Skip to content

Conversation

@stadust
Copy link
Owner

@stadust stadust commented Mar 9, 2025

Allow linking google accounts to pointercrate accounts, to allow signing in through google. This then eliminates the option to sign in with pointercrate password, but also means you can no longer lock yourself out of your pointercrate account as easily (unless you also lock yourself out of your google account, but really, what are you doing?).

This is a very bare-bones implementation:

  • No registration with google possible yet (you must register for a legacy account, and then link)
  • No changing of linked google account

Essentially, we're implementing Phase 1 and 2 of #127, leaving Phase 3 and especially 4 for later work.

License Acceptance

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@codecov
Copy link

codecov bot commented Mar 9, 2025

Codecov Report

Attention: Patch coverage is 16.37168% with 189 lines in your changes missing coverage. Please review.

Project coverage is 30.17%. Comparing base (4da49a1) to head (6ee7058).
Report is 1 commits behind head on master.

Files with missing lines Patch % Lines
pointercrate-user-api/src/oauth.rs 0.00% 46 Missing ⚠️
pointercrate-user-api/src/pages.rs 6.12% 46 Missing ⚠️
pointercrate-user/src/auth/oauth/post.rs 0.00% 25 Missing ⚠️
pointercrate-user/src/auth/oauth/get.rs 0.00% 15 Missing ⚠️
pointercrate-core-pages/src/head.rs 0.00% 13 Missing ⚠️
pointercrate-user/src/auth/oauth/patch.rs 0.00% 9 Missing ⚠️
pointercrate-user/src/auth/patch.rs 18.18% 9 Missing ⚠️
pointercrate-user-pages/src/login.rs 0.00% 8 Missing ⚠️
pointercrate-user-pages/src/account/profile.rs 0.00% 6 Missing ⚠️
pointercrate-user/src/auth/oauth/mod.rs 33.33% 6 Missing ⚠️
... and 3 more
Additional details and impacted files
@@            Coverage Diff             @@
##           master     #229      +/-   ##
==========================================
- Coverage   30.36%   30.17%   -0.20%     
==========================================
  Files         113      118       +5     
  Lines        8012     8126     +114     
==========================================
+ Hits         2433     2452      +19     
- Misses       5579     5674      +95     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

stadust added 9 commits March 23, 2025 12:00
Signed-off-by: stadust <43299462+stadust@users.noreply.github.com>
Signed-off-by: stadust <43299462+stadust@users.noreply.github.com>
If these are wanted, they can be applied on the form-input itself, since
all form inputs we are using are laid out top-to-bottom anyway.

Signed-off-by: stadust <43299462+stadust@users.noreply.github.com>
Signed-off-by: stadust <43299462+stadust@users.noreply.github.com>
Sometimes we might want to use these outside of forms.

Signed-off-by: stadust <43299462+stadust@users.noreply.github.com>
Both /login and /register place CSRF and access tokens in cookies.
Deduplicate the code with a helper function (especially because later
on, oauth will _also_ need to place the same cookies).

Signed-off-by: stadust <43299462+stadust@users.noreply.github.com>
Also add a dummy request handler to the backend which for now always
returns 403 UNAUTHORIZED.

We use the javascript callback version (instead of redirect) of the
google oauth flow so that it's easier to display potential error
messages directly on the login page, as well as to avoid the form data
payload that google would give us if we let it directly POST to our
servers (going through javascript allows us to convert to JSON, which is
easier to deal with).

Signed-off-by: stadust <43299462+stadust@users.noreply.github.com>
Mark as UNIQUE to prevent any bugs/race conditions from allowing the
same google account for multiple pointercrate accounts.

Signed-off-by: stadust <43299462+stadust@users.noreply.github.com>
Introduce a new `AuthenticationType` for these, so that password based
login will automatically be rejected.

Signed-off-by: stadust <43299462+stadust@users.noreply.github.com>
stadust added 5 commits March 23, 2025 12:06
Have the backend validate credentials it receives via /auth/oauth/google
with the certificates that google publishes, decode the associated JWT
to determine the google account id, and then log in the user who has
that google account id linked by placing the required cookies.

Signed-off-by: stadust <43299462+stadust@users.noreply.github.com>
Signed-off-by: stadust <43299462+stadust@users.noreply.github.com>
Signed-off-by: stadust <43299462+stadust@users.noreply.github.com>
When reaching the /oauth/google endpoint fully authenticated, and the
provided google credentials are valid, link the authenticated
pointercrate account with the google account. Only do so it the google
account is not already linked to another pointercrate account, and if
the pointercrate account is not already linked to a google account (e.g.
re-linking from one google account to a different one is not possible
right now).

Signed-off-by: stadust <43299462+stadust@users.noreply.github.com>
Add an integration test to ensure that if a google account is linked to
a pointercrate account, that pointercrate account becomes impossible to
log in via username/password combo.

Signed-off-by: stadust <43299462+stadust@users.noreply.github.com>
@stadust stadust merged commit 031261e into master Mar 29, 2025
2 of 4 checks passed
This was referenced Mar 29, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants