feat: notion OAuth setup (#11765)

Co-authored-by: Muhsin Keloth <muhsinkeramam@gmail.com>

spec/controllers/api/v1/accounts/notion/authorization_controller_spec.rb

@@ -0,0 +1,53 @@
+require 'rails_helper'
+
+RSpec.describe 'Notion Authorization API', type: :request do
+  let(:account) { create(:account) }
+
+  describe 'POST /api/v1/accounts/{account.id}/notion/authorization' do
+    context 'when it is an unauthenticated user' do
+      it 'returns unauthorized' do
+        post "/api/v1/accounts/#{account.id}/notion/authorization"
+
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+
+    context 'when it is an authenticated user' do
+      let(:agent) { create(:user, account: account, role: :agent) }
+      let(:administrator) { create(:user, account: account, role: :administrator) }
+
+      it 'returns unauthorized for agent' do
+        post "/api/v1/accounts/#{account.id}/notion/authorization",
+             headers: agent.create_new_auth_token,
+             params: { email: administrator.email },
+             as: :json
+
+        expect(response).to have_http_status(:unauthorized)
+      end
+
+      it 'creates a new authorization and returns the redirect url' do
+        post "/api/v1/accounts/#{account.id}/notion/authorization",
+             headers: administrator.create_new_auth_token,
+             params: { email: administrator.email },
+             as: :json
+
+        expect(response).to have_http_status(:success)
+
+        # Validate URL components
+        url = response.parsed_body['url']
+        uri = URI.parse(url)
+        params = CGI.parse(uri.query)
+
+        expect(url).to start_with('https://api.notion.com/v1/oauth/authorize')
+        expect(params['response_type']).to eq(['code'])
+        expect(params['owner']).to eq(['user'])
+        expect(params['redirect_uri']).to eq(["#{ENV.fetch('FRONTEND_URL', 'http://localhost:3000')}/notion/callback"])
+
+        # Validate state parameter exists and can be decoded back to the account
+        expect(params['state']).to be_present
+        decoded_account = GlobalID::Locator.locate_signed(params['state'].first, for: 'default')
+        expect(decoded_account).to eq(account)
+      end
+    end
+  end
+end

spec/controllers/concerns/notion_concern_spec.rb

@@ -0,0 +1,56 @@
+require 'rails_helper'
+
+RSpec.describe NotionConcern, type: :concern do
+  let(:controller_class) do
+    Class.new do
+      include NotionConcern
+    end
+  end
+
+  let(:controller) { controller_class.new }
+
+  describe '#notion_client' do
+    let(:client_id) { 'test_notion_client_id' }
+    let(:client_secret) { 'test_notion_client_secret' }
+
+    before do
+      allow(GlobalConfigService).to receive(:load).with('NOTION_CLIENT_ID', nil).and_return(client_id)
+      allow(GlobalConfigService).to receive(:load).with('NOTION_CLIENT_SECRET', nil).and_return(client_secret)
+    end
+
+    it 'creates OAuth2 client with correct configuration' do
+      expect(OAuth2::Client).to receive(:new).with(
+        client_id,
+        client_secret,
+        {
+          site: 'https://api.notion.com',
+          authorize_url: 'https://api.notion.com/v1/oauth/authorize',
+          token_url: 'https://api.notion.com/v1/oauth/token',
+          auth_scheme: :basic_auth
+        }
+      )
+
+      controller.notion_client
+    end
+
+    it 'loads client credentials from GlobalConfigService' do
+      expect(GlobalConfigService).to receive(:load).with('NOTION_CLIENT_ID', nil)
+      expect(GlobalConfigService).to receive(:load).with('NOTION_CLIENT_SECRET', nil)
+
+      controller.notion_client
+    end
+
+    it 'returns OAuth2::Client instance' do
+      client = controller.notion_client
+      expect(client).to be_an_instance_of(OAuth2::Client)
+    end
+
+    it 'configures client with Notion-specific endpoints' do
+      client = controller.notion_client
+      expect(client.site).to eq('https://api.notion.com')
+      expect(client.options[:authorize_url]).to eq('https://api.notion.com/v1/oauth/authorize')
+      expect(client.options[:token_url]).to eq('https://api.notion.com/v1/oauth/token')
+      expect(client.options[:auth_scheme]).to eq(:basic_auth)
+    end
+  end
+end

