[IMPROVE] Support for Google OAuth for mobile app (#22014)

4 years ago · 3db591804c
parent 99e7da6601
commit 3db591804c
2 changed files with 93 additions and 0 deletions
--- a/app/google-oauth/server/index.js
+++ b/app/google-oauth/server/index.js
@ -0,0 +1,92 @@
 import { Meteor } from 'meteor/meteor';
 import { OAuth } from 'meteor/oauth';
 // The code on this file was copied directly from Meteor and modified to support mobile google oauth
 // https://github.com/meteor/meteor/blob/ffcfa5062cf1bf8a64ea64fef681ffcd99fe7939/packages/oauth/oauth_server.js
 Meteor.startup(() => {
 	const appRedirectUrl = 'rocketchat://auth';
 	const renderEndOfLoginResponse = (options) => {
 		const escape = (s) => {
 			if (!s) {
 				return s;
 			}
 			return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\'/g, '&quot;').replace(/\'/g, '&#x27;').replace(/\//g, '&#x2F;');
 		};
 		const config = {
 			setCredentialToken: !! options.setCredentialToken,
 			credentialToken: escape(options.credentialToken),
 			credentialSecret: escape(options.credentialSecret),
 			storagePrefix: escape(OAuth._storageTokenPrefix),
 			redirectUrl: escape(options.redirectUrl),
 			isCordova: !! options.isCordova,
 		};
 		let template;
 		if (options.loginStyle === 'popup') {
 			template = OAuth._endOfPopupResponseTemplate;
 		} else if (options.loginStyle === 'redirect') {
 			template = OAuth._endOfRedirectResponseTemplate;
 		} else {
 			throw new Error(`invalid loginStyle: ${ options.loginStyle }`);
 		}
 		const result = template.replace(/##CONFIG##/, JSON.stringify(config)).replace(/##ROOT_URL_PATH_PREFIX##/, __meteor_runtime_config__.ROOT_URL_PATH_PREFIX);
 		return `<!DOCTYPE html>\n${ result }`;
 	};
 	OAuth._endOfLoginResponse = (res, details) => {
 		res.writeHead(200, { 'Content-Type': 'text/html' });
 		let redirectUrl;
 		if (details.loginStyle === 'redirect') {
 			redirectUrl = OAuth._stateFromQuery(details.query).redirectUrl;
 			const appHost = Meteor.absoluteUrl();
 			if (redirectUrl.startsWith(appRedirectUrl)) {
 				redirectUrl = `${ appRedirectUrl }?host=${ appHost }&type=oauth`;
 				if (details.error) {
 					const error = encodeURIComponent(details.error.toString());
 					redirectUrl = `${ redirectUrl }&error=${ error }`;
 				}
 				if (details.credentials) {
 					const { token, secret } = details.credentials;
 					redirectUrl = `${ redirectUrl }&credentialToken=${ token }&credentialSecret=${ secret }`;
 				}
 			} else if (!Meteor.settings?.packages?.oauth?.disableCheckRedirectUrlOrigin && OAuth._checkRedirectUrlOrigin(redirectUrl)) {
 				details.error = `redirectUrl (${ redirectUrl }) is not on the same host as the app (${ appHost })`;
 				redirectUrl = appHost;
 			}
 		}
 		const isCordova = OAuth._isCordovaFromQuery(details.query);
 		if (details.error) {
 			res.end(renderEndOfLoginResponse({
 				loginStyle: details.loginStyle,
 				setCredentialToken: false,
 				redirectUrl,
 				isCordova,
 			}), 'utf-8');
 			return;
 		}
 		// If we have a credentialSecret, report it back to the parent
 		// window, with the corresponding credentialToken. The parent window
 		// uses the credentialToken and credentialSecret to log in over DDP.
 		res.end(renderEndOfLoginResponse({
 			loginStyle: details.loginStyle,
 			setCredentialToken: true,
 			credentialToken: details.credentials.token,
 			credentialSecret: details.credentials.secret,
 			redirectUrl,
 			isCordova,
 		}), 'utf-8');
 	};
 });
--- a/server/importPackages.js
+++ b/server/importPackages.js
@ -27,6 +27,7 @@ import '../app/file';
 import '../app/file-upload';
 import '../app/github-enterprise/server';
 import '../app/gitlab/server';
 import '../app/google-oauth/server';
 import '../app/google-vision/server';
 import '../app/iframe-login/server';
 import '../app/importer/server';