From f4b8760e0084f2aa5b487e0b83fbbca6107541d5 Mon Sep 17 00:00:00 2001
From: Shivam Mishra <scm.mymail@gmail.com>
Date: Mon, 2 Jun 2025 20:17:54 +0530
Subject: [PATCH] feat: handle oauth scope verification and errors

---
 app/controllers/concerns/google_concern.rb    |  2 +-
 .../google/callbacks_controller.rb            | 20 +++++
 app/controllers/oauth_callback_controller.rb  | 17 ++++-
 .../settings/inbox/channels/Email.vue         | 15 +++-
 config/locales/en.yml                         |  5 ++
 lib/custom_exceptions/oauth.rb                | 74 +++++++++++++++++++
 6 files changed, 129 insertions(+), 4 deletions(-)
 create mode 100644 lib/custom_exceptions/oauth.rb

diff --git a/app/controllers/concerns/google_concern.rb b/app/controllers/concerns/google_concern.rb
index 13de7ced3..8b55bc642 100644
--- a/app/controllers/concerns/google_concern.rb
+++ b/app/controllers/concerns/google_concern.rb
@@ -15,6 +15,6 @@ module GoogleConcern
   private
 
   def scope
-    'email profile https://mail.google.com/'
+    'https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email https://mail.google.com/'
   end
 end
diff --git a/app/controllers/google/callbacks_controller.rb b/app/controllers/google/callbacks_controller.rb
index 766d984df..fd785cb84 100644
--- a/app/controllers/google/callbacks_controller.rb
+++ b/app/controllers/google/callbacks_controller.rb
@@ -12,6 +12,16 @@ class Google::CallbacksController < OauthCallbackController
 
   private
 
+  def verify_scopes
+    granted_scopes = parsed_body['scope']&.split || []
+    required_scopes = scope.split
+
+    missing_scopes = required_scopes - granted_scopes
+    return if missing_scopes.empty?
+
+    raise CustomExceptions::OAuth::InsufficientScopes.new({ missing_scopes: missing_scopes })
+  end
+
   def provider_name
     'google'
   end
@@ -24,4 +34,14 @@ class Google::CallbacksController < OauthCallbackController
     # from GoogleConcern
     google_client
   end
+
+  def handle_error(exception)
+    ChatwootExceptionTracker.new(exception).capture_exception
+
+    error_code = exception.respond_to?(:code) ? exception.code : 'OAUTH_ERR'
+    error_message = exception.message || 'OAuth authorization failed'
+
+    redirect_url = "#{ENV.fetch('FRONTEND_URL', 'http://localhost:3000')}/app/accounts/#{account.id}/settings/inboxes/new/email"
+    redirect_to "#{redirect_url}?error=#{CGI.escape(error_message)}&code=#{error_code}"
+  end
 end
diff --git a/app/controllers/oauth_callback_controller.rb b/app/controllers/oauth_callback_controller.rb
index e9c327109..75d818efa 100644
--- a/app/controllers/oauth_callback_controller.rb
+++ b/app/controllers/oauth_callback_controller.rb
@@ -5,10 +5,10 @@ class OauthCallbackController < ApplicationController
       redirect_uri: "#{base_url}/#{provider_name}/callback"
     )
 
+    verify_scopes
     handle_response
   rescue StandardError => e
-    ChatwootExceptionTracker.new(e).capture_exception
-    redirect_to '/'
+    handle_error(e)
   end
 
   private
@@ -63,6 +63,19 @@ class OauthCallbackController < ApplicationController
     raise NotImplementedError
   end
 
