Sign in with GitLab, and branded sign-in buttons 810896d41be7

{# Branded sign-in buttons (oxygenhub#213), in the style of Gitter's: the

   provider's colour and logo (Simple Icons, CC0). Needs `providers` and

   `verb` ("Sign in" or "Sign up"). #}

<div class="signin-with">

{% for (id, name) in providers %}<a class="signin-btn {{ id }}" href="/login/{{ id }}">

  <svg viewBox="0 0 24 24" width="18" height="18" aria-hidden="true" focusable="false">{% if *id == "gitlab" %}<path d="m23.6004 9.5927-.0337-.0862L20.3.9814a.851.851 0 0 0-.3362-.405.8748.8748 0 0 0-.9997.0539.8748.8748 0 0 0-.29.4399l-2.2055 6.748H7.5375l-2.2057-6.748a.8573.8573 0 0 0-.29-.4412.8748.8748 0 0 0-.9997-.0537.8585.8585 0 0 0-.3362.4049L.4332 9.5015l-.0325.0862a6.0657 6.0657 0 0 0 2.0119 7.0105l.0113.0087.03.0213 4.976 3.7264 2.462 1.8633 1.4995 1.1321a1.0085 1.0085 0 0 0 1.2197 0l1.4995-1.1321 2.4619-1.8633 5.006-3.7489.0125-.01a6.0682 6.0682 0 0 0 2.0094-7.003z"/>{% else if *id == "github" %}<path d="M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12"/>{% else if *id == "google" %}<path d="M12.48 10.92v3.28h7.84c-.24 1.84-.853 3.187-1.787 4.133-1.147 1.147-2.933 2.4-6.053 2.4-4.827 0-8.6-3.893-8.6-8.72s3.773-8.72 8.6-8.72c2.6 0 4.507 1.027 5.907 2.347l2.307-2.307C18.747 1.44 16.133 0 12.48 0 5.867 0 .307 5.387.307 12s5.56 12 12.173 12c3.573 0 6.267-1.173 8.373-3.36 2.16-2.16 2.84-5.213 2.84-7.667 0-.76-.053-1.467-.173-2.053H12.48z"/>{% endif %}</svg>

  <span>{{ verb }} with {{ name }}</span>

</a>

{% endfor %}</div>

//! GitLab (gitlab.com or a self-managed GitLab), GitHub and Google

//! through OAuth 2.0's authorization code flow, set up

    /// For a provider that can be self-hosted: the address used when the

    /// administrator gives none. Its endpoints are then paths under the

    /// address (oxygenhub#213).

    pub default_base: Option<&'static str>,

pub const PROVIDERS: [Provider; 3] = [

    // GitLab's OpenID Connect endpoints, the same on gitlab.com and on a

    // self-managed GitLab.

        id: "gitlab",

        name: "GitLab",

        authorize: "/oauth/authorize",

        token: "/oauth/token",

        userinfo: "/oauth/userinfo",

        scope: "openid profile email",

        default_base: Some("https://gitlab.com"),

    },

    Provider {

        default_base: None,

        default_base: None,

    fn url(&self, app: &Shared, s: &Settings, which: &str) -> String {

        let path = match which {

            "authorize" => self.authorize,

            "token" => self.token,

            _ => self.userinfo,

        };

            None => match self.default_base {

                Some(default) => format!("{}{path}", s.base_or(default)),

                None => path.to_string(),

    /// A self-hostable provider's address (GitLab), empty for its default.

    pub base: String,

    }

    /// The address to use: the one set, else `default`.

    pub fn base_or<'a>(&'a self, default: &'a str) -> &'a str {

        let b = self.base.trim().trim_end_matches('/');

        if b.is_empty() {

            default

        } else {

            b

        }

/// Whether `base` may be a self-hosted provider's address: https, a host,

/// nothing after it but an optional path prefix, no query.

pub fn valid_base(base: &str) -> bool {

    let Some(rest) = base.strip_prefix("https://") else { return false };

    let host = rest.split('/').next().unwrap_or("");

    !host.is_empty() && !rest.contains(['?', '#', ' ']) && host.contains('.')

}

    let base = accounts::setting(&app.db, &key(id, "base")).await?.unwrap_or_default();

    Ok(Settings { client_id, secret, enabled, base })

pub async fn save(app: &Shared, id: &str, client_id: &str, secret: Option<&str>, enabled: bool, base: &str) -> sqlx::Result<()> {

    accounts::set_setting(&app.db, &key(id, "base"), base.trim().trim_end_matches('/')).await?;

pub fn authorize_url(app: &Shared, p: &Provider, s: &Settings, state: &str) -> String {

        p.url(app, s, "authorize"),

        q(&s.client_id),

        .post(p.url(app, s, "token"))

    let user = get(p.url(app, s, "userinfo")).await?;

            let emails = get(format!("{}/emails", p.url(app, s, "userinfo"))).await.unwrap_or_default();

        }

        // GitLab's OpenID Connect userinfo: the subject is its user id, the

        // username is `nickname`.

