refactor: replace console.log with logger.debug in OAuth2 server#41563
refactor: replace console.log with logger.debug in OAuth2 server#41563Rajkaran-122 wants to merge 1 commit into
Conversation
|
Looks like this PR is not ready to merge, because of the following issues:
Please fix the issues and try again If you have any trouble, please check the PR guidelines |
|
|
|
WalkthroughOAuth2 debug logging now uses Rocket.Chat’s ChangesOAuth2 logging
Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/meteor/server/oauth2-server/model.ts`:
- Around line 43-45: Prevent credential and personal-data exposure in OAuth
logging: in apps/meteor/server/oauth2-server/model.ts at lines 43-45, 76-79,
101-104, 133-148, 174-189, 216-219, 259-262, and 278-281, remove or redact
access tokens, refresh tokens, authorization codes, clientSecret, and full user
objects, retaining only safe metadata; in
apps/meteor/server/oauth2-server/oauth.ts at lines 49-52, log only the request
path rather than the full URL or query string. Update the relevant
getAccessToken and adjacent OAuth model methods without changing their behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 33010d9e-3b38-41e7-853f-46cc127fbdf1
📒 Files selected for processing (2)
apps/meteor/server/oauth2-server/model.tsapps/meteor/server/oauth2-server/oauth.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: cubic · AI code reviewer
🧰 Additional context used
📓 Path-based instructions (1)
**/*.{ts,tsx,js}
📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)
**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation
Files:
apps/meteor/server/oauth2-server/oauth.tsapps/meteor/server/oauth2-server/model.ts
🧠 Learnings (3)
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In the Rocket.Chat repository, do not reference Biome lint rules in code review feedback. Biome is not used even if biome.json exists; only reference Biome rules if there is explicit, project-wide usage documented. For TypeScript files, review lint implications without Biome guidance unless the project enables Biome rules.
Applied to files:
apps/meteor/server/oauth2-server/oauth.tsapps/meteor/server/oauth2-server/model.ts
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In this repository (RocketChat/Rocket.Chat), Biome lint rules are not used even if a biome.json exists. When reviewing TypeScript files (e.g., packages/ui-voip/src/providers/useMediaSession.ts), ensure lint suggestions do not reference Biome-specific rules. Rely on general ESLint/TypeScript lint rules and project conventions instead.
Applied to files:
apps/meteor/server/oauth2-server/oauth.tsapps/meteor/server/oauth2-server/model.ts
📚 Learning: 2026-05-06T12:21:44.083Z
Learnt from: juliajforesti
Repo: RocketChat/Rocket.Chat PR: 40256
File: apps/meteor/client/components/CreateDiscussion/CreateDiscussion.tsx:121-149
Timestamp: 2026-05-06T12:21:44.083Z
Learning: Field wrappers in rocket.chat/fuselage-forms (Field, FieldLabel, FieldRow, FieldError, FieldHint) auto-create htmlFor/id associations, aria-describedby, and role="alert" for errors. Do not manually set htmlFor, id, aria-describedby, or role attributes when using these wrappers. This automatic wiring does not apply to plain rocket.chat/fuselage components, which require explicit ID wiring per the accessibility docs. In code reviews, prefer using fuselage-forms wrappers for form fields and verify there is no unnecessary manual ID/aria wiring in files that use these wrappers. If a component uses plain fuselage components, ensure proper id wiring as per docs.
Applied to files:
apps/meteor/server/oauth2-server/oauth.tsapps/meteor/server/oauth2-server/model.ts
🔇 Additional comments (4)
apps/meteor/server/oauth2-server/model.ts (2)
1-21: 🗄️ Data Integrity & IntegrationVerify the
Modelexport removal.
Modelwas changed from exported to internal, which is an API change despite the PR objective stating that APIs are unchanged. Confirm that no tests or server modules importModel; otherwise retain the export or update all consumers.
30-41: LGTM!apps/meteor/server/oauth2-server/oauth.ts (2)
1-9: LGTM!
72-76: LGTM!
| async getAccessToken(accessToken: string): Promise<Token | Falsey> { | ||
| if (this.debug === true) { | ||
| console.log('[OAuth2Server]', 'in getAccessToken (bearerToken:', accessToken, ')'); | ||
| logger.debug('in getAccessToken (bearerToken:', accessToken, ')'); |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Prevent OAuth secrets from reaching centralized logs.
