grahamc/hydra - Change 3QWDDLBR5DGFK5Y3TDMK55R2SCHRHFVO2KW2BMZGIYRTIQEZC45AC

Add support for logging in via a Google account

The required configuration in hydra.conf:

enable_google_login = 1 google_client_id = 238429sdjkds….apps.googleusercontent.com

and optionally persona_allowed_domains to restrict to one or more domains.

Created by Eelco Dolstra on January 13, 2016

3QWDDLBR5DGFK5Y3TDMK55R2SCHRHFVO2KW2BMZGIYRTIQEZC45AC

Dependencies

In channels

main

upstream

Change contents

Insertion in release.nix at line 120 [9.1]
[8.556]
[8.601]
```
            CryptJWT
```
Insertion in src/lib/Hydra/Controller/Root.pm at line 16 [10.804]
[10.1084]
[6.0]
Insertion in src/lib/Hydra/Controller/Root.pm at line 22 [10.804]
[6.87]
[6.87]
```
         $c->request->path eq "google-login" ||
```
Deletion in src/lib/Hydra/Controller/Root.pm at line 40 [10.804]
B:BD[11.196] → [12.0:78]
```
    $c->stash->{personaEnabled} = $c->config->{enable_persona} // "0" eq "1";
```
Insertion in src/lib/Hydra/Controller/Root.pm at line 73 [10.804]
[13.21615]
[13.21615]
Insertion in src/lib/Hydra/Controller/User.pm at line 7 [11.252]
[13.23630]
[14.272]
```
use Crypt::JWT qw(decode_jwt);
```

Deletion in src/lib/Hydra/Controller/User.pm at line 47 [11.252]

B:BD[13.24932] → [15.33:112]

B:BD[15.140] → [16.0:21]

B:BD[16.21] → [12.79:165]


sub persona_login :Path('/persona-login') Args(0) {
    my ($self, $c) = @_;
    requirePost($c);
    error($c, "Persona support is not enabled.") unless $c->stash->{personaEnabled};

Deletion in src/lib/Hydra/Controller/User.pm at line 48 [11.252]

B:BD[15.183] → [4.0:61]

∅:D[4.61] → [15.240:392]

B:BD[15.240] → [15.240:392]

B:BD[15.392] → [3.0:39]

∅:D[3.39] → [15.439:451]

B:BD[15.439] → [15.439:451]

B:BD[15.451] → [16.22:106]

    my $assertion = $c->stash->{params}->{assertion} or die;
    my $ua = new LWP::UserAgent;
    my $response = $ua->post(
        'https://verifier.login.persona.org/verify',
        { assertion => $assertion,
          audience => $c->uri_for('/')
        });
    error($c, "Did not get a response from Persona.") unless $response->is_success;

Replacement in src/lib/Hydra/Controller/User.pm at line 49 [11.252]

B:BD[11.1421] → [15.553:613]

B:BD[15.613] → [16.107:178]

    my $d = decode_json($response->decoded_content) or die;
    error($c, "Persona says: $d->{reason}") if $d->{status} ne "okay";

[11.1421]

[13.24933]

sub doEmailLogin {
    my ($self, $c, $type, $email, $fullName) = @_;

Replacement in src/lib/Hydra/Controller/User.pm at line 52 [11.252]
B:BD[13.24934] → [15.702:738]
```
    my $email = $d->{email} or die;
```
[13.24934]
[17.0]
```
    die "No email address provided.\n" unless defined $email;
```

Replacement in src/lib/Hydra/Controller/User.pm at line 56 [11.252]

B:BD[17.85] → [17.85:178]

    die "Illegal email address." unless $email =~ /^[a-zA-Z0-9\.\-\_]+@[a-zA-Z0-9\.\-\_]+$/;

[17.85]

[5.0]

    die "Illegal email address.\n" unless $email =~ /^[a-zA-Z0-9\.\-\_]+@[a-zA-Z0-9\.\-\_]+$/;

Replacement in src/lib/Hydra/Controller/User.pm at line 58 [11.252]

B:BD[5.1] → [5.1:145]

    # If persona_allowed_domains is set, check if the email address returned is on these domains.
    # When not configured, allow all domains.

[5.1]

[5.145]

    # If persona_allowed_domains is set, check if the email address
    # returned is on these domains.  When not configured, allow all
    # domains.

