fix(connectors): route Google OAuth callbacks by connector path

Merged
WE
2d ago
+76-2

Description

Fix Google Drive authorization failing with “Request did not pass CSRF verification” when using a shared Google credential.

The callback selected Gmail whenever the full URL contained gmail. Shared Google credentials request both Drive and Gmail scopes. A Drive callback containing gmail.readonly therefore reached the Gmail handler, which expected a different credential cookie.

Select the handler from the [connector] route parameter and reject unsupported connectors. Preserve the callback query and cookies. Add regression tests and update the feature map.

How Has This Been Tested?

  • All three callback regression tests pass: Drive and Gmail with combined scopes, plus unsupported connector rejection.
  • Confirmed that the Drive regression test fails with the old routing logic.
  • All pre-commit checks pass, including TypeScript type checking and coverage, formatting, linting, and feature map integrity.
  • Completed real Google OAuth on a fresh isolated Docker-backed ODS stack from this branch. The callback included Gmail scopes, reached the Drive handler successfully, and returned to Drive without an OAuth failure. The Drive auth-check endpoint then returned authenticated: true.

Additional Options

  • [Optional] Please cherry-pick this PR to the latest release version.

Summary by cubic

Fixes Google Drive OAuth authorization failing with "Request did not pass CSRF verification" when using a shared Google credential.

The callback previously chose the Gmail handler whenever the full URL contained "gmail". Shared Google credentials return scopes for both Drive and Gmail, so a Drive callback including "gmail.readonly" was routed to the Gmail handler, which expects a different credential cookie. The handler is now selected from the [connector] route parameter, and unsupported connectors are rejected with a 404 before any backend call.

Testing

  • Regression tests cover Drive and Gmail callbacks with combined scopes, plus rejection of unsupported connectors.
  • The Drive regression test fails under the old routing logic.

Summary by CodeRabbit

  • Bug Fixes

    • Corrected OAuth callback handling for Gmail and Google Drive connectors.
    • Unsupported connector routes now return a 404 response instead of proceeding through authentication.
    • Valid callbacks continue to forward authorization details and cookies, then redirect successfully.

  • Documentation

    • Added guidance clarifying connector-specific Google OAuth callback behavior and shared credential scopes.