feat: oauth integration (#2659)

* feat: add Google OAuth login support (#2625) * 🔧 Add login via google * 🔧 Update code style and docs * Add fix for db migrate * 🔧 Update docker-compose * 🔧 Fix sqlite" * 🔧 Update docker-compose * ⚰️ Remove environments * 🔧 Fix: remove ensureGoogleIdColumn workaround from sqlite.ts * 🔧 Remove space * move oauth section * add openid client * wip make oauth more generic * properly allow multiple providers * fix type import * github login flow * adjust github logo with theme * move docs to own page * nullable password, prevent timing attack this prevents timing attacks by always checking hash even if there is none prevents using basic auth if 2fa is enabled * support generic oidc * add ability to set password for oidc users this allows oidc users to add password login cant be removed after * move password login route move password login route from /api/session to /api/auth/password align with oauth * unique index on oauth * link/unlink logic * improve docs * support allowed domains * support auto register * refactoring * disable pw auth * move 2fa to its own page * 2fa for oauth, rework 2fa system * fix design, fix link Closes #2650 * add auto launch * improve docs * improvements --------- Co-authored-by: Daniel Molenda <dm@fotc.com>
2026-06-12 13:38:32 +02:00
parent c70ad1d08b
commit ac547bbf7c
44 changed files with 2848 additions and 222 deletions
@@ -0,0 +1,50 @@
+import * as client from 'openid-client';
+import { z } from 'zod';
+
+const OauthQuerySchema = z.object({
+  link: z.coerce.boolean().optional(),
+});
+
+export default defineEventHandler(async (event) => {
+  const params = await getValidatedQuery(
+    event,
+    validateZod(OauthQuerySchema, event)
+  );
+
+  const { config, provider, providerConfig } = await buildOauthConfig(event);
+
+  const host = getRequestHost(event);
+  const protocol = WG_ENV.INSECURE ? 'http' : 'https';
+  const baseUri = `${protocol}://${host}/api/auth/${provider}`;
+
+  let redirectUri = `${baseUri}/callback`;
+  if (params.link) {
+    redirectUri = `${baseUri}/link`;
+  }
+
+  const codeVerifier = client.randomPKCECodeVerifier();
+  const codeChallenge = await client.calculatePKCECodeChallenge(codeVerifier);
+  const nonce = client.randomNonce();
+  const state = client.randomState();
+
+  const parameters: Record<string, string> = {
+    ...providerConfig.params,
+    redirect_uri: redirectUri,
+    scope: providerConfig.scope,
+    code_challenge: codeChallenge,
+    code_challenge_method: 'S256',
+    nonce: nonce,
+    state: state,
+  };
+
+  const session = await useWGSession(event);
+  await session.update({
+    oauth_nonce: nonce,
+    oauth_verifier: codeVerifier,
+    oauth_state: state,
+  });
+
+  const redirectTo = client.buildAuthorizationUrl(config, parameters);
+
+  return sendRedirect(event, redirectTo.toString());
+});