Replacement in src/lib/Hydra/Controller/User.pm at line 62 [11.252]
B:BD[5.216] → [5.216:251]
```
    if ( $allowed_domains ne "") {
```
[5.216]
[5.251]
```
    if ($allowed_domains ne "") {
```

Replacement in src/lib/Hydra/Controller/User.pm at line 70 [11.252]

B:BD[5.505] → [5.505:576]

        die "Email address is not allowed to login." unless $email_ok;

[5.505]

[5.576]

        error($c, "Your email address does not belong to a domain that is allowed to log in.\n")
            unless $email_ok;

Replacement in src/lib/Hydra/Controller/User.pm at line 76 [11.252]

B:BD[15.794] → [15.794:812]

    if (!$user) {

[15.794]

[15.812]

    if ($user) {
        # Automatically upgrade Persona accounts to Google accounts.
        if ($user->type eq "persona" && $type eq "google") {
            $user->update({type => "google"});
        }
        die "You cannot login via login type '$type'.\n" if $user->type ne $type;
    } else {

Insertion in src/lib/Hydra/Controller/User.pm at line 86 [11.252]
[15.885]
[15.885]
```
            , fullname => $fullName,
```
Replacement in src/lib/Hydra/Controller/User.pm at line 89 [11.252]
B:BD[15.953] → [18.0:32]
```
            , type => "persona"
```
[15.953]
[15.953]
```
            , type => $type
```

Insertion in src/lib/Hydra/Controller/User.pm at line 99 [11.252]

[15.1115]


sub persona_login :Path('/persona-login') Args(0) {
    my ($self, $c) = @_;
    requirePost($c);
    error($c, "Logging in via Persona is not enabled.") unless $c->config->{enable_persona};

Insertion in src/lib/Hydra/Controller/User.pm at line 107 [11.252]
[15.1116]
[15.1116]
```
    my $assertion = $c->stash->{params}->{assertion} or die;
```

Insertion in src/lib/Hydra/Controller/User.pm at line 109 [11.252]

[15.1117]

[11.1421]

    my $ua = new LWP::UserAgent;
    my $response = $ua->post(
        'https://verifier.login.persona.org/verify',
        { assertion => $assertion,
          audience => $c->uri_for('/')
        });
    error($c, "Did not get a response from Persona.") unless $response->is_success;
    my $d = decode_json($response->decoded_content) or die;
    error($c, "Persona says: $d->{reason}") if $d->{status} ne "okay";
    doEmailLogin($self, $c, "persona", $d->{email}, undef);
}
# From https://www.googleapis.com/oauth2/v3/certs. Should probably not
# hard-code this.
my $googleKeys = <<'EOF';
{
 "keys": [
  {
   "kty": "RSA",
   "alg": "RS256",
   "use": "sig",
   "kid": "10685afd5291883ce668345afd77201390406f82",
   "n": "xeNopuszp35W6H1w2Tw4OrSwT8BZ9f7-2PoOyWZmfMmUDmYT2uxrZezDK0YLap5LVmpLNcpZP5Hj67_32NU3my4qfA-SlxuJMUxHWJF7Dqr-QNAqld0SZ_po4qz5ZTHDxNxoZ4iw_T-4lhIBGm0RIZprDDGPI7Vo8qIeIMjZywoh_nq32zB6tnjEUBvHcgay0qXEnQkKkavzHO_c5sLc1qXM0jDQVqyO1enevW2yA_8gP0Qb7014ycN5umCvEHc66c2_iNT-R4zgw8gd1g05n2xwyET8qb_3wi5LqUV-Cri4mJ2xwGY8uynlD2I4jVtOYJusBgNs6AfwyehzsLdwSQ",
   "e": "AQAB"
  },
  {
   "kty": "RSA",
   "alg": "RS256",
   "use": "sig",
   "kid": "5a68fc8a3ec0c30e0be95aa08db99a68a725467f",
   "n": "zmXvUwXYSo8VouhnkURp-3xywch-jPrk7q0gugqC7QIchBPnvdXdS-bj6sr1AqDl_hEDtiLGfiVr3Ft_U022rtHAl5n5NxyybUtZXWyT5yQZM4jopGBajavEUdCl9b4pqb-q_3fVaxUXe7re23sVjI5Bntd-8RYZ70tq-ZvCWBqsnz6lHi9Ditp3CZGWLMMBZlIv3nKnClOrZXL98Jmt7AAod-Gtk65saqnrMwWtBcI_Q-3u23ytywbMLanCeFFNUWlIOgZqyYYkOm-ylLRJzVaZ1THtcWILWCYUgxXjyF9DtXO3a8nct2JhdacD3LzRiPv3sXr31cg4arwUk19JoQ",
   "e": "AQAB"
  }
 ]
}
EOF
sub google_login :Path('/google-login') Args(0) {
    my ($self, $c) = @_;
    requirePost($c);
    error($c, "Logging in via Google is not enabled.") unless $c->config->{enable_google_login};
    my $data = decode_jwt(
        token => ($c->stash->{params}->{id_token} // die "No token."),
        kid_keys => $googleKeys,
        verify_exp => 1,
    );
    die unless $data->{aud} eq $c->config->{google_client_id};
    die unless $data->{iss} eq "accounts.google.com" || $data->{iss} eq "https://accounts.google.com";
    die "Email address is not verified" unless $data->{email_verified};
    # FIXME: verify hosted domain claim?
    doEmailLogin($self, $c, "google", $data->{email}, $data->{name} // undef);
}

