fix(selfhost): handle unavailable SSO UserInfo

Author: askalf

apps/host-selfhost/src/auth/sso-userinfo.test.ts

@@ -236,6 +236,36 @@ test("returns null when UserInfo fails or omits sub or email", async () => {
   }
 });
 
+// Network and decoding failures at either external boundary must decline the
+// profile like a non-OK response, rather than reject the OAuth callback.
+test("returns null when UserInfo fetch or JSON parsing rejects", async () => {
+  const getUserInfo = ssoProviderConfig(sso).getUserInfo!;
+  const tokens = {
+    idToken: jwt({ sub: "alice", email: "alice@example.com" }),
+    accessToken: "access-token",
+  };
+  const discovery = new Response(
+    JSON.stringify({ userinfo_endpoint: "https://idp.example/userinfo" }),
+  );
+  // oxlint-disable-next-line executor/no-promise-reject, executor/no-error-constructor -- test-only mock of a third-party response JSON boundary
+  const invalidJson = { ok: true, json: () => Promise.reject(new Error("invalid JSON")) };
+  // oxlint-disable-next-line executor/no-promise-reject, executor/no-error-constructor -- test-only mock of an unavailable third-party request boundary
+  const offline = () => Promise.reject(new Error("offline"));
+
+  for (const responses of [
+    [offline()],
+    [invalidJson],
+    [discovery, offline()],
+    [discovery, invalidJson],
+  ]) {
+    const fetch = vi.fn();
+    for (const response of responses) fetch.mockImplementationOnce(() => response);
+    vi.stubGlobal("fetch", fetch);
+    await expect(getUserInfo(tokens)).resolves.toBeNull();
+    vi.unstubAllGlobals();
+  }
+});
+
 // The claim is only worth resolving because the admission gate reads it: a thin
 // token that used to arrive without `email_verified` was refused at the door.
 test("resolves a thin ID token into an admitted user at the gate", async () => {

apps/host-selfhost/src/auth/sso.ts

@@ -43,24 +43,31 @@ export const ssoUserInfo = async (discoveryUrl: string, tokens: OAuthTokens) =>
   }
 
   if (!tokens.accessToken) return null;
-  const discovery = await fetch(discoveryUrl).then(async (response) =>
-    response.ok ? (response.json() as Promise<{ userinfo_endpoint?: string }>) : null,
-  );
-  if (!discovery?.userinfo_endpoint) return null;
+  // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: an unavailable IdP must decline the profile rather than reject the OAuth callback
+  try {
+    const discoveryResponse = await fetch(discoveryUrl);
+    if (!discoveryResponse.ok) return null;
+    const discovery = (await discoveryResponse.json()) as { userinfo_endpoint?: string };
+    if (!discovery.userinfo_endpoint) return null;
 
-  const profile = await fetch(discovery.userinfo_endpoint, {
-    headers: { authorization: `Bearer ${tokens.accessToken}` },
-  }).then(async (response) => (response.ok ? (response.json() as Promise<OidcClaims>) : null));
-  if (!profile?.sub || !profile.email) return null;
+    const profileResponse = await fetch(discovery.userinfo_endpoint, {
+      headers: { authorization: `Bearer ${tokens.accessToken}` },
+    });
+    if (!profileResponse.ok) return null;
+    const profile = (await profileResponse.json()) as OidcClaims;
+    if (!profile.sub || !profile.email) return null;
 
-  return {
-    ...profile,
-    id: profile.sub,
-    email: profile.email,
-    emailVerified: profile.email_verified ?? false,
-    name: profile.name,
-    image: profile.picture,
-  };
+    return {
+      ...profile,
+      id: profile.sub,
+      email: profile.email,
+      emailVerified: profile.email_verified ?? false,
+      name: profile.name,
+      image: profile.picture,
+    };
+  } catch {
+    return null;
+  }
 };
 
 // Better Auth serves OAuth sign-in callbacks at `/oauth2/callback/:providerId`