From 51d469008cf03dcd52dac8decbec74aaedf5790c Mon Sep 17 00:00:00 2001
From: ZacharyZcR <zacharyzcr1984@gmail.com>
Date: Wed, 13 May 2026 14:56:45 +0800
Subject: [PATCH] fix: decode oidc client_secret before token exchange

---
 src/backend/database/routes/users.ts | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/backend/database/routes/users.ts b/src/backend/database/routes/users.ts
index cb4912cc..be074932 100644
--- a/src/backend/database/routes/users.ts
+++ b/src/backend/database/routes/users.ts
@@ -949,6 +949,18 @@ router.get("/oidc/callback", async (req, res) => {
       config = JSON.parse(
         (configRow as Record<string, unknown>).value as string,
       );
+
+      if (config.client_secret?.startsWith("encrypted:")) {
+        config.client_secret = Buffer.from(
+          config.client_secret.substring(10),
+          "base64",
+        ).toString("utf8");
+      } else if (config.client_secret?.startsWith("encoded:")) {
+        config.client_secret = Buffer.from(
+          config.client_secret.substring(8),
+          "base64",
+        ).toString("utf8");
+      }
     }
 
     const tokenResponse = await fetch(config.token_url, {