        "gitlab" => {

            let subject = user["sub"]

                .as_str()

                .map(String::from)

                .or_else(|| user["sub"].as_i64().map(|i| i.to_string()))

                .ok_or("GitLab gave no subject")?;

            let email = user["email"].as_str().filter(|_| user["email_verified"] == true).map(String::from);

            let login = user["nickname"].as_str().or(user["preferred_username"].as_str()).unwrap_or("").to_string();

            External { provider: p.id, subject, login, name: user["name"].as_str().unwrap_or("").to_string(), email }

        assert_eq!(provider("gitlab").map(|p| (p.name, p.default_base)), Some(("GitLab", Some("https://gitlab.com"))));

        assert!(provider("bitbucket").is_none());

        // A self-managed GitLab's address (#213).

        assert!(valid_base("https://gitlab.example.org") && valid_base("https://code.example.org/gitlab"));

        assert!(

            !valid_base("http://gitlab.example.org")

                && !valid_base("https://")

                && !valid_base("https://gitlab.example.org/?x=1")

                && !valid_base("https://localhost")

        );

        let s = Settings { base: "https://gitlab.example.org/".into(), ..Settings::default() };

        assert_eq!(s.base_or("https://gitlab.com"), "https://gitlab.example.org");

        assert_eq!(Settings::default().base_or("https://gitlab.com"), "https://gitlab.com");

    /// Providers to sign up with, when registration is open (#213).

    providers: Vec<(&'static str, &'static str)>,

    let mode = registration_mode(&app).await;

    let providers = if mode == "open" && !first { super::signin::buttons(&app).await } else { vec![] };

    Ok(Page(RegisterPage { shell, error: None, mode, first, invite: q.invite.unwrap_or_default(), providers }).into_response())

        Page(RegisterPage {

            shell: shell.clone(),

            error: Some(msg.into()),

            mode: mode.clone(),

            first,

            invite: f.invite.clone(),

            providers: vec![],

        })

        .into_response()

    let to = signin::authorize_url(app, p, &s, &state);

    /// For a self-hostable provider: its default address and the one set.

    pub default_base: Option<&'static str>,

    pub base: String,

            default_base: p.default_base,

            base: s.base,

    /// A self-hostable provider's address (GitLab); empty for its default.

    #[serde(default)]

    pub base: String,

    let base = f.base.trim().trim_end_matches('/');

    if p.default_base.is_none() && !base.is_empty() {

        return Ok(Err(format!("{} has no address to set.", p.name)));

    }

    if !base.is_empty() && !signin::valid_base(base) {

        return Ok(Err(format!("The {} address is an https:// address, like https://gitlab.example.org.", p.name)));

    }

    signin::save(app, p.id, client_id, secret, enabled, base).await?;

            "/gitlab/token",

            axum::routing::post(|| async { axum::Json(serde_json::json!({ "access_token": "gl-token", "token_type": "Bearer" })) }),

        )

        .route(

            "/gitlab/userinfo",

            axum::routing::get(|headers: axum::http::HeaderMap| async move {

                assert_eq!(headers.get("authorization").and_then(|v| v.to_str().ok()), Some("Bearer gl-token"));

                axum::Json(serde_json::json!({ "sub": "1234567", "nickname": "tanuki", "name": "The Tanuki", "email": "[email protected]", "email_verified": true }))

            }),

        )

        .route(

    // GitLab (#213): a self-managed address is checked, then sign-in makes

    // an account from the GitLab username.

    let r = post(

        app,

        "/admin/signin",

        Some(&andy),

        &format!("_csrf={csrf}&provider=gitlab&client_id=gl-cid&secret=gl-sek&enabled=1&base=http%3A%2F%2Fgitlab.example.org"),

    )

    .await;

    assert!(r.body.contains("is an https:// address"), "{}", r.body);

    let r = post(

        app,

        "/admin/signin",

        Some(&andy),

        &format!("_csrf={csrf}&provider=gitlab&client_id=gl-cid&secret=gl-sek&enabled=1&base=https%3A%2F%2Fgitlab.example.org%2F"),

    )

    .await;

    assert!(r.body.contains("Signing in with GitLab is on.") && r.body.contains("value=\"https://gitlab.example.org\""), "{}", r.body);

    let r = post(

        app,

        "/admin/signin",

        Some(&andy),

        &format!("_csrf={csrf}&provider=github&client_id=gh-cid&enabled=1&base=https%3A%2F%2Fx.org"),

