Sign in with GitHub or Google 83940d53664f

-- Sign-in with an external account (hub spec §5.1.2, #106): which

-- provider subject is which account, and the login name there.

CREATE TABLE account_logins (

    provider    TEXT NOT NULL,

    subject     TEXT NOT NULL,

    account_id  INTEGER NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,

    login       TEXT NOT NULL DEFAULT '',

    linked_ms   INTEGER NOT NULL,

    PRIMARY KEY (provider, subject)

);

CREATE INDEX account_logins_by_account ON account_logins (account_id);

//! Sign in with an external account (hub spec §5.1.2, oxygenhub#106):

//! GitHub and Google through OAuth 2.0's authorization code flow, set up

//! by an administrator per provider (client id, a sealed secret, on or

//! off). A first sign-in links the provider's subject to the account with

//! the same verified email, or makes an account when registration is

//! open; later sign-ins find the link.

use crate::db::{accounts, now_ms, Pool};

use crate::Shared;

use sqlx::FromRow;

/// A provider the hub knows how to talk to.

#[derive(Clone, Copy, Debug, PartialEq, Eq)]

pub struct Provider {

    pub id: &'static str,

    pub name: &'static str,

    authorize: &'static str,

    token: &'static str,

    userinfo: &'static str,

    pub scope: &'static str,

}

pub const PROVIDERS: [Provider; 2] = [

    Provider {

        id: "github",

        name: "GitHub",

        authorize: "https://github.com/login/oauth/authorize",

        token: "https://github.com/login/oauth/access_token",

        userinfo: "https://api.github.com/user",

        scope: "read:user user:email",

    },

    Provider {

        id: "google",

        name: "Google",

        authorize: "https://accounts.google.com/o/oauth2/v2/auth",

        token: "https://oauth2.googleapis.com/token",

        userinfo: "https://openidconnect.googleapis.com/v1/userinfo",

        scope: "openid email profile",

    },

];

pub fn provider(id: &str) -> Option<&'static Provider> {

    PROVIDERS.iter().find(|p| p.id == id)

}

impl Provider {

    /// The provider's endpoints, or a test double's when `[auth]

    /// signin_mock` names one: `{mock}/{id}/authorize|token|userinfo`.

    fn url(&self, app: &Shared, which: &str) -> String {

        match &app.config.auth.signin_mock {

            Some(base) => format!("{}/{}/{which}", base.trim_end_matches('/'), self.id),

            None => match which {

                "authorize" => self.authorize.to_string(),

                "token" => self.token.to_string(),

                _ => self.userinfo.to_string(),

            },

        }

    }

    /// Where the provider sends the person back.

    pub fn callback_url(&self, app: &Shared) -> String {

        format!("{}/login/{}/callback", app.config.base_url(), self.id)

    }

}

/// What an administrator set for a provider.

#[derive(Clone, Debug, Default)]

pub struct Settings {

    pub client_id: String,

    /// The client secret, opened; empty when none is set.

    pub secret: String,

    pub enabled: bool,

}

impl Settings {

    pub fn usable(&self) -> bool {

        self.enabled && !self.client_id.is_empty() && !self.secret.is_empty()

    }

}

fn key(id: &str, what: &str) -> String {

    format!("signin.{id}.{what}")

}

pub async fn settings(app: &Shared, id: &str) -> sqlx::Result<Settings> {

    let client_id = accounts::setting(&app.db, &key(id, "client_id")).await?.unwrap_or_default();

    let sealed = accounts::setting(&app.db, &key(id, "secret")).await?.unwrap_or_default();

    let secret = hex::decode(&sealed).ok().and_then(|b| app.secret_key.open(&b)).unwrap_or_default();

    let enabled = accounts::setting(&app.db, &key(id, "enabled")).await?.as_deref() == Some("1");

    Ok(Settings { client_id, secret, enabled })

}

/// Save a provider's settings; `secret` is `None` to keep the stored one.

pub async fn save(app: &Shared, id: &str, client_id: &str, secret: Option<&str>, enabled: bool) -> sqlx::Result<()> {

    accounts::set_setting(&app.db, &key(id, "client_id"), client_id.trim()).await?;

    if let Some(s) = secret {

        accounts::set_setting(&app.db, &key(id, "secret"), &hex::encode(app.secret_key.seal(s.trim()))).await?;

    }

    accounts::set_setting(&app.db, &key(id, "enabled"), if enabled { "1" } else { "0" }).await?;

    Ok(())

}

/// The providers people may sign in with: usable ones, in order.

pub async fn enabled(app: &Shared) -> Vec<&'static Provider> {

    let mut out = vec![];

    for p in &PROVIDERS {

        if settings(app, p.id).await.map(|s| s.usable()).unwrap_or(false) {

            out.push(p);

        }

    }

    out

}

// ------------------------------------------------------------- the flow

/// The state cookie's name: a nonce, what the sign-in is for, and a MAC.

pub const STATE_COOKIE: &str = "oxyhub_signin";

/// A state value: `NONCE.MODE.MAC`, where MODE is `in` (sign in) or

/// `link:ACCOUNT_ID` (connect to a signed-in account).