File addition: auth.tt (----------)

[19.1486]

[% IF c.user_exists  %]
  <script>
    function finishSignOut() {
      $.post("[% c.uri_for('/logout') %]")
        .done(function(data) {
          window.location.reload();
        })
        .fail(function() { bootbox.alert("Server request failed!"); });
    }
    function signOut() {
      [% IF c.user.type == 'google' %]
        gapi.load('auth2', function() {
          gapi.auth2.init();
          var auth2 = gapi.auth2.getAuthInstance();
          auth2.then(function () {
            auth2.signOut().then(finishSignOut, finishSignOut);
          });
        });
      [% ELSE %]
        finishSignOut();
      [% END %]
    }
  </script>
[% ELSE %]
  <div id="hydra-signin" class="modal hide fade" tabindex="-1" role="dialog" aria-hidden="true">
    <form class="form-horizontal">
      <div class="modal-body">
        <div class="control-group">
          <label class="control-label">User name</label>
          <div class="controls">
            <input type="text" class="span3" name="username" value=""/>
          </div>
        </div>
        <div class="control-group">
          <label class="control-label">Password</label>
          <div class="controls">
            <input type="password" class="span3" name="password" value=""/>
          </div>
        </div>
      </div>
      <div class="modal-footer">
        <button id="do-signin" class="btn btn-primary">Sign in</button>
        <button class="btn" data-dismiss="modal" aria-hidden="true">Cancel</button>
      </div>
    </form>
  </div>
  <script>
    function finishSignOut() { }
    $("#do-signin").click(function() {
      requestJSON({
        url: "[% c.uri_for('/login') %]",
        data: $(this).parents("form").serialize(),
        type: 'POST',
        success: function(data) {
          window.location.reload();
        }
      });
      return false;
    });
  </script>
  [% IF c.config.enable_google_login %]
    <script>
      function onGoogleSignIn(googleUser) {
        requestJSON({
          url: "[% c.uri_for('/google-login') %]",
          data: "id_token=" + googleUser.getAuthResponse().id_token,
          type: 'POST',
          success: function(data) {
            window.location.reload();
          }
        });
        return false;
      };
    </script>
  [% END %]
[% END %]
[% IF c.config.enable_persona %]
  <script src="https://login.persona.org/include.js"></script>
  <script>
    navigator.id.watch({
      onlogin: function(assertion) {
        requestJSON({
          url: "[% c.uri_for('/persona-login') %]",
          data: "assertion=" + assertion,
          type: 'POST',
          success: function(data) { window.location.reload(); },
          postError: function() { navigator.id.logout(); }
        });
      }
    });
    $("#persona-signin").click(function() {
      navigator.id.request({ siteName: 'Hydra' });
    });
  </script>
[% END %]

Insertion in src/root/layout.tt at line 38 [10.11219]

[2.2270]

[20.54]


    [% IF c.config.enable_google_login %]
      <meta name="google-signin-client_id" content="[% c.config.google_client_id %]">
      <script src="https://apis.google.com/js/platform.js" async="1" defer="1"></script>
    [% END %]

Replacement in src/root/layout.tt at line 102 [10.11219]

B:BD[21.9312] → [18.511:641]

          You are signed in as <tt>[% HTML.escape(c.user.username) %]</tt>[% IF c.user.type == 'persona' %] via Persona[% END %].

[21.9312]

[21.9375]

          You are signed in as <tt>[% HTML.escape(c.user.username) %]</tt>
            [%- IF c.user.type == 'persona' %] via Persona
            [%- ELSIF c.user.type == 'google' %] via Google[% END %].

