homeio

1import "server-only";
2
3import { randomBytes } from "node:crypto";
4import { asc, eq, sql } from "drizzle-orm";
5import { db } from "@/lib/server/db/drizzle";
6import { filesGoogleDriveTokens } from "@/lib/server/db/schema";
7import { encryptSecret, decryptSecret } from "@/lib/server/modules/files/secrets";
8import { getGoogleOAuthConfig } from "@/lib/server/modules/files/google-oauth-config";
9
10const SCOPES = [
11  "https://www.googleapis.com/auth/drive.readonly",
12  "https://www.googleapis.com/auth/userinfo.email",
13  "https://www.googleapis.com/auth/userinfo.profile",
14].join(" ");
15
16export type GoogleDriveConnection = {
17  id: string;
18  email: string;
19  displayName: string | null;
20  connectedAt: string;
21};
22
23export class GoogleDriveError extends Error {
24  constructor(
25    message: string,
26    public readonly code: string,
27    public readonly statusCode: number = 500,
28  ) {
29    super(message);
30    this.name = "GoogleDriveError";
31  }
32}
33
34async function getOAuthConfig() {
35  const dbConfig = await getGoogleOAuthConfig();
36  if (dbConfig) return dbConfig;
37
38  const clientId = process.env.GOOGLE_CLIENT_ID;
39  const clientSecret = process.env.GOOGLE_CLIENT_SECRET;
40  const redirectUri = process.env.GOOGLE_DRIVE_REDIRECT_URI ?? "http://localhost:3000/api/v1/files/google-drive/callback";
41
42  if (!clientId || !clientSecret) {
43    throw new GoogleDriveError(
44      "Google Drive is not configured. Set up your OAuth credentials in Settings → Integrations.",
45      "not_configured",
46      501,
47    );
48  }
49
50  return { clientId, clientSecret, redirectUri };
51}
52
53async function ensureTable() {
54  await db.execute(sql`
55    CREATE TABLE IF NOT EXISTS files_google_drive_tokens (
56      id text PRIMARY KEY,
57      email text NOT NULL,
58      display_name text,
59      access_token_ciphertext text NOT NULL,
60      access_token_iv text NOT NULL,
61      access_token_tag text NOT NULL,
62      refresh_token_ciphertext text,
63      refresh_token_iv text,
64      refresh_token_tag text,
65      expires_at timestamptz,
66      created_at timestamptz NOT NULL DEFAULT NOW(),
67      updated_at timestamptz NOT NULL DEFAULT NOW()
68    )
69  `);
70  await db.execute(sql`
71    CREATE UNIQUE INDEX IF NOT EXISTS files_google_drive_tokens_email_idx
72    ON files_google_drive_tokens (email)
73  `);
74}
75
76let ensureTablePromise: Promise<void> | null = null;
77
78async function ensureTableOnce() {
79  if (!ensureTablePromise) {
80    ensureTablePromise = ensureTable().catch((err) => {
81      ensureTablePromise = null;
82      throw err;
83    });
84  }
85  await ensureTablePromise;
86}
87
88export async function isGoogleDriveConfigured(): Promise<boolean> {
89  const dbConfig = await getGoogleOAuthConfig();
90  if (dbConfig) return true;
91  return Boolean(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET);
92}
93
94export async function buildAuthUrl(state: string): Promise<string> {
95  const { clientId, redirectUri } = await getOAuthConfig();
96  const params = new URLSearchParams({
97    client_id: clientId,
98    redirect_uri: redirectUri,
99    response_type: "code",
100    scope: SCOPES,
101    access_type: "offline",
102    prompt: "consent",
103    state,
104  });
105  return `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
106}
107
108export function generateState(): string {
109  return randomBytes(16).toString("hex");
110}
111
112type TokenResponse = {
113  access_token: string;
114  refresh_token?: string;
115  expires_in: number;
116  token_type: string;
117};
118
119type UserInfo = {
120  email: string;
121  name?: string;
122};
123
124async function exchangeCodeForTokens(code: string): Promise<TokenResponse> {
125  const { clientId, clientSecret, redirectUri } = await getOAuthConfig();
126
127  const response = await fetch("https://oauth2.googleapis.com/token", {
128    method: "POST",
129    headers: { "Content-Type": "application/x-www-form-urlencoded" },
130    body: new URLSearchParams({
131      code,
132      client_id: clientId,
133      client_secret: clientSecret,
134      redirect_uri: redirectUri,
135      grant_type: "authorization_code",
136    }).toString(),
137  });
138
139  if (!response.ok) {
140    const body = (await response.json().catch(() => ({}))) as { error?: string };
141    throw new GoogleDriveError(
142      `Token exchange failed: ${body.error ?? response.statusText}`,
143      "token_exchange_failed",
144    );
145  }
146
147  return response.json() as Promise<TokenResponse>;
148}
149
150async function fetchUserInfo(accessToken: string): Promise<UserInfo> {
151  const response = await fetch("https://www.googleapis.com/oauth2/v3/userinfo", {
152    headers: { Authorization: `Bearer ${accessToken}` },
153  });
154
155  if (!response.ok) {
156    throw new GoogleDriveError("Failed to fetch Google user info", "userinfo_failed");
157  }
158
159  return response.json() as Promise<UserInfo>;
160}
161
