Sign up through an invitation with GitHub, GitLab or Google 3ff52534f69b

/// Use an invitation up if it is still unused; whether it was.

pub async fn claim_invitation(pool: &Pool, code: &str, account_id: i64) -> sqlx::Result<bool> {

    let r = sqlx::query("UPDATE invitations SET used_by = ? WHERE code = ? AND used_by IS NULL")

        .bind(account_id)

        .bind(code)

        .execute(pool)

        .await?;

    Ok(r.rows_affected() > 0)

}

    /// Providers to sign up with, when registration is open (#213) or

    /// the page has a usable invitation (oxygenhub#214).

    /// What the provider buttons carry: `?invite=CODE`, or nothing.

    provider_query: String,

    let invite = q.invite.unwrap_or_default().trim().to_string();

    let usable_invite = mode == "invite"

        && super::signin::invite_code_ok(&invite)

        && accounts::invitation_unused(&app.db, &invite).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    let providers = if !first && (mode == "open" || usable_invite) { super::signin::buttons(&app).await } else { vec![] };

    let provider_query = if usable_invite { format!("?invite={invite}") } else { String::new() };

    Ok(Page(RegisterPage { shell, error: None, mode, first, invite, providers, provider_query }).into_response())

            provider_query: String::new(),

#[derive(Deserialize)]

pub struct StartQuery {

    #[serde(default)]

    invite: String,

}

/// An invitation code as it may ride in the signed state: letters and

/// digits only (the state's parts are separated by dots).

pub fn invite_code_ok(code: &str) -> bool {

    !code.is_empty() && code.len() <= 64 && code.chars().all(|c| c.is_ascii_alphanumeric())

}

/// `GET /login/{provider}`: sign in with the provider; with `?invite=`,

/// sign up with it through that invitation (oxygenhub#214), which rides

/// through the round trip in the signed state.

pub async fn start(

    State(app): State<Shared>,

    viewer: Viewer,

    Path(id): Path<String>,

    Query(q): Query<StartQuery>,

) -> Result<Response, Error> {

    }

    let invite = q.invite.trim();

    if invite.is_empty() {

        return begin(&app, p, "in").await.map_err(|m| Error::bad(shell.clone(), m));

    let unused =

        invite_code_ok(invite) && accounts::invitation_unused(&app.db, invite).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    if !unused {

        return Err(Error::bad(shell, "That invitation has been used or does not exist. Ask whoever invited you for a new one."));

    }

    begin(&app, p, &format!("invite:{invite}")).await.map_err(|m| Error::bad(shell.clone(), m))

    // A new account: when registration is open, or by invitation with an

    // invitation that came through the round trip and is still unused.

    let registration = super::session::registration_mode(&app).await;

    let invite = mode.strip_prefix("invite:").filter(|c| invite_code_ok(c));

    let allowed = match registration.as_str() {

        "open" => true,

        "invite" => invite.is_some(),

        _ => false,

    };

    if !allowed {

            if registration == "invite" { "by invitation" } else { "closed" }

    let by_invitation = (registration == "invite").then_some(invite).flatten();

    if let Some(code) = by_invitation {

        if !accounts::invitation_unused(&app.db, code).await.map_err(e)? {

            return Ok(with_clear(to_login("That invitation was used meanwhile. Ask whoever invited you for a new one.")));

        }

    }

    if let Some(code) = by_invitation {

        if !accounts::claim_invitation(&app.db, code, account.id).await.map_err(e)? {

            tracing::warn!("invitation {code} was used by someone else while {} signed up", account.username);

        }

    }

#[tokio::test]

async fn an_invitation_signs_up_through_a_provider_once() {

    hermetic();

    let (mock, _) = mock_provider().await;

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    let port = listener.local_addr().unwrap().port();

    config.server.base_url = format!("http://127.0.0.1:{port}");

    config.registration.mode = "invite".into();

    config.auth.signin_mock = Some(mock.clone());

    let app = oxygenhub::build(config).await.unwrap();

    let router = oxygenhub::router(app.clone());

    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });

    let app = &app;

    let andy = register(app, "andy", "").await;

    let admin = get(app, "/admin", Some(&andy)).await.body;

    let csrf = csrf_of(&admin);

    post(app, "/admin/signin", Some(&andy), &format!("_csrf={csrf}&provider=github&client_id=gh-cid&secret=gh-sek&enabled=1")).await;

    // Without an invitation: no buttons, and the provider alone makes no account.

