Merge pull request #1946 from transloadit/check-access-token

companion: only generate uppyToken if access_token was received from provider

packages/@uppy/companion/src/server/controllers/callback.js

@@ -17,8 +17,13 @@ module.exports = function callback (req, res, next) {
     req.companion.providerTokens = {}
   }
 
-  req.companion.providerTokens[providerName] = req.session.grant.response.access_token
-  logger.debug(`Generating auth token for provider ${providerName}.`, null, req.id)
-  const uppyAuthToken = tokenService.generateToken(req.companion.providerTokens, req.companion.options.secret)
-  return res.redirect(req.companion.buildURL(`/${providerName}/send-token?uppyAuthToken=${uppyAuthToken}`, true))
+  if (req.session.grant.response.access_token) {
+    req.companion.providerTokens[providerName] = req.session.grant.response.access_token
+    logger.debug(`Generating auth token for provider ${providerName}`, null, req.id)
+    const uppyAuthToken = tokenService.generateToken(req.companion.providerTokens, req.companion.options.secret)
+    return res.redirect(req.companion.buildURL(`/${providerName}/send-token?uppyAuthToken=${uppyAuthToken}`, true))
+  }
+
+  logger.debug(`Did not receive access token for provider ${providerName}`, null, req.id)
+  return res.sendStatus(400)
 }