1839

Committed 12 Nov 2024 07:54PM UTC coverage: 84.09% (+0.09%) from 83.997%

Build # 1839

Build Type

Pull #126

circleci

Committed by

allanpoppe2

Commit Message

Avoid exposing access token in URL [CodeRabbit]

Pull Request Pull Request #126: Facebook Profile Posts

Run Details

490 of 685 branches covered (71.53%)

Branch coverage included in aggregate %.

51 of 56 new or added lines in 5 files covered. (91.07%)

8 existing lines in 1 file now uncovered.

1677 of 1892 relevant lines covered (88.64%)

4.21 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

69.7

/src/oauth/meta.js

const MetaCredentials = require("../credentials/meta-app-credentials");
const fetch = require("node-fetch");
const { URLSearchParams } = require("url");

const facebookApiBaseUrl = "https://graph.facebook.com/v20.0";

const refreshAccessToken = async (provider, accessToken, account) => {
  try {
    const userCode = await getFacebookUserCode(provider, accessToken);
    return await getFacebookExchangeTokenWithCode(provider, userCode.code);
  } catch (error) {
    const status = error.status ? error.status : error.code;
    const statusText = error.statusText ? error.statusText : error.message;
    console.warn(
      `Refreshing access token request failed for account: ${account} with status: ${status} and statusText: ${statusText}`
    );
    throw Error(
      `Refreshing access token request failed with status: ${status} and statusText: ${statusText}`
    );
  }
};

const getFacebookUserCode = async (provider, longLivedToken) => {
  const body = new URLSearchParams();
  body.append("redirect_uri", "https://risevision.com");
  body.append("client_id", MetaCredentials[provider].client_id);
  body.append("client_secret", MetaCredentials[provider].client_secret);
  body.append("access_token", longLivedToken);
  const response = await fetch(`${facebookApiBaseUrl}/oauth/client_code`, {
    body,
    method: "POST",
  });
  if (response.error) {
    throw response.error;
  }

  const json = await response.json();
  if (json.error) {
    throw json.error;
  }
  return json;
};

const getFacebookExchangeTokenWithCode = async (provider, userCode) => {
  const body = new URLSearchParams();
  body.append("redirect_uri", "https://risevision.com");
  body.append("client_id", MetaCredentials[provider].client_id);
  body.append("client_secret", MetaCredentials[provider].client_secret);
  body.append("code", userCode);
  const response = await fetch(
    "https://graph.facebook.com/v20.0/oauth/access_token",
    {
      body,
      method: "POST",
    }
  );
  if (response.error) {
    throw response.error;
  }

  const json = await response.json();
  if (json.error) {
    throw json.error;
  }
  return json;
};

const revokeAccess = async (credentials) => {
  const { access_token } = credentials;

  const body = new URLSearchParams();
  body.append("access_token", access_token);
  const response = await fetch(`${facebookApiBaseUrl}/me/permissions`, {
    method: "DELETE",
    body,
  });
  if (response.error) {
    throw response.error;
  }

  const json = await response.json();
  if (json.error) {
    throw json.error;
  }
  return json.success;
};

module.exports = {
  refreshAccessToken,
  revokeAccess,
};

1	const MetaCredentials = require("../credentials/meta-app-credentials");	2✔
2	const fetch = require("node-fetch");	2✔
3	const { URLSearchParams } = require("url");	2✔
4
5	const facebookApiBaseUrl = "https://graph.facebook.com/v20.0";	2✔
6
7	const refreshAccessToken = async (provider, accessToken, account) => {	2✔
8	try {	2✔
9	const userCode = await getFacebookUserCode(provider, accessToken);	2✔
10	return await getFacebookExchangeTokenWithCode(provider, userCode.code);	1✔
11	} catch (error) {
12	const status = error.status ? error.status : error.code;	1!
13	const statusText = error.statusText ? error.statusText : error.message;	1!
14	console.warn(	1✔
15	`Refreshing access token request failed for account: ${account} with status: ${status} and statusText: ${statusText}`
16	);
17	throw Error(	1✔
18	`Refreshing access token request failed with status: ${status} and statusText: ${statusText}`
19	);
20	}
21	};
22
23	const getFacebookUserCode = async (provider, longLivedToken) => {	2✔
24	const body = new URLSearchParams();	4✔
25	body.append("redirect_uri", "https://risevision.com");	4✔
26	body.append("client_id", MetaCredentials[provider].client_id);	4✔
27	body.append("client_secret", MetaCredentials[provider].client_secret);	4✔
28	body.append("access_token", longLivedToken);	4✔
29	const response = await fetch(`${facebookApiBaseUrl}/oauth/client_code`, {	4✔
30	body,
31	method: "POST",
32	});
33	if (response.error) {	3!
34	throw response.error;	×
35	}
36
37	const json = await response.json();	3✔
38	if (json.error) {	3✔
39	throw json.error;	1✔
40	}
41	return json;	2✔
42	};
43
44	const getFacebookExchangeTokenWithCode = async (provider, userCode) => {	2✔
45	const body = new URLSearchParams();	3✔
46	body.append("redirect_uri", "https://risevision.com");	3✔
47	body.append("client_id", MetaCredentials[provider].client_id);	3✔
48	body.append("client_secret", MetaCredentials[provider].client_secret);	3✔
49	body.append("code", userCode);	3✔
50	const response = await fetch(	3✔
51	"https://graph.facebook.com/v20.0/oauth/access_token",
52	{
53	body,
54	method: "POST",
55	}
56	);
57	if (response.error) {	3!
UNCOV 58	throw response.error;	×
59	}
60
61	const json = await response.json();	3✔
62	if (json.error) {	3✔
63	throw json.error;	1✔
64	}
65	return json;	2✔
66	};
67
68	const revokeAccess = async (credentials) => {	2✔
69	const { access_token } = credentials;	×
70
UNCOV 71	const body = new URLSearchParams();	×
UNCOV 72	body.append("access_token", access_token);	×
UNCOV 73	const response = await fetch(`${facebookApiBaseUrl}/me/permissions`, {	×
74	method: "DELETE",
75	body,
76	});
UNCOV 77	if (response.error) {	×
78	throw response.error;	×
79	}
80
UNCOV 81	const json = await response.json();	×
82	if (json.error) {	×
UNCOV 83	throw json.error;	×
84	}
UNCOV 85	return json.success;	×
86	};
87
88	module.exports = {	2✔
89	refreshAccessToken,
90	revokeAccess,
91	};

Rise-Vision / google-service / 1839

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous