Function createAgentOAuthRouter

server/src/routes/agent-oauth.ts:199–530

()

 * Create agent OAuth routes
 */
export function createAgentOAuthRouter(): Router {
  const router = Router();
  const agentContextDb = new AgentContextDatabase();

  // Get the base URL for callbacks
  const getCallbackUrl = (req: Request): string => {
    const protocol = req.headers['x-forwarded-proto'] || req.protocol;
    const host = req.headers['x-forwarded-host'] || req.get('host');
    return `${protocol}://${host}/api/oauth/agent/callback`;
  };

  /**
   * Start OAuth flow for an agent
   * GET /api/oauth/agent/start?agent_context_id=...
   */
  router.get('/start', requireAuth, async (req: Request, res: Response) => {
    try {
      const { agent_context_id, pending_task, pending_params, return_to } = req.query;
      const returnTo = sanitizeReturnTo(return_to);

      // codeql[js/user-controlled-bypass] - agent context ID from query is validated and used as a lookup key
      if (!agent_context_id || typeof agent_context_id !== 'string') {
        return res.status(400).json({ error: 'agent_context_id is required' });
      }

      // Parse pending request context (for auto-retry after OAuth)
      let pendingRequest: { task: string; params: Record<string, unknown> } | undefined;
      if (pending_task && typeof pending_task === 'string') {
        try {
          const params = pending_params && typeof pending_params === 'string'
            ? JSON.parse(decodeURIComponent(pending_params))
            : {};
          pendingRequest = { task: pending_task, params };
        } catch (error) {
          logger.warn({ error, pending_params }, 'Failed to parse pending request params - continuing without retry context');
        }
      }

      // Get user ID from authenticated request
      const userId = req.user?.id;
      if (!userId) {
        return res.status(401).json({ error: 'Not authenticated' });
      }

      // Get member context for organization
      const memberContext = await getWebMemberContext(userId);
      if (!memberContext?.organization?.workos_organization_id) {
        return res.status(401).json({ error: 'No organization found' });
      }

      const organizationId = memberContext.organization.workos_organization_id;

      // Get agent context
      const agentContext = await agentContextDb.getById(agent_context_id);
      if (!agentContext) {
        return res.status(404).json({ error: 'Agent context not found' });
      }