pub fn state_value(app: &Shared, mode: &str) -> String {

    let nonce = crate::auth::random_hex(16);

    let mac = app.cookie_key.mac(format!("signin:{nonce}:{mode}").as_bytes());

    format!("{nonce}.{mode}.{mac}")

}

/// The mode a state value carries, when its MAC holds.

pub fn state_mode(app: &Shared, value: &str) -> Option<String> {

    let (nonce, rest) = value.split_once('.')?;

    let (mode, mac) = rest.rsplit_once('.')?;

    let want = app.cookie_key.mac(format!("signin:{nonce}:{mode}").as_bytes());

    crate::auth::mac_equal(&want, mac).then(|| mode.to_string())

}

/// Where to send the person to sign in with `p`.

pub fn authorize_url(app: &Shared, p: &Provider, client_id: &str, state: &str) -> String {

    let q = |s: &str| crate::web::settings::urlencode(s);

    format!(

        "{}?client_id={}&redirect_uri={}&scope={}&state={}&response_type=code{}",

        p.url(app, "authorize"),

        q(client_id),

        q(&p.callback_url(app)),

        q(p.scope),

        q(state),

        if p.id == "google" { "&access_type=online&prompt=select_account" } else { "" }

    )

}

/// Who the provider says the person is.

#[derive(Clone, Debug)]

pub struct External {

    pub provider: &'static str,

    pub subject: String,

    pub login: String,

    pub name: String,

    /// A verified email, when the provider vouches for one.

    pub email: Option<String>,

}

/// Swap the code for a token and ask who it belongs to.

pub async fn identify(app: &Shared, p: &'static Provider, s: &Settings, code: &str) -> Result<External, String> {

    let client = reqwest::Client::builder()

        .timeout(std::time::Duration::from_secs(20))

        .user_agent(format!("oxygenhub/{}", env!("CARGO_PKG_VERSION")))

        .build()

        .map_err(|e| e.to_string())?;

    let token: serde_json::Value = client

        .post(p.url(app, "token"))

        .header("accept", "application/json")

        .form(&[

            ("client_id", s.client_id.as_str()),

            ("client_secret", s.secret.as_str()),

            ("code", code),

            ("redirect_uri", &p.callback_url(app)),

            ("grant_type", "authorization_code"),

        ])

        .send()

        .await

        .map_err(|e| format!("{} did not answer: {e}", p.name))?

        .json()

        .await

        .map_err(|_| format!("{} answered with something other than a token", p.name))?;

    let Some(access) = token["access_token"].as_str() else {

        let why = token["error_description"].as_str().or(token["error"].as_str()).unwrap_or("no token");

        return Err(format!("{} refused the sign-in: {why}", p.name));

    };

    let get = |url: String| {

        let client = client.clone();

        let access = access.to_string();

        async move {

            client

                .get(url)

                .bearer_auth(access)

                .header("accept", "application/json")

                .send()

                .await

                .map_err(|e| format!("{} did not answer: {e}", p.name))?

                .json::<serde_json::Value>()

                .await

                .map_err(|_| format!("{} answered with something unexpected", p.name))

        }

    };

    let user = get(p.url(app, "userinfo")).await?;

    Ok(match p.id {

        "github" => {

            let subject =

                user["id"].as_i64().map(|i| i.to_string()).or_else(|| user["id"].as_str().map(String::from)).ok_or("GitHub gave no id")?;

            // The primary verified address is on its own endpoint.

            let emails = get(format!("{}/emails", p.url(app, "userinfo"))).await.unwrap_or_default();

            let email = emails

                .as_array()

                .and_then(|list| {

                    list.iter()

                        .filter(|e| e["verified"] == true)

                        .max_by_key(|e| e["primary"] == true)

                        .and_then(|e| e["email"].as_str().map(String::from))

                })

                .or_else(|| user["email"].as_str().map(String::from).filter(|_| false));

            External {

                provider: p.id,

                subject,

                login: user["login"].as_str().unwrap_or("").to_string(),

                name: user["name"].as_str().unwrap_or("").to_string(),

                email,

            }

        }

        _ => {

            let subject = user["sub"].as_str().ok_or("Google gave no subject")?.to_string();

            let email = user["email"].as_str().filter(|_| user["email_verified"] == true).map(String::from);

            let login = email.as_deref().and_then(|e| e.split('@').next()).unwrap_or("").to_string();

            External { provider: p.id, subject, login, name: user["name"].as_str().unwrap_or("").to_string(), email }

        }

    })

}

// --------------------------------------------------------------- links

#[derive(Clone, Debug, FromRow)]

pub struct Login {

    pub provider: String,

    pub subject: String,

    pub account_id: i64,

    pub login: String,

    pub linked_ms: i64,

}

pub async fn linked_account(pool: &Pool, provider: &str, subject: &str) -> sqlx::Result<Option<accounts::Account>> {

    let id: Option<i64> = sqlx::query_scalar("SELECT account_id FROM account_logins WHERE provider = ? AND subject = ?")

        .bind(provider)

        .bind(subject)

        .fetch_optional(pool)

        .await?;

    match id {

        Some(id) => accounts::account_by_id(pool, id).await,

        None => Ok(None),

    }

}

pub async fn link(pool: &Pool, provider: &str, subject: &str, account_id: i64, login: &str) -> sqlx::Result<()> {

    sqlx::query("INSERT OR REPLACE INTO account_logins (provider, subject, account_id, login, linked_ms) VALUES (?, ?, ?, ?, ?)")

