fix: Unable to log in with third-party apps without "Manage OAuth Apps" permission

apps/meteor/app/api/server/v1/oauthapps.ts

@@ -1,5 +1,11 @@
 import { OAuthApps } from '@rocket.chat/models';
-import { isUpdateOAuthAppParams, isOauthAppsGetParams, isOauthAppsAddParams, isDeleteOAuthAppParams } from '@rocket.chat/rest-typings';
+import {
+	isDeleteOAuthAppParams,
+	isOauthAppsAddParams,
+	isOauthAppsGetParams,
+	isOauthInfoInfoParams,
+	isUpdateOAuthAppParams,
+} from '@rocket.chat/rest-typings';
 
 import { hasPermissionAsync } from '../../../authorization/server/functions/hasPermission';
 import { apiDeprecationLogger } from '../../../lib/server/lib/deprecationWarningLogger';
@@ -48,6 +54,24 @@ API.v1.addRoute(
 	},
 );
 
+API.v1.addRoute(
+	'oauth-apps.info',
+	{ authRequired: true, validateParams: isOauthInfoInfoParams },
+	{
+		async get() {
+			const oauthApp = await OAuthApps.findOneAuthAppByIdOrClientId(this.queryParams);
+
+			if (!oauthApp) {
+				return API.v1.failure('OAuth app not found.');
+			}
+
+			return API.v1.success({
+				oauthApp: { clientId: oauthApp.clientId, name: oauthApp.name },
+			});
+		},
+	},
+);
+
 API.v1.addRoute(
 	'oauth-apps.update',
 	{

apps/meteor/client/views/oauth/hooks/useOAuthAppQuery.ts

@@ -1,15 +1,15 @@
-import type { IOAuthApps } from '@rocket.chat/core-typings';
+import type { IOAuthAppsInfo } from '@rocket.chat/core-typings';
 import { useEndpoint } from '@rocket.chat/ui-contexts';
 import type { UseQueryOptions } from '@tanstack/react-query';
 import { useQuery } from '@tanstack/react-query';
 
 type UseOAuthAppQueryOptions = Omit<
-	UseQueryOptions<IOAuthApps, unknown, IOAuthApps, readonly ['oauth-app', { readonly clientId: string | undefined }]>,
+	UseQueryOptions<IOAuthAppsInfo, unknown, IOAuthAppsInfo, readonly ['oauth-app', { readonly clientId: string | undefined }]>,
 	'queryKey' | 'queryFn'
 >;
 
 export const useOAuthAppQuery = (clientId: string | undefined, options?: UseOAuthAppQueryOptions) => {
-	const getOAuthApp = useEndpoint('GET', '/v1/oauth-apps.get');
+	const getOAuthApp = useEndpoint('GET', '/v1/oauth-apps.info');
 
 	return useQuery(
 		['oauth-app', { clientId }] as const,
@@ -19,11 +19,7 @@ export const useOAuthAppQuery = (clientId: string | undefined, options?: UseOAut
 			}
 
 			const { oauthApp } = await getOAuthApp({ clientId });
-			return {
-				...oauthApp,
-				_createdAt: new Date(oauthApp._createdAt),
-				_updatedAt: new Date(oauthApp._updatedAt),
-			};
+			return oauthApp;
 		},
 		options,
 	);

apps/meteor/tests/end-to-end/api/oauthapps.ts

@@ -107,6 +107,24 @@ describe('[OAuthApps]', () => {
 		});
 	});
 
+	describe('[/oauth-apps.info]', () => {
+		it('should return a single oauthApp with only client id and name attributes', (done) => {
+			void request
+				.get(api('oauth-apps.info'))
+				.query({ clientId: 'zapier' })
+				.set(credentials)
+				.expect(200)
+				.expect((res) => {
+					expect(res.body).to.have.property('success', true);
+					expect(res.body).to.have.property('oauthApp');
+					expect(res.body.oauthApp.clientId).to.be.equal('zapier');
+					expect(res.body.oauthApp).to.have.keys(['clientId', 'name']);
+					expect(Object.keys(res.body.oauthApp)).to.have.length(2);
+				})
+				.end(done);
+		});
+	});
+
 	describe('[/oauth-apps.create]', () => {
 		it('should return an error when the user does not have the necessary permission', async () => {
 			await updatePermission('manage-oauth-apps', []);

packages/core-typings/src/IOAuthApps.ts

@@ -1,8 +1,11 @@
-export interface IOAuthApps {
-	_id: string;
+export interface IOAuthAppsInfo {
+	clientId: string;
 	name: string;
+}
+
+export interface IOAuthApps extends IOAuthAppsInfo {
+	_id: string;
 	active: boolean;
-	clientId: string;
 	clientSecret: string;
 	redirectUri: string;
 	_createdAt: Date;

packages/rest-typings/src/index.ts

@@ -233,6 +233,7 @@ export * from './v1/omnichannel';
 export * from './v1/oauthapps';
 export * from './v1/oauthapps/UpdateOAuthAppParamsPOST';
 export * from './v1/oauthapps/OAuthAppsGetParamsGET';
+export * from './v1/oauthapps/OAuthAppsInfoParamsGET';
 export * from './v1/oauthapps/OAuthAppsAddParamsPOST';
 export * from './v1/oauthapps/DeleteOAuthAppParamsDELETE';
 export * from './helpers/PaginatedRequest';

packages/rest-typings/src/v1/oauthapps.ts

@@ -1,8 +1,9 @@
-import type { IOAuthApps, IUser } from '@rocket.chat/core-typings';
+import type { IOAuthApps, IOAuthAppsInfo, IUser } from '@rocket.chat/core-typings';
 
 import type { DeleteOAuthAppParams } from './oauthapps/DeleteOAuthAppParamsDELETE';
 import type { OauthAppsAddParams } from './oauthapps/OAuthAppsAddParamsPOST';
 import type { OauthAppsGetParams } from './oauthapps/OAuthAppsGetParamsGET';
+import type { OauthAppsInfoParams } from './oauthapps/OAuthAppsInfoParamsGET';
 import type { UpdateOAuthAppParams } from './oauthapps/UpdateOAuthAppParamsPOST';
 
 export type OAuthAppsEndpoint = {
@@ -18,6 +19,12 @@ export type OAuthAppsEndpoint = {
 		};
 	};
 
+	'/v1/oauth-apps.info': {
+		GET: (params: OauthAppsInfoParams) => {
+			oauthApp: IOAuthAppsInfo;
+		};
+	};
+
 	'/v1/oauth-apps.create': {
 		POST: (params: OauthAppsAddParams) => { application: IOAuthApps };
 	};

packages/rest-typings/src/v1/oauthapps/OAuthAppsInfoParamsGET.ts

@@ -0,0 +1,16 @@
+import { ajv } from '../Ajv';
+
+export type OauthAppsInfoParams = { clientId: string };
+
+const oauthAppsInfoParamsSchema = {
+	type: 'object',
+	properties: {
+		clientId: {
+			type: 'string',
+		},
+	},
+	required: ['clientId'],
+	additionalProperties: false,
+};
+
+export const isOauthAppsInfoParams = ajv.compile<OauthAppsInfoParams>(oauthAppsInfoParamsSchema);