Skip to content

Promote dev to main (reddit refresh via broker) #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JOY (JOY) merged 2 commits into from
Sep 25, 2026
Merged

Promote dev to main (reddit refresh via broker) #64

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
18b681f
feat(reddit): refresh through the dos.me broker, drop Reddit client c…
JOY Sep 25, 2026
fca1258
Merge pull request #63 from DOS/feat/reddit-broker-refresh
JOY Sep 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 3 additions & 7 deletions .env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,16 +310,12 @@ LINKEDIN_CLIENT_ID="sample_linkedin_client_id"
LINKEDIN_CLIENT_SECRET="sample_linkedin_client_secret"

# --- Reddit ---
# Channel connect goes through the dos.me Reddit OAuth broker (DOS_ME_API_URL,
# auth key = DOS_ME_INTERNAL_API_KEY), which owns the Reddit app credentials.
# These two are ONLY used for the refresh grant on 401 token recovery
# (RedditProvider.refreshToken) - the broker does not cover it. Removing them
# breaks scheduled Reddit posts older than one hour.
# Both connect AND refresh run through the dos.me Reddit OAuth broker
# (DOS_ME_API_URL, auth key = DOS_ME_INTERNAL_API_KEY) - no Reddit client
# credentials are needed in Crove env at all.
# Optional override for the broker product label (auto-detected from
# FRONTEND_URL: beta-post.crove.com -> crove-post-beta, else crove-post-prod).
# REDDIT_BROKER_PRODUCT="crove-post-beta"
REDDIT_CLIENT_ID="sample_reddit_client_id"
REDDIT_CLIENT_SECRET="sample_reddit_client_secret"

# --- GitHub ---
GITHUB_CLIENT_ID="sample_github_oauth_client_id"
Expand Down
2 changes: 0 additions & 2 deletions docker-compose.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,6 @@ services:
X_API_SECRET: ''
LINKEDIN_CLIENT_ID: ''
LINKEDIN_CLIENT_SECRET: ''
REDDIT_CLIENT_ID: ''
REDDIT_CLIENT_SECRET: ''
GITHUB_CLIENT_ID: ''
GITHUB_CLIENT_SECRET: ''
APPLE_CLIENT_ID: ''
Expand Down
133 changes: 78 additions & 55 deletions libraries/nestjs-libraries/src/integrations/social/reddit.provider.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,52 +91,39 @@ export class RedditProvider extends SocialAbstract implements SocialProvider {
}

async refreshToken(refreshToken: string): Promise<AuthTokenDetails> {
// NOT brokered: the dos.me broker (below) only covers the connect/exchange
// flow. This refresh grant runs against Reddit directly with the app
// credentials, and removing REDDIT_CLIENT_ID/REDDIT_CLIENT_SECRET from the
// env would break the 401 recovery every scheduled post older than an hour
// depends on.
const { access_token: accessToken, expires_in: expiresIn } = await (
await this.fetch('https://www.reddit.com/api/v1/access_token', {
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
Authorization: `Basic ${Buffer.from(
`${process.env.REDDIT_CLIENT_ID}:${process.env.REDDIT_CLIENT_SECRET}`
).toString('base64')}`,
},
body: new URLSearchParams({
grant_type: 'refresh_token',
refresh_token: refreshToken,
}),
})
).json();
// Brokered like the connect flow: the dos.me broker holds the Reddit app
// credentials and exposes POST /oauth/reddit/refresh (same bundle shape as
// token-delivery), so Crove needs no Reddit client credentials at all.
const bundle = await this.fetchRefreshBundle(refreshToken);
// Reddit usually does not rotate the refresh token - when the broker
// omits the field the old one stays valid and MUST be kept, or the next
// refresh would fire with a blank token.
const effectiveRefreshToken = bundle.refreshToken || refreshToken;

const { name, id, icon_img } = await (
await this.fetch('https://oauth.reddit.com/api/v1/me', {
headers: {
Authorization: `Bearer ${accessToken}`,
Authorization: `Bearer ${bundle.accessToken}`,
},
})
).json();

return {
id,
name,
accessToken,
refreshToken: refreshToken,
expiresIn,
accessToken: bundle.accessToken,
refreshToken: effectiveRefreshToken,
expiresIn: bundle.expiresIn,
picture: icon_img?.split?.('?')?.[0] || '',
username: name,
};
}

