fix(auth): handle GET OAuth callback with undefined req.body on Express 5 (#3492) (#3496)

Closes #3492

Author: PierreBrisorgueil

modules/auth/controllers/auth.controller.js

@@ -342,7 +342,7 @@ const checkOAuthUserProfile = async (profil, key, provider) => {
 const oauthCallback = async (req, res, next) => {
   const strategy = req.params.strategy;
   // app Auth with Strategy managed on client side
-  if (req.body.strategy === false && req.body.key) {
+  if (req.body?.strategy === false && req.body?.key) {
     const allowedKeys = ['id', 'sub', 'email'];
     if (!allowedKeys.includes(req.body.key)) {
       return responses.error(res, 422, 'Unprocessable Entity', 'Invalid provider key')();

modules/auth/tests/auth.integration.tests.js

@@ -626,6 +626,25 @@ describe('Auth integration tests:', () => {
       authenticateSpy.mockRestore();
     });
 
+    test('should handle GET callback when req.body is undefined (Express 5)', async () => {
+      const authenticateSpy = jest.spyOn(passport, 'authenticate').mockImplementationOnce(
+        (strategy, callback) => () => callback(null, { id: 'mock-get-cb-user' }),
+      );
+      const cookies = {};
+      const redirectCalls = [];
+      const mockReq = { params: { strategy: 'google' } };
+      const mockRes = {
+        cookie(name, val, opts) { cookies[name] = { val, opts }; return this; },
+        redirect(code, url) { redirectCalls.push({ code, url }); },
+      };
+
+      await AuthController.oauthCallback(mockReq, mockRes, () => {});
+
+      expect(cookies.TOKEN).toBeDefined();
+      expect(redirectCalls[0]).toMatchObject({ code: 302 });
+      authenticateSpy.mockRestore();
+    });
+
     test('should find an existing OAuth user via checkOAuthUserProfile', async () => {
       // Create an OAuth user directly first
       const createdUser = await UserService.create({