feat: oauth integration (#2659)

* feat: add Google OAuth login support (#2625)

* 🔧 Add login via google

* 🔧 Update code style and docs

* Add fix for db migrate

* 🔧 Update docker-compose

* 🔧 Fix sqlite"

* 🔧 Update docker-compose

* ⚰️ Remove environments

* 🔧 Fix: remove ensureGoogleIdColumn workaround from sqlite.ts

* 🔧 Remove space

* move oauth section

* add openid client

* wip make oauth more generic

* properly allow multiple providers

* fix type import

* github login flow

* adjust github logo with theme

* move docs to own page

* nullable password, prevent timing attack

this prevents timing attacks by always checking hash even if there is none
prevents using basic auth if 2fa is enabled

* support generic oidc

* add ability to set password for oidc users

this allows oidc users to add password login
cant be removed after

* move password login route

move password login route from /api/session to /api/auth/password
align with oauth

* unique index on oauth

* link/unlink logic

* improve docs

* support allowed domains

* support auto register

* refactoring

* disable pw auth

* move 2fa to its own page

* 2fa for oauth, rework 2fa system

* fix design, fix link

Closes #2650

* add auto launch

* improve docs

* improvements

---------

Co-authored-by: Daniel Molenda <dm@fotc.com>

src/server/database/repositories/user/schema.ts

@@ -1,26 +1,38 @@
 import { sql, relations } from 'drizzle-orm';
-import { int, sqliteTable, text } from 'drizzle-orm/sqlite-core';
+import { int, sqliteTable, text, uniqueIndex } from 'drizzle-orm/sqlite-core';
 
 import { client } from '../../schema';
 
-export const user = sqliteTable('users_table', {
-  id: int().primaryKey({ autoIncrement: true }),
-  username: text().notNull().unique(),
-  password: text().notNull(),
-  email: text(),
-  name: text().notNull(),
-  role: int().$type<Role>().notNull(),
-  totpKey: text('totp_key'),
-  totpVerified: int('totp_verified', { mode: 'boolean' }).notNull(),
-  enabled: int({ mode: 'boolean' }).notNull(),
-  createdAt: text('created_at')
-    .notNull()
-    .default(sql`(CURRENT_TIMESTAMP)`),
-  updatedAt: text('updated_at')
-    .notNull()
-    .default(sql`(CURRENT_TIMESTAMP)`)
-    .$onUpdate(() => sql`(CURRENT_TIMESTAMP)`),
-});
+export const user = sqliteTable(
+  'users_table',
+  {
+    id: int().primaryKey({ autoIncrement: true }),
+    username: text().notNull().unique(),
+    /** `password == null` means password login disabled */
+    password: text(),
+    email: text(),
+    name: text().notNull(),
+    role: int().$type<Role>().notNull(),
+    totpKey: text('totp_key'),
+    totpVerified: int('totp_verified', { mode: 'boolean' }).notNull(),
+    enabled: int({ mode: 'boolean' }).notNull(),
+    oauthProvider: text('oauth_provider').$type<OAUTH_PROVIDER>(),
+    oauthId: text('oauth_id'),
+    createdAt: text('created_at')
+      .notNull()
+      .default(sql`(CURRENT_TIMESTAMP)`),
+    updatedAt: text('updated_at')
+      .notNull()
+      .default(sql`(CURRENT_TIMESTAMP)`)
+      .$onUpdate(() => sql`(CURRENT_TIMESTAMP)`),
+  },
+  (table) => [
+    uniqueIndex('oauth_provider_id_unique').on(
+      table.oauthProvider,
+      table.oauthId
+    ),
+  ]
+);
 
 export const usersRelations = relations(user, ({ many }) => ({
   clients: many(client),