+
+    throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(parameterObject));
+  };
 }

packages/connector-facebook/src/types.ts

@@ -29,3 +29,10 @@ export const userInfoResponseGuard = z.object({
 });
 
 export type UserInfoResponse = z.infer<typeof userInfoResponseGuard>;
+
+export const authorizationCallbackErrorGuard = z.object({
+  error: z.string(),
+  error_code: z.number().optional(),
+  error_description: z.string(),
+  error_reason: z.string(),
+});

packages/connector-github/src/index.test.ts

@@ -137,6 +137,48 @@ describe('getUserInfo', () => {
     );
   });
 
+  it('throws AuthorizationFailed error if error is access_denied', async () => {
+    nock(userInfoEndpoint).get('').reply(200, {
+      id: 1,
+      avatar_url: 'https://github.com/images/error/octocat_happy.gif',
+      name: 'monalisa octocat',
+      email: 'octocat@github.com',
+    });
+    await expect(
+      githubMethods.getUserInfo({
+        error: 'access_denied',
+        error_description: 'The user has denied your application access.',
+        error_uri:
+          'https://docs.github.com/apps/troubleshooting-authorization-request-errors#access-denied',
+      })
+    ).rejects.toMatchError(
+      new ConnectorError(
+        ConnectorErrorCodes.AuthorizationFailed,
+        'The user has denied your application access.'
+      )
+    );
+  });
+
+  it('throws General error if error is not access_denied', async () => {
+    nock(userInfoEndpoint).get('').reply(200, {
+      id: 1,
+      avatar_url: 'https://github.com/images/error/octocat_happy.gif',
+      name: 'monalisa octocat',
+      email: 'octocat@github.com',
+    });
+    await expect(
+      githubMethods.getUserInfo({
+        error: 'general_error',
+        error_description: 'General error encountered.',
+      })
+    ).rejects.toMatchError(
+      new ConnectorError(
+        ConnectorErrorCodes.General,
+        '{"error":"general_error","error_description":"General error encountered."}'
+      )
+    );
+  });
+
   it('throws unrecognized error', async () => {
     nock(userInfoEndpoint).get('').reply(500);
     await expect(githubMethods.getUserInfo({ code: 'code' })).rejects.toThrow();

packages/connector-github/src/index.ts

@@ -22,6 +22,7 @@ import {
   defaultTimeout,
 } from './constant';
 import {
+  authorizationCallbackErrorGuard,
   githubConfigGuard,
   accessTokenResponseGuard,
   GithubConfig,
@@ -54,7 +55,7 @@ export default class GithubConnector implements SocialConnector {
     return `${authorizationEndpoint}?${queryParameters.toString()}`;
   };
 
-  getAccessToken = async (code: string) => {
+  public getAccessToken = async (code: string) => {
     const { clientId: client_id, clientSecret: client_secret } = await this.getConfig(
       this.metadata.id
     );
@@ -83,7 +84,7 @@ export default class GithubConnector implements SocialConnector {
   };
 
   public getUserInfo: GetUserInfo = async (data) => {
-    const { code } = codeDataGuard.parse(data);
+    const { code } = await this.authorizationCallbackHandler(data);
     const { accessToken } = await this.getAccessToken(code);
 
     try {
@@ -115,4 +116,27 @@ export default class GithubConnector implements SocialConnector {
       throw error;
     }
   };
+
+  private readonly authorizationCallbackHandler = async (parameterObject: unknown) => {
+    const result = codeDataGuard.safeParse(parameterObject);
+
+    if (result.success) {
+      return result.data;
+    }
+
+    const parsedError = authorizationCallbackErrorGuard.safeParse(parameterObject);
+
+    if (!parsedError.success) {
+      throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(parameterObject));
+    }
+
+    if (parsedError.data.error === 'access_denied') {
+      throw new ConnectorError(
+        ConnectorErrorCodes.AuthorizationFailed,
+        parsedError.data.error_description
+      );
+    }
+
+    throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(parameterObject));
+  };
 }

packages/connector-github/src/types.ts

@@ -23,3 +23,9 @@ export const userInfoResponseGuard = z.object({
 });
 
 export type UserInfoResponse = z.infer<typeof userInfoResponseGuard>;
+
+export const authorizationCallbackErrorGuard = z.object({
+  error: z.string(),
+  error_description: z.string(),
+  error_uri: z.string(),
+});

packages/connector-google/src/index.test.ts

@@ -118,6 +118,30 @@ describe('google connector', () => {
       ).rejects.toMatchError(new ConnectorError(ConnectorErrorCodes.SocialAccessTokenInvalid));
     });
 