    assert!(!get(app, "/register", None).await.body.contains("/login/github"));

    let r = get(app, "/login/github", None).await;

    let (cookie, state) = state_of(&r);

    let no = send_with(app, "GET", &format!("/login/github/callback?code=c1&state={state}"), Some(&cookie), None).await;

    assert!(no.location.as_deref().unwrap_or("").contains("by%20invitation"), "{:?}", no.location);

    assert_eq!(db::accounts::account_count(&app.db).await.unwrap(), 1);

    // With one: the branded buttons carry it, it rides the round trip, and

    // the new account uses it up.

    let r = post(app, "/admin/invite", Some(&andy), &format!("_csrf={csrf}")).await;

    let code = r.body.split("register?invite=").nth(1).unwrap().split('<').next().unwrap().trim().to_string();

    let page = get(app, &format!("/register?invite={code}"), None).await.body;

    assert!(page.contains(&format!("href=\"/login/github?invite={code}\"")) && page.contains("Sign up with GitHub"), "{page}");

    let r = get(app, &format!("/login/github?invite={code}"), None).await;

    assert_eq!(r.status, StatusCode::SEE_OTHER);

    let (cookie, state) = state_of(&r);

    let ok = send_with(app, "GET", &format!("/login/github/callback?code=c2&state={state}"), Some(&cookie), None).await;

    assert_eq!(ok.location.as_deref(), Some("/"), "{}", ok.body);

    let octo = db::accounts::account_by_name(&app.db, "octocat").await.unwrap().expect("signed up through the invitation");

    assert!(!db::accounts::invitation_unused(&app.db, &code).await.unwrap(), "the invitation is spent");

    let used_by: Option<i64> =

        sqlx::query_scalar("SELECT used_by FROM invitations WHERE code = ?").bind(&code).fetch_one(&app.db).await.unwrap();

    assert_eq!(used_by, Some(octo.id));

    // Spent: no buttons, and starting with it is refused plainly.

    assert!(!get(app, &format!("/register?invite={code}"), None).await.body.contains("/login/github"));

    let r = get(app, &format!("/login/github?invite={code}"), None).await;

    assert_eq!(r.status, StatusCode::BAD_REQUEST);

    assert!(r.body.contains("That invitation has been used or does not exist."), "{}", r.body);

    assert_eq!(get(app, "/login/github?invite=not-a.code", None).await.status, StatusCode::BAD_REQUEST);

}

An administrator sets up each provider under Administration › Sign in with: the OAuth client id, the client secret (sealed under `keys/secrets.key`, never shown again) and a switch; the page shows the callback URL to register with the provider (`/login/{provider}/callback`). The login page then offers the usable providers (oxygenhub#106). The flow is OAuth 2.0's authorization code: `/login/{provider}` sets a state cookie (a nonce and the purpose, MACed with the cookie key, ten minutes, path `/login`) and sends the person to the provider; the callback checks the state against the cookie, swaps the code for a token server to server, and asks who it is (GitHub: `/user` and the primary verified address from `/user/emails`; Google: the OpenID `userinfo`, the address only when `email_verified`). Then: a subject already linked signs in; else an account with that verified email is linked and signed in; else, when registration is open, or it is by invitation and an unused invitation came through the round trip (`/login/{provider}?invite=CODE`, carried in the signed state as the purpose `invite:CODE`, used up when the account is made; the registration page shows the provider buttons for a usable invitation, oxygenhub#214), an account is made from the provider's login name (made valid and free), with an unusable password and the email verified when the provider vouched for it; otherwise the person is told to register or sign in and connect. A signed-in person connects or disconnects a provider under Settings › Security; a subject can be linked to one account. Links live in `account_logins`. Audited as `admin.signin`, `signin.connected`, `signin.disconnected`, `login` and `register` with the provider. For tests, `[auth] signin_mock` names a base URL that stands in for every provider.

{% let verb = "Sign in" %}{% let suffix = "" %}{% include "signin_buttons.html" %}{% endif %}

{% let verb = "Sign up" %}{% let suffix = provider_query.as_str() %}{% include "signin_buttons.html" %}{% endif %}

   `verb` ("Sign in" or "Sign up"), and `suffix` (a query the links

   carry: `?invite=CODE` on an invitation, oxygenhub#214). #}

{% for (id, name) in providers %}<a class="signin-btn {{ id }}" href="/login/{{ id }}{{ suffix }}">