        .bind(provider)

        .bind(subject)

        .bind(account_id)

        .bind(login)

        .bind(now_ms())

        .execute(pool)

        .await?;

    Ok(())

}

pub async fn unlink(pool: &Pool, provider: &str, account_id: i64) -> sqlx::Result<bool> {

    let r = sqlx::query("DELETE FROM account_logins WHERE provider = ? AND account_id = ?")

        .bind(provider)

        .bind(account_id)

        .execute(pool)

        .await?;

    Ok(r.rows_affected() > 0)

}

pub async fn links_of(pool: &Pool, account_id: i64) -> sqlx::Result<Vec<Login>> {

    sqlx::query_as("SELECT * FROM account_logins WHERE account_id = ? ORDER BY provider").bind(account_id).fetch_all(pool).await

}

/// A username for a new account from what the provider calls them:

/// valid, and free.

pub async fn free_username(pool: &Pool, wanted: &str, provider: &str) -> sqlx::Result<String> {

    let base: String = wanted.chars().filter(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '_')).take(40).collect();

    let base = base.trim_matches(|c: char| !c.is_ascii_alphanumeric()).to_string();

    let base = if base.is_empty() { provider.to_string() } else { base };

    let mut candidates = vec![base.clone(), format!("{base}-{provider}")];

    candidates.extend((2..100).map(|n| format!("{base}-{n}")));

    for c in candidates {

        if !crate::repos::names::valid_owner(&c) {

            continue;

        }

        let taken = accounts::account_by_name(pool, &c).await?.is_some()

            || accounts::org_by_name(pool, &c).await?.is_some()

            || accounts::username_retired(pool, &c).await?;

        if !taken {

            return Ok(c);

        }

    }

    Ok(format!("{provider}-{}", crate::auth::random_hex(4)))

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn providers_are_known() {

        assert_eq!(provider("github").map(|p| p.name), Some("GitHub"));

        assert_eq!(provider("google").map(|p| p.name), Some("Google"));

        assert!(provider("gitlab").is_none());

    }

}

//! Sign in with GitHub or Google on the web (hub spec §5.1.2, #106):

//! the start of the flow, the callback, the administrator's provider

//! settings, and connecting or disconnecting a provider from Settings ›

//! Security.

use super::session::signed_in;

use super::settings::{csrf, require};

use super::{Error, Shell};

use crate::auth::{self, Viewer};

use crate::db::accounts;

use crate::signin::{self, External, Provider, STATE_COOKIE};

use crate::Shared;

use axum::extract::{Path, Query, State};

use axum::http::{header, HeaderMap};

use axum::response::{IntoResponse, Redirect, Response};

use axum::Form;

use serde::Deserialize;

fn state_cookie(app: &Shared, value: &str, max_age: u32) -> String {

    let secure = if app.config.base_url().starts_with("https://") { "; Secure" } else { "" };

    format!("{STATE_COOKIE}={value}; Path=/login; HttpOnly; SameSite=Lax; Max-Age={max_age}{secure}")

}

fn cookie_value(headers: &HeaderMap) -> Option<String> {

    headers

        .get_all(header::COOKIE)

        .iter()

        .filter_map(|v| v.to_str().ok())

        .flat_map(|v| v.split(';'))

        .filter_map(|c| c.trim().strip_prefix(&format!("{STATE_COOKIE}=")))

        .map(String::from)

        .next()

}

/// Begin: a state cookie, then off to the provider.

async fn begin(app: &Shared, p: &'static Provider, mode: &str) -> Result<Response, String> {

    let s = signin::settings(app, p.id).await.map_err(|e| e.to_string())?;

    if !s.usable() {

        return Err(format!("Signing in with {} is not set up on this hub.", p.name));

    }

    let state = signin::state_value(app, mode);

    let to = signin::authorize_url(app, p, &s.client_id, &state);

    Ok(([(header::SET_COOKIE, state_cookie(app, &state, 600))], Redirect::to(&to)).into_response())

}

/// `GET /login/{provider}`: sign in with the provider.

pub async fn start(State(app): State<Shared>, viewer: Viewer, Path(id): Path<String>) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/login", &viewer);

    let p = signin::provider(&id).ok_or_else(|| Error::not_found(shell.clone()))?;

    if viewer.signed_in() {

        return Ok(Redirect::to("/").into_response());

    }

    begin(&app, p, "in").await.map_err(|m| Error::bad(shell.clone(), m))

}

/// `GET /settings/security/connect/{provider}`: link the provider to the

/// signed-in account.

pub async fn connect(State(app): State<Shared>, viewer: Viewer, Path(id): Path<String>) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/settings/security", &viewer);

    let me = require(&viewer, &shell)?;

    let p = signin::provider(&id).ok_or_else(|| Error::not_found(shell.clone()))?;

    begin(&app, p, &format!("link:{}", me.account.id)).await.map_err(|m| Error::bad(shell.clone(), m))

}

#[derive(Deserialize)]

pub struct Callback {

    #[serde(default)]

    code: String,

    #[serde(default)]

    state: String,

    #[serde(default)]

    error: String,

    #[serde(default)]

    error_description: String,

}

fn to_login(msg: &str) -> Response {

    Redirect::to(&format!("/login?error={}", super::settings::urlencode(msg))).into_response()

