From e27db2ed63fd3c9c686c049a9b9049a907985ecc Mon Sep 17 00:00:00 2001 From: JoramWilander Date: Thu, 13 Aug 2015 12:03:47 -0400 Subject: [PATCH 1/6] initial server implementation for using google as a single-sign-on oauth service --- api/user.go | 6 ++++ config/config.json | 10 +++++++ model/gitlab.go | 57 ++++++++++++++++++++++++++++++++++++++ model/google.go | 54 ++++++++++++++++++++++++++++++++++++ model/user.go | 68 ++++++++-------------------------------------- utils/config.go | 1 + web/web.go | 9 ++++-- 7 files changed, 146 insertions(+), 59 deletions(-) create mode 100644 model/gitlab.go create mode 100644 model/google.go diff --git a/api/user.go b/api/user.go index a42f81cf14..79f2201da2 100644 --- a/api/user.go +++ b/api/user.go @@ -1314,9 +1314,15 @@ func GetAuthorizationCode(c *Context, w http.ResponseWriter, r *http.Request, te clientId := utils.Cfg.SSOSettings[service].Id endpoint := utils.Cfg.SSOSettings[service].AuthEndpoint + scope := utils.Cfg.SSOSettings[service].Scope state := model.HashPassword(clientId) authUrl := endpoint + "?response_type=code&client_id=" + clientId + "&redirect_uri=" + url.QueryEscape(redirectUri+"?team="+teamName) + "&state=" + url.QueryEscape(state) + + if len(scope) > 0 { + authUrl += "&scope=" + utils.UrlEncode(scope) + } + http.Redirect(w, r, authUrl, http.StatusFound) } diff --git a/config/config.json b/config/config.json index c446b517cb..8405b90769 100644 --- a/config/config.json +++ b/config/config.json @@ -29,9 +29,19 @@ "Allow": false, "Secret" : "", "Id": "", + "Scope": "", "AuthEndpoint": "", "TokenEndpoint": "", "UserApiEndpoint": "" + }, + "google": { + "Allow": true, + "Secret": "hWN1kiPeyihN6nHr36j0oDqx", + "Id": "974585606220-ek5q66olpagb069pkg9ok0d7h8djeov6.apps.googleusercontent.com", + "Scope": "email profile", + "AuthEndpoint": "https://accounts.google.com/o/oauth2/auth", + "TokenEndpoint": "https://www.googleapis.com/oauth2/v3/token", + "UserApiEndpoint": "https://www.googleapis.com/plus/v1/people/me" } }, "SqlSettings": { diff --git a/model/gitlab.go b/model/gitlab.go new file mode 100644 index 0000000000..9adcac1894 --- /dev/null +++ b/model/gitlab.go @@ -0,0 +1,57 @@ +// Copyright (c) 2015 Spinpunch, Inc. All Rights Reserved. +// See License.txt for license information. + +package model + +import ( + "encoding/json" + "io" + "strconv" + "strings" +) + +const ( + USER_AUTH_SERVICE_GITLAB = "gitlab" +) + +type GitLabUser struct { + Id int64 `json:"id"` + Username string `json:"username"` + Email string `json:"email"` + Name string `json:"name"` +} + +func UserFromGitLabUser(glu *GitLabUser) *User { + user := &User{} + user.Username = glu.Username + splitName := strings.Split(glu.Name, " ") + if len(splitName) == 2 { + user.FirstName = splitName[0] + user.LastName = splitName[1] + } else if len(splitName) >= 2 { + user.FirstName = splitName[0] + user.LastName = strings.Join(splitName[1:], " ") + } else { + user.FirstName = glu.Name + } + user.Email = glu.Email + user.AuthData = strconv.FormatInt(glu.Id, 10) + user.AuthService = USER_AUTH_SERVICE_GITLAB + + return user +} + +func GitLabUserFromJson(data io.Reader) *GitLabUser { + decoder := json.NewDecoder(data) + var glu GitLabUser + err := decoder.Decode(&glu) + if err == nil { + return &glu + } else { + return nil + } +} + +func (glu *GitLabUser) GetAuthData() string { + return strconv.FormatInt(glu.Id, 10) +} diff --git a/model/google.go b/model/google.go new file mode 100644 index 0000000000..bdb5007045 --- /dev/null +++ b/model/google.go @@ -0,0 +1,54 @@ +// Copyright (c) 2015 Spinpunch, Inc. All Rights Reserved. +// See License.txt for license information. + +package model + +import ( + "encoding/json" + "io" +) + +const ( + USER_AUTH_SERVICE_GOOGLE = "google" +) + +type GoogleUser struct { + Id string `json:"id"` + Nickname string `json:"nickname"` + Emails []map[string]string `json:"emails"` + Names map[string]string `json:"name"` +} + +func UserFromGoogleUser(gu *GoogleUser) *User { + user := &User{} + user.Username = gu.Nickname + user.FirstName = gu.Names["givenName"] + user.LastName = gu.Names["familyName"] + user.Nickname = gu.Nickname + + for _, e := range gu.Emails { + if e["type"] == "account" { + user.Email = e["value"] + } + } + + user.AuthData = gu.Id + user.AuthService = USER_AUTH_SERVICE_GOOGLE + + return user +} + +func GoogleUserFromJson(data io.Reader) *GoogleUser { + decoder := json.NewDecoder(data) + var gu GoogleUser + err := decoder.Decode(&gu) + if err == nil { + return &gu + } else { + return nil + } +} + +func (gu *GoogleUser) GetAuthData() string { + return gu.Id +} diff --git a/model/user.go b/model/user.go index ed5161538a..ebefa47628 100644 --- a/model/user.go +++ b/model/user.go @@ -8,24 +8,22 @@ import ( "encoding/json" "io" "regexp" - "strconv" "strings" ) const ( - ROLE_ADMIN = "admin" - ROLE_SYSTEM_ADMIN = "system_admin" - ROLE_SYSTEM_SUPPORT = "system_support" - USER_AWAY_TIMEOUT = 5 * 60 * 1000 // 5 minutes - USER_OFFLINE_TIMEOUT = 1 * 60 * 1000 // 1 minute - USER_OFFLINE = "offline" - USER_AWAY = "away" - USER_ONLINE = "online" - USER_NOTIFY_ALL = "all" - USER_NOTIFY_MENTION = "mention" - USER_NOTIFY_NONE = "none" - BOT_USERNAME = "valet" - USER_AUTH_SERVICE_GITLAB = "gitlab" + ROLE_ADMIN = "admin" + ROLE_SYSTEM_ADMIN = "system_admin" + ROLE_SYSTEM_SUPPORT = "system_support" + USER_AWAY_TIMEOUT = 5 * 60 * 1000 // 5 minutes + USER_OFFLINE_TIMEOUT = 1 * 60 * 1000 // 1 minute + USER_OFFLINE = "offline" + USER_AWAY = "away" + USER_ONLINE = "online" + USER_NOTIFY_ALL = "all" + USER_NOTIFY_MENTION = "mention" + USER_NOTIFY_NONE = "none" + BOT_USERNAME = "valet" ) type User struct { @@ -54,13 +52,6 @@ type User struct { FailedAttempts int `json:"failed_attempts"` } -type GitLabUser struct { - Id int64 `json:"id"` - Username string `json:"username"` - Email string `json:"email"` - Name string `json:"name"` -} - // IsValid validates the user and returns an error if it isn't configured // correctly. func (u *User) IsValid() *AppError { @@ -355,38 +346,3 @@ func IsUsernameValid(username string) bool { return true } - -func UserFromGitLabUser(glu *GitLabUser) *User { - user := &User{} - user.Username = glu.Username - splitName := strings.Split(glu.Name, " ") - if len(splitName) == 2 { - user.FirstName = splitName[0] - user.LastName = splitName[1] - } else if len(splitName) >= 2 { - user.FirstName = splitName[0] - user.LastName = strings.Join(splitName[1:], " ") - } else { - user.FirstName = glu.Name - } - user.Email = glu.Email - user.AuthData = strconv.FormatInt(glu.Id, 10) - user.AuthService = USER_AUTH_SERVICE_GITLAB - - return user -} - -func GitLabUserFromJson(data io.Reader) *GitLabUser { - decoder := json.NewDecoder(data) - var glu GitLabUser - err := decoder.Decode(&glu) - if err == nil { - return &glu - } else { - return nil - } -} - -func (glu *GitLabUser) GetAuthData() string { - return strconv.FormatInt(glu.Id, 10) -} diff --git a/utils/config.go b/utils/config.go index 8d9dd11e0f..a3944f6708 100644 --- a/utils/config.go +++ b/utils/config.go @@ -37,6 +37,7 @@ type SSOSetting struct { Allow bool Secret string Id string + Scope string AuthEndpoint string TokenEndpoint string UserApiEndpoint string diff --git a/web/web.go b/web/web.go index 8b329c1496..1acddb914d 100644 --- a/web/web.go +++ b/web/web.go @@ -53,13 +53,13 @@ func InitWeb() { mainrouter.Handle("/{team:[A-Za-z0-9-]+(__)?[A-Za-z0-9-]+}/", api.AppHandler(login)).Methods("GET") mainrouter.Handle("/{team:[A-Za-z0-9-]+(__)?[A-Za-z0-9-]+}/login", api.AppHandler(login)).Methods("GET") - // Bug in gorilla.mux pervents us from using regex here. + // Bug in gorilla.mux prevents us from using regex here. mainrouter.Handle("/{team}/login/{service}", api.AppHandler(loginWithOAuth)).Methods("GET") mainrouter.Handle("/login/{service:[A-Za-z]+}/complete", api.AppHandlerIndependent(loginCompleteOAuth)).Methods("GET") mainrouter.Handle("/{team:[A-Za-z0-9-]+(__)?[A-Za-z0-9-]+}/logout", api.AppHandler(logout)).Methods("GET") mainrouter.Handle("/{team:[A-Za-z0-9-]+(__)?[A-Za-z0-9-]+}/reset_password", api.AppHandler(resetPassword)).Methods("GET") - // Bug in gorilla.mux pervents us from using regex here. + // Bug in gorilla.mux prevents us from using regex here. mainrouter.Handle("/{team}/channels/{channelname}", api.UserRequired(getChannel)).Methods("GET") // Anything added here must have an _ in it so it does not conflict with team names @@ -67,7 +67,7 @@ func InitWeb() { mainrouter.Handle("/signup_user_complete/", api.AppHandlerIndependent(signupUserComplete)).Methods("GET") mainrouter.Handle("/signup_team_confirm/", api.AppHandlerIndependent(signupTeamConfirm)).Methods("GET") - // Bug in gorilla.mux pervents us from using regex here. + // Bug in gorilla.mux prevents us from using regex here. mainrouter.Handle("/{team}/signup/{service}", api.AppHandler(signupWithOAuth)).Methods("GET") mainrouter.Handle("/signup/{service:[A-Za-z]+}/complete", api.AppHandlerIndependent(signupCompleteOAuth)).Methods("GET") @@ -532,6 +532,9 @@ func signupCompleteOAuth(c *api.Context, w http.ResponseWriter, r *http.Request) if service == model.USER_AUTH_SERVICE_GITLAB { glu := model.GitLabUserFromJson(body) user = model.UserFromGitLabUser(glu) + } else if service == model.USER_AUTH_SERVICE_GOOGLE { + gu := model.GoogleUserFromJson(body) + user = model.UserFromGoogleUser(gu) } if user == nil { From b704e9489b21b3bec17f5c8b573a1724781ee6f7 