amy/donetick
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix #117 can complete overdue chore

Browse source 
Add Support for SSO  and OIDC authentication (Aurthentik)
Update server timeouts to 10 seconds for read and write operations
This commit is contained in:
Mo Tarbin 2025-02-07 00:38:52 -05:00
commit e6859daeed
14 changed files with 338 additions and 43 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
config/config.go
View file

@ -3,6 +3,7 @@ package config
import (
"fmt"
"os"
"strings"
"time"
"github.com/spf13/viper"
@ -18,6 +19,7 @@ type Config struct {
SchedulerJobs SchedulerConfig `mapstructure:"scheduler_jobs" yaml:"scheduler_jobs"`
EmailConfig EmailConfig `mapstructure:"email" yaml:"email"`
StripeConfig StripeConfig `mapstructure:"stripe" yaml:"stripe"`
OAuth2Config OAuth2Config `mapstructure:"oauth2" yaml:"oauth2"`
IsDoneTickDotCom bool `mapstructure:"is_done_tick_dot_com" yaml:"is_done_tick_dot_com"`
IsUserCreationDisabled bool `mapstructure:"is_user_creation_disabled" yaml:"is_user_creation_disabled"`
}
@ -84,6 +86,17 @@ type EmailConfig struct {
AppHost string `mapstructure:"appHost"`
}
type OAuth2Config struct {
ClientID string `mapstructure:"client_id" yaml:"client_id"`
ClientSecret string `mapstructure:"client_secret" yaml:"client_secret"`
RedirectURL string `mapstructure:"redirect_url" yaml:"redirect_url"`
Scopes []string `mapstructure:"scopes" yaml:"scopes"`
AuthURL string `mapstructure:"auth_url" yaml:"auth_url"`
TokenURL string `mapstructure:"token_url" yaml:"token_url"`
UserInfoURL string `mapstructure:"user_info_url" yaml:"user_info_url"`
Name string `mapstructure:"name" yaml:"name"`
}
func NewConfig() *Config {
return &Config{
Telegram: TelegramConfig{
@ -126,9 +139,13 @@ func LoadConfig() *Config {
}
// get logger and log the current environment:
fmt.Printf("--ConfigLoad config for environment: %s ", os.Getenv("DT_ENV"))
viper.SetEnvPrefix("DT")
viper.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
viper.AutomaticEnv()
viper.AddConfigPath("./config")
viper.SetConfigType("yaml")
err := viper.ReadInConfig()
// print a useful error:
if err != nil {
@ -141,8 +158,7 @@ func LoadConfig() *Config {
panic(err)
}
fmt.Printf("--ConfigLoad name : %s ", config.Name)
viper.SetEnvPrefix("DT")
viper.AutomaticEnv()
configEnvironmentOverrides(&config)
return &config

4
config/local.yaml
View file

@ -14,8 +14,8 @@ jwt:
max_refresh: 168h
server:
port: 2021
read_timeout: 2s
write_timeout: 1s
read_timeout: 10s
write_timeout: 10s
rate_period: 60s
rate_limit: 300
cors_allow_origins:

8
config/selfhosted.env
View file

@ -22,4 +22,10 @@ DT_EMAIL_HOST=
DT_EMAIL_PORT=
DT_EMAIL_KEY=
DT_EMAIL_EMAIL=
DT_EMAIL_APP_HOST=
DT_EMAIL_APP_HOST=
DT_OAUTH2_CLIENT_ID=
DT_OAUTH2_CLIENT_SECRET=
DT_OAUTH2_AUTH_URL=
DT_OAUTH2_TOKEN_URL=
DT_OAUTH2_USER_INFO_URL=
DT_OAUTH2_REDIRECT_URL=

8
config/selfhosted.yaml
View file

@ -35,3 +35,11 @@ email:
key:
email:
appHost:
oauth2:
client_id:
client_secret:
auth_url:
token_url:
user_info_url:
redirect_url:
name:

