Bug: ZOHO_CLIENT_ID missing from credential check in forwardToZoho #57

New Issue

Closed

opened 2026-05-17 17:24:39 -05:00 by null · 0 comments

null commented

2026-05-17 17:24:39 -05:00

Owner

Problem

In server/index.js, the guard condition for skipping Zoho forwarding (around line ~293) only checks ZOHO_CLIENT_SECRET and ZOHO_REFRESH_TOKEN:

if (!ZOHO_CLIENT_SECRET || !ZOHO_REFRESH_TOKEN) {
  log.warn('[Zoho] Skipping forwarding - ZOHO_CLIENT_SECRET or ZOHO_REFRESH_TOKEN not configured')
  return
}

But ZOHO_CLIENT_ID defaults to empty string '' (falsy in a boolean context but NOT caught by the check). If someone enables Zoho and provides ZOHO_CLIENT_SECRET and ZOHO_REFRESH_TOKEN but forgets ZOHO_CLIENT_ID, the code will proceed to call getZohoAccessToken() with an empty client_id, which will fail silently.

Fix

Add ZOHO_CLIENT_ID to the guard:

if (!ZOHO_CLIENT_ID || !ZOHO_CLIENT_SECRET || !ZOHO_REFRESH_TOKEN) {
  log.warn('[Zoho] Skipping forwarding - ZOHO_CLIENT_ID, ZOHO_CLIENT_SECRET, or ZOHO_REFRESH_TOKEN not configured')
  return
}

Also consider normalizing the defaults: all three should default to null or all to empty string, not a mix.

Severity

Low — Zoho is currently disabled. But this will bite when it's enabled.

## Problem In `server/index.js`, the guard condition for skipping Zoho forwarding (around line ~293) only checks `ZOHO_CLIENT_SECRET` and `ZOHO_REFRESH_TOKEN`: ```js if (!ZOHO_CLIENT_SECRET || !ZOHO_REFRESH_TOKEN) { log.warn('[Zoho] Skipping forwarding - ZOHO_CLIENT_SECRET or ZOHO_REFRESH_TOKEN not configured') return } ``` But `ZOHO_CLIENT_ID` defaults to empty string `''` (falsy in a boolean context but NOT caught by the check). If someone enables Zoho and provides `ZOHO_CLIENT_SECRET` and `ZOHO_REFRESH_TOKEN` but forgets `ZOHO_CLIENT_ID`, the code will proceed to call `getZohoAccessToken()` with an empty client_id, which will fail silently. ## Fix Add `ZOHO_CLIENT_ID` to the guard: ```js if (!ZOHO_CLIENT_ID || !ZOHO_CLIENT_SECRET || !ZOHO_REFRESH_TOKEN) { log.warn('[Zoho] Skipping forwarding - ZOHO_CLIENT_ID, ZOHO_CLIENT_SECRET, or ZOHO_REFRESH_TOKEN not configured') return } ``` Also consider normalizing the defaults: all three should default to `null` or all to empty string, not a mix. ## Severity Low — Zoho is currently disabled. But this will bite when it's enabled.