From 8f7ca6a0e32d2ad3d77a42a645906af772861dc9 Mon Sep 17 00:00:00 2001
From: Pushpender <129095696+Pushpender1122@users.noreply.github.com>
Date: Fri, 18 Oct 2024 03:51:57 +0530
Subject: [PATCH] Fix Google Auth displays Status: 401 on screen (#7659)

When the user presses the cancel button, the server sends the following
response:

![image](https://github.com/user-attachments/assets/cb68cf01-b32c-4680-a811-cd917db88ca9)

{"statusCode": 401, "message": "Unauthorized"}

Now, when the user clicks the cancel button, they are redirected to the
home page for login.

Related Issue
Fixes #7584

---------

Co-authored-by: Charles Bochet <charles@twenty.com>
---
 .../core-modules/auth/auth.exception.ts       |  1 +
 .../controllers/google-auth.controller.ts     |  2 ++
 .../filters/auth-oauth-exception.filter.ts    | 34 +++++++++++++++++++
 .../auth/guards/google-oauth.guard.ts         | 12 +++++++
 .../src/utils/apply-cors-to-exceptions.ts     |  4 +--
 5 files changed, 51 insertions(+), 2 deletions(-)
 create mode 100644 packages/twenty-server/src/engine/core-modules/auth/filters/auth-oauth-exception.filter.ts

diff --git a/packages/twenty-server/src/engine/core-modules/auth/auth.exception.ts b/packages/twenty-server/src/engine/core-modules/auth/auth.exception.ts
index 2387ff9d31..62b215f269 100644
--- a/packages/twenty-server/src/engine/core-modules/auth/auth.exception.ts
+++ b/packages/twenty-server/src/engine/core-modules/auth/auth.exception.ts
@@ -16,4 +16,5 @@ export enum AuthExceptionCode {
   UNAUTHENTICATED = 'UNAUTHENTICATED',
   INVALID_DATA = 'INVALID_DATA',
   INTERNAL_SERVER_ERROR = 'INTERNAL_SERVER_ERROR',
+  OAUTH_ACCESS_DENIED = 'OAUTH_ACCESS_DENIED',
 }
diff --git a/packages/twenty-server/src/engine/core-modules/auth/controllers/google-auth.controller.ts b/packages/twenty-server/src/engine/core-modules/auth/controllers/google-auth.controller.ts
index 6ae9b11d74..c674569d43 100644
--- a/packages/twenty-server/src/engine/core-modules/auth/controllers/google-auth.controller.ts
+++ b/packages/twenty-server/src/engine/core-modules/auth/controllers/google-auth.controller.ts
@@ -9,6 +9,7 @@ import {
 
 import { Response } from 'express';
 
+import { AuthOAuthExceptionFilter } from 'src/engine/core-modules/auth/filters/auth-oauth-exception.filter';
 import { AuthRestApiExceptionFilter } from 'src/engine/core-modules/auth/filters/auth-rest-api-exception.filter';
 import { GoogleOauthGuard } from 'src/engine/core-modules/auth/guards/google-oauth.guard';
 import { GoogleProviderEnabledGuard } from 'src/engine/core-modules/auth/guards/google-provider-enabled.guard';
@@ -33,6 +34,7 @@ export class GoogleAuthController {
 
   @Get('redirect')
   @UseGuards(GoogleProviderEnabledGuard, GoogleOauthGuard)
+  @UseFilters(AuthOAuthExceptionFilter)
   async googleAuthRedirect(@Req() req: GoogleRequest, @Res() res: Response) {
     const {
       firstName,
diff --git a/packages/twenty-server/src/engine/core-modules/auth/filters/auth-oauth-exception.filter.ts b/packages/twenty-server/src/engine/core-modules/auth/filters/auth-oauth-exception.filter.ts
new file mode 100644
index 0000000000..008e7d1103
--- /dev/null
+++ b/packages/twenty-server/src/engine/core-modules/auth/filters/auth-oauth-exception.filter.ts
@@ -0,0 +1,34 @@
+import {
+  ArgumentsHost,
+  Catch,
+  ExceptionFilter,
+  InternalServerErrorException,
+} from '@nestjs/common';
+
+import { Response } from 'express';
+
+import {
+  AuthException,
+  AuthExceptionCode,
+} from 'src/engine/core-modules/auth/auth.exception';
+import { EnvironmentService } from 'src/engine/core-modules/environment/environment.service';
+
+@Catch(AuthException)
+export class AuthOAuthExceptionFilter implements ExceptionFilter {
+  constructor(private readonly environmentService: EnvironmentService) {}
+
+  catch(exception: AuthException, host: ArgumentsHost) {
+    const ctx = host.switchToHttp();
+    const response = ctx.getResponse<Response>();
+
+    switch (exception.code) {
+      case AuthExceptionCode.OAUTH_ACCESS_DENIED:
+        response
+          .status(403)
+          .redirect(this.environmentService.get('FRONT_BASE_URL'));
+        break;
+      default:
+        throw new InternalServerErrorException(exception.message);
+    }
+  }
+}
diff --git a/packages/twenty-server/src/engine/core-modules/auth/guards/google-oauth.guard.ts b/packages/twenty-server/src/engine/core-modules/auth/guards/google-oauth.guard.ts
index dd9fbf17f2..f4675888b2 100644
--- a/packages/twenty-server/src/engine/core-modules/auth/guards/google-oauth.guard.ts
+++ b/packages/twenty-server/src/engine/core-modules/auth/guards/google-oauth.guard.ts
@@ -1,6 +1,11 @@
 import { ExecutionContext, Injectable } from '@nestjs/common';
 import { AuthGuard } from '@nestjs/passport';
 
+import {
+  AuthException,
+  AuthExceptionCode,
+} from 'src/engine/core-modules/auth/auth.exception';
+
 @Injectable()
 export class GoogleOauthGuard extends AuthGuard('google') {
   constructor() {
@@ -14,6 +19,13 @@ export class GoogleOauthGuard extends AuthGuard('google') {
     const workspaceInviteHash = request.query.inviteHash;
     const workspacePersonalInviteToken = request.query.inviteToken;
 
+    if (request.query.error === 'access_denied') {
+      throw new AuthException(
+        'Google OAuth access denied',
+        AuthExceptionCode.OAUTH_ACCESS_DENIED,
+      );
+    }
+
     if (workspaceInviteHash && typeof workspaceInviteHash === 'string') {
       request.params.workspaceInviteHash = workspaceInviteHash;
     }
diff --git a/packages/twenty-server/src/utils/apply-cors-to-exceptions.ts b/packages/twenty-server/src/utils/apply-cors-to-exceptions.ts
index 0dd3a5cc12..eba73f8e05 100644
--- a/packages/twenty-server/src/utils/apply-cors-to-exceptions.ts
+++ b/packages/twenty-server/src/utils/apply-cors-to-exceptions.ts
@@ -1,7 +1,7 @@
 import {
-  ExceptionFilter,
-  Catch,
   ArgumentsHost,
+  Catch,
+  ExceptionFilter,
   HttpException,
 } from '@nestjs/common';