}

fn to_security(msg: &str, ok: bool) -> Response {

    let k = if ok { "notice" } else { "error" };

    Redirect::to(&format!("/settings/security?{k}={}", super::settings::urlencode(msg))).into_response()

}

/// `GET /login/{provider}/callback`: the provider sent the person back.

pub async fn callback(

    State(app): State<Shared>,

    viewer: Viewer,

    Path(id): Path<String>,

    headers: HeaderMap,

    Query(q): Query<Callback>,

) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/login", &viewer);

    let p = signin::provider(&id).ok_or_else(|| Error::not_found(shell.clone()))?;

    // The state cookie goes, whatever else the answer sets (appended, so a

    // session cookie beside it is kept).

    let clear = state_cookie(&app, "", 0);

    let with_clear = |mut r: Response| {

        if let Ok(v) = header::HeaderValue::from_str(&clear) {

            r.headers_mut().append(header::SET_COOKIE, v);

        }

        r

    };

    if !q.error.is_empty() {

        let why = if q.error_description.is_empty() { q.error.clone() } else { q.error_description.clone() };

        return Ok(with_clear(to_login(&format!("{} did not sign you in: {why}", p.name))));

    }

    let Some(cookie) = cookie_value(&headers) else {

        return Ok(with_clear(to_login("The sign-in took too long or the browser kept no cookie; try again.")));

    };

    if cookie != q.state || q.code.is_empty() {

        return Ok(with_clear(to_login("The sign-in did not match the one started here; try again.")));

    }

    let Some(mode) = signin::state_mode(&app, &cookie) else {

        return Ok(with_clear(to_login("The sign-in did not match the one started here; try again.")));

    };

    let s = signin::settings(&app, p.id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    if !s.usable() {

        return Ok(with_clear(to_login(&format!("Signing in with {} is not set up on this hub.", p.name))));

    }

    let who = match signin::identify(&app, p, &s, &q.code).await {

        Ok(w) => w,

        Err(msg) => return Ok(with_clear(to_login(&msg))),

    };

    let e = |e| Error::from_db(shell.clone(), e);

    // Connecting to a signed-in account.

    if let Some(account_id) = mode.strip_prefix("link:").and_then(|i| i.parse::<i64>().ok()) {

        let Some(me) = viewer.account().filter(|a| a.id == account_id) else {

            return Ok(with_clear(to_security("Sign in first, then connect the account.", false)));

        };

        if let Some(other) = signin::linked_account(&app.db, p.id, &who.subject).await.map_err(e)? {

            if other.id != me.id {

                return Ok(with_clear(to_security(&format!("That {} account is connected to {} already.", p.name, other.username), false)));

            }

        }

        signin::link(&app.db, p.id, &who.subject, me.id, &who.login).await.map_err(e)?;

        accounts::audit(&app.db, Some(me), "signin.connected", &me.username, p.id).await.ok();

        return Ok(with_clear(to_security(&format!("{} connected as {}.", p.name, who.login), true)));

    }

    // Signing in: a known link, else the account with that verified email,

    // else a new account when registration is open.

    if let Some(account) = signin::linked_account(&app.db, p.id, &who.subject).await.map_err(e)? {

        if account.blocked() {

            return Ok(with_clear(to_login("This account cannot sign in.")));

        }

        accounts::audit(&app.db, Some(&account), "login", &account.username, p.id).await.ok();

        return Ok(with_clear(signed_in(&app, &account, "/")));

    }

    if let Some(email) = &who.email {

        if let Some(account) = accounts::account_by_verified_email(&app.db, email).await.map_err(e)? {

            if account.blocked() {

                return Ok(with_clear(to_login("This account cannot sign in.")));

            }

            signin::link(&app.db, p.id, &who.subject, account.id, &who.login).await.map_err(e)?;

            accounts::audit(&app.db, Some(&account), "signin.connected", &account.username, &format!("{} by email", p.id)).await.ok();

            accounts::audit(&app.db, Some(&account), "login", &account.username, p.id).await.ok();

            return Ok(with_clear(signed_in(&app, &account, "/")));

        }

    }

    let mode = super::session::registration_mode(&app).await;

    if mode != "open" {

        return Ok(with_clear(to_login(&format!(

            "No account here is connected to that {} account, and registration is {}. Register or sign in first, then connect it under Settings › Security.",

            p.name,

            if mode == "invite" { "by invitation" } else { "closed" }

        ))));

    }

    let account = register(&app, p, &who).await.map_err(e)?;

    Ok(with_clear(signed_in(&app, &account, "/")))

}

/// A new account for someone the provider vouches for: a username from

/// their login there, an unusable password, the email verified when the

/// provider says so.

async fn register(app: &Shared, p: &Provider, who: &External) -> sqlx::Result<accounts::Account> {

    let username = signin::free_username(&app.db, &who.login, p.id).await?;

    let hash = auth::hash_password(&auth::random_hex(24)).unwrap_or_default();

    let first = accounts::account_count(&app.db).await? == 0;

    let account =

        accounts::create_account(&app.db, &username, who.email.as_deref().unwrap_or(""), &hash, &auth::random_hex(16), first).await?;

    if who.email.is_some() {

        accounts::set_email_verified(&app.db, account.id, true).await?;