+    it('throws General error', async () => {
+      nock(userInfoEndpoint).post('').reply(200, {
+        sub: '1234567890',
+        name: 'monalisa octocat',
+        given_name: 'monalisa',
+        family_name: 'octocat',
+        picture: 'https://github.com/images/error/octocat_happy.gif',
+        email: 'octocat@google.com',
+        email_verified: true,
+        locale: 'en',
+      });
+      await expect(
+        googleMethods.getUserInfo({
+          error: 'general_error',
+          error_description: 'General error encountered.',
+        })
+      ).rejects.toMatchError(
+        new ConnectorError(
+          ConnectorErrorCodes.General,
+          '{"error":"general_error","error_description":"General error encountered."}'
+        )
+      );
+    });
+
     it('throws unrecognized error', async () => {
       nock(userInfoEndpoint).post('').reply(500);
       await expect(googleMethods.getUserInfo({ code: 'code', redirectUri: '' })).rejects.toThrow();

packages/connector-google/src/index.ts

@@ -88,7 +88,7 @@ export default class GoogleConnector implements SocialConnector {
   };
 
   public getUserInfo: GetUserInfo = async (data) => {
-    const { code, redirectUri } = codeWithRedirectDataGuard.parse(data);
+    const { code, redirectUri } = await this.authorizationCallbackHandler(data);
     const { accessToken } = await this.getAccessToken(code, redirectUri);
 
     try {
@@ -121,4 +121,14 @@ export default class GoogleConnector implements SocialConnector {
       throw error;
     }
   };
+
+  private readonly authorizationCallbackHandler = async (parameterObject: unknown) => {
+    const result = codeWithRedirectDataGuard.safeParse(parameterObject);
+
+    if (!result.success) {
+      throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(parameterObject));
+    }
+
+    return result.data;
+  };
 }

packages/connector-types/src/index.ts

@@ -36,6 +36,7 @@ export enum ConnectorErrorCodes {
   SocialAuthCodeInvalid,
   SocialAccessTokenInvalid,
   SocialIdTokenInvalid,
+  AuthorizationFailed,
 }
 
 export class ConnectorError extends Error {

packages/connector-wechat-native/src/index.test.ts

@@ -159,6 +159,12 @@ describe('getUserInfo', () => {
     });
   });
 
+  it('throws General error if code not provided in input', async () => {
+    await expect(weChatNativeMethods.getUserInfo({})).rejects.toMatchError(
+      new ConnectorError(ConnectorErrorCodes.General, '{}')
+    );
+  });
+
   it('throws error if `openid` is missing', async () => {
     nockNoOpenIdAccessTokenResponse();
     nock(userInfoEndpointUrl.origin)

packages/connector-wechat-native/src/index.ts

@@ -85,7 +85,7 @@ export default class WeChatNativeConnector implements SocialConnector {
   };
 
   public getUserInfo: GetUserInfo = async (data) => {
-    const { code } = codeDataGuard.parse(data);
+    const { code } = await this.authorizationCallbackHandler(data);
     const { accessToken, openid } = await this.getAccessToken(code);
 
     try {
@@ -144,4 +144,14 @@ export default class WeChatNativeConnector implements SocialConnector {
     );
     assert(!errcode, new Error(errmsg ?? ''));
   };
+
+  private readonly authorizationCallbackHandler = async (parameterObject: unknown) => {
+    const result = codeDataGuard.safeParse(parameterObject);
+
+    if (!result.success) {
+      throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(parameterObject));
+    }
+
+    return result.data;
+  };
 }

packages/connector-wechat/src/index.test.ts

@@ -152,6 +152,12 @@ describe('getUserInfo', () => {
     });
   });
 
