| name | lgs-1920-backend-cloud-oauth |
| description | Maintain LGS1920 cloud OAuth providers, PKCE authorization, callbacks, token storage, session cookies, refresh behavior, and connected-provider APIs. Use when changing CloudAuthController.js, CloudOAuthStore.js, cloud provider configuration, or authenticated remote imports. |
LGS1920 Backend Cloud OAuth
Use this skill for authentication flows involving Google Drive, OneDrive, Dropbox, pCloud, or Nextcloud. Treat provider callbacks and tokens as security-sensitive boundary code.
Workflow
- Inspect
src/controllers/CloudAuthController.js, src/resources/CloudAuthResource.js, and src/utils/CloudOAuthStore.js together.
- Confirm the provider identifier, authorization URL, token URL, redirect URI, scopes, PKCE requirement, and environment variables.
- Generate unpredictable state and PKCE values, consume authorization state exactly once, and enforce its expiry and provider binding.
- Validate return URLs against the existing allowlist. Never redirect to an arbitrary user-provided host.
- Keep tokens server-side. Use
HttpOnly, SameSite, and environment-appropriate Secure cookie attributes.
- Handle missing configuration, provider errors, invalid callbacks, expired tokens, and revoked sessions with controlled responses.
- Add tests for state replay, invalid providers, redirect validation, cookie attributes, token expiry, and provider failure paths.
Security constraints
- Never commit client secrets, access tokens, refresh tokens, authorization codes, or session identifiers.
- Never log authorization headers, cookies, token responses, or complete callback URLs when they contain secrets.
- Preserve the in-memory session expiry and cleanup behavior unless a durable store is explicitly designed and reviewed.
- Keep provider-specific URL normalization and scope handling isolated from generic session logic.
- Do not broaden CORS or redirect allowlists to make a failing provider flow pass.