3
go.mod
View file

@ -10,6 +10,8 @@ require (
github.com/gin-gonic/gin v1.10.0
github.com/glebarez/sqlite v1.11.0
github.com/go-telegram-bot-api/telegram-bot-api/v5 v5.5.1
github.com/golang-jwt/jwt/v5 v5.2.1
github.com/gregdel/pushover v1.3.1
github.com/rubenv/sql-migrate v1.7.0
github.com/spf13/viper v1.19.0
github.com/ulule/limiter/v3 v3.11.2
@ -50,7 +52,6 @@ require (
github.com/google/uuid v1.6.0 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
github.com/googleapis/gax-go/v2 v2.12.4 // indirect
github.com/gregdel/pushover v1.3.1 // indirect
github.com/hashicorp/hcl v1.0.0 // indirect
github.com/jackc/pgpassfile v1.0.0 // indirect
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect

2
go.sum
View file

@ -72,6 +72,8 @@ github.com/goccy/go-json v0.10.3 h1:KZ5WoDbxAIgm2HNbYckL0se1fHD6rz5j4ywS6ebzDqA=
github.com/goccy/go-json v0.10.3/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=

95
internal/authorization/identity_provider.go Normal file
View file

@ -0,0 +1,95 @@
package auth
import (
"context"
"encoding/json"
"errors"
"io"
"net/http"
"donetick.com/core/config"
"golang.org/x/oauth2"
)
type IdentityProviderUserInfo struct {
Identifier string
DisplayName string
Email string
}
type IdentityProvider struct {
config *config.OAuth2Config
isEnabled bool
}
func NewIdentityProvider(cfg *config.Config) *IdentityProvider {
if cfg.OAuth2Config.ClientID == "" || cfg.OAuth2Config.ClientSecret == "" {
return &IdentityProvider{isEnabled: false}
}
return &IdentityProvider{config: &cfg.OAuth2Config, isEnabled: true}
}
func (i *IdentityProvider) ExchangeToken(ctx context.Context, code string) (string, error) {
if !i.isEnabled {
return "", errors.New("identity provider is not enabled")
}
conf := &oauth2.Config{
ClientID: i.config.ClientID,
ClientSecret: i.config.ClientSecret,
RedirectURL: i.config.RedirectURL,
Scopes: i.config.Scopes,
Endpoint: oauth2.Endpoint{
AuthURL: i.config.AuthURL,
TokenURL: i.config.TokenURL,
},
}
token, err := conf.Exchange(ctx, code)
if err != nil {
return "", err
}
accessToken, ok := token.AccessToken, token.Valid()
if !ok {
return "", errors.New("access token not found")
}
return accessToken, nil
}
func (i *IdentityProvider) GetUserInfo(ctx context.Context, accessToken string) (*IdentityProviderUserInfo, error) {
req, err := http.NewRequest("GET", i.config.UserInfoURL, nil)
if err != nil {
return nil, err
}
req.Header.Set("Authorization", "Bearer "+accessToken)
req.Header.Set("Accept", "application/json")
resp, err := http.DefaultClient.Do(req)
if err != nil {
return nil, err
}
body, err := io.ReadAll(resp.Body)
if err != nil {
return nil, err
}
defer resp.Body.Close()
var claims map[string]any
err = json.Unmarshal(body, &claims)
if err != nil {
return nil, errors.New("failed to unmarshal claims")
}
userInfo := IdentityProviderUserInfo{}
if val, ok := claims["sub"]; ok {
userInfo.Identifier = val.(string)
}
if val, ok := claims["name"]; ok {
userInfo.DisplayName = val.(string)
}
if val, ok := claims["email"]; ok {
userInfo.Email = val.(string)
}
return &userInfo, nil
}

4
internal/chore/handler.go
View file

@ -427,7 +427,7 @@ func (h *Handler) editChore(c *gin.Context) {
})
return
}
if currentUser.ID != oldChore.CreatedBy {
if !oldChore.CanEdit(currentUser.ID, circleUsers) {
c.JSON(403, gin.H{
"error": "You are not allowed to edit this chore",
})
@ -998,7 +998,7 @@ func (h *Handler) completeChore(c *gin.Context) {
}
// confirm that the chore in completion window:
if chore.CompletionWindow != nil {
if completedDate.After(chore.NextDueDate.Add(time.Hour * time.Duration(*chore.CompletionWindow))) {
if completedDate.Before(chore.NextDueDate.Add(time.Hour * time.Duration(*chore.CompletionWindow))) {
c.JSON(400, gin.H{
"error": "Chore is out of completion window",
})

13
internal/chore/model/model.go
View file

@ -3,6 +3,7 @@ package model
import (
"time"
cModel "donetick.com/core/internal/circle/model"
lModel "donetick.com/core/internal/label/model"
tModel "donetick.com/core/internal/thing/model"
thingModel "donetick.com/core/internal/thing/model"
@ -169,3 +170,15 @@ type ChoreReq struct {
CompletionWindow *int `json:"completionWindow"`
Description *string `json:"description"`
}
func (c *Chore) CanEdit(userID int, circleUsers []*cModel.UserCircleDetail) bool {
if c.CreatedBy == userID {
return true
}
for _, cu := range circleUsers {
if cu.UserID == userID && cu.Role == "admin" {
return true
}
}
return false
}

50
internal/resource/handler.go Normal file
View file

@ -0,0 +1,50 @@
package resource
import (
"donetick.com/core/config"
jwt "github.com/appleboy/gin-jwt/v2"
"github.com/gin-gonic/gin"
"github.com/ulule/limiter/v3"
)
type Resource struct {
Idp identityProvider `json:"identity_provider" binding:"omitempty"`
}
type identityProvider struct {
Auth_url string `json:"auth_url" binding:"omitempty"`
Client_ID string `json:"client_id" binding:"omitempty"`
Name string `json:"name" binding:"omitempty"`
}
type Handler struct {
config config.Config
}
func NewHandler(cfg *config.Config) *Handler {
return &Handler{
config: *cfg,
}
}
func (h *Handler) getResource(c *gin.Context) {
c.JSON(200, &Resource{
Idp: identityProvider{
Auth_url: h.config.OAuth2Config.AuthURL,
Client_ID: h.config.OAuth2Config.ClientID,
Name: h.config.OAuth2Config.Name,
},
})
}
func Routes(r *gin.Engine, h *Handler, auth *jwt.GinJWTMiddleware, limiter *limiter.Limiter) {
resourceRoutes := r.Group("api/v1/resource")
// skip resource endpoint for donetick.com
if h.config.IsDoneTickDotCom {
resourceRoutes.GET("", func(c *gin.Context) {
c.JSON(200, gin.H{})
})
return
}
resourceRoutes.GET("", h.getResource)
}