Mon Sep 17 00:00:00 2001 From: JoramWilander Date: Fri, 14 Aug 2015 08:43:49 -0400 Subject: [PATCH 2/6] added google sign-in functionality to the client, with minor model modifications --- api/user.go | 53 ++++++++++++++----- model/google.go | 16 ++++-- web/react/components/login.jsx | 13 +++-- web/react/components/signup_user_complete.jsx | 28 +++++++--- web/react/components/signup_user_oauth.jsx | 5 +- web/react/pages/channel.jsx | 11 ++-- web/react/stores/user_store.jsx | 14 ++++- web/react/utils/async_client.jsx | 14 ++--- web/react/utils/client.jsx | 15 ++++-- web/react/utils/constants.jsx | 2 + web/web.go | 48 ++++------------- 11 files changed, 137 insertions(+), 82 deletions(-) diff --git a/api/user.go b/api/user.go index 79f2201da2..303ec2b0af 100644 --- a/api/user.go +++ b/api/user.go @@ -7,6 +7,7 @@ import ( "bytes" "code.google.com/p/freetype-go/freetype" l4g "code.google.com/p/log4go" + b64 "encoding/base64" "fmt" "github.com/gorilla/mux" "github.com/mattermost/platform/model" @@ -1304,7 +1305,7 @@ func getStatuses(c *Context, w http.ResponseWriter, r *http.Request) { } } -func GetAuthorizationCode(c *Context, w http.ResponseWriter, r *http.Request, teamName, service, redirectUri string) { +func GetAuthorizationCode(c *Context, w http.ResponseWriter, r *http.Request, teamName, service, redirectUri, loginHint string) { if s, ok := utils.Cfg.SSOSettings[service]; !ok || !s.Allow { c.Err = model.NewAppError("GetAuthorizationCode", "Unsupported OAuth service provider", "service="+service) @@ -1315,26 +1316,48 @@ func GetAuthorizationCode(c *Context, w http.ResponseWriter, r *http.Request, te clientId := utils.Cfg.SSOSettings[service].Id endpoint := utils.Cfg.SSOSettings[service].AuthEndpoint scope := utils.Cfg.SSOSettings[service].Scope - state := model.HashPassword(clientId) - authUrl := endpoint + "?response_type=code&client_id=" + clientId + "&redirect_uri=" + url.QueryEscape(redirectUri+"?team="+teamName) + "&state=" + url.QueryEscape(state) + stateProps := map[string]string{"team": teamName, "hash": model.HashPassword(clientId)} + state := b64.StdEncoding.EncodeToString([]byte(model.MapToJson(stateProps))) + + authUrl := endpoint + "?response_type=code&client_id=" + clientId + "&redirect_uri=" + url.QueryEscape(redirectUri) + "&state=" + url.QueryEscape(state) if len(scope) > 0 { authUrl += "&scope=" + utils.UrlEncode(scope) } + if len(loginHint) > 0 { + authUrl += "&login_hint=" + utils.UrlEncode(loginHint) + } + http.Redirect(w, r, authUrl, http.StatusFound) } -func AuthorizeOAuthUser(service, code, state, redirectUri string) (io.ReadCloser, *model.AppError) { +func AuthorizeOAuthUser(service, code, state, redirectUri string) (io.ReadCloser, *model.Team, *model.AppError) { if s, ok := utils.Cfg.SSOSettings[service]; !ok || !s.Allow { - return nil, model.NewAppError("AuthorizeOAuthUser", "Unsupported OAuth service provider", "service="+service) + return nil, nil, model.NewAppError("AuthorizeOAuthUser", "Unsupported OAuth service provider", "service="+service) } - if !model.ComparePassword(state, utils.Cfg.SSOSettings[service].Id) { - return nil, model.NewAppError("AuthorizeOAuthUser", "Invalid state", "") + stateStr := "" + if b, err := b64.StdEncoding.DecodeString(state); err != nil { + return nil, nil, model.NewAppError("AuthorizeOAuthUser", "Invalid state", err.Error()) + } else { + stateStr = string(b) } + stateProps := model.MapFromJson(strings.NewReader(stateStr)) + + if !model.ComparePassword(stateProps["hash"], utils.Cfg.SSOSettings[service].Id) { + return nil, nil, model.NewAppError("AuthorizeOAuthUser", "Invalid state", "") + } + + teamName := stateProps["team"] + if len(teamName) == 0 { + return nil, nil, model.NewAppError("AuthorizeOAuthUser", "Invalid state; missing team name", "") + } + + tchan := Srv.Store.Team().GetByName(teamName) + p := url.Values{} p.Set("client_id", utils.Cfg.SSOSettings[service].Id) p.Set("client_secret", utils.Cfg.SSOSettings[service].Secret) @@ -1350,17 +1373,17 @@ func AuthorizeOAuthUser(service, code, state, redirectUri string) (io.ReadCloser var ar *model.AccessResponse if resp, err := client.Do(req); err != nil { - return nil, model.NewAppError("AuthorizeOAuthUser", "Token request failed", err.Error()) + return nil, nil, model.NewAppError("AuthorizeOAuthUser", "Token request failed", err.Error()) } else { ar = model.AccessResponseFromJson(resp.Body) } - if ar.TokenType != model.ACCESS_TOKEN_TYPE { - return nil, model.NewAppError("AuthorizeOAuthUser", "Bad token type", "token_type="+ar.TokenType) + if strings.ToLower(ar.TokenType) != model.ACCESS_TOKEN_TYPE { + return nil, nil, model.NewAppError("AuthorizeOAuthUser", "Bad token