From f29a23bd4aae5640f9c60616ec22a03d732f97c0 Mon Sep 17 00:00:00 2001
From: "caputo.marcos" <caputo.marcos@gmail.com>
Date: Fri, 7 Apr 2023 17:39:55 -0300
Subject: [PATCH] small improvements #65

---
 README.md                 |  5 +++++
 locales/en-US/oauth2.html |  8 +++++++-
 oauth2.js                 | 42 +++++++++++++++++++++++----------------
 3 files changed, 37 insertions(+), 18 deletions(-)

diff --git a/README.md b/README.md
index 66f9fe5..0424ab1 100644
--- a/README.md
+++ b/README.md
@@ -76,6 +76,11 @@ This sample used the [go-oauth2-server](https://github.com/RichardKnop/go-oauth2
 | embedded credentials           | boolean        | This specifies whether to include the client credentials in the token request body for authentication purposes.       |
 | reject Unauthorized            | boolean        | This specifies whether to reject unauthorized requests. The rejectUnauthorized parameter controls SSL/TLS certificate validation for the server, with true enforcing validation and false disabling it. |
 
+**`Note:`** 
+
+> * If running behind a proxy, the standard `http_proxy=...` environment variable should be set and `Node-RED restarted, or use Proxy Configuration`. If Proxy Configuration was set, the configuration take precedence over environment variable.
+
+> * The OAuth redirect URL is set by default to `/oauth2/redirect`, which is the endpoint responsible for receiving the authorization `code`.
 
 # Outputs
 
diff --git a/locales/en-US/oauth2.html b/locales/en-US/oauth2.html
index d024ae7..e8b6a42 100644
--- a/locales/en-US/oauth2.html
+++ b/locales/en-US/oauth2.html
@@ -47,13 +47,19 @@
 
 : use proxy (boolean)                                 :  This specifies whether to use a proxy or not.
 * use proxy: `true` 
-: use proxy(Proxy Configuration) (object)             :  This specifies the configuration for the proxy.
+: Proxy Configuration (object)                        :  This specifies the configuration for the proxy.
 
 : only send non-2xx responses to catch node (boolean) :  This specifies whether to only catch non-2xx responses.
 : embedded credentials (boolean)                      :  This specifies whether to include the client credentials in the token request body for authentication purposes.
 : reject Unauthorized (boolean)                       :  This specifies whether to reject unauthorized requests. The rejectUnauthorized parameter controls SSL/TLS certificate validation for the server, with true enforcing validation and false disabling it.
 
 
+**`Note:`** 
+
+> * If running behind a proxy, the standard `http_proxy=...` environment variable should be set and `Node-RED restarted, or use Proxy Configuration`. If Proxy Configuration was set, the configuration take precedence over environment variable.
+
+> * The OAuth redirect URL is set by default to `/oauth2/redirect`, which is the endpoint responsible for receiving the authorization `code`.
+
 ### Outputs
 
 : access_token (string)     : This is the access token obtained from the OAuth2 server.
diff --git a/oauth2.js b/oauth2.js
index b8aab30..19d5d60 100644
--- a/oauth2.js
+++ b/oauth2.js
@@ -179,8 +179,10 @@ module.exports = function (RED) {
             }
 
             const credentials = RED.nodes.getCredentials(node.id);
-            options.form.code = credentials.code;
-            options.form.redirect_uri = credentials.redirectUri;
+            if (credentials) {
+              options.form.code = credentials.code;
+              options.form.redirect_uri = credentials.redirectUri;
+            }
           }
         }
 
@@ -311,10 +313,14 @@ module.exports = function (RED) {
    */
   RED.httpAdmin.get("/oauth2/credentials/:token", function (req, res) {
     const credentials = RED.nodes.getCredentials(req.params.token);
-    res.json({
-      code: credentials.code,
-      redirect_uri: credentials.redirect_uri,
-    });
+    if (credentials) {
+      res.json({
+        code: credentials.code,
+        redirect_uri: credentials.redirect_uri,
+      });
+    } else {
+      res.send("oauth2.error.no-credentials");
+    }
   });
 
   /**
@@ -327,10 +333,10 @@ module.exports = function (RED) {
       const state = req.query.state.split(":");
       const node_id = state[0];
       const credentials = RED.nodes.getCredentials(node_id);
-      credentials.code = req.query.code;
-      RED.nodes.addCredentials(node_id, credentials);
-
-      const html = `<HTML>
+      if (credentials) {
+        credentials.code = req.query.code;
+        RED.nodes.addCredentials(node_id, credentials);
+        const html = `<HTML>
       <HEAD>
           <script language=\"javascript\" type=\"text/javascript\">
             function closeWindow() {
@@ -346,7 +352,10 @@ module.exports = function (RED) {
               <p>Success! This page can be closed if it doesn't do so automatically.</p>
       </BODY>
       </HTML>`;
-      res.send(html);
+        res.send(html);
+      }
+    } else {
+      res.send("oauth2.error.no-credentials");
     }
   });
 
@@ -402,7 +411,7 @@ module.exports = function (RED) {
 
     res.cookie("csrf", csrfToken);
 
-    var l = url.parse(req.query.authorizationEndpoint, true);
+    const l = url.parse(req.query.authorizationEndpoint, true);
     const redirectUrl = url.format({
       protocol: l.protocol.replace(":", ""),
       hostname: l.hostname,
@@ -422,10 +431,9 @@ module.exports = function (RED) {
         proxy: proxyOptions,
       });
       res.redirect(response.request.res.responseUrl);
-
       RED.nodes.addCredentials(node_id, credentials);
     } catch (error) {
-      res.sendStatus(500);
+      res.sendStatus(404);
     }
   });
 
@@ -441,9 +449,9 @@ module.exports = function (RED) {
         description: req.query.error_description,
       });
     }
-    var state = req.query.state.split(":");
-    var node_id = state[0];
-    var credentials = RED.nodes.getCredentials(node_id);
+    const state = req.query.state.split(":");
+    const node_id = state[0];
+    const credentials = RED.nodes.getCredentials(node_id);
     if (!credentials || !credentials.clientId || !credentials.clientSecret) {
       return res.send("oauth2.error.no-credentials");
     }