+  it('throws General error if code not provided in input', async () => {
+    await expect(weChatMethods.getUserInfo({})).rejects.toMatchError(
+      new ConnectorError(ConnectorErrorCodes.General, '{}')
+    );
+  });
+
   it('throws error if `openid` is missing', async () => {
     nockNoOpenIdAccessTokenResponse();
     nock(userInfoEndpointUrl.origin)

packages/connector-wechat/src/index.ts

@@ -89,7 +89,7 @@ export default class WeChatConnector implements SocialConnector {
   };
 
   public getUserInfo: GetUserInfo = async (data) => {
-    const { code } = codeDataGuard.parse(data);
+    const { code } = await this.authorizationCallbackHandler(data);
     const { accessToken, openid } = await this.getAccessToken(code);
 
     try {
@@ -148,4 +148,14 @@ export default class WeChatConnector implements SocialConnector {
     );
     assert(!errcode, new Error(errmsg ?? ''));
   };
+
+  private readonly authorizationCallbackHandler = async (parameterObject: unknown) => {
+    const result = codeDataGuard.safeParse(parameterObject);
+
+    if (!result.success) {
+      throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(parameterObject));
+    }
+
+    return result.data;
+  };
 }

packages/core/src/middleware/koa-connector-error-handler.test.ts

@@ -149,6 +149,24 @@ describe('koaConnectorErrorHandler middleware', () => {
     );
   });
 
+  it('Authorization Failed', async () => {
+    const message = 'Mock Authorization Failed';
+    const error = new ConnectorError(ConnectorErrorCodes.AuthorizationFailed, message);
+    next.mockImplementationOnce(() => {
+      throw error;
+    });
+
+    await expect(koaConnectorErrorHandler()(ctx, next)).rejects.toMatchError(
+      new RequestError(
+        {
+          code: 'connector.authorization_failed',
+          status: 401,
+        },
+        { message }
+      )
+    );
+  });
+
   it('General connector errors', async () => {
     const message = 'Mock General connector errors';
     const error = new ConnectorError(ConnectorErrorCodes.General, message);

packages/core/src/middleware/koa-connector-error-handler.ts

@@ -74,6 +74,14 @@ export default function koaConnectorErrorHandler<StateT, ContextT>(): Middleware
             },
             data
           );
+        case ConnectorErrorCodes.AuthorizationFailed:
+          throw new RequestError(
+            {
+              code: 'connector.authorization_failed',
+              status: 401,
+            },
+            data
+          );
 
         default:
           throw new RequestError(

packages/phrases/src/locales/en.ts

@@ -666,6 +666,7 @@ const errors = {
     invalid_access_token: "The connector's access token is invalid.",
     invalid_auth_code: "The connector's auth code is invalid.",
     invalid_id_token: "The connector's id token is invalid.",
+    authorization_failed: "The user's authorization process is unsuccessful.",
     oauth_code_invalid: 'Unable to get access token, please check authorization code.',
     more_than_one_sms: 'The number of SMS connectors is larger then 1.',
     more_than_one_email: 'The number of Email connectors is larger then 1.',

packages/phrases/src/locales/zh-cn.ts

@@ -647,6 +647,7 @@ const errors = {
     invalid_access_token: '当前连接器的 access_token 无效。',
     invalid_auth_code: '当前连接器的授权码无效。',
     invalid_id_token: '当前连接器的 id_token 无效。',
+    authorization_failed: '用户授权流程失败。',
     oauth_code_invalid: '无法获取 access_token，请检查授权 code 是否有效。',
     more_than_one_sms: '同时存在超过 1 个短信连接器。',
     more_than_one_email: '同时存在超过 1 个邮件连接器。',

pnpm-lock.yaml

@@ -235,6 +235,7 @@ importers:
       eslint: ^8.10.0
       got: ^11.8.2
       jest: ^27.5.1
+      jest-matcher-specific-error: ^1.0.0
       jose: ^4.3.8
       lint-staged: ^13.0.0
       nock: ^13.2.2
@@ -260,6 +261,7 @@ importers:
       '@types/node': 16.11.12
       eslint: 8.10.0
       jest: 27.5.1
+      jest-matcher-specific-error: 1.0.0
       lint-staged: 13.0.0
       nock: 13.2.2
       prettier: 2.5.1