From b509555f341cb7de96d57e33b89da7d041b5a721 Mon Sep 17 00:00:00 2001 From: Prathamesh Date: Wed, 23 Oct 2024 17:54:38 +0530 Subject: [PATCH] added sign in with facebook --- backend/config/config.yaml | 2 + backend/config/config_default.go | 4 + backend/config/config_third_party.go | 5 +- .../flow/shared/hook_generate_oauth_links.go | 6 +- backend/handler/thirdparty_auth_test.go | 9 ++ .../handler/thirdparty_callback_error_test.go | 58 ++++++++- backend/handler/thirdparty_callback_test.go | 117 ++++++++++++++++++ backend/handler/thirdparty_test.go | 9 ++ backend/json_schema/hanko.config.json | 4 + backend/thirdparty/provider_facebook.go | 97 +++++++++++++++ .../thirdparty-x-domain/env-patch.yaml | 10 ++ .../thirdparty-x-domain/kustomization.yaml | 3 + 12 files changed, 319 insertions(+), 5 deletions(-) create mode 100644 backend/thirdparty/provider_facebook.go diff --git a/backend/config/config.yaml b/backend/config/config.yaml index 255e24a35..db17b6283 100644 --- a/backend/config/config.yaml +++ b/backend/config/config.yaml @@ -87,6 +87,8 @@ third_party: enabled: false microsoft: enabled: false + facebook: + enabled: false username: enabled: false optional: true diff --git a/backend/config/config_default.go b/backend/config/config_default.go index 2f16652d1..d224b6dd6 100644 --- a/backend/config/config_default.go +++ b/backend/config/config_default.go @@ -129,6 +129,10 @@ func DefaultConfig() *Config { DisplayName: "Discord", AllowLinking: true, }, + Facebook: ThirdPartyProvider{ + DisplayName: "Facebook", + AllowLinking: true, + }, }, }, Passkey: Passkey{ diff --git a/backend/config/config_third_party.go b/backend/config/config_third_party.go index 789825124..857ca101c 100644 --- a/backend/config/config_third_party.go +++ b/backend/config/config_third_party.go @@ -3,11 +3,12 @@ package config import ( "errors" "fmt" + "strings" + "github.com/fatih/structs" "github.com/gobwas/glob" "github.com/invopop/jsonschema" orderedmap "github.com/wk8/go-ordered-map/v2" - "strings" ) type ThirdParty struct { @@ -113,6 +114,8 @@ type ThirdPartyProviders struct { LinkedIn ThirdPartyProvider `yaml:"linkedin" json:"linkedin,omitempty" koanf:"linkedin"` // `microsoft` contains the provider configuration for Microsoft. Microsoft ThirdPartyProvider `yaml:"microsoft" json:"microsoft,omitempty" koanf:"microsoft"` + //`facebook` contains the provider configuration for Facebook. + Facebook ThirdPartyProvider `yaml:"facebook" json:"facebook,omitempty" koanf:"facebook"` } func (p *ThirdPartyProviders) Validate() error { diff --git a/backend/flow_api/flow/shared/hook_generate_oauth_links.go b/backend/flow_api/flow/shared/hook_generate_oauth_links.go index 612c36809..603e887a3 100644 --- a/backend/flow_api/flow/shared/hook_generate_oauth_links.go +++ b/backend/flow_api/flow/shared/hook_generate_oauth_links.go @@ -2,9 +2,10 @@ package shared import ( "fmt" + "net/url" + "github.com/labstack/echo/v4" "github.com/teamhanko/hanko/backend/flowpilot" - "net/url" ) type GenerateOAuthLinks struct { @@ -38,6 +39,9 @@ func (h GenerateOAuthLinks) Execute(c flowpilot.HookExecutionContext) error { if deps.Cfg.ThirdParty.Providers.Apple.Enabled { c.AddLink(OAuthLink("apple", h.generateHref(deps.HttpContext, "apple", returnToUrl))) } + if deps.Cfg.ThirdParty.Providers.Facebook.Enabled { + c.AddLink(OAuthLink("facebook", h.generateHref(deps.HttpContext, "facebook", returnToUrl))) + } return nil } diff --git a/backend/handler/thirdparty_auth_test.go b/backend/handler/thirdparty_auth_test.go index f625847a9..b38e05982 100644 --- a/backend/handler/thirdparty_auth_test.go +++ b/backend/handler/thirdparty_auth_test.go @@ -66,6 +66,15 @@ func (s *thirdPartySuite) TestThirdPartyHandler_Auth() { requestedRedirectTo: "https://app.test.example", expectedBaseURL: thirdparty.MicrosoftOAuthAuthEndpoint, }, + { + name: "successful redirect to facebook", + referer: "https://login.test.example", + enabledProviders: []string{"facebook"}, + allowedRedirectURLs: []string{"https://*.test.example"}, + requestedProvider: "facebook", + requestedRedirectTo: "https://app.test.example", + expectedBaseURL: thirdparty.FacebookOauthAuthEndpoint, + }, { name: "error redirect on missing provider", referer: "https://login.test.example", diff --git a/backend/handler/thirdparty_callback_error_test.go b/backend/handler/thirdparty_callback_error_test.go index cc2af7c84..1ae96e592 100644 --- a/backend/handler/thirdparty_callback_error_test.go +++ b/backend/handler/thirdparty_callback_error_test.go @@ -2,12 +2,13 @@ package handler import ( "fmt" - "github.com/h2non/gock" - "github.com/teamhanko/hanko/backend/thirdparty" - "github.com/teamhanko/hanko/backend/utils" "net/http" "net/http/httptest" "testing" + + "github.com/h2non/gock" + "github.com/teamhanko/hanko/backend/thirdparty" + "github.com/teamhanko/hanko/backend/utils" ) func (s *thirdPartySuite) TestThirdPartyHandler_Callback_Error_LinkingNotAllowedForProvider() { @@ -438,3 +439,54 @@ func (s *thirdPartySuite) TestThirdPartyHandler_Callback_Error_MicrosoftUnverifi s.Len(logs, 1) } } + +func (s *thirdPartySuite) TestThirdPartyHandler_Callback_Error_FacebookUnverifiedEmail() { + if testing.Short() { + s.T().Skip("skipping test in short mode.") + } + + err := s.LoadFixtures("../test/fixtures/thirdparty") + s.NoError(err) + + gock.New(thirdparty.FacebookOauthTokenEndpoint). + Post("/"). + Reply(200). + JSON(map[string]string{"access_token": "fakeAccessToken"}) + + gock.New(thirdparty.FacebookUserInfoEndpoint). + Get("/me"). + Reply(200). + JSON(map[string]interface{}{ + "id": "facebook_abcde", + "email": "test-facebook@example.com", + "verified": false, + }) + + cfg := s.setUpConfig([]string{"facebook"}, []string{"https://example.com"}) + cfg.Email.RequireVerification = true + + state, err := thirdparty.GenerateState(cfg, "facebook", "https://example.com") + s.NoError(err) + + req := httptest.NewRequest(http.MethodGet, fmt.Sprintf("/thirdparty/callback?code=abcde&state=%s", state), nil) + req.AddCookie(&http.Cookie{ + Name: utils.HankoThirdpartyStateCookie, + Value: string(state), + }) + + c, rec := s.setUpContext(req) + handler := s.setUpHandler(cfg) + + if s.NoError(handler.Callback(c)) { + s.Equal(http.StatusTemporaryRedirect, rec.Code) + location, err := rec.Result().Location() + s.NoError(err) + + s.Equal(thirdparty.ErrorCodeUnverifiedProviderEmail, location.Query().Get("error")) + s.Equal("third party provider email must be verified", location.Query().Get("error_description")) + + logs, lerr := s.Storage.GetAuditLogPersister().List(0, 0, nil, nil, []string{"thirdparty_signin_signup_failed"}, "", "", "", "") + s.NoError(lerr) + s.Len(logs, 1) + } +} diff --git a/backend/handler/thirdparty_callback_test.go b/backend/handler/thirdparty_callback_test.go index ca8ce9170..556ca5970 100644 --- a/backend/handler/thirdparty_callback_test.go +++ b/backend/handler/thirdparty_callback_test.go @@ -618,6 +618,123 @@ func (s *thirdPartySuite) TestThirdPartyHandler_Callback_SignIn_Microsoft() { } } +func (s *thirdPartySuite) TestThirdPartyHandler_Callback_SignUp_Facebook() { + defer gock.Off() + if testing.Short() { + s.T().Skip("skipping test in short mode.") + } + + gock.New(thirdparty.FacebookOauthTokenEndpoint). + Post("/"). + Reply(200). + JSON(map[string]string{"access_token": "fakeAccessToken"}) + + gock.New(thirdparty.FacebookUserInfoEndpoint). + Get("/me"). + Reply(200). + JSON(&thirdparty.FacebookUser{ + ID: "facebook_abcde", + Email: "test-facebook-signup@example.com", + }) + + cfg := s.setUpConfig([]string{"facebook"}, []string{"https://example.com"}) + + state, err := thirdparty.GenerateState(cfg, "facebook", "https://example.com") + s.NoError(err) + + req := httptest.NewRequest(http.MethodGet, fmt.Sprintf("/thirdparty/callback?code=abcde&state=%s", state), nil) + req.AddCookie(&http.Cookie{ + Name: utils.HankoThirdpartyStateCookie, + Value: string(state), + }) + + c, rec := s.setUpContext(req) + handler := s.setUpHandler(cfg) + + if s.NoError(handler.Callback(c)) { + s.Equal(http.StatusTemporaryRedirect, rec.Code) + + s.assertLocationHeaderHasToken(rec) + s.assertStateCookieRemoved(rec) + + email, err := s.Storage.GetEmailPersister().FindByAddress("test-facebook-signup@example.com") + s.NoError(err) + s.NotNil(email) + s.True(email.IsPrimary()) + + user, err := s.Storage.GetUserPersister().Get(*email.UserID) + s.NoError(err) + s.NotNil(user) + + identity := email.Identities.GetIdentity("facebook", "facebook_abcde") + s.NotNil(identity) + + logs, lerr := s.Storage.GetAuditLogPersister().List(0, 0, nil, nil, []string{"thirdparty_signup_succeeded"}, user.ID.String(), email.Address, "", "") + s.NoError(lerr) + s.Len(logs, 1) + } +} + +func (s *thirdPartySuite) TestThirdPartyHandler_Callback_SignIn_Facebook() { + defer gock.Off() + if testing.Short() { + s.T().Skip("skipping test in short mode.") + } + + err := s.LoadFixtures("../test/fixtures/thirdparty") + s.NoError(err) + + gock.New(thirdparty.FacebookOauthTokenEndpoint). + Post("/"). + Reply(200). + JSON(map[string]string{"access_token": "fakeAccessToken"}) + + gock.New(thirdparty.FacebookUserInfoEndpoint). + Get("/me"). + Reply(200). + JSON(&thirdparty.FacebookUser{ + ID: "facebook_abcde", + Email: "test-with-facebook-identity@example.com", + }) + + cfg := s.setUpConfig([]string{"facebook"}, []string{"https://example.com"}) + + state, err := thirdparty.GenerateState(cfg, "facebook", "https://example.com") + s.NoError(err) + + req := httptest.NewRequest(http.MethodGet, fmt.Sprintf("/thirdparty/callback?code=abcde&state=%s", state), nil) + req.AddCookie(&http.Cookie{ + Name: utils.HankoThirdpartyStateCookie, + Value: string(state), + }) + + c, rec := s.setUpContext(req) + handler := s.setUpHandler(cfg) + + if s.NoError(handler.Callback(c)) { + s.Equal(http.StatusTemporaryRedirect, rec.Code) + + s.assertLocationHeaderHasToken(rec) + s.assertStateCookieRemoved(rec) + + email, err := s.Storage.GetEmailPersister().FindByAddress("test-with-facebook-identity@example.com") + s.NoError(err) + s.NotNil(email) + s.True(email.IsPrimary()) + + user, err := s.Storage.GetUserPersister().Get(*email.UserID) + s.NoError(err) + s.NotNil(user) + + identity := email.Identities.GetIdentity("facebook", "facebook_abcde") + s.NotNil(identity) + + logs, lerr := s.Storage.GetAuditLogPersister().List(0, 0, nil, nil, []string{"thirdparty_signin_succeeded"}, user.ID.String(), "", "", "") + s.NoError(lerr) + s.Len(logs, 1) + } +} + func (s *thirdPartySuite) TestThirdPartyHandler_Callback_SignUp_WithUnclaimedEmail() { defer gock.Off() if testing.Short() { diff --git a/backend/handler/thirdparty_test.go b/backend/handler/thirdparty_test.go index 9261bc6af..4ddc164b5 100644 --- a/backend/handler/thirdparty_test.go +++ b/backend/handler/thirdparty_test.go @@ -89,6 +89,12 @@ func (s *thirdPartySuite) setUpConfig(enabledProviders []string, allowedRedirect Secret: "fakeClientSecret", AllowLinking: false, }, + Facebook: config.ThirdPartyProvider{ + Enabled: false, + ClientID: "fakeClientID", + Secret: "fakeClientSecret", + AllowLinking: false, + }, }, ErrorRedirectURL: "https://error.test.example", RedirectURL: "https://api.test.example/callback", @@ -112,6 +118,9 @@ func (s *thirdPartySuite) setUpConfig(enabledProviders []string, allowedRedirect cfg.ThirdParty.Providers.Discord.Enabled = true case "microsoft": cfg.ThirdParty.Providers.Microsoft.Enabled = true + case "facebook": + cfg.ThirdParty.Providers.Facebook.Enabled = true + } } } diff --git a/backend/json_schema/hanko.config.json b/backend/json_schema/hanko.config.json index 0a8345932..1949ce3da 100644 --- a/backend/json_schema/hanko.config.json +++ b/backend/json_schema/hanko.config.json @@ -1073,6 +1073,10 @@ "microsoft": { "$ref": "#/$defs/ThirdPartyProvider", "description": "`microsoft` contains the provider configuration for Microsoft." + }, + "facebook": { + "$ref": "#/$defs/ThirdPartyProvider", + "description": "`facebook` contains the provider configuration for Facebook." } }, "additionalProperties": false, diff --git a/backend/thirdparty/provider_facebook.go b/backend/thirdparty/provider_facebook.go new file mode 100644 index 000000000..f530e7534 --- /dev/null +++ b/backend/thirdparty/provider_facebook.go @@ -0,0 +1,97 @@ +package thirdparty + +import ( + "context" + "encoding/json" + "errors" + + "github.com/teamhanko/hanko/backend/config" + "golang.org/x/oauth2" + "golang.org/x/oauth2/facebook" +) + +const ( + FacebookAuthBase = "https://www.facebook.com" + FacebookAPIBase = "https://graph.facebook.com" + FacebookOauthAuthEndpoint = FacebookAuthBase + "/v9.0/dialog/oauth" + FacebookOauthTokenEndpoint = FacebookAPIBase + "/v9.0/oauth/access_token" + FacebookUserInfoEndpoint = FacebookAPIBase + "/me?fields=id,name,email,picture" +) + +var DefaultFacebookScopes = []string{ + "email", "public_profile", +} + +type facebookProvider struct { + *oauth2.Config +} + +type FacebookUser struct { + ID string `json:"id"` + Name string `json:"name"` + Email string `json:"email"` + Picture struct { + Data struct { + URL string `json:"url"` + } `json:"data"` + } `json:"picture"` +} + +// NewFacebookProvider creates a Facebook third-party OAuth provider. +func NewFacebookProvider(config config.ThirdPartyProvider, redirectURL string) (OAuthProvider, error) { + if !config.Enabled { + return nil, errors.New("facebook provider is disabled") + } + + return &facebookProvider{ + Config: &oauth2.Config{ + ClientID: config.ClientID, + ClientSecret: config.Secret, + Endpoint: facebook.Endpoint, + Scopes: DefaultFacebookScopes, + RedirectURL: redirectURL, + }, + }, nil +} + +func (f facebookProvider) GetOAuthToken(code string) (*oauth2.Token, error) { + return f.Exchange(context.Background(), code) +} + +func (f facebookProvider) GetUserData(token *oauth2.Token) (*UserData, error) { + var fbUser FacebookUser + client := f.Client(context.Background(), token) + resp, err := client.Get(FacebookUserInfoEndpoint) + if err != nil { + return nil, err + } + defer resp.Body.Close() + + if err := json.NewDecoder(resp.Body).Decode(&fbUser); err != nil { + return nil, err + } + + data := &UserData{ + Emails: []Email{ + { + Email: fbUser.Email, + Verified: true, // Facebook email is considered verified + Primary: true, + }, + }, + Metadata: &Claims{ + Issuer: FacebookAuthBase, + Subject: fbUser.ID, + Name: fbUser.Name, + Picture: fbUser.Picture.Data.URL, + Email: fbUser.Email, + EmailVerified: true, + }, + } + + return data, nil +} + +func (f facebookProvider) Name() string { + return "facebook" +} diff --git a/deploy/k8s/overlays/thirdparty-x-domain/env-patch.yaml b/deploy/k8s/overlays/thirdparty-x-domain/env-patch.yaml index 08f5ae1e2..bea6da6be 100644 --- a/deploy/k8s/overlays/thirdparty-x-domain/env-patch.yaml +++ b/deploy/k8s/overlays/thirdparty-x-domain/env-patch.yaml @@ -59,6 +59,16 @@ spec: secretKeyRef: key: client_secret name: apple + - name: THIRD_PARTY_PROVIDERS_FACEBOOK_CLIENT_ID + valueFrom: + secretKeyRef: + key: client_id + name: facebook + - name: THIRD_PARTY_PROVIDERS_FACEBOOK_SECRET + valueFrom: + secretKeyRef: + key: client_secret + name: facebook initContainers: - name: hanko-migrate env: diff --git a/deploy/k8s/overlays/thirdparty-x-domain/kustomization.yaml b/deploy/k8s/overlays/thirdparty-x-domain/kustomization.yaml index 781106a71..999d976ab 100644 --- a/deploy/k8s/overlays/thirdparty-x-domain/kustomization.yaml +++ b/deploy/k8s/overlays/thirdparty-x-domain/kustomization.yaml @@ -23,3 +23,6 @@ secretGenerator: - name: apple envs: - apple.env + - name: facebook + envs: + - facebook.env