+  def verify_scopes
+    true
+  end
+
+  def failure_redirect_url
+    '/'
+  end
+
+  def handle_error(exception)
+    ChatwootExceptionTracker.new(exception).capture_exception
+    redirect_to failure_redirect_url
+  end
+
   def create_channel_with_inbox
     ActiveRecord::Base.transaction do
       channel_email = Channel::Email.create!(email: users_data['email'], account: account)
diff --git a/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/Email.vue b/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/Email.vue
index fe4d7acf3..f60e35f14 100644
--- a/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/Email.vue
+++ b/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/Email.vue
@@ -1,17 +1,21 @@
 <script setup>
-import { ref, computed } from 'vue';
+import { ref, computed, onMounted } from 'vue';
 import ForwardToOption from './emailChannels/ForwardToOption.vue';
 import Microsoft from './emailChannels/Microsoft.vue';
 import Google from './emailChannels/Google.vue';
 import ChannelSelector from 'dashboard/components/ChannelSelector.vue';
 import PageHeader from '../../SettingsSubPageHeader.vue';
 
+import { useAlert } from 'dashboard/composables';
 import { useStoreGetters } from 'dashboard/composables/store';
+
+import { useRoute } from 'vue-router';
 import { useI18n } from 'vue-i18n';
 
 const provider = ref('');
 
 const getters = useStoreGetters();
+const route = useRoute();
 const { t } = useI18n();
 
 const globalConfig = getters['globalConfig/get'];
@@ -45,6 +49,15 @@ const emailProviderList = computed(() => {
   });
 });
 
+const checkForOAuthError = () => {
+  const { error } = route.query;
+  if (error) {
+    useAlert(decodeURIComponent(error));
+  }
+};
+
+onMounted(checkForOAuthError);
+
 function onClick(emailProvider) {
   if (emailProvider.isEnabled) {
     provider.value = emailProvider.key;
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 74177f7dd..8185bd923 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -48,6 +48,11 @@ en:
       email_already_exists: 'You have already signed up for an account with %{email}'
       invalid_params: 'Invalid, please check the signup paramters and try again'
       failed: Signup failed
+    oauth:
+      insufficient_scopes: 'Insufficient permissions granted. Missing scopes: %{scopes}'
+      authorization_failed: 'Authorization failed for %{provider}'
+      token_exchange_failed: 'Failed to exchange authorization code for %{provider}'
+      invalid_state: 'Invalid or missing state parameter'
     data_import:
       data_type:
         invalid: Invalid data type
diff --git a/lib/custom_exceptions/oauth.rb b/lib/custom_exceptions/oauth.rb
new file mode 100644
index 000000000..ba73635d9
--- /dev/null
+++ b/lib/custom_exceptions/oauth.rb
@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+module CustomExceptions::OAuth
+  class InsufficientScopes < CustomExceptions::Base
+    def message
+      I18n.t('errors.oauth.insufficient_scopes', scopes: @data[:missing_scopes].join(', '))
+    end
+
+    def code
+      'SCOPE_ERR'
+    end
+
+    def to_hash
+      {
+        message: message,
+        code: code,
+        missing_scopes: @data[:missing_scopes]
+      }
+    end
+  end
+
+  class AuthorizationFailed < CustomExceptions::Base
+    def message
+      I18n.t('errors.oauth.authorization_failed', provider: @data[:provider])
+    end
+
+    def code
+      'AUTH_ERR'
+    end
+
+    def to_hash
+      {
+        message: message,
+        code: code,
+        provider: @data[:provider]
+      }
+    end
+  end
+
+  class TokenExchangeFailed < CustomExceptions::Base
+    def message
+      I18n.t('errors.oauth.token_exchange_failed', provider: @data[:provider])
+    end
+
+    def code
+      'TOKEN_ERR'
+    end
+
+    def to_hash
+      {
+        message: message,
+        code: code,
+        provider: @data[:provider]
+      }
+    end
+  end
+
+  class InvalidState < CustomExceptions::Base
+    def message
+      I18n.t('errors.oauth.invalid_state')
+    end
+
+    def code
+      'STATE_ERR'
+    end
+
+    def to_hash
+      {
+        message: message,
+        code: code
+      }
+    end
+  end
+end
\ No newline at end of file