Snapchat OAuth Provider #1998
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,141 @@ | ||
| package api | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "net/http" | ||
| "net/http/httptest" | ||
| "net/url" | ||
|
|
||
| jwt "github.com/golang-jwt/jwt/v5" | ||
| ) | ||
|
|
||
| const ( | ||
| snapchatUser = `{"data":{"me":{"externalId":"snapchatTestId","displayName":"Snapchat Test","bitmoji":{"avatar":"http://example.com/bitmoji"}}}}` | ||
| ) | ||
|
|
||
| func (ts *ExternalTestSuite) TestSignupExternalSnapchat() { | ||
| req := httptest.NewRequest(http.MethodGet, "http://localhost/authorize?provider=snapchat", nil) | ||
| w := httptest.NewRecorder() | ||
| ts.API.handler.ServeHTTP(w, req) | ||
| ts.Require().Equal(http.StatusFound, w.Code) | ||
| u, err := url.Parse(w.Header().Get("Location")) | ||
| ts.Require().NoError(err, "redirect url parse failed") | ||
| q := u.Query() | ||
| ts.Equal(ts.Config.External.Snapchat.RedirectURI, q.Get("redirect_uri")) | ||
| ts.Equal(ts.Config.External.Snapchat.ClientID, []string{q.Get("client_id")}) | ||
| ts.Equal("code", q.Get("response_type")) | ||
| ts.Equal("https://auth.snapchat.com/oauth2/api/user.external_id https://auth.snapchat.com/oauth2/api/user.display_name https://auth.snapchat.com/oauth2/api/user.bitmoji.avatar", q.Get("scope")) | ||
|
|
||
| claims := ExternalProviderClaims{} | ||
| p := jwt.NewParser(jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Name})) | ||
| _, err = p.ParseWithClaims(q.Get("state"), &claims, func(token *jwt.Token) (interface{}, error) { | ||
| return []byte(ts.Config.JWT.Secret), nil | ||
| }) | ||
| ts.Require().NoError(err) | ||
|
|
||
| ts.Equal("snapchat", claims.Provider) | ||
| ts.Equal(ts.Config.SiteURL, claims.SiteURL) | ||
| } | ||
|
|
||
| func SnapchatTestSignupSetup(ts *ExternalTestSuite, tokenCount *int, userCount *int, code string, user string) *httptest.Server { | ||
| server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { | ||
| switch r.URL.Path { | ||
| case "/accounts/oauth2/token": | ||
| *tokenCount++ | ||
| ts.Equal(code, r.FormValue("code")) | ||
| ts.Equal("authorization_code", r.FormValue("grant_type")) | ||
| ts.Equal(ts.Config.External.Snapchat.RedirectURI, r.FormValue("redirect_uri")) | ||
|
|
||
| w.Header().Add("Content-Type", "application/json") | ||
| fmt.Fprint(w, `{"access_token":"snapchat_token","expires_in":3600}`) | ||
| case "/v1/me": | ||
| *userCount++ | ||
| w.Header().Add("Content-Type", "application/json") | ||
| fmt.Fprint(w, user) | ||
| default: | ||
| w.WriteHeader(500) | ||
| ts.Fail("unknown snapchat oauth call %s", r.URL.Path) | ||
| } | ||
| })) | ||
|
|
||
| ts.Config.External.Snapchat.URL = server.URL | ||
|
|
||
| return server | ||
| } | ||
|
|
||
| func (ts *ExternalTestSuite) TestSignupExternalSnapchat_AuthorizationCode() { | ||
| ts.Config.DisableSignup = false | ||
| tokenCount, userCount := 0, 0 | ||
| code := "authcode" | ||
| server := SnapchatTestSignupSetup(ts, &tokenCount, &userCount, code, snapchatUser) | ||
| defer server.Close() | ||
|
|
||
| u := performAuthorization(ts, "snapchat", code, "") | ||
|
|
||
| assertAuthorizationSuccess(ts, u, tokenCount, userCount, "[email protected]", "Snapchat Test", "snapchatTestId", "http://example.com/bitmoji") | ||
| } | ||
|
|
||
| func (ts *ExternalTestSuite) TestSignupExternalSnapchatDisableSignupErrorWhenNoUser() { | ||
| ts.Config.DisableSignup = true | ||
|
|
||
| tokenCount, userCount := 0, 0 | ||
| code := "authcode" | ||
| server := SnapchatTestSignupSetup(ts, &tokenCount, &userCount, code, snapchatUser) | ||
| defer server.Close() | ||
|
|
||
