Oauth2 support

jc21 · jc21 · commit 208037946f0d · 2024-11-07T07:24:38.000+10:00
diff --git a/backend/.testcoverage.yml b/backend/.testcoverage.yml
@@ -18,4 +18,4 @@ threshold:
   # package: 30
   # (optional; default 0)
   # The minimum total coverage project should have
-  total: 33
+  total: 30
diff --git a/backend/embed/api_docs/components/AuthConfigObject.json b/backend/embed/api_docs/components/AuthConfigObject.json
@@ -7,7 +7,7 @@
 		"enum": [
 			"local",
 			"ldap",
-			"oidc"
+			"oauth"
 		]
 	}
 }
diff --git a/backend/embed/api_docs/components/UserAuthObject.json b/backend/embed/api_docs/components/UserAuthObject.json
@@ -24,7 +24,7 @@
 		},
 		"type": {
 			"type": "string",
-			"pattern": "^(local|ldap|oidc)$"
+			"pattern": "^(local|ldap|oauth)$"
 		}
 	}
 }
diff --git a/backend/embed/api_docs/components/UserObject.json b/backend/embed/api_docs/components/UserObject.json
@@ -53,7 +53,7 @@
 				},
 				"type": {
 					"type": "string",
-					"pattern": "^(local|ldap|oidc)$"
+					"pattern": "^(local|ldap|oauth)$"
 				}
 			}
 		},
diff --git a/backend/embed/migrations/mysql/20201013035839_initial_data.sql b/backend/embed/migrations/mysql/20201013035839_initial_data.sql
@@ -48,8 +48,8 @@ INSERT INTO `setting` (
 (
 	ROUND(UNIX_TIMESTAMP(CURTIME(4)) * 1000),
 	ROUND(UNIX_TIMESTAMP(CURTIME(4)) * 1000),
-	"oidc-auth",
-	"Configuration for OIDC authentication",
+	"oauth-auth",
+	"Configuration for OAuth authentication",
 	'{}' -- remember this is json
 ),
 (
diff --git a/backend/embed/migrations/postgres/20201013035839_initial_data.sql b/backend/embed/migrations/postgres/20201013035839_initial_data.sql
@@ -48,8 +48,8 @@ INSERT INTO "setting" (
 (
 	EXTRACT(EPOCH FROM TIMESTAMP '2011-05-17 10:40:28.876944') * 1000,
 	EXTRACT(EPOCH FROM TIMESTAMP '2011-05-17 10:40:28.876944') * 1000,
-	'oidc-auth',
-	'Configuration for OIDC authentication',
+	'oauth-auth',
+	'Configuration for OAuth authentication',
 	'{}' -- remember this is json
 ),
 (
diff --git a/backend/embed/migrations/sqlite/20201013035839_initial_data.sql b/backend/embed/migrations/sqlite/20201013035839_initial_data.sql
@@ -47,8 +47,8 @@ INSERT INTO `setting` (
 (
 	unixepoch() * 1000,
 	unixepoch() * 1000,
-	"oidc-auth",
-	"Configuration for OIDC authentication",
+	"oauth-auth",
+	"Configuration for OAuth authentication",
 	'{}' -- remember this is json
 ),
 (
diff --git a/backend/go.mod b/backend/go.mod
@@ -24,6 +24,7 @@ require (
 	github.com/vrischmann/envconfig v1.3.0
 	go.uber.org/goleak v1.3.0
 	golang.org/x/crypto v0.27.0
+	golang.org/x/oauth2 v0.23.0
 	gorm.io/datatypes v1.2.1
 	gorm.io/driver/mysql v1.5.7
 	gorm.io/driver/postgres v1.5.9
diff --git a/backend/go.sum b/backend/go.sum
@@ -205,6 +205,8 @@ golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/oauth2 v0.23.0 h1:PbgcYx2W7i4LvjJWEbf0ngHV6qJYr86PkAV3bXdLEbs=
+golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
diff --git a/backend/internal/api/handler/auth.go b/backend/internal/api/handler/auth.go
@@ -70,8 +70,6 @@ func NewToken() func(http.ResponseWriter, *http.Request) {
 		switch payload.Type {
 		case "ldap":
 			newTokenLDAP(w, r, payload)
-		case "oidc":
-			newTokenOIDC(w, r, payload)
 		case "local":
 			newTokenLocal(w, r, payload)
 		}
@@ -199,10 +197,6 @@ func newTokenLDAP(w http.ResponseWriter, r *http.Request, payload tokenPayload)
 	}
 }
 