    }

    if !who.name.is_empty() {

        accounts::set_profile(&app.db, account.id, &who.name, who.email.as_deref().unwrap_or("")).await?;

        if who.email.is_some() {

            accounts::set_email_verified(&app.db, account.id, true).await?;

        }

    }

    signin::link(&app.db, p.id, &who.subject, account.id, &who.login).await?;

    accounts::audit(&app.db, Some(&account), "register", &username, &format!("with {}", p.id)).await.ok();

    accounts::account_by_id(&app.db, account.id).await.map(|a| a.unwrap_or(account))

}

#[derive(Deserialize)]

pub struct DisconnectForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

}

/// `POST /settings/security/disconnect/{provider}`.

pub async fn disconnect(

    State(app): State<Shared>,

    viewer: Viewer,

    Path(id): Path<String>,

    Form(f): Form<DisconnectForm>,

) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/settings/security", &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let p = signin::provider(&id).ok_or_else(|| Error::not_found(shell.clone()))?;

    if signin::unlink(&app.db, p.id, me.account.id).await.map_err(|e| Error::from_db(shell.clone(), e))? {

        accounts::audit(&app.db, Some(&me.account), "signin.disconnected", &me.account.username, p.id).await.ok();

    }

    Ok(to_security(&format!("{} disconnected.", p.name), true))

}

/// A provider as the admin page shows it.

pub struct ProviderView {

    pub id: &'static str,

    pub name: &'static str,

    pub client_id: String,

    pub has_secret: bool,

    pub enabled: bool,

    pub callback: String,

}

pub async fn provider_views(app: &Shared) -> sqlx::Result<Vec<ProviderView>> {

    let mut out = vec![];

    for p in &signin::PROVIDERS {

        let s = signin::settings(app, p.id).await?;

        out.push(ProviderView {

            id: p.id,

            name: p.name,

            client_id: s.client_id,

            has_secret: !s.secret.is_empty(),

            enabled: s.enabled,

            callback: p.callback_url(app),

        });

    }

    Ok(out)

}

#[derive(Deserialize)]

pub struct ProviderForm {

    #[serde(rename = "_csrf")]

    pub csrf_token: String,

    pub provider: String,

    #[serde(default)]

    pub client_id: String,

    #[serde(default)]

    pub secret: String,

    #[serde(default)]

    pub enabled: Option<String>,

}

/// Apply the admin form: `Ok(notice)` or `Err(message)`.

pub async fn apply(app: &Shared, viewer: &Viewer, f: ProviderForm) -> sqlx::Result<Result<String, String>> {

    let Some(p) = signin::provider(&f.provider) else { return Ok(Err("Unknown provider.".into())) };

    let client_id = f.client_id.trim();

    if client_id.len() > 200 || client_id.contains(char::is_whitespace) && !client_id.is_empty() {

        return Ok(Err("A client id is one token.".into()));

    }

    let secret = f.secret.trim();

    let secret = if secret.is_empty() { None } else { Some(secret) };

    let enabled = f.enabled.is_some();

    signin::save(app, p.id, client_id, secret, enabled).await?;

    let s = signin::settings(app, p.id).await?;

    accounts::audit(&app.db, viewer.account(), "admin.signin", p.id, if s.usable() { "on" } else { "off" }).await.ok();

    Ok(Ok(if s.usable() {

        format!("Signing in with {} is on.", p.name)

    } else if enabled {

        format!("{} is saved but off until it has a client id and secret.", p.name)

    } else {

        format!("{} is off.", p.name)

    }))

}

/// A page's view of what people may sign in with.

pub async fn buttons(app: &Shared) -> Vec<(&'static str, &'static str)> {

    signin::enabled(app).await.into_iter().map(|p| (p.id, p.name)).collect()

}

- **Sign in with GitHub or Google (#106).** Set up per provider under Administration (client id, sealed secret, on or off); the login page offers them. A first sign-in links the account with the same verified email, or makes an account when registration is open; connect or disconnect under Settings › Security.

    /// For tests only: a base URL that stands in for every sign-in

    /// provider (`{base}/{provider}/authorize|token|userinfo`).

    pub signin_mock: Option<String>,

pub mod signin;

    /// Sign-in providers (#106).

    providers: Vec<super::signin::ProviderView>,

    let providers = super::signin::provider_views(app).await.map_err(e)?;

        providers,

/// `POST /admin/signin`: a sign-in provider's client id, secret and switch (#106).

pub async fn signin(

    State(app): State<Shared>,

    viewer: Viewer,

    Form(f): Form<super::signin::ProviderForm>,

) -> Result<Page<AdminPage>, Error> {

    let shell = Shell::new(&app, "/admin", &viewer);

    require_admin(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let outcome = super::signin::apply(&app, &viewer, f).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    admin_page(&app, shell, Some(outcome.unwrap_or_else(|e| e))).await

}

mod signin;

        .route("/admin/signin", post(admin::signin))

        .route("/login/{provider}", get(signin::start))

        .route("/login/{provider}/callback", get(signin::callback))

