Michael/noteflow
1
0 Fork 0
mirror of https://github.com/R0m1k3/noteflow.git synced 2026-10-24 15:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #46 from R0m1k3/claude/integrate-google-calendar-api-011CV44Nie9HB7U35ArSUnNa

Browse Source 
Fix: Route oauth-callback accessible sans authentification
This commit is contained in:
LogiFlow authored and GitHub committed 2025-11-12 15:17:15 +01:00
2 parents 756a979240 31d5ee24f5
commit 92fae63756
1 file changed
+5 -8
Download Patch File Download Diff File Expand all files Collapse all files
routes/calendar.routes.js
+5 -8
View File
@@ -6,9 +6,6 @@ const { getAll, getOne, runQuery } = require('../config/database');
const { authenticateToken, requireAdmin } = require('../middleware/auth'); const { authenticateToken, requireAdmin } = require('../middleware/auth');
const logger = require('../config/logger'); const logger = require('../config/logger');
// Toutes les routes nécessitent authentification
router.use(authenticateToken);
// Scopes Google Calendar requis // Scopes Google Calendar requis
const SCOPES = ['https://www.googleapis.com/auth/calendar.readonly']; const SCOPES = ['https://www.googleapis.com/auth/calendar.readonly'];
@@ -245,7 +242,7 @@ router.get('/oauth-callback', async (req, res) => {
* GET /api/calendar/auth-status * GET /api/calendar/auth-status
* Vérifier si l'utilisateur est authentifié avec Google * Vérifier si l'utilisateur est authentifié avec Google
*/ */
router.get('/auth-status', async (req, res) => { router.get('/auth-status', authenticateToken, async (req, res) => {
try { try {
const authType = await getAuthType(); const authType = await getAuthType();
@@ -343,7 +340,7 @@ async function getValidTokens(userId) {
* GET /api/calendar/events * GET /api/calendar/events
* Récupérer les événements du calendrier * Récupérer les événements du calendrier
*/ */
router.get('/events', async (req, res) => { router.get('/events', authenticateToken, async (req, res) => {
try { try {
const limit = parseInt(req.query.limit) || 10; const limit = parseInt(req.query.limit) || 10;
const now = new Date().toISOString(); const now = new Date().toISOString();
@@ -370,7 +367,7 @@ router.get('/events', async (req, res) => {
* POST /api/calendar/sync * POST /api/calendar/sync
* Synchroniser avec Google Calendar (OAuth2, Service Account ou API Key) * Synchroniser avec Google Calendar (OAuth2, Service Account ou API Key)
*/ */
router.post('/sync', async (req, res) => { router.post('/sync', authenticateToken, async (req, res) => {
try { try {
const authType = await getAuthType(); const authType = await getAuthType();
let calendarId = 'primary'; // Par défaut : calendrier principal let calendarId = 'primary'; // Par défaut : calendrier principal
@@ -487,7 +484,7 @@ router.post('/sync', async (req, res) => {
* POST /api/calendar/disconnect * POST /api/calendar/disconnect
* Déconnecter Google Calendar (supprimer les tokens) * Déconnecter Google Calendar (supprimer les tokens)
*/ */
router.post('/disconnect', async (req, res) => { router.post('/disconnect', authenticateToken, async (req, res) => {
try { try {
await runQuery('DELETE FROM google_oauth_tokens WHERE user_id = ?', [req.user.id]); await runQuery('DELETE FROM google_oauth_tokens WHERE user_id = ?', [req.user.id]);
logger.info(`Tokens OAuth supprimés pour l'utilisateur ${req.user.username}`); logger.info(`Tokens OAuth supprimés pour l'utilisateur ${req.user.username}`);
@@ -503,7 +500,7 @@ router.post('/disconnect', async (req, res) => {
* DELETE /api/calendar/events/:id * DELETE /api/calendar/events/:id
* Supprimer un événement local * Supprimer un événement local
*/ */
router.delete('/events/:id', async (req, res) => { router.delete('/events/:id', authenticateToken, async (req, res) => {
try { try {
const event = await getOne( const event = await getOne(
'SELECT id FROM calendar_events WHERE id = ? AND user_id = ?', 'SELECT id FROM calendar_events WHERE id = ? AND user_id = ?',