feat(companion): oauth

[dhairyashiil]

IOS: External Browser

Screen.Recording.2025-11-19.at.11.11.20.PM.mov

IOS: webview

Screen.Recording.2025-11-19.at.11.52.17.PM.mov

Web:

Screen.Recording.2025-11-19.at.11.12.43.PM.mov

---

Summary by cubic

Implemented Cal.com OAuth end-to-end with deep linking: onboarding triggers auth (iOS uses an in-app WebView), the callback exchanges/verifies tokens, saves auth, and logs in to event types. Added an OAuth helper for redirect issues, fixed token exchange headers/URL, and improved iOS stability with ErrorBoundary, SafeArea, AuthProvider, and global error handlers.

• New Features

  • Onboarding starts OAuth; deep link callback exchanges code for tokens, verifies, saves auth, and redirects to event types.
  • iOS uses a WebView for OAuth with a browser fallback; Android/web use external browser.
  • Sign out clears tokens and returns to onboarding.
  • OAuth helper screen to manually extract the code when Cal.com redirects incorrectly.
  • Platform-aware redirect_uri handling for web and native.

• Bug Fixes

  • Token exchange uses application/x-www-form-urlencoded and the correct OAuth URL; env var names corrected.
  • Replaced expo-secure-store with cross-platform storage.

^{Written for commit fcf0afd. Summary will update automatically on new commits.}

[vercel]

@dhairyashiil is attempting to deploy a commit to the cal Team on Vercel.

A member of the Team first needs to authorize it.

[cubic-dev-ai]

12 issues found across 23 files

Prompt for AI agents (all 12 issues)

Understand the root cause of the following 12 issues and fix them.


<file name="companion/services/oauth.ts">

<violation number="1" location="companion/services/oauth.ts:34">
The Cal.com OAuth client secret is embedded in the client bundle and used from the device to exchange codes/tokens, so anyone with the app can extract it and impersonate the client. Move the token exchange/refresh flow to a trusted backend (or use PKCE without a secret) so the secret is never shipped to end users.</violation>

<violation number="2" location="companion/services/oauth.ts:56">
OAuth state is generated with Math.random(), which is not cryptographically secure. Use a CSPRNG (e.g., crypto.getRandomValues/Expo Random) so the state cannot be guessed and the authorization flow retains CSRF protection.</violation>

<violation number="3" location="companion/services/oauth.ts:125">
Rule violated: **Avoid Logging Sensitive Information**

Logging the full token exchange response prints the raw OAuth payload (including access_token and refresh_token), directly violating the &quot;Avoid Logging Sensitive Information&quot; rule.</violation>
</file>

<file name="companion/app/oauth/callback.tsx">

<violation number="1" location="companion/app/oauth/callback.tsx:21">
The OAuth callback never verifies the `state` value before exchanging the authorization code, so any forged redirect can be accepted and tokens issued without CSRF protection.</violation>

<violation number="2" location="companion/app/oauth/callback.tsx:31">
UI strings and error messages are hardcoded English instead of using t(), violating the project’s localization requirement and making translations impossible.</violation>
</file>

<file name="companion/index.js">

<violation number="1" location="companion/index.js:10">
Replacing ErrorUtils’ global handler without calling the previous handler swallows fatal errors, preventing React Native’s default crash/reload flow and hiding production failures.</violation>
</file>

<file name="companion/components/ErrorBoundary.tsx">

<violation number="1" location="companion/components/ErrorBoundary.tsx:49">
User-facing strings are hard-coded instead of using the required t() localization helper, so this screen won’t be translatable.</violation>
</file>

<file name="companion/contexts/AuthContext.tsx">

<violation number="1" location="companion/contexts/AuthContext.tsx:113">
Replacing expo-secure-store with the in-memory storage utility means mobile tokens are no longer persisted across app restarts, so users are logged out whenever the app is killed. Please keep using a persistent native store (e.g., SecureStore/AsyncStorage) instead of this memory-only helper.</violation>
</file>

<file name="companion/app/onboarding.tsx">

<violation number="1" location="companion/app/onboarding.tsx:25">
Please wrap the alert title/message/button label in t() (with an import if needed) so the onboarding error path is localizable.</violation>

<violation number="2" location="companion/app/onboarding.tsx:69">
Wrap the CTA label in t() (and add the corresponding translation key) so the button text is localizable.</violation>

<violation number="3" location="companion/app/onboarding.tsx:81">
Use t() for the helper link copy so the message can be localized along with the rest of the onboarding UI.</violation>
</file>

<file name="companion/app/_layout.tsx">

<violation number="1" location="companion/app/_layout.tsx:36">
Rule violated: **Avoid Logging Sensitive Information**

Logging the full deep-link URL reveals OAuth authorization codes/state in console output, violating the &quot;Avoid Logging Sensitive Information&quot; rule. Remove or sanitize the sensitive parameters before logging.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

[cubic-dev-ai]

4 issues found across 5 files (reviewed changes from recent commits).

Prompt for AI agents (all 4 issues)

Understand the root cause of the following 4 issues and fix them.


<file name="companion/app/onboarding.tsx">

<violation number="1" location="companion/app/onboarding.tsx:23">
Authorization uses http://localhost:8081/oauth/callback but the later token exchange still posts expo-wxt-app://oauth/callback, so Cal.com will reject every code on iOS due to redirect_uri mismatch.</violation>
</file>

<file name="companion/app/oauth/webview.tsx">

<violation number="1" location="companion/app/oauth/webview.tsx:81">
Rule violated: **Avoid Logging Sensitive Information**

The redirect URL (which includes the OAuth authorization code) is logged verbatim, leaking the code to device logs. Remove or sanitize these `console.log` statements so the code/token is never written to logs, per the &quot;Avoid Logging Sensitive Information&quot; rule.</violation>

<violation number="2" location="companion/app/oauth/webview.tsx:128">
All user-facing strings in this screen are hardcoded (e.g., alerts, headers, button labels) instead of using t(), so the OAuth UI cannot be localized and violates the project’s localization requirement.</violation>
</file>

<file name="companion/app/_layout.tsx">

<violation number="1" location="companion/app/_layout.tsx:25">
Rule violated: **Avoid Logging Sensitive Information**

Logging the raw deep-link URL exposes OAuth codes/state parameters in device logs, leaking sensitive credentials and violating the Avoid Logging Sensitive Information rule.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

[dhairyashiil]

closing, addressed by #25298