type", "token_type="+ar.TokenType) } if len(ar.AccessToken) == 0 { - return nil, model.NewAppError("AuthorizeOAuthUser", "Missing access token", "") + return nil, nil, model.NewAppError("AuthorizeOAuthUser", "Missing access token", "") } p = url.Values{} @@ -1372,9 +1395,13 @@ func AuthorizeOAuthUser(service, code, state, redirectUri string) (io.ReadCloser req.Header.Set("Authorization", "Bearer "+ar.AccessToken) if resp, err := client.Do(req); err != nil { - return nil, model.NewAppError("AuthorizeOAuthUser", "Token request to "+service+" failed", err.Error()) + return nil, nil, model.NewAppError("AuthorizeOAuthUser", "Token request to "+service+" failed", err.Error()) } else { - return resp.Body, nil + if result := <-tchan; result.Err != nil { + return nil, nil, result.Err + } else { + return resp.Body, result.Data.(*model.Team), nil + } } } diff --git a/model/google.go b/model/google.go index bdb5007045..2a1eb3caa9 100644 --- a/model/google.go +++ b/model/google.go @@ -6,6 +6,7 @@ package model import ( "encoding/json" "io" + "strings" ) const ( @@ -13,15 +14,20 @@ const ( ) type GoogleUser struct { - Id string `json:"id"` - Nickname string `json:"nickname"` - Emails []map[string]string `json:"emails"` - Names map[string]string `json:"name"` + Id string `json:"id"` + Nickname string `json:"nickname"` + DisplayName string `json:"displayName"` + Emails []map[string]string `json:"emails"` + Names map[string]string `json:"name"` } func UserFromGoogleUser(gu *GoogleUser) *User { user := &User{} - user.Username = gu.Nickname + if len(gu.Nickname) > 0 { + user.Username = gu.Nickname + } else { + user.Username = strings.ToLower(strings.Replace(gu.DisplayName, " ", "", -1)) + } user.FirstName = gu.Names["givenName"] user.LastName = gu.Names["familyName"] user.Nickname = gu.Nickname diff --git a/web/react/components/login.jsx b/web/react/components/login.jsx index fe0a47777b..5f396ac49a 100644 --- a/web/react/components/login.jsx +++ b/web/react/components/login.jsx @@ -92,14 +92,21 @@ module.exports = React.createClass({ var auth_services = JSON.parse(this.props.authServices); - var login_message; - if (auth_services.indexOf("gitlab") >= 0) { - login_message = ( + var login_message = []; + if (auth_services.indexOf(Constants.GITLAB_SERVICE) >= 0) { + login_message.push(
{"Log in with GitLab"}
); } + if (auth_services.indexOf(Constants.GOOGLE_SERVICE) >= 0) { + login_message.push( +
+ {"Log in with Google"} +
+ ); + } return (
diff --git a/web/react/components/signup_user_complete.jsx b/web/react/components/signup_user_complete.jsx index b21553d8a5..fd389e21f4 100644 --- a/web/react/components/signup_user_complete.jsx +++ b/web/react/components/signup_user_complete.jsx @@ -5,6 +5,7 @@ var utils = require('../utils/utils.jsx'); var client = require('../utils/client.jsx'); var UserStore = require('../stores/user_store.jsx'); var BrowserStore = require('../stores/browser_store.jsx'); +var Constants = require('../utils/constants.jsx'); module.exports = React.createClass({ handleSubmit: function(e) { @@ -151,19 +152,34 @@ module.exports = React.createClass({ // add options to log in using another service var authServices = JSON.parse(this.props.authServices); - var signupMessage = null; - if (authServices.indexOf('gitlab') >= 0) { - signupMessage = ( -
+ var signupMessage = []; + if (authServices.indexOf(Constants.GITLAB_SERVICE) >= 0) { + signupMessage.push( with GitLab + ); + } + + if (authServices.indexOf(Constants.GOOGLE_SERVICE) >= 0) { + signupMessage.push( + + + with Google + + ); + } + + if (signupMessage.length > 0) { + signupMessage = ( +
+ {signupMessage}
or
-
- ); +
+ ); } var termsDisclaimer = null; diff --git a/web/react/components/signup_user_oauth.jsx b/web/react/components/signup_user_oauth.jsx index 6322aedee0..8b2800bde4 100644 --- a/web/react/components/signup_user_oauth.jsx +++ b/web/react/components/signup_user_oauth.jsx @@ -33,7 +33,10 @@ module.exports = React.createClass({ client.createUser(user, "", "", function(data) { client.track('signup', 'signup_user_oauth_02'); - window.location.href = '/' + this.props.teamName + '/login/'+user.auth_service; + UserStore.setCurrentUser(data); + UserStore.setLastEmail(data.email); + + window.location.href = '/' + this.props.teamName + '/login/' + user.auth_service + '?login_hint=' + user.email; }.bind(this), function(err) { this.state.server_error = err.message; diff --git a/web/react/pages/channel.jsx b/web/react/pages/channel.jsx index 9294997151..52d537f275 100644 --- a/web/react/pages/channel.jsx +++ b/web/react/pages/channel.jsx @@ -54,16 +54,17 @@ global.window.setup_channel_page = function(team_name, team_type, team_id, chann id: team_id }); - React.render( - , - document.getElementById('error_bar') - ); - + // ChannelLoader must be rendered first React.render( , document.getElementById('channel_loader') ); + React.render( + , + document.getElementById('error_bar') + ); + React.render( , document.getElementById('navbar') diff --git a/web/react/stores/user_store.jsx b/web/react/stores/user_store.jsx index f8616c6abe..248495daca 100644 --- a/web/react/stores/user_store.jsx +++ b/web/react/stores/user_store.jsx @@ -4,6 +4,7 @@ var AppDispatcher = require('../dispatcher/app_dispatcher.jsx'); var EventEmitter = require('events').EventEmitter; var assign = require('object-assign'); +var client = require('../utils/client.jsx'); var Constants = require('../utils/constants.jsx'); var ActionTypes = Constants.ActionTypes; @@ -72,7 +73,7 @@ var UserStore = assign({}, EventEmitter.prototype, { BrowserStore.setGlobalItem('current_user_id', id); } }, - getCurrentId: function() { + getCurrentId: function(skipFetch) { var currentId = this.gCurrentId; if (currentId == null) { @@ -80,6 +81,17 @@ var UserStore = assign({}, EventEmitter.prototype, { this.gCurrentId = currentId; } + // this is a special case to force fetch the + // current user if it's missing + // it's synchronous to block rendering + if (currentId == null && !skipFetch) { + var me = client.getMeSynchronous(); + if (me != null) { + this.setCurrentUser(me); + currentId = me.id; + } + } + return currentId; }, getCurrentUser: function() { diff --git a/web/react/utils/async_client.jsx b/web/react/utils/async_client.jsx index 0b87bbd7b1..09710ddf06 100644 --- a/web/react/utils/async_client.jsx +++ b/web/react/utils/async_client.jsx @@ -390,15 +390,15 @@ module.exports.getPosts = function(force, id, maxPosts) { } } -function getMe() { - if (isCallInProgress('getMe')) { +function getMeSynchronous() { + if (isCallInProgress('getMeSynchronous')) { return; } - callTracker.getMe = utils.getTimestamp(); - client.getMe( + callTracker.getMeSynchronous = utils.getTimestamp(); + client.getMeSynchronous( function(data, textStatus, xhr) { - callTracker.getMe = 0; + callTracker.getMeSynchronous = 0; if (xhr.status === 304 || !data) return; @@ -409,11 +409,11 @@ function getMe() { }, function(err) { callTracker.getMe = 0; - dispatchError(err, 'getMe'); + dispatchError(err, 'getMeSynchronous'); } ); } -module.exports.getMe = getMe; +module.exports.getMeSynchronous = getMeSynchronous; module.exports.getStatuses = function() { if (isCallInProgress('getStatuses')) return; diff --git a/web/react/utils/client.jsx b/web/react/utils/client.jsx index 5aab80d014..ce044457a5 100644 --- a/web/react/utils/client.jsx +++ b/web/react/utils/client.jsx @@ -279,24 +279,33 @@ module.exports.getAudits = function(userId, success, error) { }); }; -module.exports.getMe = function(success, error) { +module.exports.getMeSynchronous = function(success, error) { + var currentUser = null; $.ajax({ + async: false, url: "/api/v1/users/me", dataType: 'json', contentType: 'application/json', type: 'GET', - success: success, + success: function gotUser(data, textStatus, xhr) { + currentUser = data; + if (success) { + success(data, textStatus, xhr); + } + }, error: function(xhr, status, err) { var ieChecker = window.navigator.userAgent; // This and the condition below is used to check specifically for browsers IE10 & 11 to suppress a 200 'OK' error from appearing on login if (xhr.status != 200 || !(ieChecker.indexOf("Trident/7.0") > 0 || ieChecker.indexOf("Trident/6.0") > 0)) { if (error) { - e = handleError("getMe", xhr, status, err); + e = handleError('getMeSynchronous', xhr, status, err); error(e); }; }; } }); + + return currentUser; }; module.exports.inviteMembers = function(data, success, error) { diff --git a/web/react/utils/constants.jsx b/web/react/utils/constants.jsx index 508de9185c..1fe0faccf2 100644 --- a/web/react/utils/constants.jsx +++ b/web/react/utils/constants.jsx @@ -58,6 +58,8 @@ module.exports = { THUMBNAIL_HEIGHT: 100, DEFAULT_CHANNEL: 'town-square', OFFTOPIC_CHANNEL: 'off-topic', + GITLAB_SERVICE: 'gitlab', + GOOGLE_SERVICE: 'google', POST_CHUNK_SIZE: 60, MAX_POST_CHUNKS: 3, RESERVED_TEAM_NAMES: [ diff --git a/web/web.go b/web/web.go index 1acddb914d..d6f8d553b2 100644 --- a/web/web.go +++ b/web/web.go @@ -496,7 +496,7 @@ func signupWithOAuth(c *api.Context, w http.ResponseWriter, r *http.Request) { redirectUri := c.GetSiteURL() + "/signup/" + service + "/complete" - api.GetAuthorizationCode(c, w, r, teamName, service, redirectUri) + api.GetAuthorizationCode(c, w, r, teamName, service, redirectUri, "") } func signupCompleteOAuth(c *api.Context, w http.ResponseWriter, r *http.Request) { @@ -505,26 +505,10 @@ func signupCompleteOAuth(c *api.Context, w http.ResponseWriter, r *http.Request) code := r.URL.Query().Get("code") state := r.URL.Query().Get("state") - teamName := r.FormValue("team") - uri := c.GetSiteURL() + "/signup/" + service + "/complete?team=" + teamName + uri := c.GetSiteURL() + "/signup/" + service + "/complete" - if len(teamName) == 0 { - c.Err = model.NewAppError("signupCompleteOAuth", "Invalid team name", "team_name="+teamName) - c.Err.StatusCode = http.StatusBadRequest - return - } - - // Make sure team exists - var team *model.Team - if result := <-api.Srv.Store.Team().GetByName(teamName); result.Err != nil { - c.Err = result.Err - return - } else { - team = result.Data.(*model.Team) - } - - if body, err := api.AuthorizeOAuthUser(service, code, state, uri); err != nil { + if body, team, err := api.AuthorizeOAuthUser(service, code, state, uri); err != nil { c.Err = err return } else { @@ -566,6 +550,7 @@ func loginWithOAuth(c *api.Context, w http.ResponseWriter, r *http.Request) { params := mux.Vars(r) service := params["service"] teamName := params["team"] + loginHint := r.URL.Query().Get("login_hint") if len(teamName) == 0 { c.Err = model.NewAppError("loginWithOAuth", "Invalid team name", "team_name="+teamName) @@ -581,7 +566,7 @@ func loginWithOAuth(c *api.Context, w http.ResponseWriter, r *http.Request) { redirectUri := c.GetSiteURL() + "/login/" + service + "/complete" - api.GetAuthorizationCode(c, w, r, teamName, service, redirectUri) + api.GetAuthorizationCode(c, w, r, teamName, service, redirectUri, loginHint) } func loginCompleteOAuth(c *api.Context, w http.ResponseWriter, r *http.Request) { @@ -590,26 +575,10 @@ func loginCompleteOAuth(c *api.Context, w http.ResponseWriter, r *http.Request) code := r.URL.Query().Get("code") state := r.URL.Query().Get("state") - teamName := r.FormValue("team") - uri := c.GetSiteURL() + "/login/" + service + "/complete?team=" + teamName + uri := c.GetSiteURL() + "/login/" + service + "/complete" - if len(teamName) == 0 { - c.Err = model.NewAppError("loginCompleteOAuth", "Invalid team name", "team_name="+teamName) - c.Err.StatusCode = http.StatusBadRequest - return - } - - // Make sure team exists - var team *model.Team - if result := <-api.Srv.Store.Team().GetByName(teamName); result.Err != nil { - c.Err = result.Err - return - } else { - team = result.Data.(*model.Team) - } - - if body, err := api.AuthorizeOAuthUser(service, code, state, uri); err != nil { + if body, team, err := api.AuthorizeOAuthUser(service, code, state, uri); err != nil { c.Err = err return } else { @@ -617,6 +586,9 @@ func loginCompleteOAuth(c *api.Context, w http.ResponseWriter, r *http.Request) if service == model.USER_AUTH_SERVICE_GITLAB { glu := model.GitLabUserFromJson(body) authData = glu.GetAuthData() + } else if service == model.USER_AUTH_SERVICE_GOOGLE { + gu := model.GoogleUserFromJson(body) + authData = gu.GetAuthData() } if len(authData) == 0 { From 8feec04929f17eb99e2f121530b8596966161528 Mon Sep 17 00:00:00 2001 From: JoramWilander Date: Fri, 14 Aug 2015 11:57:13 -0400 Subject: [PATCH 3/6] incorporate asaad's UI updates for google sign-up --- web/react/components/signup_user_complete.jsx | 2 +- web/sass-files/sass/partials/_signup.scss | 17 +++++++++++++++++ web/static/images/googleLogo.png | Bin 0 -> 3519 bytes 3 files changed, 18 insertions(+), 1 deletion(-) create mode 100644 web/static/images/googleLogo.png diff --git a/web/react/components/signup_user_complete.jsx b/web/react/components/signup_user_complete.jsx index fd389e21f4..0393e04138 100644 --- a/web/react/components/signup_user_complete.jsx +++ b/web/react/components/signup_user_complete.jsx @@ -164,7 +164,7 @@ module.exports = React.createClass({ if (authServices.indexOf(Constants.GOOGLE_SERVICE) >= 0) { signupMessage.push( - + with Google diff --git a/web/sass-files/sass/partials/_signup.scss b/web/sass-files/sass/partials/_signup.scss index 3a6f733163..ddf2aab88f 100644 --- a/web/sass-files/sass/partials/_signup.scss +++ b/web/sass-files/sass/partials/_signup.scss @@ -186,6 +186,23 @@ display: inline-block; } } + &.google { + background: #dd4b39; + &:hover { + background: darken(#dd4b39, 10%); + } + span { + vertical-align: middle; + } + .icon { + background: url("../images/googleLogo.png"); + width: 18px; + height: 18px; + margin-right: 8px; + @include background-size(100% 100%); + display: inline-block; + } + } } &.btn-default { color: #444; diff --git a/web/static/images/googleLogo.png b/web/static/images/googleLogo.png new file mode 100644 index 0000000000000000000000000000000000000000..932d755db8adb0ce748d18562cd16283607e663f GIT binary patch literal 3519 zcmV;w4M6gVP)KLZ*U+IBfRsybQWXdwQbLP>6pAqfylh#{fb6;Z(vMMVS~$e@S=j*ftg6;Uhf59&ghTmgWD0l;*T zI709Y^p6lP1rIRMx#05C~cW=H_Aw*bJ-5DT&Z2n+x)QHX^p z00esgV8|mQcmRZ%02D^@S3L16t`O%c004NIvOKvYIYoh62rY33S640`D9%Y2D-rV&neh&#Q1i z007~1e$oCcFS8neI|hJl{-P!B1ZZ9hpmq0)X0i`JwE&>$+E?