        .route("/settings/security/connect/{provider}", get(signin::connect))

        .route("/settings/security/disconnect/{provider}", post(signin::disconnect))

    /// Providers to sign in with (#106): (id, name).

    providers: Vec<(&'static str, &'static str)>,

    #[serde(default)]

    error: Option<String>,

    let providers = super::signin::buttons(&app).await;

    Page(LoginPage {

        shell: Shell::new(&app, "/login", &viewer),

        error: q.error,

        next: safe_next(q.next),

        totp_for: None,

        reset,

        providers,

    })

    .into_response()

        Page(LoginPage { shell: shell.clone(), error: Some(msg.into()), next: next.clone(), totp_for, reset: false, providers: vec![] })

            .into_response()

use axum::extract::{Form, Multipart, Path, Query, State};

    /// Providers on this hub and the login connected, if any (#106).

    connected: Vec<(&'static str, &'static str, Option<String>)>,

#[derive(Deserialize)]

pub struct SecurityQuery {

    notice: Option<String>,

    error: Option<String>,

}

pub async fn security(State(app): State<Shared>, viewer: Viewer, Query(q): Query<SecurityQuery>) -> Result<Page<SecurityPage>, Error> {

    let connected = connected_of(&app, me.account.id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    Ok(Page(SecurityPage { shell, me: me.account, notice: q.notice, error: q.error, enrol: None, recovery: vec![], connected }))

/// Each sign-in provider this hub offers, with the login connected to the account.

pub async fn connected_of(app: &Shared, account_id: i64) -> sqlx::Result<Vec<(&'static str, &'static str, Option<String>)>> {

    let links = crate::signin::links_of(&app.db, account_id).await?;

    let mut out = vec![];

    for p in crate::signin::enabled(app).await {

        out.push((p.id, p.name, links.iter().find(|l| l.provider == p.id).map(|l| l.login.clone())));

    }

    Ok(out)

}

    Ok(Page(SecurityPage {

        shell,

        me: me.account,

        notice: None,

        error: None,

        enrol: Some((secret, uri, qr)),

        recovery: vec![],

        connected: vec![],

    }))

            connected: vec![],

        connected: vec![],

            connected: vec![],

        connected: vec![],

    /// The session cookie's value, when the response set one.

    /// Every Set-Cookie header, whole.

    raw_cookies: Vec<String>,

    let header_value = cookie.map(|c| format!("oxyhub={c}"));

    send_with(app, method, path, header_value.as_deref(), form).await

}

/// As `send`, with the whole Cookie header given.

async fn send_with(app: &Shared, method: &str, path: &str, cookie_header: Option<&str>, form: Option<&str>) -> Res {

    if let Some(c) = cookie_header {

        req = req.header(header::COOKIE, c.to_string());

    let raw_cookies: Vec<String> =

        res.headers().get_all(header::SET_COOKIE).iter().filter_map(|v| v.to_str().ok()).map(String::from).collect();

    let cookie =

        raw_cookies.iter().filter_map(|c| c.split(';').next()).filter_map(|kv| kv.strip_prefix("oxyhub=")).map(String::from).next();

    Res { status, body: String::from_utf8_lossy(&bytes).into_owned(), cookie, location, raw_cookies }

    Res { status, body: String::from_utf8_lossy(&bytes).into_owned(), cookie: None, location: None, raw_cookies: vec![] }

}

/// A stand-in GitHub and Google: token exchanges and who the token is.

async fn mock_provider() -> (String, std::sync::Arc<std::sync::Mutex<Vec<String>>>) {

    use std::sync::{Arc, Mutex};

    let seen: Arc<Mutex<Vec<String>>> = Arc::new(Mutex::new(vec![]));

    let s1 = seen.clone();

    let s2 = seen.clone();

    let router = axum::Router::new()

        .route(

            "/github/token",

            axum::routing::post(move |body: String| {

                let s1 = s1.clone();

                async move {

                    s1.lock().unwrap().push(format!("github token {body}"));

                    axum::Json(serde_json::json!({ "access_token": "gh-token", "token_type": "bearer" }))

                }

            }),

        )

        .route(

            "/github/userinfo",

            axum::routing::get(|headers: axum::http::HeaderMap| async move {

                assert_eq!(headers.get("authorization").and_then(|v| v.to_str().ok()), Some("Bearer gh-token"));

                axum::Json(serde_json::json!({ "id": 583231, "login": "octocat", "name": "The Octocat", "email": null }))

            }),

        )

        .route(

            "/github/userinfo/emails",

            axum::routing::get(|| async {

                axum::Json(serde_json::json!([

                    { "email": "[email protected]", "primary": false, "verified": false },

                    { "email": "[email protected]", "primary": true, "verified": true }

                ]))

            }),

        )

        .route(

            "/google/token",

            axum::routing::post(move |body: String| {

                let s2 = s2.clone();

                async move {

                    s2.lock().unwrap().push(format!("google token {body}"));

                    axum::Json(serde_json::json!({ "access_token": "g-token", "id_token": "x" }))

                }

            }),

        )

        .route(

            "/google/userinfo",

            axum::routing::get(|| async {

                axum::Json(serde_json::json!({ "sub": "1076915035000615071", "email": "[email protected]", "email_verified": true, "name": "Andy McCall" }))