18
internal/thing/webhook.go → internal/thing/api.go
View file

@ -16,7 +16,7 @@ import (
"github.com/gin-gonic/gin"
)
type Webhook struct {
type API struct {
choreRepo *chRepo.ChoreRepository
circleRepo *cRepo.CircleRepository
thingRepo *tRepo.ThingRepository
@ -24,9 +24,9 @@ type Webhook struct {
tRepo *tRepo.ThingRepository
}
func NewWebhook(cr *chRepo.ChoreRepository, circleRepo *cRepo.CircleRepository,
thingRepo *tRepo.ThingRepository, userRepo *uRepo.UserRepository, tRepo *tRepo.ThingRepository) *Webhook {
return &Webhook{
func NewAPI(cr *chRepo.ChoreRepository, circleRepo *cRepo.CircleRepository,
thingRepo *tRepo.ThingRepository, userRepo *uRepo.UserRepository, tRepo *tRepo.ThingRepository) *API {
return &API{
choreRepo: cr,
circleRepo: circleRepo,
thingRepo: thingRepo,
@ -35,7 +35,7 @@ func NewWebhook(cr *chRepo.ChoreRepository, circleRepo *cRepo.CircleRepository,
}
}
func (h *Webhook) UpdateThingState(c *gin.Context) {
func (h *API) UpdateThingState(c *gin.Context) {
thing, shouldReturn := validateUserAndThing(c, h)
if shouldReturn {
return
@ -60,7 +60,7 @@ func (h *Webhook) UpdateThingState(c *gin.Context) {
c.JSON(200, gin.H{})
}
func (h *Webhook) ChangeThingState(c *gin.Context) {
func (h *API) ChangeThingState(c *gin.Context) {
thing, shouldReturn := validateUserAndThing(c, h)
if shouldReturn {
return
@ -109,7 +109,7 @@ func (h *Webhook) ChangeThingState(c *gin.Context) {
c.JSON(200, gin.H{"state": thing.State})
}
func WebhookEvaluateTriggerAndScheduleDueDate(h *Webhook, c *gin.Context, thing *tModel.Thing) bool {
func WebhookEvaluateTriggerAndScheduleDueDate(h *API, c *gin.Context, thing *tModel.Thing) bool {
// handler should be interface to not duplicate both WebhookEvaluateTriggerAndScheduleDueDate and EvaluateTriggerAndScheduleDueDate
// this is bad code written Saturday at 2:25 AM
@ -134,7 +134,7 @@ func WebhookEvaluateTriggerAndScheduleDueDate(h *Webhook, c *gin.Context, thing
return false
}
func validateUserAndThing(c *gin.Context, h *Webhook) (*tModel.Thing, bool) {
func validateUserAndThing(c *gin.Context, h *API) (*tModel.Thing, bool) {
apiToken := c.GetHeader("secretkey")
if apiToken == "" {
c.JSON(401, gin.H{"error": "Unauthorized"})
@ -162,7 +162,7 @@ func validateUserAndThing(c *gin.Context, h *Webhook) (*tModel.Thing, bool) {
return thing, false
}
func Webhooks(cfg *config.Config, w *Webhook, r *gin.Engine, auth *jwt.GinJWTMiddleware) {
func APIs(cfg *config.Config, w *API, r *gin.Engine, auth *jwt.GinJWTMiddleware) {
thingsAPI := r.Group("eapi/v1/things")