>%_LC6RbVIkUx0b+_+BaR3cnT7Zv!AJxW zizFb)h!jyGOOZ85F;a?DAXP{m@;!0_IfqH8(HlgRxt7s3}k3K`kFu>>-2Q$QMFfPW!La{h336o>X zu_CMttHv6zR;&ZNiS=X8v3CR#fknUxHUxJ0uoBa_M6WNWeqIg~6QE69c9o#eyhGvpiOA@W-aonk<7r1(?fC{oI5N*U!4 zfg=2N-7=cNnjjOr{yriy6mMFgG#l znCF=fnQv8CDz++o6_Lscl}eQ+l^ZHARH>?_s@|##Rr6KLRFA1%Q+=*RRWnoLsR`7U zt5vFIcfW3@?wFpwUVxrVZ>QdQz32KIeJ}k~{cZZE^+ya? z2D1z#2HOnI7(B%_ac?{wFUQ;QQA1tBKtrWrm0_3Rgps+?Jfqb{jYbcQX~taRB;#$y zZN{S}1|}gUOHJxc?wV3fxuz+mJ4`!F$IZ;mqRrNsHJd##*D~ju=bP7?-?v~|cv>vB zsJ6IeNwVZxrdjT`yl#bBIa#GxRa#xMMy;K#CDyyGyQdMSxlWT#tDe?p!?5wT$+oGt z8L;Kp2HUQ-ZMJ=3XJQv;x5ci*?vuTfeY$;({XGW_huIFR9a(?@3)XSs8O^N5RyOM=TTmp(3=8^+zpz2r)C z^>JO{deZfso3oq3?Wo(Y?l$ge?uXo;%ru`Vo>?<<(8I_>;8Eq#KMS9gFl*neeosSB zfoHYnBQIkwkyowPu(zdms`p{<7e4kra-ZWq<2*OsGTvEV%s0Td$hXT+!*8Bnh2KMe zBmZRodjHV?r+_5^X9J0WL4jKW`}lf%A-|44I@@LTvf1rHjG(ze6+w@Jt%Bvjts!X0 z?2xS?_ve_-kiKB_KiJlZ$9G`c^=E@oNG)mWWaNo-3TIW8)$Hg0Ub-~8?KhvJ>$ z3*&nim@mj(aCxE5!t{lw7O5^0EIO7zOo&c6l<+|iDySBWCGrz@C5{St!X3hAA}`T4 z(TLbXTq+(;@<=L8dXnssyft|w#WSTW<++3>sgS%(4NTpeI-VAqb|7ssJvzNHgOZVu zaYCvgO_R1~>SyL=cFU|~g|hy|Zi}}s9+d~lYqOB71z9Z$wnC=pR9Yz4DhIM>Wmjgu z&56o6maCpC&F##y%G;1PobR9i?GnNg;gYtchD%p19a!eQtZF&3JaKv33gZ<8D~47E ztUS1iwkmDaPpj=$m#%)jCVEY4fnLGNg2A-`YwHVD3gv};>)hAvT~AmqS>Lr``i7kw zJ{5_It`yrBmlc25DBO7E8;5VoznR>Ww5hAaxn$2~(q`%A-YuS64wkBy=9dm`4cXeX z4c}I@?e+FW+b@^RDBHV(wnMq2zdX3SWv9u`%{xC-q*U}&`cyXV(%rRT*Z6MH?i+i& z_B8C(+grT%{XWUQ+f@NoP1R=AW&26{v-dx)iK^-Nmiuj8txj!m?Z*Ss1N{dh4z}01 z)YTo*JycSU)+_5r4#yw9{+;i4Ee$peRgIj+;v;ZGdF1K$3E%e~4LaI(jC-u%2h$&R z9cLXcYC@Xwnns&bn)_Q~Te?roKGD|d-g^8;+aC{{G(1^(O7m37Y1-+6)01cN&y1aw zoqc{T`P^XJqPBbIW6s}d4{z_f5Om?vMgNQEJG?v2T=KYd^0M3I6IZxbny)%vZR&LD zJpPl@Psh8QyPB@KTx+@RdcC!KX7}kEo;S|j^u2lU7XQ}Oo;f|;z4Ll+_r>@1-xl3| zawq-H%e&ckC+@AhPrP6BKT#_XdT7&;F71j}Joy zkC~6lh7E@6o;W@^IpRNZ{ptLtL(gQ-CY~4mqW;US7Zxvm_|@yz&e53Bp_lTPlfP|z zrTyx_>lv@x#=^!PzR7qqF<$gm`|ZJZ+;<)Cqu&ot2z=0000WV@Og>004R=004l4008;_004mL004C`008P>0026e000+nl3&F} z0008&Nkl2#nOskR%C;%zSY2-<=+h~j#AJf zVAz_V)dT02lRLMg6jb8`Kk0!}1Wa3;IiM^PFUw;x?{x5}2hKN19nOZR%0%)iXk`YR z%3e9RC@MiC4&LIC*YDs&RDyaOT;-8B>)`IF1a(OIVc`l%dpz*gTjOC#&!Q4EA?d2~ zS&O9H47~l;_^hOdp z&bxO(0%j>X+vMPSb6os4L0=ra&y)s#qC)i4?z7c7-RG^%v@ic8sn?ilyh>7@q!W@3 zCh>bC>4>S;>3ie=g0@LIWtOBw(u|~D(~@LMDwb55VoCQ(8jNbm;=mJYDPEe}M_v-& zb-=?U%hvoB?2^|l!%a#D|9Z`e8W{*N*z!`IEodJ$V(J>YP zj~!7Hz;&P^1t%Y<13Ha=!u(kgX$xBiyiIZ(i~z5J=jQ!@bDw_%lrQ9Izfn?+q#csV tC9Rc|Z~C5TbE1Ec)M*m9-%s$r0{~xg;39ftjf4OI002ovPDHLkV1nBuj*b8T literal 0 HcmV?d00001 From 07704d3299d6c85c531c98d7ff61251dc8e1f277 Mon Sep 17 00:00:00 2001 From: JoramWilander Date: Fri, 14 Aug 2015 11:57:46 -0400 Subject: [PATCH 4/6] turn off google SSO by default and remove test google oauth credentials --- config/config.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/config/config.json b/config/config.json index 8405b90769..e7134cba56 100644 --- a/config/config.json +++ b/config/config.json @@ -35,9 +35,9 @@ "UserApiEndpoint": "" }, "google": { - "Allow": true, - "Secret": "hWN1kiPeyihN6nHr36j0oDqx", - "Id": "974585606220-ek5q66olpagb069pkg9ok0d7h8djeov6.apps.googleusercontent.com", + "Allow": false, + "Secret": "", + "Id": "", "Scope": "email profile", "AuthEndpoint": "https://accounts.google.com/o/oauth2/auth", "TokenEndpoint": "https://www.googleapis.com/oauth2/v3/token", From 3faa09c641cc6cb7f2a5e88d080b6a90339972d9 Mon Sep 17 00:00:00 2001 From: JoramWilander Date: Fri, 14 Aug 2015 12:35:43 -0400 Subject: [PATCH 5/6] reformat login.jsx to meet style guide --- web/react/components/login.jsx | 102 +++++++++++++++++---------------- 1 file changed, 54 insertions(+), 48 deletions(-) diff --git a/web/react/components/login.jsx b/web/react/components/login.jsx index 5f396ac49a..c395bb500e 100644 --- a/web/react/components/login.jsx +++ b/web/react/components/login.jsx @@ -4,64 +4,62 @@ var utils = require('../utils/utils.jsx'); var client = require('../utils/client.jsx'); var UserStore = require('../stores/user_store.jsx'); -var TeamStore = require('../stores/team_store.jsx'); var BrowserStore = require('../stores/browser_store.jsx'); var Constants = require('../utils/constants.jsx'); module.exports = React.createClass({ handleSubmit: function(e) { e.preventDefault(); - var state = { } + var state = {}; - var name = this.props.teamName + var name = this.props.teamName; if (!name) { - state.server_error = "Bad team name" + state.serverError = 'Bad team name'; this.setState(state); return; } var email = this.refs.email.getDOMNode().value.trim(); if (!email) { - state.server_error = "An email