35f36fccba
Only the OAuth2 auth strategy was using the state parameter, which should be used as described in the RFC. The other auth strategies such as GitHub, GitLab or Google were lacking the state parameter. This change adds the required state parameter as well as enabling PKCE support on providers where it's possible. Signed-off-by: Erik Michelson <github@erik.michelson.eu>
50 lines
1.4 KiB
JavaScript
50 lines
1.4 KiB
JavaScript
'use strict'
|
|
|
|
const Router = require('express').Router
|
|
const passport = require('passport')
|
|
const Mattermost = require('mattermost')
|
|
const OAuthStrategy = require('passport-oauth2').Strategy
|
|
const config = require('../../../config')
|
|
const { passportGeneralCallback } = require('../utils')
|
|
|
|
const mattermost = new Mattermost.Client()
|
|
|
|
const mattermostAuth = module.exports = Router()
|
|
|
|
const mattermostStrategy = new OAuthStrategy({
|
|
authorizationURL: config.mattermost.baseURL + '/oauth/authorize',
|
|
tokenURL: config.mattermost.baseURL + '/oauth/access_token',
|
|
clientID: config.mattermost.clientID,
|
|
clientSecret: config.mattermost.clientSecret,
|
|
callbackURL: config.serverURL + '/auth/mattermost/callback',
|
|
state: true
|
|
}, passportGeneralCallback)
|
|
|
|
mattermostStrategy.userProfile = (accessToken, done) => {
|
|
mattermost.setUrl(config.mattermost.baseURL)
|
|
mattermost.token = accessToken
|
|
mattermost.useHeaderToken()
|
|
mattermost.getMe(
|
|
(data) => {
|
|
done(null, data)
|
|
},
|
|
(err) => {
|
|
done(err)
|
|
}
|
|
)
|
|
}
|
|
|
|
passport.use(mattermostStrategy)
|
|
|
|
mattermostAuth.get('/auth/mattermost', function (req, res, next) {
|
|
passport.authenticate('oauth2')(req, res, next)
|
|
})
|
|
|
|
// mattermost auth callback
|
|
mattermostAuth.get('/auth/mattermost/callback',
|
|
passport.authenticate('oauth2', {
|
|
successReturnToOrRedirect: config.serverURL + '/',
|
|
failureRedirect: config.serverURL + '/'
|
|
})
|
|
)
|