Fix social auth follow-up issues from PR #81

Agent-Logs-Url: https://github.com/geturbackend/urBackend/sessions/b448bc8a-7b88-4981-bd67-1b8225e6973c

Co-authored-by: yash-pouranik <172860064+yash-pouranik@users.noreply.github.com>

Author: Copilot

apps/dashboard-api/src/controllers/project.controller.js

@@ -1099,7 +1099,12 @@ module.exports.updateProject = async (req, res) => {
   try {
     const { name, siteUrl, resendApiKey, resendFromEmail } = req.body;
     const updateFields = {};
-    if (name !== undefined) updateFields.name = name;
+    if (name !== undefined) {
+      if (typeof name !== "string" || !name.trim()) {
+        return res.status(400).json({ error: "name must be a non-empty string." });
+      }
+      updateFields.name = name.trim();
+    }
     if (resendFromEmail !== undefined) {
       if (typeof resendFromEmail !== "string") {
         return res.status(400).json({ error: "resendFromEmail must be a string." });
@@ -1338,11 +1343,19 @@ module.exports.toggleAuth = async (req, res) => {
     const { projectId } = req.params;
     const { enable } = req.body; // true or false
 
-    // Ensure user owns project
+    // Ensure user owns project, and load authProviders secrets so sanitizeAuthProviders
+    // can correctly compute hasClientSecret in the response.
     const project = await Project.findOne({
       _id: projectId,
       owner: req.user._id,
-    });
+    }).select(
+      "+authProviders.github.clientSecret.encrypted " +
+      "+authProviders.github.clientSecret.iv " +
+      "+authProviders.github.clientSecret.tag " +
+      "+authProviders.google.clientSecret.encrypted " +
+      "+authProviders.google.clientSecret.iv " +
+      "+authProviders.google.clientSecret.tag"
+    );
     if (!project) return res.status(404).json({ error: "Project not found" });
 
     if (enable) {

apps/public-api/src/controllers/userAuth.controller.js

@@ -58,8 +58,11 @@ const getSocialRefreshExchangeKey = (rtCode) => `project:social-auth:refresh-exc
  */
 const getFrontendCallbackBaseUrl = (project) => {
     const configured = String(project?.siteUrl || '').trim();
-    const base = configured || process.env.FRONTEND_URL || 'http://localhost:5173';
-    return `${base.replace(/\/$/, '')}/auth/callback`;
+    const base = configured || process.env.FRONTEND_URL || '';
+    if (!base) {
+        console.warn('[social-auth] getFrontendCallbackBaseUrl: siteUrl is not set on the project and FRONTEND_URL env is not configured. Falling back to http://localhost:5173. Set siteUrl in Project Settings or configure FRONTEND_URL.');
+    }
+    return `${(base || 'http://localhost:5173').replace(/\/$/, '')}/auth/callback`;
 };
 
 /**
@@ -69,6 +72,43 @@ const getFrontendCallbackBaseUrl = (project) => {
  */
 const toBase64UrlBuffer = (input) => Buffer.from(input.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(input.length / 4) * 4, '='), 'base64');
 
+/**
+ * In-memory cache for Google's public JWK keys.
+ * Keys are refreshed when the cache expires (based on Cache-Control max-age).
+ */
+const googleJwkCache = { keys: null, expiresAt: 0 };
+
+/**
+ * Fetches Google's public JWK keys, using an in-memory cache keyed by Cache-Control max-age.
+ * @returns {Promise<Array>} Array of JWK key objects
+ */
+const getGooglePublicKeys = async () => {
+    const now = Date.now();
+    if (googleJwkCache.keys && now < googleJwkCache.expiresAt) {
+        return googleJwkCache.keys;
+    }
+
+    const certsResponse = await fetch('https://www.googleapis.com/oauth2/v3/certs');
+    if (!certsResponse.ok) {
+        throw new Error('Unable to fetch Google JWK keys');
+    }
+
+    const certsPayload = await certsResponse.json();
+    const keys = certsPayload.keys || [];
+
+    // Parse Cache-Control max-age from response headers to determine TTL.
+    const cacheControl = (typeof certsResponse.headers?.get === 'function')
+        ? (certsResponse.headers.get('cache-control') || '')
+        : '';
+    const maxAgeMatch = cacheControl.match(/max-age=(\d+)/);
+    const ttlMs = maxAgeMatch ? parseInt(maxAgeMatch[1], 10) * 1000 : 3600 * 1000;
+
+    googleJwkCache.keys = keys;
+    googleJwkCache.expiresAt = now + ttlMs;
+
+    return keys;
+};
+
 /**
  * Asserts that a project has auth enabled and a valid users collection schema.
  * Throws with an appropriate statusCode on failure.
@@ -315,10 +355,9 @@ const verifyGoogleIdToken = async ({ idToken, clientId }) => {
         throw new Error('Unsupported Google id_token signature');
     }
 
-    const certsResponse = await fetch('https://www.googleapis.com/oauth2/v3/certs');
-    const certsPayload = await certsResponse.json();
-    const signingKey = certsPayload.keys?.find((key) => key.kid === header.kid);
-    if (!certsResponse.ok || !signingKey) {
+    const certsKeys = await getGooglePublicKeys();
+    const signingKey = certsKeys.find((key) => key.kid === header.kid);
+    if (!signingKey) {
         throw new Error('Unable to verify Google id_token signing key');
     }
 

apps/public-api/src/middlewares/verifyApiKey.js

@@ -8,9 +8,12 @@ const {
 module.exports = async (req, res, next) => {
     try {
         // x-api-key header is preferred. For browser-navigation endpoints (e.g. social OAuth start),
+        // a publishable key may be supplied via the `key` query parameter instead.
         const headerKey = req.header('x-api-key');
+        const queryKey = typeof req.query?.key === 'string' ? req.query.key : undefined;
 
-        const apiKey = headerKey;
+        // Only allow publishable keys (pk_live_) via query param; secret keys must use the header.
+        const apiKey = headerKey || (queryKey?.startsWith('pk_live_') ? queryKey : undefined);
         if (!apiKey) {
             return res.status(401).json({ error: 'API key not found' });
         }

examples/social-demo/COLLECTIONS_GUIDE.md

@@ -38,7 +38,7 @@ For GitHub social auth in this demo, these extra `users` fields are recommended:
 ```
 Field Name        | Type    | Required | Unique | Default
 ------------------|---------|----------|--------|----------
-githubId          | String  | No       | No     | -
+githubId          | String  | No       | Yes    | -
 authProviders     | Array   | No       | No     | []
 ```
 

examples/social-demo/client/src/lib/api.js

@@ -129,7 +129,7 @@ export const authApi = {
     return response;
   },
   getSocialStartUrl: (provider) => (
-    `${PROXY_URL}/userAuth/social/${encodeURIComponent(provider)}/start`
+    `${API_BASE_URL}${API_PREFIX}/userAuth/social/${encodeURIComponent(provider)}/start?key=${encodeURIComponent(PUBLIC_KEY)}`
   ),
   exchangeSocialAuth: async ({ token, rtCode }) => {
     const response = await axios.post(