Add OAuth2 login

Author: Minei3oat

api/.yarn/cache/jose-npm-6.1.0-b52bb87803-d111bc11fd.zip

@@ -2,7 +2,7 @@
 
 # Global args, set before the first FROM, shared by all stages
 ARG NODE_ENV="production"
-ARG NODE_IMAGE="18.19.1-alpine"
+ARG NODE_IMAGE="20.19.5-alpine"
 
 ################################################################################
 # Build stage 1 - `yarn build`

api/.yarn/cache/oauth4webapi-npm-3.8.2-251c3d9d97-5f96b50dd5.zip

@@ -0,0 +1,25 @@
+-- Login with external identity and register/migrate user if not present/externally managed
+CREATE FUNCTION ctfnote_private.login_with_extern("name" text, "role" ctfnote.role)
+RETURNS ctfnote.jwt
+AS $$
+DECLARE
+  log_user ctfnote_private.user;
+BEGIN
+  INSERT INTO ctfnote_private.user ("login", "password", "role")
+    VALUES (login_with_extern.name, 'external', login_with_extern.role)
+    ON CONFLICT ("login") DO UPDATE
+      SET login = login_with_extern.name, password = 'external'
+  RETURNING
+    * INTO log_user;
+  INSERT INTO ctfnote.profile ("id", "username")
+    VALUES (log_user.id, login_with_extern.name)
+    ON CONFLICT (id) DO UPDATE
+      SET username = login_with_extern.name;
+  RETURN (ctfnote_private.new_token (log_user.id))::ctfnote.jwt;
+END;
+$$
+LANGUAGE plpgsql
+STRICT
+SECURITY DEFINER;
+
+GRANT EXECUTE ON FUNCTION ctfnote_private.login_with_extern TO user_anonymous;

api/.yarn/cache/openid-client-npm-6.8.1-616ccc5934-94d18d39f8.zip

@@ -0,0 +1,5 @@
+ALTER TABLE ctfnote.settings
+  ADD COLUMN "oauth2_enabled" boolean NOT NULL DEFAULT FALSE;
+
+GRANT SELECT ("oauth2_enabled") ON ctfnote.settings TO user_anonymous;
+GRANT UPDATE ("oauth2_enabled") ON ctfnote.settings TO user_postgraphile;

api/Dockerfile

@@ -30,6 +30,7 @@
     "graphql": "^16.9.0",
     "graphql-upload-ts": "^2.1.2",
     "ical-generator": "^7.0.0",
+    "openid-client": "6.8.1",
     "postgraphile": "4.13.0",
     "postgraphile-plugin-connection-filter": "^2.3.0",
     "postgres-migrations": "^5.3.0",

api/migrations/57-external-login.sql

@@ -51,6 +51,21 @@ export type CTFNoteConfig = DeepReadOnly<{
     registrationRoleId: string;
     channelHandleStyle: DiscordChannelHandleStyle;
   };
+  oauth2: {
+    enabled: string;
+    clientId: string;
+    clientSecret: string;
+    scope: string;
+    usernameAttr: string;
+    roleAttr: string;
+    roleMapping: string;
+    discoveryUrl: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    userinfoEndpoint: string;
+    tokenEndpointAuthMethod: string;
+    issuer: string;
+  };
 }>;
 
 function getEnv(
@@ -112,6 +127,24 @@ const config: CTFNoteConfig = {
       "agile"
     ) as DiscordChannelHandleStyle,
   },
+  oauth2: {
+    enabled: getEnv("OAUTH2_ENABLED", "false"),
+    clientId: getEnv("OAUTH2_CLIENT_ID", ""),
+    clientSecret: getEnv("OAUTH2_CLIENT_SECRET", ""),
+    scope: getEnv("OAUTH2_SCOPE", ""),
+    usernameAttr: getEnv("OAUTH2_USERNAME_ATTR", ""),
+    roleAttr: getEnv("OAUTH2_ROLE_ATTR", ""),
+    roleMapping: getEnv("OAUTH2_ROLE_MAPPING", ""),
+    discoveryUrl: getEnv("OAUTH2_DISCOVERY_URL", ""),
+    authorizationEndpoint: getEnv("OAUTH2_AUTHORIZATION_ENDPOINT", ""),
+    tokenEndpoint: getEnv("OAUTH2_TOKEN_ENDPOINT", ""),
+    userinfoEndpoint: getEnv("OAUTH2_USERINFO_ENDPOINT", ""),
+    tokenEndpointAuthMethod: getEnv(
+      "OAUTH2_TOKEN_ENDPOINT_AUTH_METHOD",
+      "client_secret_basic"
+    ),
+    issuer: getEnv("OAUTH2_ISSUER", ""),
+  },
 };
 
 export default config;

api/migrations/58-oauth2-login.sql

@@ -6,11 +6,11 @@ import {
 } from "discord.js";
 import { Command } from "../../interfaces/command";
 import {
-  AllowedRoles,
   createInvitationTokenForDiscordId,
   getInvitationTokenForDiscordId,
   getUserByDiscordId,
 } from "../../database/users";
+import { AllowedRoles } from "../../../utils/role";
 import config from "../../../config";
 
 async function getInvitationUrl(invitationCode: string | null = null) {

api/package.json

@@ -1,5 +1,6 @@
 import { connectToDatabase } from "../../utils/database";
 import { PoolClient } from "pg";
+import { AllowedRoles } from "../../utils/role";
 
 /*
  * Only returns users that have not linked their discord account yet.
@@ -45,15 +46,6 @@ export async function setDiscordIdForUser(
   }
 }
 
-// refactor above to an enum
-export enum AllowedRoles {
-  user_guest = "user_guest",
-  user_friend = "user_friend",
-  user_member = "user_member",
-  user_manager = "user_manager",
-  user_admin = "user_admin",
-}
-
 export async function getInvitationTokenForDiscordId(
   discordId: string,
   pgClient: PoolClient | null = null