-func newTokenOIDC(w http.ResponseWriter, r *http.Request, _ tokenPayload) {
-	h.ResultErrorJSON(w, r, http.StatusInternalServerError, "NOT YET SUPPORTED", nil)
-}
-
 // RefreshToken an existing token by given them a new one with the same claims
 // Route: POST /auth/refresh
 func RefreshToken() func(http.ResponseWriter, *http.Request) {
diff --git a/backend/internal/api/handler/helpers.go b/backend/internal/api/handler/helpers.go
@@ -21,11 +21,22 @@ func getPageInfoFromRequest(r *http.Request) (model.PageInfo, error) {
 		return pageInfo, err
 	}
 
-	// pageInfo.Sort = middleware.GetSortFromContext(r)
-
 	return pageInfo, nil
 }
 
+func getQueryVarString(r *http.Request, varName string, required bool, defaultValue string) (string, error) {
+	queryValues := r.___URL.Query()
+	varValue := queryValues.Get(varName)
+
+	if varValue == "" && required {
+		return "", eris.Errorf("%v was not supplied in the request", varName)
+	} else if varValue == "" {
+		return defaultValue, nil
+	}
+
+	return varValue, nil
+}
+
 func getQueryVarInt(r *http.Request, varName string, required bool, defaultValue int) (int, error) {
 	queryValues := r.___URL.Query()
 	varValue := queryValues.Get(varName)
diff --git a/backend/internal/api/handler/oauth.go b/backend/internal/api/handler/oauth.go
@@ -0,0 +1,156 @@
+package handler
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+
+	h "npm/internal/api/http"
+	"npm/internal/entity/auth"
+	"npm/internal/entity/setting"
+	"npm/internal/entity/user"
+	"npm/internal/errors"
+	njwt "npm/internal/jwt"
+	"npm/internal/logger"
+
+	"gorm.io/gorm"
+)
+
+// getRequestIPAddress will use X-FORWARDED-FOR header if it exists
+// otherwise it will use RemoteAddr
+func getRequestIPAddress(r *http.Request) string {
+	// this Get is case insensitive
+	xff := r.Header.Get("X-FORWARDED-FOR")
+	if xff != "" {
+		ip, _, _ := strings.Cut(xff, ",")
+		return strings.TrimSpace(ip)
+	}
+	return r.RemoteAddr
+}
+
+// OAuthLogin ...
+// Route: GET /oauth/login
+func OAuthLogin() func(http.ResponseWriter, *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if !setting.AuthMethodEnabled(auth.TypeOAuth) {
+			h.ResultErrorJSON(w, r, http.StatusNotFound, "Not found", nil)
+			return
+		}
+
+		redirectBase, _ := getQueryVarString(r, "redirect_base", false, "")
+		url, err := auth.OAuthLogin(redirectBase, getRequestIPAddress(r))
+		if err != nil {
+			h.ResultErrorJSON(w, r, http.StatusBadRequest, err.Error(), nil)
+			return
+		}
+
+		h.ResultResponseJSON(w, r, http.StatusOK, url)
+	}
+}
+
+// OAuthRedirect ...
+// Route: GET /oauth/redirect
+func OAuthRedirect() func(http.ResponseWriter, *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if !setting.AuthMethodEnabled(auth.TypeOAuth) {
+			h.ResultErrorJSON(w, r, http.StatusNotFound, "Not found", nil)
+			return
+		}
+
+		code, err := getQueryVarString(r, "code", true, "")
+		if err != nil {
+			h.ResultErrorJSON(w, r, http.StatusBadRequest, err.Error(), nil)
+			return
+		}
+
+		ou, err := auth.OAuthReturn(r.Context(), code, getRequestIPAddress(r))
+		if err != nil {
+			h.ResultErrorJSON(w, r, http.StatusBadRequest, err.Error(), nil)
+			return
+		}
+
+		if ou.Identifier == "" {
+			h.ResultErrorJSON(w, r, http.StatusBadRequest, "User found, but OAuth identifier seems misconfigured", nil)
+			return
+		}
+
+		jwt, err := newTokenOAuth(ou)
+		if err != nil {
+			h.ResultErrorJSON(w, r, http.StatusInternalServerError, err.Error(), nil)
+			return
+		}
+
+		// encode jwt to json
+		j, _ := json.Marshal(jwt)
+
+		// Redirect to frontend with success
+		http.Redirect(w, r, fmt.Sprintf("/?token_response=%s", url.QueryEscape(string(j))), http.StatusSeeOther)
+	}
+}
+
+// newTokenOAuth takes a OAuthUser and creates a new token,
+// optionally creating a new user if one does not exist
+func newTokenOAuth(ou *auth.OAuthUser) (*njwt.GeneratedResponse, error) {
+	// Get OAuth settings
+	oAuthSettings, err := setting.GetOAuthSettings()
+	if err != nil {
+		logger.Error("OAuth settings not found", err)
+		return nil, err
+	}
+
+	// Get Auth by identity
+	authObj, authErr := auth.GetByIdenityType(ou.GetID(), auth.TypeOAuth)
+	if authErr == gorm.ErrRecordNotFound {
+		// Auth is not found for this identity. We can create it
+		if !oAuthSettings.AutoCreateUser {
+			// user does not have an auth record
+			// and auto create is disabled. Showing account disabled error
+			// for the time being
+			return nil, errors.ErrUserDisabled
+		}
+
+		// Attempt to find user by email
+		foundUser, err := user.GetByEmail(ou.GetEmail())
+		if err == gorm.ErrRecordNotFound {
+			// User not found, create user
+			foundUser, err = user.CreateFromOAuthUser(ou)
+			if err != nil {
+				logger.Error("user.CreateFromOAuthUser", err)
+				return nil, err
+			}
+			logger.Info("Created user from OAuth: %s, %s", ou.GetID(), foundUser.Email)
+		} else if err != nil {
+			logger.Error("user.GetByEmail", err)
+			return nil, err
+		}
+
+		// Create auth record and attach to this user
+		authObj = auth.Model{
+			UserID:   foundUser.ID,
+			Type:     auth.TypeOAuth,
+			Identity: ou.GetID(),
+		}
+		if err := authObj.Save(); err != nil {
+			logger.Error("auth.Save", err)
+			return nil, err
+		}
+		logger.Info("Created OAuth auth for user: %s, %s", ou.GetID(), foundUser.Email)
+	} else if authErr != nil {
+		logger.Error("auth.GetByIdenityType", err)
+		return nil, authErr
+	}
+
+	userObj, userErr := user.GetByID(authObj.UserID)
+	if userErr != nil {
+		return nil, userErr
+	}
+
+	if userObj.IsDisabled {
+		return nil, errors.ErrUserDisabled
+	}
+
+	jwt, err := njwt.Generate(&userObj, false)
+	return &jwt, err
+}
diff --git a/backend/internal/api/middleware/log.go b/backend/internal/api/middleware/log.go
@@ -0,0 +1,16 @@
+package middleware
+
+import (
+	"net/http"
+
+	"npm/internal/logger"
+)
+
+// Log will print out route information to the logger
+// only when debug is enabled
+func Log(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		logger.Debug("Request: %s %s", r.Method, r.___URL.Path)
+		next.ServeHTTP(w, r)
+	})
+}
diff --git a/backend/internal/api/router.go b/backend/internal/api/router.go
@@ -50,6 +50,7 @@ func NewRouter() http.Handler {
 		middleware.Expansion,
 		middleware.DecodeAuth(),
 		middleware.BodyContext(),
+		middleware.Log,
 	)
 