The model logs tokens, authorization codes, client secrets, and user data, while the middleware logs query strings that may contain the same credentials. Redact sensitive fields and log only request paths or safe metadata.
apps/meteor/server/oauth2-server/model.ts#L43-L45: remove or redact the access token.apps/meteor/server/oauth2-server/model.ts#L76-L79: never logclientSecret.apps/meteor/server/oauth2-server/model.ts#L101-L104: remove or redact the authorization code.apps/meteor/server/oauth2-server/model.ts#L133-L148: avoid logging the full user object.apps/meteor/server/oauth2-server/model.ts#L174-L189: remove access and refresh token values.apps/meteor/server/oauth2-server/model.ts#L216-L219: remove or redact the refresh token.apps/meteor/server/oauth2-server/model.ts#L259-L262: remove or redact the access token.apps/meteor/server/oauth2-server/model.ts#L278-L281: remove or redact the authorization code.apps/meteor/server/oauth2-server/oauth.ts#L49-L52: log the path instead of the full URL/query string.
📍 Affects 2 files
apps/meteor/server/oauth2-server/model.ts#L43-L45(this comment)apps/meteor/server/oauth2-server/model.ts#L76-L79apps/meteor/server/oauth2-server/model.ts#L101-L104apps/meteor/server/oauth2-server/model.ts#L133-L148apps/meteor/server/oauth2-server/model.ts#L174-L189apps/meteor/server/oauth2-server/model.ts#L216-L219apps/meteor/server/oauth2-server/model.ts#L259-L262apps/meteor/server/oauth2-server/model.ts#L278-L281apps/meteor/server/oauth2-server/oauth.ts#L49-L52
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/meteor/server/oauth2-server/model.ts` around lines 43 - 45, Prevent
credential and personal-data exposure in OAuth logging: in
apps/meteor/server/oauth2-server/model.ts at lines 43-45, 76-79, 101-104,
133-148, 174-189, 216-219, 259-262, and 278-281, remove or redact access tokens,
refresh tokens, authorization codes, clientSecret, and full user objects,
retaining only safe metadata; in apps/meteor/server/oauth2-server/oauth.ts at
lines 49-52, log only the request path rather than the full URL or query string.
Update the relevant getAccessToken and adjacent OAuth model methods without
changing their behavior.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 2 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="apps/meteor/server/oauth2-server/oauth.ts">
<violation number="1" location="apps/meteor/server/oauth2-server/oauth.ts:51">
P2: Logging `req.url` can expose OAuth credentials (authorization codes, tokens) that appear in query strings. Consider logging only `req.path` or stripping query parameters to avoid leaking sensitive values to centralized log storage.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| const debugMiddleware = function (req: Request, _res: Response, next: NextFunction) { | ||
| if (config.debug === true) { | ||
| console.log('[OAuth2Server]', req.method, req.url); | ||
| logger.debug(req.method, req.url); |
There was a problem hiding this comment.
P2: Logging req.url can expose OAuth credentials (authorization codes, tokens) that appear in query strings. Consider logging only req.path or stripping query parameters to avoid leaking sensitive values to centralized log storage.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/server/oauth2-server/oauth.ts, line 51:
<comment>Logging `req.url` can expose OAuth credentials (authorization codes, tokens) that appear in query strings. Consider logging only `req.path` or stripping query parameters to avoid leaking sensitive values to centralized log storage.</comment>
<file context>
@@ -47,7 +48,7 @@ export class OAuth2Server {
const debugMiddleware = function (req: Request, _res: Response, next: NextFunction) {
if (config.debug === true) {
- console.log('[OAuth2Server]', req.method, req.url);
+ logger.debug(req.method, req.url);
}
return next();
</file context>
| logger.debug(req.method, req.url); | |
| logger.debug(req.method, req.path); |
2 participants
Summary
This PR replaces a
console.logstatement in the OAuth2 server with the project's logging utility (logger.debug) to follow the existing logging conventions and avoid writing sensitive runtime information directly to standard output.What Changed
console.logwithlogger.debugWhy
Using the centralized logger provides consistent logging behavior and is more appropriate for production environments.
Testing
Checklist