fix(express): encode the provider id on the oauth provider admin routes

.changeset/encode-oauth-provider-id.md

@@ -0,0 +1,11 @@
+---
+"@seamless-auth/express": patch
+---
+
+Encode the provider id on the OAuth provider admin routes before forwarding it upstream.
+
+`PATCH` and `DELETE /system-config/oauth-providers/:id` interpolated `req.params.id` straight into the upstream URL. Every other proxied route param goes through `encodeURIComponent`, and these two were missed when that pass landed. A param carrying `?`, `#`, or an encoded `/` was decoded into the URL raw, so it could append or override upstream query parameters or reshape the upstream path.
+
+An id of `abc?admin=1` was forwarded as `/system-config/oauth-providers/abc?admin=1`, turning attacker-controlled input into an upstream query parameter. It is now forwarded as a single encoded path segment, which upstream rejects as an unknown id.
+
+The routes require an authenticated access session, so this is not reachable anonymously.

packages/express/src/createServer.ts

@@ -495,15 +495,17 @@ export function createSeamlessAuthServer(
   r.patch(
     "/system-config/oauth-providers/:id",
     proxyWithIdentity(
-      (req) => `system-config/oauth-providers/${req.params.id}`,
+      (req) =>
+        `system-config/oauth-providers/${encodeURIComponent(routeParam(req, "id"))}`,
       "access",
       "PATCH",
     ),
   );
   r.delete(
     "/system-config/oauth-providers/:id",
     proxyWithIdentity(
-      (req) => `system-config/oauth-providers/${req.params.id}`,
+      (req) =>
+        `system-config/oauth-providers/${encodeURIComponent(routeParam(req, "id"))}`,
       "access",
       "DELETE",
     ),

packages/express/tests/proxyQueryForwarding.test.js

@@ -97,3 +97,39 @@ describe("proxy query forwarding", () => {
     );
   });
 });
+
+// A route param interpolated raw into the upstream URL can append query
+// parameters or reshape the path, which is what #65 fixed elsewhere. These two
+// oauth-provider routes were missed by that pass.
+describe("route params stay in one upstream path segment", () => {
+  const originalFetch = global.fetch;
+  let requestedUrl;
+
+  beforeEach(() => {
+    requestedUrl = undefined;
+    global.fetch = jest.fn(async (url) => {
+      requestedUrl = String(url);
+      return createJsonResponse(200, { ok: true });
+    });
+  });
+
+  afterEach(() => {
+    global.fetch = originalFetch;
+  });
+
+  it.each([
+    ["patch", "abc?admin=1"],
+    ["delete", "abc?admin=1"],
+    ["patch", "abc#frag"],
+    ["patch", "../../admin/users"],
+  ])("%s /system-config/oauth-providers/:id encodes %s", async (method, id) => {
+    await request(createApp())
+      [method](`/auth/system-config/oauth-providers/${encodeURIComponent(id)}`)
+      .set("Cookie", createAccessCookie())
+      .send({});
+
+    expect(requestedUrl).toBe(
+      `https://auth.example.com/system-config/oauth-providers/${encodeURIComponent(id)}`,
+    );
+  });
+});