| u := performAuthorization(ts, "snapchat", code, "") | ||
|
|
||
| assertAuthorizationFailure(ts, u, "Signups not allowed for this instance", "access_denied", "") | ||
| } | ||
|
|
||
| func (ts *ExternalTestSuite) TestSignupExternalSnapchatDisableSignupSuccessWithExistingUser() { | ||
| ts.Config.DisableSignup = true | ||
|
|
||
| ts.createUser("snapchatTestId", "[email protected]", "Snapchat Test", "http://example.com/bitmoji", "") | ||
|
|
||
| tokenCount, userCount := 0, 0 | ||
| code := "authcode" | ||
| server := SnapchatTestSignupSetup(ts, &tokenCount, &userCount, code, snapchatUser) | ||
| defer server.Close() | ||
|
|
||
| u := performAuthorization(ts, "snapchat", code, "") | ||
|
|
||
| assertAuthorizationSuccess(ts, u, tokenCount, userCount, "[email protected]", "Snapchat Test", "snapchatTestId", "http://example.com/bitmoji") | ||
| } | ||
|
|
||
| func (ts *ExternalTestSuite) TestInviteTokenExternalSnapchatSuccessWhenMatchingToken() { | ||
| // name and avatar should be populated from Snapchat API | ||
| // Use the same email that the provider will generate - converted to lowercase | ||
| ts.createUser("snapchatTestId", "[email protected]", "", "", "invite_token") | ||
|
|
||
| tokenCount, userCount := 0, 0 | ||
| code := "authcode" | ||
| server := SnapchatTestSignupSetup(ts, &tokenCount, &userCount, code, snapchatUser) | ||
| defer server.Close() | ||
|
|
||
| u := performAuthorization(ts, "snapchat", code, "invite_token") | ||
|
|
||
| assertAuthorizationSuccess(ts, u, tokenCount, userCount, "[email protected]", "Snapchat Test", "snapchatTestId", "http://example.com/bitmoji") | ||
| } | ||
|
|
||
| func (ts *ExternalTestSuite) TestInviteTokenExternalSnapchatErrorWhenNoMatchingToken() { | ||
| tokenCount, userCount := 0, 0 | ||
| code := "authcode" | ||
| server := SnapchatTestSignupSetup(ts, &tokenCount, &userCount, code, snapchatUser) | ||
| defer server.Close() | ||
|
|
||
| w := performAuthorizationRequest(ts, "snapchat", "invite_token") | ||
| ts.Require().Equal(http.StatusNotFound, w.Code) | ||
| } | ||
|
|
||
| func (ts *ExternalTestSuite) TestInviteTokenExternalSnapchatErrorWhenWrongToken() { | ||
| ts.createUser("snapchatTestId", "", "", "", "invite_token") | ||
|
|
||
| tokenCount, userCount := 0, 0 | ||
| code := "authcode" | ||
| server := SnapchatTestSignupSetup(ts, &tokenCount, &userCount, code, snapchatUser) | ||
| defer server.Close() | ||
|
|
||
| w := performAuthorizationRequest(ts, "snapchat", "wrong_token") | ||
| ts.Require().Equal(http.StatusNotFound, w.Code) | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,117 @@ | ||
| package provider | ||
|
|
||
| import ( | ||
| "context" | ||
| "net/url" | ||
| "strings" | ||
|
|
||
| "github.com/supabase/auth/internal/conf" | ||
| "golang.org/x/oauth2" | ||
| ) | ||
|
|
||
| const IssuerSnapchat = "https://accounts.snapchat.com" | ||
|
|
||
| const ( | ||
| defaultSnapchatAuthBase = "accounts.snapchat.com" | ||
| defaultSnapchatTokenBase = "accounts.snapchat.com" | ||
| defaultSnapchatAPIBase = "kit.snapchat.com" | ||
| ) | ||
|
|
||
| type snapchatProvider struct { | ||
| *oauth2.Config | ||
| ProfileURL string | ||
| } | ||
|
|
||
| type snapchatUser struct { | ||
| Data struct { | ||
| Me struct { | ||
| ExternalID string `json:"externalId"` | ||
| DisplayName string `json:"displayName"` | ||
| Bitmoji struct { | ||
| Avatar string `json:"avatar"` | ||
| } `json:"bitmoji"` | ||
| } `json:"me"` | ||
| } `json:"data"` | ||
| } | ||
|
|
||
| // NewSnapchatProvider creates a Snapchat account provider. | ||
| func NewSnapchatProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error) { | ||
