🔒 Add validation for Challonge OAuth configuration in token and refresh endpoints

2026-01-29 04:35:14 +00:00
parent 4769193ae4
commit 8650920c7c
1 changed files with 14 additions and 0 deletions
--- a/code/websites/pokedex.online/server/oauth-proxy.js
+++ b/code/websites/pokedex.online/server/oauth-proxy.js
@@ -54,6 +54,13 @@ app.use('/api/gamemaster', gamemasterRouter);
 * POST /oauth/token
 */
 app.post('/oauth/token', async (req, res) => {
+  if (!hasChallongeAuth) {
+    return res.status(503).json({ 
+      error: 'Challonge OAuth not configured',
+      message: 'Set CHALLONGE_CLIENT_ID and CHALLONGE_CLIENT_SECRET environment variables'
+    });
+  }
+
  const { code } = req.body;

  if (!code) {
@@ -98,6 +105,13 @@ app.post('/oauth/token', async (req, res) => {
 * POST /oauth/refresh
 */
 app.post('/oauth/refresh', async (req, res) => {
+  if (!hasChallongeAuth) {
+    return res.status(503).json({ 
+      error: 'Challonge OAuth not configured',
+      message: 'Set CHALLONGE_CLIENT_ID and CHALLONGE_CLIENT_SECRET environment variables'
+    });
+  }
+
  const { refresh_token } = req.body;

  if (!refresh_token) {