fix(companion): Fix Gmail OAuth integration (calcom#25978)

Co-authored-by: Peer Richelsen <peeroke@gmail.com>

Author: dhairyashiil

companion/contexts/AuthContext.tsx

@@ -84,15 +84,29 @@ export function AuthProvider({ children }: AuthProviderProps) {
     }
   };
 
-  // Save OAuth tokens to storage
   const saveOAuthTokens = async (tokens: OAuthTokens) => {
     await storage.set(OAUTH_TOKENS_KEY, JSON.stringify(tokens));
     await storage.set(AUTH_TYPE_KEY, "oauth");
+
+    if (oauthService) {
+      try {
+        await oauthService.syncTokensToExtension(tokens);
+      } catch (error) {
+        console.warn("Failed to sync tokens to extension:", error);
+      }
+    }
   };
 
-  // Clear all auth data from storage
   const clearAuth = async () => {
     await storage.removeAll([ACCESS_TOKEN_KEY, REFRESH_TOKEN_KEY, OAUTH_TOKENS_KEY, AUTH_TYPE_KEY]);
+
+    if (oauthService) {
+      try {
+        await oauthService.clearTokensFromExtension();
+      } catch (error) {
+        console.warn("Failed to clear tokens from extension:", error);
+      }
+    }
   };
 
   // Reset all auth state
@@ -147,11 +161,13 @@ export function AuthProvider({ children }: AuthProviderProps) {
 
     // Refresh token if expired
     let tokens = storedTokens;
+    let tokensWereRefreshed = false;
     if (oauthService.isTokenExpired(storedTokens) && storedTokens.refreshToken) {
       try {
         console.log("Access token expired, refreshing...");
         tokens = await oauthService.refreshAccessToken(storedTokens.refreshToken);
         await saveOAuthTokens(tokens);
+        tokensWereRefreshed = true;
       } catch (refreshError) {
         console.error("Failed to refresh token:", refreshError);
         await clearAuth();
@@ -170,6 +186,14 @@ export function AuthProvider({ children }: AuthProviderProps) {
     if (tokens.refreshToken) {
       setupRefreshTokenFunction(oauthService);
     }
+
+    if (!tokensWereRefreshed) {
+      try {
+        await oauthService.syncTokensToExtension(tokens);
+      } catch (error) {
+        console.warn("Failed to sync tokens to extension on init:", error);
+      }
+    }
   };
 
   // Handle web session authentication

companion/extension/entrypoints/background/index.ts

@@ -95,6 +95,67 @@ export default defineBackground(() => {
       return true;
     }
 
+    if (message.action === "sync-oauth-tokens") {
+      const tokens = message.tokens as OAuthTokens | null;
+
+      if (isRateLimited()) {
+        devLog.warn("Token sync rate limited");
+        sendResponse({ success: false, error: "Rate limited. Please try again later." });
+        return true;
+      }
+
+      if (!tokens || !tokens.accessToken) {
+        sendResponse({ success: false, error: "No valid tokens provided" });
+        return true;
+      }
+
+      validateTokens(tokens)
+        .then((isValid) => {
+          if (!isValid) {
+            devLog.warn("Token sync rejected: invalid tokens");
+            sendResponse({ success: false, error: "Invalid tokens" });
+            return;
+          }
+
+          recordTokenOperation();
+          chrome.storage.local.set({ cal_oauth_tokens: JSON.stringify(tokens) }, () => {
+            if (chrome.runtime.lastError) {
+              devLog.error("Failed to sync OAuth tokens:", chrome.runtime.lastError.message);
+              sendResponse({ success: false, error: chrome.runtime.lastError.message });
+            } else {
+              devLog.log("OAuth tokens synced to chrome.storage.local (validated)");
+              sendResponse({ success: true });
+            }
+          });
+        })
+        .catch((error) => {
+          devLog.error("Token validation failed:", error);
+          sendResponse({ success: false, error: "Token validation failed" });
+        });
+
+      return true;
+    }
+
+    if (message.action === "clear-oauth-tokens") {
+      if (isRateLimited()) {
+        devLog.warn("Token clear rate limited");
+        sendResponse({ success: false, error: "Rate limited. Please try again later." });
+        return true;
+      }
+
+      recordTokenOperation();
+      chrome.storage.local.remove(["cal_oauth_tokens", "oauth_state"], () => {
+        if (chrome.runtime.lastError) {
+          devLog.error("Failed to clear OAuth tokens:", chrome.runtime.lastError.message);
+          sendResponse({ success: false, error: chrome.runtime.lastError.message });
+        } else {
+          devLog.log("OAuth tokens cleared from chrome.storage.local");
+          sendResponse({ success: true });
+        }
+      });
+      return true;
+    }
+
     return false;
   });
 });
@@ -168,13 +229,22 @@ async function handleTokenExchange(
 
   const tokenData = await response.json();
 
-  return {
+  const tokens: OAuthTokens = {
     accessToken: tokenData.access_token,
     refreshToken: tokenData.refresh_token,
     tokenType: tokenData.token_type || "Bearer",
     expiresAt: tokenData.expires_in ? Date.now() + tokenData.expires_in * 1000 : undefined,
     scope: tokenData.scope,
   };
+
+  try {
+    await chrome.storage.local.set({ cal_oauth_tokens: JSON.stringify(tokens) });
+    devLog.log("OAuth tokens stored in chrome.storage.local");
+  } catch (storageError) {
+    devLog.error("Failed to store OAuth tokens:", storageError);
+  }
+
+  return tokens;
 }
 
 async function validateOAuthState(state: string): Promise<void> {
@@ -201,6 +271,52 @@ async function validateOAuthState(state: string): Promise<void> {
 
 const API_BASE_URL = "https://api.cal.com/v2";
 
+const tokenOperationTimestamps: number[] = [];
+const TOKEN_RATE_LIMIT_WINDOW_MS = 60000;
+const TOKEN_RATE_LIMIT_MAX_OPS = 5;
+
+function isRateLimited(): boolean {
+  const now = Date.now();
+  while (
+    tokenOperationTimestamps.length > 0 &&
+    tokenOperationTimestamps[0] < now - TOKEN_RATE_LIMIT_WINDOW_MS
+  ) {
+    tokenOperationTimestamps.shift();
+  }
+  return tokenOperationTimestamps.length >= TOKEN_RATE_LIMIT_MAX_OPS;
+}
+
+function recordTokenOperation(): void {
+  tokenOperationTimestamps.push(Date.now());
+}
+
+async function validateTokens(tokens: OAuthTokens): Promise<boolean> {
+  if (!tokens.accessToken) {
+    return false;
+  }
+
+  try {
+    const response = await fetch(`${API_BASE_URL}/me`, {
+      headers: {
+        Authorization: `Bearer ${tokens.accessToken}`,
+        "Content-Type": "application/json",
+        "cal-api-version": "2024-06-11",
+      },
+    });
+
+    if (response.ok) {
+      devLog.log("Token validation successful");
+      return true;
+    }
+
+    devLog.warn("Token validation failed:", response.status);
+    return false;
+  } catch (error) {
+    devLog.error("Token validation error:", error);
+    return false;
+  }
+}
+
 async function getAuthHeader(): Promise<string> {
   const result = await chrome.storage.local.get(["cal_oauth_tokens"]);
   const oauthTokens = result.cal_oauth_tokens