    )

    .await;

    assert!(r.body.contains("GitHub has no address to set."), "{}", r.body);

    let login = get(app, "/login", None).await.body;

    assert!(login.contains("signin-btn gitlab") && login.contains("Sign in with GitLab"), "{login}");

    let r = get(app, "/login/gitlab", None).await;

    assert!(r.location.clone().unwrap().contains("scope=openid%20profile%20email"), "{:?}", r.location);

    let (cookie, state) = state_of(&r);

    let ok = send_with(app, "GET", &format!("/login/gitlab/callback?code=c9&state={state}"), Some(&cookie), None).await;

    assert_eq!(ok.location.as_deref(), Some("/"), "{}", ok.body);

    let tanuki = db::accounts::account_by_name(&app.db, "tanuki").await.unwrap().expect("account made from the GitLab username");

    assert!((tanuki.email.as_str(), tanuki.email_verified) == ("[email protected]", true), "{tanuki:?}");

    assert_eq!(db::accounts::account_count(&app.db).await.unwrap(), 3);

    assert_eq!(db::accounts::account_count(&app.db).await.unwrap(), 3, "no fourth account");

    {% if let Some(d) = p.default_base %}<label for="base-{{ p.id }}">{{ p.name }} address</label><input type="url" id="base-{{ p.id }}" name="base" value="{{ p.base }}" placeholder="{{ d }}" autocomplete="off">

    <p class="small mute">Empty for {{ d }}; or a self-managed {{ p.name }}, like https://gitlab.example.org. Register the hub there as an application with the scopes <code>openid profile email</code>.</p>{% endif %}

<div class="signin-layout{% if !providers.is_empty() && totp_for.is_none() %} with-providers{% endif %}">

{% if !providers.is_empty() && totp_for.is_none() %}<div class="signin-or" aria-hidden="true"><span>or</span></div>

{% let verb = "Sign in" %}{% include "signin_buttons.html" %}{% endif %}

</div>

<div class="signin-layout">

{% if !providers.is_empty() %}<div class="signin-or" aria-hidden="true"><span>or</span></div>

{% let verb = "Sign up" %}{% include "signin_buttons.html" %}{% endif %}

</div>

/* Sign-in with a provider (oxygenhub#213): branded buttons beside the

   sign-in box, in the style of Gitter's (the provider's colour and logo). */

.signin-layout { display: flex; flex-wrap: wrap; align-items: center; gap: 24px; }

.signin-layout > form.card { flex: 1 1 320px; margin: 0; }

.signin-or { display: flex; flex-direction: column; align-items: center; align-self: stretch; color: var(--mute); font-size: 12px; text-transform: uppercase; letter-spacing: .08em; }

.signin-or::before, .signin-or::after { content: ""; flex: 1; width: 1px; background: var(--line); }

.signin-or span { padding: 8px 0; }

.signin-with { display: flex; flex-direction: column; gap: 10px; flex: 0 1 280px; min-width: 0; }

/* `:root .signin-with` outranks the looks' link colours (assets/github.css). */

:root .signin-with a.signin-btn { display: flex; align-items: center; justify-content: center; gap: 10px; padding: 11px 16px; border-radius: 4px; color: #fff; font-weight: 700; font-size: 13px; letter-spacing: .06em; text-transform: uppercase; text-decoration: none; border: 1px solid transparent; }

:root .signin-with a.signin-btn svg { flex-shrink: 0; fill: currentColor; }

:root .signin-with a.signin-btn:hover, :root .signin-with a.signin-btn:focus-visible { filter: brightness(1.08); text-decoration: none; color: #fff; }

:root .signin-with a.signin-btn:focus-visible { outline: 2px solid var(--acc); outline-offset: 2px; }

:root .signin-with a.signin-btn.gitlab { background: #cf3d1b; } /* GitLab's red-orange, dark enough for white text (4.8:1) */

:root .signin-with a.signin-btn.github { background: #24292f; }

:root .signin-with a.signin-btn.google { background: #fff; color: #3c4043; border-color: #dadce0; }

:root .signin-with a.signin-btn.google:hover, :root .signin-with a.signin-btn.google:focus-visible { color: #3c4043; background: #f8f9fa; filter: none; }

@media (max-width: 700px) {

  .signin-or { flex-direction: row; width: 100%; }

  .signin-or::before, .signin-or::after { height: 1px; width: auto; }

  .signin-or span { padding: 0 8px; }

  .signin-with { flex-basis: 100%; }

}