spec/controllers/notion/callbacks_controller_spec.rb

@@ -0,0 +1,112 @@
+require 'rails_helper'
+
+RSpec.describe Notion::CallbacksController, type: :request do
+  let(:account) { create(:account) }
+  let(:state) { account.to_sgid.to_s }
+  let(:oauth_code) { 'test_oauth_code' }
+  let(:notion_redirect_uri) { "#{ENV.fetch('FRONTEND_URL', 'http://localhost:3000')}/app/accounts/#{account.id}/settings/integrations/notion" }
+
+  let(:notion_response_body) do
+    {
+      'access_token' => 'notion_access_token_123',
+      'token_type' => 'bearer',
+      'workspace_name' => 'Test Workspace',
+      'workspace_id' => 'workspace_123',
+      'workspace_icon' => 'https://notion.so/icon.png',
+      'bot_id' => 'bot_123',
+      'owner' => {
+        'type' => 'user',
+        'user' => {
+          'id' => 'user_123',
+          'name' => 'Test User'
+        }
+      }
+    }
+  end
+
+  describe 'GET /notion/callback' do
+    before do
+      account.enable_features('notion_integration')
+      stub_const('ENV', ENV.to_hash.merge(
+                          'FRONTEND_URL' => 'http://localhost:3000',
+                          'NOTION_CLIENT_ID' => 'test_client_id',
+                          'NOTION_CLIENT_SECRET' => 'test_client_secret'
+                        ))
+
+      controller = described_class.new
+      allow(controller).to receive(:account).and_return(account)
+      allow(controller).to receive(:notion_redirect_uri).and_return(notion_redirect_uri)
+      allow(described_class).to receive(:new).and_return(controller)
+    end
+
+    context 'when OAuth callback is successful' do
+      before do
+        stub_request(:post, 'https://api.notion.com/v1/oauth/token')
+          .to_return(
+            status: 200,
+            body: notion_response_body.to_json,
+            headers: { 'Content-Type' => 'application/json' }
+          )
+      end
+
+      it 'creates a new integration hook' do
+        expect do
+          get '/notion/callback', params: { code: oauth_code, state: state }
+        end.to change(Integrations::Hook, :count).by(1)
+
+        hook = Integrations::Hook.last
+        expect(hook.access_token).to eq('notion_access_token_123')
+        expect(hook.app_id).to eq('notion')
+        expect(hook.status).to eq('enabled')
+      end
+
+      it 'sets correct hook attributes' do
+        get '/notion/callback', params: { code: oauth_code, state: state }
+
+        hook = Integrations::Hook.last
+        expect(hook.account).to eq(account)
+        expect(hook.app_id).to eq('notion')
+        expect(hook.access_token).to eq('notion_access_token_123')
+        expect(hook.status).to eq('enabled')
+      end
+
+      it 'stores notion workspace data in settings' do
+        get '/notion/callback', params: { code: oauth_code, state: state }
+
+        hook = Integrations::Hook.last
+        expect(hook.settings['token_type']).to eq('bearer')
+        expect(hook.settings['workspace_name']).to eq('Test Workspace')
+        expect(hook.settings['workspace_id']).to eq('workspace_123')
+        expect(hook.settings['workspace_icon']).to eq('https://notion.so/icon.png')
+        expect(hook.settings['bot_id']).to eq('bot_123')
+        expect(hook.settings['owner']).to eq(notion_response_body['owner'])
+      end
+
+      it 'handles successful callback and creates hook' do
+        get '/notion/callback', params: { code: oauth_code, state: state }
+
+        # Due to controller mocking limitations in test,
+        # the redirect URL construction fails but hook creation succeeds
+        expect(Integrations::Hook.last.app_id).to eq('notion')
+        expect(response).to be_redirect
+      end
+    end
+
+    context 'when OAuth token request fails' do
+      before do
+        stub_request(:post, 'https://api.notion.com/v1/oauth/token')
+          .to_return(
+            status: 400,
+            body: { error: 'invalid_grant' }.to_json,
+            headers: { 'Content-Type' => 'application/json' }
+          )
+      end
+
+      it 'redirects to home page on error' do
+        get '/notion/callback', params: { code: oauth_code, state: state }
+
+        expect(response).to redirect_to('/')
+      end
+    end
+  end
+end