stadust / pointercrate

Rewrite of the https://pointercrate.com backend in Rust

MIT License

73 stars 46 forks source link

Add Google OAuth2 Integration #135

Open peonii opened 2 months ago

peonii commented 2 months ago

Google OAuth2 Integration

Implements integration from issue #127.

To-do

[X] Sign in flow
[X] Registration flow
[X] Support for null password fields
[x] Integration with existing auth system (token creation)
[x] Account linking
[X] YouTube channel linking - This will be implemented in a future PR, right now it's just the barebones to get the system going

License Acceptance

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

peonii commented 1 week ago

@stadust there's one issue here, maybe you'll have some idea on how to resolve this; when logging via google to an account that's been linked after previously being created with the register endpoint, the signature of the JWT is invalid

peonii commented 1 week ago

okay Another Problem has arisen do we force the user to go through the oauth2 flow again each time they'd like to make any change on their profile or do we trust the access token!

for applications that have an oauth2 login flow (im using Notion as a reference) they usually just trust the token and let it do destructive changes but im asking before we implement anything

stadust commented 1 week ago

okay Another Problem has arisen do we force the user to go through the oauth2 flow again each time they'd like to make any change on their profile or do we trust the access token!

for applications that have an oauth2 login flow (im using Notion as a reference) they usually just trust the token and let it do destructive changes but im asking before we implement anything

The current system trusts the access token instead of requiring the user to re-enter their password for everything (with few exceptions, such as changing the password), so I think keeping it like that is fine