// dos.me Reddit OAuth broker (docs/platform/REDDIT-OAUTH-BROKER.md): the
// broker owns the Reddit app credentials for the connect flow. Crove sends
// the user to the broker authorize URL, receives a one-time delivery handle
// back at its returnTo, and exchanges that handle server-side for the token
// bundle. REDDIT_CLIENT_ID/SECRET are unused here and stay only for the
// refresh grant above.
// broker owns the Reddit app credentials for connect AND refresh. Crove
// sends the user to the broker authorize URL, receives a one-time delivery
// handle back at its returnTo, and exchanges that handle server-side for
// the token bundle; refreshes go through /oauth/reddit/refresh.
private brokerUrl() {
return (process.env.DOS_ME_API_URL || 'https://api.dos.me').replace(
/\/+$/,
Expand Down Expand Up @@ -231,39 +218,75 @@ export class RedditProvider extends SocialAbstract implements SocialProvider {
'reddit'
);

let body: any = await response.json();
// dos.me wraps some endpoints in { success, data } - unwrap defensively.
if (
body &&
typeof body === 'object' &&
'success' in body &&
'data' in body &&
body.data
) {
body = body.data;
}
return this.parseBundle(await response.json());
} catch (err: any) {
console.log(`Reddit broker token delivery failed: ${err?.message}`);
throw err;
}
}

const accessToken = body?.accessToken ?? body?.access_token;
if (!accessToken) {
throw new Error('token bundle has no access token');
}
private async fetchRefreshBundle(refreshToken: string): Promise<{
accessToken: string;
refreshToken?: string;
expiresIn: number;
scopes: string[];
}> {
Comment on lines +228 to +233

@gemini-code-assist gemini-code-assist Bot Sep 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

To improve code clarity and maintainability, consider defining a dedicated interface for the token bundle structure. This structure is used as a return type in fetchTokenBundle, fetchRefreshBundle, and parseBundle, and defining it once would avoid repetition and make the code easier to read.

For example:

interface RedditBrokerBundle {
  accessToken: string;
  refreshToken?: string;
  expiresIn: number;
  scopes: string[];
}

You could then use Promise<RedditBrokerBundle> and RedditBrokerBundle in the respective method signatures.

try {
const response = await this.fetch(
`${this.brokerUrl()}/oauth/reddit/refresh`,
{
method: 'POST',
headers: {
'X-API-Key': this.brokerApiKey(),
Accept: 'application/json',
'Content-Type': 'application/json',
},
body: JSON.stringify({ refresh_token: refreshToken }),
},
'reddit'
);

return {
accessToken,
refreshToken: body?.refreshToken ?? body?.refresh_token,
expiresIn: body?.expiresIn ?? body?.expires_in ?? 3600,
scopes: Array.isArray(body?.scopes)
? body.scopes
: String(body?.scopes ?? '')
.split(/[\s,]+/)
.filter(Boolean),
};
return this.parseBundle(await response.json());
} catch (err: any) {
console.log(`Reddit broker token delivery failed: ${err?.message}`);
console.log(`Reddit broker refresh failed: ${err?.message}`);
throw err;
}
}

private parseBundle(body: any): {
accessToken: string;
refreshToken?: string;
expiresIn: number;
scopes: string[];
} {
// dos.me wraps some endpoints in { success, data } - unwrap defensively.
if (
body &&
typeof body === 'object' &&
'success' in body &&
'data' in body &&
body.data
) {
body = body.data;
}

const accessToken = body?.accessToken ?? body?.access_token;
if (!accessToken) {
throw new Error('token bundle has no access token');
}

return {
accessToken,
refreshToken: body?.refreshToken ?? body?.refresh_token,
expiresIn: body?.expiresIn ?? body?.expires_in ?? 3600,
scopes: Array.isArray(body?.scopes)
? body.scopes
: String(body?.scopes ?? '')
.split(/[\s,]+/)
.filter(Boolean),
};
}

private async uploadFileToReddit(accessToken: string, path: string) {
const mimeType = lookup(path);
const formData = new FormData();
Expand Down
Loading