| if err := ext.ValidateOAuth(); err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| authHost := chooseHost(ext.URL, defaultSnapchatAuthBase) | ||
| tokenHost := chooseHost(ext.URL, defaultSnapchatTokenBase) | ||
| profileURL := chooseHost(ext.URL, defaultSnapchatAPIBase) + "/v1/me" | ||
|
|
||
| oauthScopes := []string{ | ||
| "https://auth.snapchat.com/oauth2/api/user.external_id", | ||
| "https://auth.snapchat.com/oauth2/api/user.display_name", | ||
| "https://auth.snapchat.com/oauth2/api/user.bitmoji.avatar", | ||
| } | ||
|
|
||
| if scopes != "" { | ||
| oauthScopes = append(oauthScopes, strings.Split(scopes, ",")...) | ||
| } | ||
|
|
||
| return &snapchatProvider{ | ||
| Config: &oauth2.Config{ | ||
| ClientID: ext.ClientID[0], | ||
| ClientSecret: ext.Secret, | ||
| RedirectURL: ext.RedirectURI, | ||
| Endpoint: oauth2.Endpoint{ | ||
| AuthURL: authHost + "/accounts/oauth2/auth", | ||
| TokenURL: tokenHost + "/accounts/oauth2/token", | ||
| }, | ||
| Scopes: oauthScopes, | ||
| }, | ||
| ProfileURL: profileURL, | ||
| }, nil | ||
| } | ||
|
|
||
| func (p snapchatProvider) GetOAuthToken(code string) (*oauth2.Token, error) { | ||
| return p.Exchange(context.Background(), code) | ||
| } | ||
|
|
||
| func (p snapchatProvider) GetUserData(ctx context.Context, tok *oauth2.Token) (*UserProvidedData, error) { | ||
| var u snapchatUser | ||
|
|
||
| // Create a URL with the GraphQL query parameter | ||
| baseURL, err := url.Parse(p.ProfileURL) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| // Add the GraphQL query parameter | ||
| query := url.Values{} | ||
| query.Add("query", "{me { externalId displayName bitmoji { avatar id } } }") | ||
| baseURL.RawQuery = query.Encode() | ||
|
|
||
| if err := makeRequest(ctx, tok, p.Config, baseURL.String(), &u); err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| data := &UserProvidedData{} | ||
|
|
||
| // Snapchat doesn't provide email by default, additional scopes needed | ||
|
There was a problem hiding this comment. email is currently a requirement for the oauth login to succeed - what are the additional scopes required and can we add them to the default set above? There was a problem hiding this comment. Snapchat OAuth mechanism does not expose user emails. The workaround over here right now is to imitate the email format by adding @snapchat.id to the user's external id, which is considered to be unique and identify the user. There was a problem hiding this comment. @ymiedviediev is snapchat.id a domain owned by snapchat? oauth users are allowed to initiate password recovery flows / email change which will result in an email link being sent to that email. this would break those flows if a dummy value is used. There was a problem hiding this comment. Unfortunately the password recovery flow won't work for Snapchat OAuth integration, since email field is considered to be private information and is not part of the OAuth2 flow scopes. |
||
| data.Emails = []Email{{ | ||
| Email: strings.ToLower(u.Data.Me.ExternalID) + "@snapchat.id", // TODO: Create a pseudo-email using the external ID | ||
| Verified: true, | ||
| Primary: true, | ||
| }} | ||
|
|
||
| data.Metadata = &Claims{ | ||
| Issuer: IssuerSnapchat, | ||
| Subject: u.Data.Me.ExternalID, | ||
| Name: u.Data.Me.DisplayName, | ||
| Picture: u.Data.Me.Bitmoji.Avatar, | ||
|
|
||
| // To be deprecated | ||
| Slug: u.Data.Me.DisplayName, | ||
| AvatarURL: u.Data.Me.Bitmoji.Avatar, | ||
| FullName: u.Data.Me.DisplayName, | ||
| ProviderId: u.Data.Me.ExternalID, | ||
| } | ||
|
|
||
| return data, nil | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.