            }),

        );

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    let port = listener.local_addr().unwrap().port();

    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });

    (format!("http://127.0.0.1:{port}"), seen)

}

fn state_of(res: &Res) -> (String, String) {

    let cookie = res.raw_cookies.iter().find(|c| c.starts_with("oxyhub_signin=")).expect("state cookie").clone();

    let value = cookie.trim_start_matches("oxyhub_signin=").split(';').next().unwrap().to_string();

    (cookie, value)

}

#[tokio::test(flavor = "multi_thread")]

async fn people_sign_in_with_github_or_google_once_an_admin_sets_it_up() {

    hermetic();

    let (mock, seen) = mock_provider().await;

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    let port = listener.local_addr().unwrap().port();

    config.server.base_url = format!("http://127.0.0.1:{port}");

    config.registration.mode = "open".into();

    config.auth.signin_mock = Some(mock.clone());

    let app = oxygenhub::build(config).await.unwrap();

    let router = oxygenhub::router(app.clone());

    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });

    let app = &app;

    let andy = register(app, "andy", "").await;

    let andy_row = db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap();

    db::accounts::set_email_verified(&app.db, andy_row.id, true).await.unwrap();

    // Nothing to sign in with until an administrator sets a provider up.

    assert!(!get(app, "/login", None).await.body.contains("/login/github"));

    let admin = get(app, "/admin", Some(&andy)).await.body;

    assert!(admin.contains("Sign in with") && admin.contains(&format!("http://127.0.0.1:{port}/login/github/callback")), "{admin}");

    let csrf = csrf_of(&admin);

    let r =

        post(app, "/admin/signin", Some(&andy), &format!("_csrf={csrf}&provider=github&client_id=gh-cid&secret=gh-sek&enabled=1")).await;

    assert!(r.body.contains("Signing in with GitHub is on.") && !r.body.contains("gh-sek"), "{}", r.body);

    let r = post(app, "/admin/signin", Some(&andy), &format!("_csrf={csrf}&provider=google&client_id=g-cid&secret=g-sek&enabled=1")).await;

    assert!(r.body.contains("Signing in with Google is on."), "{}", r.body);

    let login = get(app, "/login", None).await.body;

    assert!(login.contains("href=\"/login/github\"") && login.contains("href=\"/login/google\""), "{login}");

    // GitHub: off to the provider with a state, back with a code: a new account.

    let r = get(app, "/login/github", None).await;

    assert_eq!(r.status, StatusCode::SEE_OTHER);

    let to = r.location.clone().unwrap();

    assert!(to.starts_with(&format!("{mock}/github/authorize?client_id=gh-cid&redirect_uri=")) && to.contains("&state="), "{to}");

    let (cookie, state) = state_of(&r);

    let bad = send_with(app, "GET", "/login/github/callback?code=c1&state=wrong", Some(&cookie), None).await;

    assert!(bad.location.as_deref().unwrap_or("").starts_with("/login?error="), "{:?}", bad.location);

    let ok = send_with(app, "GET", &format!("/login/github/callback?code=c1&state={state}"), Some(&cookie), None).await;

    assert_eq!(ok.status, StatusCode::SEE_OTHER, "{}", ok.body);

    assert_eq!(ok.location.as_deref(), Some("/"));

    let octo_cookie = ok.cookie.clone().expect("signed in");

    let octo = db::accounts::account_by_name(&app.db, "octocat").await.unwrap().expect("account made from the GitHub login");

    assert!(

        (octo.email.as_str(), octo.email_verified, octo.display_name.as_str()) == ("[email protected]", true, "The Octocat"),

        "{octo:?}"

    );

    assert!(seen.lock().unwrap().iter().any(|s| s.contains("github token") && s.contains("code=c1") && s.contains("client_secret=gh-sek")));

    assert!(get(app, "/settings", Some(&octo_cookie)).await.body.contains("octocat"));

    // Again: the same account, no new one.

    let r = get(app, "/login/github", None).await;

    let (cookie, state) = state_of(&r);

    let ok = send_with(app, "GET", &format!("/login/github/callback?code=c2&state={state}"), Some(&cookie), None).await;

    assert_eq!(ok.location.as_deref(), Some("/"));

    assert_eq!(db::accounts::account_count(&app.db).await.unwrap(), 2);

    // Google, for an address Andy has verified: linked to Andy, signed in as Andy.

    let r = get(app, "/login/google", None).await;

    assert!(r.location.clone().unwrap().contains("prompt=select_account"));

    let (cookie, state) = state_of(&r);

    let ok = send_with(app, "GET", &format!("/login/google/callback?code=c3&state={state}"), Some(&cookie), None).await;

    assert_eq!(ok.location.as_deref(), Some("/"), "{}", ok.body);

    let as_andy = ok.cookie.clone().unwrap();

    let sec = get(app, "/settings/security", Some(&as_andy)).await.body;

    assert!(

        sec.contains("Connected accounts")

            && sec.contains("Google: <strong>andy</strong>")

            && sec.contains("GitHub: <a href=\"/settings/security/connect/github\">connect</a>"),

        "{sec}"

    );

    assert_eq!(db::accounts::account_count(&app.db).await.unwrap(), 2, "no third account");