is required" + state.serverError = 'An email is required'; this.setState(state); return; } var password = this.refs.password.getDOMNode().value.trim(); if (!password) { - state.server_error = "A password is required" + state.serverError = 'A password is required'; this.setState(state); return; } if (!BrowserStore.isLocalStorageSupported()) { - state.server_error = "This service requires local storage to be enabled. Please enable it or exit private browsing."; + state.serverError = 'This service requires local storage to be enabled. Please enable it or exit private browsing.'; this.setState(state); return; } - state.server_error = ""; + state.serverError = ''; this.setState(state); client.loginByEmail(name, email, password, - function(data) { + function loggedIn(data) { UserStore.setCurrentUser(data); UserStore.setLastEmail(email); - var redirect = utils.getUrlParameter("redirect"); + var redirect = utils.getUrlParameter('redirect'); if (redirect) { window.location.pathname = decodeURI(redirect); } else { window.location.pathname = '/' + name + '/channels/town-square'; } - - }.bind(this), - function(err) { - if (err.message == "Login failed because email address has not been verified") { + }, + function loginFailed(err) { + if (err.message === 'Login failed because email address has not been verified') { window.location.href = '/verify_email?name=' + encodeURIComponent(name) + '&email=' + encodeURIComponent(email); return; } - state.server_error = err.message; + state.serverError = err.message; this.valid = false; this.setState(state); }.bind(this) @@ -71,10 +69,13 @@ module.exports = React.createClass({ return { }; }, render: function() { - var server_error = this.state.server_error ? : null; - var priorEmail = UserStore.getLastEmail() !== "undefined" ? UserStore.getLastEmail() : "" + var serverError; + if (this.state.serverError) { + serverError = ; + } + var priorEmail = UserStore.getLastEmail(); - var emailParam = utils.getUrlParameter("email"); + var emailParam = utils.getUrlParameter('email'); if (emailParam) { priorEmail = decodeURIComponent(emailParam); } @@ -84,57 +85,62 @@ module.exports = React.createClass({ var focusEmail = false; var focusPassword = false; - if (priorEmail != "") { + if (priorEmail !== '') { focusPassword = true; } else { focusEmail = true; } - var auth_services = JSON.parse(this.props.authServices); + var authServices = JSON.parse(this.props.authServices); - var login_message = []; - if (auth_services.indexOf(Constants.GITLAB_SERVICE) >= 0) { - login_message.push( -
- {"Log in with GitLab"} + var loginMessage = []; + if (authServices.indexOf(Constants.GITLAB_SERVICE) >= 0) { + loginMessage.push( + ); } - if (auth_services.indexOf(Constants.GOOGLE_SERVICE) >= 0) { - login_message.push( -
- {"Log in with Google"} + if (authServices.indexOf(Constants.GOOGLE_SERVICE) >= 0) { + loginMessage.push( + ); } + var errorClass = ''; + if (serverError) { + errorClass = ' has-error'; + } + return ( -
-
Sign in to:
-

{ teamDisplayName }

-

on { config.SiteName }

+
+
Sign in to:
+

{teamDisplayName}

+

on {config.SiteName}

-
- { server_error } +
+ {serverError}
-
- +
+
-
- +
+
-
- +
+
- { login_message } -
- {"Find other " + strings.TeamPlural} + {loginMessage} + -
- I forgot my password + -
- {"Want to create your own " + strings.Team + "?"} Sign up now +
+ {'Want to create your own ' + strings.Team + '?'} Sign up now
From a7f09be9783f3354ab38d4fb4fb82085241d018f Mon Sep 17 00:00:00 2001 From: JoramWilander Date: Fri, 14 Aug 2015 12:39:38 -0400 Subject: [PATCH 6/6] merge async_client getMe changes --- web/react/utils/async_client.jsx | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/web/react/utils/async_client.jsx b/web/react/utils/async_client.jsx index 09710ddf06..8b6d821d60 100644 --- a/web/react/utils/async_client.jsx +++ b/web/react/utils/async_client.jsx @@ -390,15 +390,15 @@ module.exports.getPosts = function(force, id, maxPosts) { } } -function getMeSynchronous() { - if (isCallInProgress('getMeSynchronous')) { +function getMe() { + if (isCallInProgress('getMe')) { return; } - callTracker.getMeSynchronous = utils.getTimestamp(); + callTracker.getMe = utils.getTimestamp(); client.getMeSynchronous( function(data, textStatus, xhr) { - callTracker.getMeSynchronous = 0; + callTracker.getMe = 0; if (xhr.status === 304 || !data) return; @@ -409,11 +409,11 @@ function getMeSynchronous() { }, function(err) { callTracker.getMe = 0; - dispatchError(err, 'getMeSynchronous'); + dispatchError(err, 'getMe'); } ); } -module.exports.getMeSynchronous = getMeSynchronous; +module.exports.getMe = getMe; module.exports.getStatuses = function() { if (isCallInProgress('getStatuses')) return;