117
internal/user/handler.go
View file

@ -31,16 +31,18 @@ type Handler struct {
circleRepo *cRepo.CircleRepository
jwtAuth *jwt.GinJWTMiddleware
email *email.EmailSender
identityProvider *auth.IdentityProvider
isDonetickDotCom bool
IsUserCreationDisabled bool
}
func NewHandler(ur *uRepo.UserRepository, cr *cRepo.CircleRepository, jwtAuth *jwt.GinJWTMiddleware, email *email.EmailSender, config *config.Config) *Handler {
func NewHandler(ur *uRepo.UserRepository, cr *cRepo.CircleRepository, jwtAuth *jwt.GinJWTMiddleware, email *email.EmailSender, idp *auth.IdentityProvider, config *config.Config) *Handler {
return &Handler{
userRepo: ur,
circleRepo: cr,
jwtAuth: jwtAuth,
email: email,
identityProvider: idp,
isDonetickDotCom: config.IsDoneTickDotCom,
IsUserCreationDisabled: config.IsUserCreationDisabled,
}
@ -178,7 +180,8 @@ func (h *Handler) thirdPartyAuthCallback(c *gin.Context) {
provider := c.Param("provider")
logger.Infow("account.handler.thirdPartyAuthCallback", "provider", provider)
if provider == "google" {
switch provider {
case "google":
c.Set("auth_provider", "3rdPartyAuth")
type OAuthRequest struct {
Token string `json:"token" binding:"required"`
@ -219,7 +222,7 @@ func (h *Handler) thirdPartyAuthCallback(c *gin.Context) {
Image: userinfo.Picture,
Password: encodedPassword,
DisplayName: userinfo.GivenName,
Provider: 2,
Provider: uModel.AuthProviderGoogle,
}
createdUser, err := h.userRepo.CreateUser(c, acc)
if err != nil {
@ -278,6 +281,105 @@ func (h *Handler) thirdPartyAuthCallback(c *gin.Context) {
}
c.JSON(http.StatusOK, gin.H{"token": tokenString, "expire": expire})
return
case "oauth2":
c.Set("auth_provider", "3rdPartyAuth")
// Read the ID token from the request bod
type Request struct {
Code string `json:"code"`
}
var req Request
if err := c.BindJSON(&req); err != nil {
c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request"})
return
}
token, err := h.identityProvider.ExchangeToken(c, req.Code)
if err != nil {
logger.Error("account.handler.thirdPartyAuthCallback (oauth2) failed to exchange token", "err", err)
c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to exchange token"})
return
}
claims, err := h.identityProvider.GetUserInfo(c, token)
if err != nil {
logger.Error("account.handler.thirdPartyAuthCallback (oauth2) failed to get claims", "err", err)
}
acc, err := h.userRepo.FindByEmail(c, claims.Email)
if err != nil {
// Create user
password := auth.GenerateRandomPassword(12)
encodedPassword, err := auth.EncodePassword(password)
if err != nil {
logger.Error("account.handler.thirdPartyAuthCallback (oauth2) password encoding failed", "err", err)
c.JSON(http.StatusInternalServerError, gin.H{"error": "Password encoding failed"})
return
}
acc = &uModel.User{
Username: claims.Email,
Email: claims.Email,
Password: encodedPassword,
DisplayName: claims.DisplayName,
Provider: uModel.AuthProviderOAuth2,
}
createdUser, err := h.userRepo.CreateUser(c, acc)
if err != nil {
c.JSON(http.StatusInternalServerError, gin.H{
"error": "Unable to create user",
})
return
}
// Create Circle for the user:
userCircle, err := h.circleRepo.CreateCircle(c, &cModel.Circle{
Name: claims.DisplayName + "'s circle",
CreatedAt: time.Now(),
UpdatedAt: time.Now(),
InviteCode: utils.GenerateInviteCode(c),
})
if err != nil {
c.JSON(500, gin.H{
"error": "Error creating circle",
})
return
}
if err := h.circleRepo.AddUserToCircle(c, &cModel.UserCircle{
UserID: createdUser.ID,
CircleID: userCircle.ID,
Role: "admin",
IsActive: true,
CreatedAt: time.Now(),
UpdatedAt: time.Now(),
}); err != nil {
c.JSON(500, gin.H{
"error": "Error adding user to circle",
})
return
}
createdUser.CircleID = userCircle.ID
if err := h.userRepo.UpdateUser(c, createdUser); err != nil {
c.JSON(500, gin.H{
"error": "Error updating user",
})
return
}
}
// ... (JWT generation and response)
c.Set("user_account", acc)
h.jwtAuth.Authenticator(c)
tokenString, expire, err := h.jwtAuth.TokenGenerator(acc)
if err != nil {
logger.Error("Unable to Generate a Token")
c.JSON(http.StatusInternalServerError, gin.H{
"error": "Unable to Generate a Token",
})
return
}
c.JSON(http.StatusOK, gin.H{"token": tokenString, "expire": expire})
return
}
}
@ -610,13 +712,4 @@ func Routes(router *gin.Engine, h *Handler, auth *jwt.GinJWTMiddleware, limiter
authRoutes.POST("reset", h.resetPassword)
authRoutes.POST("password", h.updateUserPassword)
}
pingRoutes := router.Group("api/v1/ping")
pingRoutes.Use(utils.RateLimitMiddleware(limiter))
{
pingRoutes.GET("/", func(c *gin.Context) {
c.JSON(200, gin.H{
"message": "pong",
})
})
}
}