    // Disconnect, then connect again from Settings › Security.

    let csrf_s = csrf_of(&sec);

    let r = post(app, "/settings/security/disconnect/google", Some(&as_andy), &format!("_csrf={csrf_s}")).await;

    assert!(r.location.as_deref().unwrap_or("").contains("notice=Google%20disconnected"), "{:?}", r.location);

    assert!(!get(app, "/settings/security", Some(&as_andy)).await.body.contains("Google: <strong>andy</strong>"));

    let r = get(app, "/settings/security/connect/google", Some(&as_andy)).await;

    assert_eq!(r.status, StatusCode::SEE_OTHER);

    let (cookie, state) = state_of(&r);

    let both = format!("{cookie}; oxyhub={as_andy}");

    let ok = send_with(app, "GET", &format!("/login/google/callback?code=c4&state={state}"), Some(&both), None).await;

    assert!(ok.location.as_deref().unwrap_or("").contains("notice=Google%20connected%20as%20andy"), "{:?} {}", ok.location, ok.body);

    // With registration closed, an unknown GitHub account is turned away.

    db::accounts::set_setting(&app.db, "registration_mode", "closed").await.unwrap();

    sqlx::query("DELETE FROM account_logins WHERE provider = 'github'").execute(&app.db).await.unwrap();

    sqlx::query("UPDATE accounts SET email_verified = 0 WHERE username = 'octocat'").execute(&app.db).await.unwrap();

    let r = get(app, "/login/github", None).await;

    let (cookie, state) = state_of(&r);

    let no = send_with(app, "GET", &format!("/login/github/callback?code=c5&state={state}"), Some(&cookie), None).await;

    assert!(no.location.as_deref().unwrap_or("").contains("registration%20is%20closed"), "{:?}", no.location);

    assert!(no.cookie.is_none());

#### 5.1.2 Sign in with GitHub or Google (done 2026-10-04)

An administrator sets up each provider under Administration › Sign in with: the OAuth client id, the client secret (sealed under `keys/secrets.key`, never shown again) and a switch; the page shows the callback URL to register with the provider (`/login/{provider}/callback`). The login page then offers the usable providers (oxygenhub#106). The flow is OAuth 2.0's authorization code: `/login/{provider}` sets a state cookie (a nonce and the purpose, MACed with the cookie key, ten minutes, path `/login`) and sends the person to the provider; the callback checks the state against the cookie, swaps the code for a token server to server, and asks who it is (GitHub: `/user` and the primary verified address from `/user/emails`; Google: the OpenID `userinfo`, the address only when `email_verified`). Then: a subject already linked signs in; else an account with that verified email is linked and signed in; else, when registration is open, an account is made from the provider's login name (made valid and free), with an unusable password and the email verified when the provider vouched for it; otherwise the person is told to register or sign in and connect. A signed-in person connects or disconnects a provider under Settings › Security; a subject can be linked to one account. Links live in `account_logins`. Audited as `admin.signin`, `signin.connected`, `signin.disconnected`, `login` and `register` with the provider. For tests, `[auth] signin_mock` names a base URL that stands in for every provider.

  <h3>Sign in with</h3>

  {% for p in providers %}

  <form class="card" method="post" action="/admin/signin">

    <input type="hidden" name="_csrf" value="{{ shell.csrf }}"><input type="hidden" name="provider" value="{{ p.id }}">

    <h4>{{ p.name }} {% if p.enabled && p.has_secret && !p.client_id.is_empty() %}<span class="tag head">on</span>{% else %}<span class="tag dim">off</span>{% endif %}</h4>

    <label for="cid-{{ p.id }}">Client id</label><input type="text" id="cid-{{ p.id }}" name="client_id" value="{{ p.client_id }}" autocomplete="off">

    <label for="sec-{{ p.id }}">Client secret</label><input type="password" id="sec-{{ p.id }}" name="secret" placeholder="{% if p.has_secret %}unchanged{% else %}none{% endif %}" autocomplete="new-password">

    <div class="choice"><label><input type="checkbox" name="enabled" value="1"{% if p.enabled %} checked{% endif %}> on</label></div>

    <p class="small mute">Callback URL to register with {{ p.name }}: <code>{{ p.callback }}</code></p>

    <button type="submit">SAVE</button>

  </form>

  {% endfor %}

  <p class="small mute">A first sign-in links the account with the same verified email, or makes an account when registration is open. Secrets are kept sealed.</p>

{% if !providers.is_empty() %}<div class="card signin-with"><p class="small mute">Or sign in with</p>{% for (id, name) in providers %}<a class="go" href="/login/{{ id }}">{{ name }}</a> {% endfor %}</div>{% endif %}

{% if !connected.is_empty() %}<section class="panel" id="connected">

  <h2>Connected accounts</h2>

  <p class="small">Sign in with these instead of a password.</p>

  <ul class="plain">{% for (id, name, login) in connected %}<li>{{ name }}: {% if let Some(l) = login %}<strong>{{ l }}</strong> <form class="tiny inline" method="post" action="/settings/security/disconnect/{{ id }}"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><button class="linkish">disconnect</button></form>{% else %}<a href="/settings/security/connect/{{ id }}">connect</a>{% endif %}</li>{% endfor %}</ul>

</section>{% endif %}