feat: oauth integration (#2659)

* feat: add Google OAuth login support (#2625) * 🔧 Add login via google * 🔧 Update code style and docs * Add fix for db migrate * 🔧 Update docker-compose * 🔧 Fix sqlite" * 🔧 Update docker-compose * ⚰️ Remove environments * 🔧 Fix: remove ensureGoogleIdColumn workaround from sqlite.ts * 🔧 Remove space * move oauth section * add openid client * wip make oauth more generic * properly allow multiple providers * fix type import * github login flow * adjust github logo with theme * move docs to own page * nullable password, prevent timing attack this prevents timing attacks by always checking hash even if there is none prevents using basic auth if 2fa is enabled * support generic oidc * add ability to set password for oidc users this allows oidc users to add password login cant be removed after * move password login route move password login route from /api/session to /api/auth/password align with oauth * unique index on oauth * link/unlink logic * improve docs * support allowed domains * support auto register * refactoring * disable pw auth * move 2fa to its own page * 2fa for oauth, rework 2fa system * fix design, fix link Closes #2650 * add auto launch * improve docs * improvements --------- Co-authored-by: Daniel Molenda <dm@fotc.com>
2026-06-12 13:38:32 +02:00
parent c70ad1d08b
commit ac547bbf7c
44 changed files with 2848 additions and 222 deletions
@@ -0,0 +1,65 @@
+import { UserLoginSchema } from '#db/repositories/user/types';
+
+export default defineEventHandler(async (event) => {
+  if (WG_ENV.DISABLE_PASSWORD_AUTH) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: 'Password authentication is disabled',
+    });
+  }
+
+  const { username, password, remember } = await readValidatedBody(
+    event,
+    validateZod(UserLoginSchema, event)
+  );
+
+  const result = await Database.users.login(username, password);
+
+  const session = await useWGSession(event, remember);
+
+  // TODO: add localization support
+
+  if (!result.success) {
+    switch (result.error) {
+      case 'INCORRECT_CREDENTIALS':
+        throw createError({
+          statusCode: 401,
+          statusMessage: 'Invalid username or password',
+        });
+      case 'TOTP_REQUIRED':
+        await session.update({
+          pendingLogin: {
+            type: 'password',
+            userId: result.userId,
+            remember,
+          },
+        });
+        return { status: 'TOTP_REQUIRED' as const };
+      case 'INVALID_TOTP_CODE':
+        return { status: 'INVALID_TOTP_CODE' as const };
+      case 'USER_DISABLED':
+        throw createError({
+          statusCode: 401,
+          statusMessage: 'User disabled',
+        });
+      case 'UNEXPECTED_ERROR':
+        throw createError({
+          statusCode: 500,
+          statusMessage: 'Unexpected error',
+        });
+    }
+    assertUnreachable(result);
+  }
+
+  const user = result.user;
+
+  const data = await session.update({
+    userId: user.id,
+  });
+
+  // TODO?: create audit log
+
+  SERVER_DEBUG(`New Session: ${data.id} for ${user.id} (${user.username})`);
+
+  return { status: 'success' as const };
+});