31
internal/user/model/model.go
View file

@ -7,18 +7,18 @@ import (
)
type User struct {
ID int `json:"id" gorm:"primary_key"` // Unique identifier
DisplayName string `json:"displayName" gorm:"column:display_name"` // Display name
Username string `json:"username" gorm:"column:username;unique"` // Username (unique)
Email string `json:"email" gorm:"column:email;unique"` // Email (unique)
Provider int `json:"provider" gorm:"column:provider"` // Provider
Password string `json:"-" gorm:"column:password"` // Password
CircleID int `json:"circleID" gorm:"column:circle_id"` // Circle ID
ChatID int64 `json:"chatID" gorm:"column:chat_id"` // Telegram chat ID
Image string `json:"image" gorm:"column:image"` // Image
CreatedAt time.Time `json:"created_at" gorm:"column:created_at"` // Created at
UpdatedAt time.Time `json:"updated_at" gorm:"column:updated_at"` // Updated at
Disabled bool `json:"disabled" gorm:"column:disabled"` // Disabled
ID int `json:"id" gorm:"primary_key"` // Unique identifier
DisplayName string `json:"displayName" gorm:"column:display_name"` // Display name
Username string `json:"username" gorm:"column:username;unique"` // Username (unique)
Email string `json:"email" gorm:"column:email;unique"` // Email (unique)
Provider AuthProviderType `json:"provider" gorm:"column:provider"` // Provider
Password string `json:"-" gorm:"column:password"` // Password
CircleID int `json:"circleID" gorm:"column:circle_id"` // Circle ID
ChatID int64 `json:"chatID" gorm:"column:chat_id"` // Telegram chat ID
Image string `json:"image" gorm:"column:image"` // Image
CreatedAt time.Time `json:"created_at" gorm:"column:created_at"` // Created at
UpdatedAt time.Time `json:"updated_at" gorm:"column:updated_at"` // Updated at
Disabled bool `json:"disabled" gorm:"column:disabled"` // Disabled
// Email string `json:"email" gorm:"column:email"` // Email
CustomerID *string `gorm:"column:customer_id;<-:false"` // read only column
Subscription *string `json:"subscription" gorm:"column:subscription;<-:false"` // read only column
@ -48,3 +48,10 @@ type UserNotificationTarget struct {
TargetID string `json:"target_id" gorm:"column:target_id"` // Target ID
CreatedAt time.Time `json:"-" gorm:"column:created_at"`
}
type AuthProviderType int
const (
AuthProviderDonetick AuthProviderType = iota
AuthProviderOAuth2
AuthProviderGoogle
)

8
main.go
View file

@ -24,6 +24,7 @@ import (
"donetick.com/core/internal/email"
label "donetick.com/core/internal/label"
lRepo "donetick.com/core/internal/label/repo"
"donetick.com/core/internal/resource"
notifier "donetick.com/core/internal/notifier"
nRepo "donetick.com/core/internal/notifier/repo"
@ -52,6 +53,8 @@ func main() {
// fx.Provide(config.NewConfig),
fx.Provide(auth.NewAuthMiddleware),
fx.Provide(auth.NewIdentityProvider),
fx.Provide(resource.NewHandler),
// fx.Provide(NewBot),
fx.Provide(database.NewDatabase),
@ -89,7 +92,7 @@ func main() {
fx.Provide(lRepo.NewLabelRepository),
fx.Provide(label.NewHandler),
fx.Provide(thing.NewWebhook),
fx.Provide(thing.NewAPI),
fx.Provide(thing.NewHandler),
fx.Provide(chore.NewAPI),
@ -103,9 +106,10 @@ func main() {
user.Routes,
circle.Routes,
thing.Routes,
thing.Webhooks,
thing.APIs,
label.Routes,
frontend.Routes,
resource.Routes,
func(r *gin.Engine) {},
),