 	return applyRoutes(r)
@@ -61,6 +62,12 @@ func applyRoutes(r chi.Router) chi.Router {
 	r.NotFound(handler.NotFound())
 	r.MethodNotAllowed(handler.NotAllowed())
 
+	// OAuth endpoints aren't technically API endpoints
+	r.With(middleware.EnforceSetup()).Route("/oauth", func(r chi.Router) {
+		r.Get("/login", handler.OAuthLogin())
+		r.Get("/redirect", handler.OAuthRedirect())
+	})
+
 	// SSE - requires a sse token as the `jwt` get parameter
 	// Exists inside /api but it's here so that we can skip the Timeout middleware
 	// that applies to other endpoints.
diff --git a/backend/internal/api/schema/get_token.go b/backend/internal/api/schema/get_token.go
@@ -18,7 +18,7 @@ func GetToken() string {
 			"properties": {
 				"type": {
 					"type": "string",
-					"enum": ["local", "ldap", "oidc"]
+					"enum": ["local", "ldap"]
 				},
 				"identity": %s,
 				"secret": %s
diff --git a/backend/internal/entity/auth/ldap.go b/backend/internal/entity/auth/ldap.go
@@ -70,7 +70,7 @@ func ldapSearchUser(l *ldap3.Conn, ldapSettings setting.LDAPSettings, username s
 		0,
 		false,
 		strings.Replace(ldapSettings.SelfFilter, "{{USERNAME}}", username, 1),
-		nil, // []string{"name"},
+		nil,
 		nil,
 	)
 
diff --git a/backend/internal/entity/auth/model.go b/backend/internal/entity/auth/model.go
@@ -12,7 +12,7 @@ import (
 const (
 	TypeLocal = "local"
 	TypeLDAP  = "ldap"
-	TypeOIDC  = "oidc"
+	TypeOAuth = "oauth"
 )
 
 // Model is the model
diff --git a/backend/internal/entity/auth/oauth.go b/backend/internal/entity/auth/oauth.go
diff --git a/backend/internal/entity/setting/auth_methods.go b/backend/internal/entity/setting/auth_methods.go
diff --git a/backend/internal/entity/setting/oauth.go b/backend/internal/entity/setting/oauth.go
diff --git a/backend/internal/entity/user/methods.go b/backend/internal/entity/user/methods.go
diff --git a/docker/rootfs/etc/nginx/conf.d/dev.conf b/docker/rootfs/etc/nginx/conf.d/dev.conf
diff --git a/frontend/src/Router.tsx b/frontend/src/Router.tsx
diff --git a/frontend/src/components/SiteWrapper.tsx b/frontend/src/components/SiteWrapper.tsx
diff --git a/frontend/src/context/AuthContext.tsx b/frontend/src/context/AuthContext.tsx

Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,7 @@`
`7`	`7`	`"enum": [`
`8`	`8`	`"local",`
`9`	`9`	`"ldap",`
`10`		`- "oidc"`
	`10`	`+ "oauth"`
`11`	`11`	`]`
`12`	`12`	`}`
`13`	`13`	`}`
Original file line number	Diff line number	Diff line change
`@@ -24,7 +24,7 @@`
`24`	`24`	`},`
`25`	`25`	`"type": {`
`26`	`26`	`"type": "string",`
`27`		`- "pattern": "^(local\|ldap\|oidc)$"`
	`27`	`+ "pattern": "^(local\|ldap\|oauth)$"`
`28`	`28`	`}`
`29`	`29`	`}`
`30`	`30`	`}`
Original file line number	Diff line number	Diff line change
`@@ -53,7 +53,7 @@`
`53`	`53`	`},`
`54`	`54`	`"type": {`
`55`	`55`	`"type": "string",`
`56`		`- "pattern": "^(local\|ldap\|oidc)$"`
	`56`	`+ "pattern": "^(local\|ldap\|oauth)$"`
`57`	`57`	`}`
`58`	`58`	`}`
`59`	`59`	`},`
Original file line number	Diff line number	Diff line change
@@ -48,8 +48,8 @@ INSERT INTO `setting` (
`48`	`48`	`(`
`49`	`49`	`ROUND(UNIX_TIMESTAMP(CURTIME(4)) * 1000),`
`50`	`50`	`ROUND(UNIX_TIMESTAMP(CURTIME(4)) * 1000),`
`51`		`- "oidc-auth",`
`52`		`- "Configuration for OIDC authentication",`
	`51`	`+ "oauth-auth",`
	`52`	`+ "Configuration for OAuth authentication",`
`53`	`53`	`'{}' -- remember this is json`
`54`	`54`	`),`
`55`	`55`	`(`
Original file line number	Diff line number	Diff line change
`@@ -48,8 +48,8 @@ INSERT INTO "setting" (`
`48`	`48`	`(`
`49`	`49`	`EXTRACT(EPOCH FROM TIMESTAMP '2011-05-17 10:40:28.876944') * 1000,`
`50`	`50`	`EXTRACT(EPOCH FROM TIMESTAMP '2011-05-17 10:40:28.876944') * 1000,`
`51`		`- 'oidc-auth',`
`52`		`- 'Configuration for OIDC authentication',`
	`51`	`+ 'oauth-auth',`
	`52`	`+ 'Configuration for OAuth authentication',`
`53`	`53`	`'{}' -- remember this is json`
`54`	`54`	`),`
`55`	`55`	`(`
Original file line number	Diff line number	Diff line change
@@ -47,8 +47,8 @@ INSERT INTO `setting` (
`47`	`47`	`(`
`48`	`48`	`unixepoch() * 1000,`
`49`	`49`	`unixepoch() * 1000,`
`50`		`- "oidc-auth",`
`51`		`- "Configuration for OIDC authentication",`
	`50`	`+ "oauth-auth",`
	`51`	`+ "Configuration for OAuth authentication",`
`52`	`52`	`'{}' -- remember this is json`
`53`	`53`	`),`
`54`	`54`	`(`
Original file line number	Diff line number	Diff line change
`@@ -70,8 +70,6 @@ func NewToken() func(http.ResponseWriter, *http.Request) {`
`70`	`70`	`switch payload.Type {`
`71`	`71`	`case "ldap":`
`72`	`72`	`newTokenLDAP(w, r, payload)`
`73`		`- case "oidc":`
`74`		`- newTokenOIDC(w, r, payload)`
`75`	`73`	`case "local":`
`76`	`74`	`newTokenLocal(w, r, payload)`
`77`	`75`	`}`
`@@ -199,10 +197,6 @@ func newTokenLDAP(w http.ResponseWriter, r *http.Request, payload tokenPayload)`
`199`	`197`	`}`
`200`	`198`	`}`
`201`	`199`
`202`		`-func newTokenOIDC(w http.ResponseWriter, r *http.Request, _ tokenPayload) {`
`203`		`- h.ResultErrorJSON(w, r, http.StatusInternalServerError, "NOT YET SUPPORTED", nil)`
`204`		`-}`
`205`		`-`
`206`	`200`	`// RefreshToken an existing token by given them a new one with the same claims`
`207`	`201`	`// Route: POST /auth/refresh`
`208`	`202`	`func RefreshToken() func(http.ResponseWriter, *http.Request) {`