162export async function handleOAuthCallback(code: string): Promise<GoogleDriveConnection> {
163  await ensureTableOnce();
164
165  const tokens = await exchangeCodeForTokens(code);
166  const userInfo = await fetchUserInfo(tokens.access_token);
167
168  const encAccessToken = encryptSecret(tokens.access_token);
169  const expiresAt = new Date(Date.now() + tokens.expires_in * 1000);
170
171  const id = randomBytes(8).toString("hex");
172  const email = userInfo.email;
173
174  const encRefresh = tokens.refresh_token ? encryptSecret(tokens.refresh_token) : null;
175
176  await db
177    .insert(filesGoogleDriveTokens)
178    .values({
179      id,
180      email,
181      displayName: userInfo.name ?? null,
182      accessTokenCiphertext: encAccessToken.ciphertext,
183      accessTokenIv: encAccessToken.iv,
184      accessTokenTag: encAccessToken.tag,
185      refreshTokenCiphertext: encRefresh?.ciphertext ?? null,
186      refreshTokenIv: encRefresh?.iv ?? null,
187      refreshTokenTag: encRefresh?.tag ?? null,
188      expiresAt,
189    })
190    .onConflictDoUpdate({
191      target: filesGoogleDriveTokens.email,
192      set: {
193        displayName: userInfo.name ?? null,
194        accessTokenCiphertext: encAccessToken.ciphertext,
195        accessTokenIv: encAccessToken.iv,
196        accessTokenTag: encAccessToken.tag,
197        refreshTokenCiphertext: encRefresh?.ciphertext ?? null,
198        refreshTokenIv: encRefresh?.iv ?? null,
199        refreshTokenTag: encRefresh?.tag ?? null,
200        expiresAt,
201        updatedAt: new Date(),
202      },
203    });
204
205  const row = await db
206    .select()
207    .from(filesGoogleDriveTokens)
208    .where(eq(filesGoogleDriveTokens.email, email))
209    .limit(1);
210
211  if (!row[0]) throw new GoogleDriveError("Failed to save Google Drive connection", "save_failed");
212
213  return {
214    id: row[0].id,
215    email: row[0].email,
216    displayName: row[0].displayName,
217    connectedAt: row[0].createdAt.toISOString(),
218  };
219}
220
221export async function listGoogleDriveConnections(): Promise<GoogleDriveConnection[]> {
222  await ensureTableOnce();
223
224  const rows = await db
225    .select({
226      id: filesGoogleDriveTokens.id,
227      email: filesGoogleDriveTokens.email,
228      displayName: filesGoogleDriveTokens.displayName,
229      createdAt: filesGoogleDriveTokens.createdAt,
230    })
231    .from(filesGoogleDriveTokens)
232    .orderBy(asc(filesGoogleDriveTokens.createdAt));
233
234  return rows.map((r) => ({
235    id: r.id,
236    email: r.email,
237    displayName: r.displayName,
238    connectedAt: r.createdAt.toISOString(),
239  }));
240}
241
242export async function removeGoogleDriveConnection(id: string): Promise<void> {
243  await ensureTableOnce();
244
245  await db.delete(filesGoogleDriveTokens).where(eq(filesGoogleDriveTokens.id, id));
246}
247
248export async function getAccessToken(connectionId: string): Promise<string> {
249  await ensureTableOnce();
250
251  const rows = await db
252    .select()
253    .from(filesGoogleDriveTokens)
254    .where(eq(filesGoogleDriveTokens.id, connectionId))
255    .limit(1);
256
257  const row = rows[0];
258  if (!row) throw new GoogleDriveError("Connection not found", "not_found", 404);
259
260  const now = new Date();
261  if (row.expiresAt && row.expiresAt > now) {
262    return decryptSecret({
263      ciphertext: row.accessTokenCiphertext,
264      iv: row.accessTokenIv,
265      tag: row.accessTokenTag,
266    });
267  }
268
269  if (!row.refreshTokenCiphertext || !row.refreshTokenIv || !row.refreshTokenTag) {
270    throw new GoogleDriveError("Access token expired and no refresh token available", "token_expired", 401);
271  }
272
273  const refreshToken = decryptSecret({
274    ciphertext: row.refreshTokenCiphertext,
275    iv: row.refreshTokenIv,
276    tag: row.refreshTokenTag,
277  });
278
279  const { clientId, clientSecret } = await getOAuthConfig();
280  const response = await fetch("https://oauth2.googleapis.com/token", {
281    method: "POST",
282    headers: { "Content-Type": "application/x-www-form-urlencoded" },
283    body: new URLSearchParams({
284      refresh_token: refreshToken,
285      client_id: clientId,
286      client_secret: clientSecret,
287      grant_type: "refresh_token",
288    }).toString(),
289  });
290
291  if (!response.ok) {
292    throw new GoogleDriveError("Failed to refresh access token", "refresh_failed", 401);
293  }
294
295  const tokens = (await response.json()) as TokenResponse;
296  const encNew = encryptSecret(tokens.access_token);
297  const newExpiry = new Date(Date.now() + tokens.expires_in * 1000);
298
299  await db
300    .update(filesGoogleDriveTokens)
301    .set({
302      accessTokenCiphertext: encNew.ciphertext,
303      accessTokenIv: encNew.iv,
304      accessTokenTag: encNew.tag,
305      expiresAt: newExpiry,
306      updatedAt: new Date(),
307    })
308    .where(eq(filesGoogleDriveTokens.id, connectionId));
309
310  return tokens.access_token;
311}
312