Trello integration OAuth callback always returns invalid_request

[ChrisAceda]

Fix Trello authorization and card creation

Summary

This fixes two issues preventing the Trello integration from working end to end:

1. Trello returns its authorization token in a URL fragment, which is not sent to the server.
2. After authorization, the Trello API key was not included in card-creation hook jobs.

Environment

Original version:

• Image: ghcr.io/quackbackio/quackback:latest
• Digest: sha256:f3a166771f6d78f6a50e7bc9372740e3a0896e129437689870172ca5465b9f42
• Created: 2026-07-07T21:15:09Z

Issue 1: OAuth callback loses the Trello token

Observed flow

GET /oauth/trello/connect -> 302
GET /oauth/trello/callback?state=[redacted] -> 302
GET /admin/settings/integrations/trello?trello=error&reason=invalid_request -> 200

The callback contained only state; no token or OAuth verifier reached the server. It completed in approximately 1 ms, and no Trello integration row was created.

Cause

Trello returns its token in the URL fragment:

#token=...

Browsers do not send URL fragments to servers, so the existing callback handler could not access the token.

Fix

The Trello callback now:

• Returns a Trello-specific browser bridge for the initial callback.
• Reads the token from window.location.hash.
• Posts the token to the same callback endpoint.
• Preserves the existing signed-state, state-cookie, session, and principal validation.
• Keeps the token out of query strings, browser history, referrers, and reverse-proxy access logs.
• Adds restrictive cache, CSP, framing, and referrer headers.

Issue 2: Feedback does not create Trello cards

Observed error

After authorization succeeded, submitting new feedback produced:

Trello API key missing from config

The post itself was created successfully, but the Trello hook failed permanently and no card appeared in the selected list.

Cause

getIntegrationTargets() constructed hook configuration with only:

{
  accessToken,
  rootUrl
}

Although TRELLO_API_KEY was configured in the application environment, it was not passed to the Trello hook as apiKey.

Fix

For Trello targets, the hook configuration now includes the configured API key:

config: {
  accessToken,
  rootUrl: context.portalBaseUrl,
  ...(m.integrationType === 'trello'
    ? { apiKey: process.env.TRELLO_API_KEY }
    : {}),
}

Other integration configurations remain unchanged.

Verification

Verified in a production Docker build:

• Trello authorization completes successfully.
• The integration is created and visible in Quackback.
• The callback uses a browser GET followed by a POST.
• The Trello token does not appear in request URLs.
• A new feedback submission emits post.created.
• A card is created in the configured Trello board and list.
• The Trello API key and access token are not written to application logs.

Commits

• Original tested source: a8e4a63fdbf8193445a144222fde7b9fb103b35e
• Latest patch commit: 78c92034

Maintainer note

The card-creation fix currently sources the API key from TRELLO_API_KEY. If platform credentials are intended to be the canonical source, the stored Trello clientId could instead be injected into the hook configuration as apiKey.