Deletion in src/root/layout.tt at line 110 [10.11219]

B:BD[15.1323] → [15.1323:1337]

B:BD[15.1337] → [22.218:246]

B:BD[22.246] → [12.166:428]

∅:D[12.428] → [22.449:471]

B:BD[22.449] → [22.449:471]

∅:D[22.471] → [23.7485:7486]

∅:D[15.2168] → [23.7485:7486]

B:BD[10.11729] → [23.7485:7486]

B:BD[23.7486] → [18.642:695]

∅:D[18.695] → [22.525:603]

B:BD[22.525] → [22.525:603]

B:BD[22.603] → [7.0:31]

∅:D[7.31] → [22.618:685]

B:BD[22.618] → [22.618:685]

∅:D[22.685] → [15.2257:2258]

B:BD[15.2257] → [15.2257:2258]

B:BD[15.2258] → [22.686:868]

B:BD[22.868] → [24.35:191]

B:BD[24.191] → [12.429:561]

∅:D[12.561] → [24.259:275]

B:BD[24.259] → [24.259:275]

∅:D[24.275] → [22.1243:1297]

B:BD[22.1243] → [22.1243:1297]

∅:D[22.1297] → [15.2360:2361]

B:BD[15.2360] → [15.2360:2361]

B:BD[15.2361] → [22.1298:1346]

B:BD[22.1346] → [25.0:55]

∅:D[25.55] → [22.1380:1518]

B:BD[22.1380] → [22.1380:1518]

B:BD[22.1518] → [26.422:1400]


    <script>
      function doLogout() {
        [% IF c.user_exists %]
          $.post("[% c.uri_for('/logout') %]")
            .done(function(data) {
              window.location.reload();
            })
            .fail(function() { bootbox.alert("Server request failed!"); });
        [% END %]
      }
    </script>
    [% IF c.user_exists && c.user.type == 'hydra' %]
      <script>
        $("#persona-signout").click(doLogout);
      </script>
    [% ELSIF personaEnabled %]
      <script src="https://login.persona.org/include.js"></script>
      <script>
        navigator.id.watch({
          loggedInUser: [% c.user_exists ? '"' _ HTML.escape(c.user.username) _ '"' : "null" %],
          onlogin: function(assertion) {
            requestJSON({
              url: "[% c.uri_for('/persona-login') %]",
              data: "assertion=" + assertion,
              type: 'POST',
              success: function(data) { window.location.reload(); },
              postError: function() { navigator.id.logout(); }
            });
          },
          onlogout: doLogout
        });
        $("#persona-signin").click(function() {
          navigator.id.request({ siteName: 'Hydra' });
        });
        $("#persona-signout").click(function() {
          navigator.id.logout();
        });
      </script>
    [% END %]
    [% IF !c.user_exists %]
      <div id="hydra-signin" class="modal hide fade" tabindex="-1" role="dialog" aria-hidden="true">
        <form class="form-horizontal">
          <div class="modal-body">
            <div class="control-group">
              <label class="control-label">User name</label>
              <div class="controls">
                <input type="text" class="span3" name="username" value=""/>
              </div>
            </div>
            <div class="control-group">
              <label class="control-label">Password</label>
              <div class="controls">
                <input type="password" class="span3" name="password" value=""/>
              </div>
            </div>
          </div>
          <div class="modal-footer">
            <button id="do-signin" class="btn btn-primary">Sign in</button>
            <button class="btn" data-dismiss="modal" aria-hidden="true">Cancel</button>
          </div>
        </form>
      </div>

Replacement in src/root/layout.tt at line 111 [10.11219]

B:BD[26.1401] → [26.1401:1804]

      <script>
          $("#do-signin").click(function() {
            requestJSON({
              url: "[% c.uri_for('/login') %]",
              data: $(this).parents("form").serialize(),
              type: 'POST',
              success: function(data) {
                window.location.reload();
              }
            });
            return false;
          });
      </script>
    [% END %]

[26.1401]

[26.1804]

    [% PROCESS auth.tt %]

Replacement in src/root/topbar.tt at line 130 [27.6671]

B:BD[15.2441] → [15.2441:2493]

      <a href="#" id="persona-signout">Sign out</a>

[15.2441]

[15.2493]

      <a href="#" onclick="signOut();">Sign out</a>

Replacement in src/root/topbar.tt at line 133 [27.6671]

B:BD[28.311] → [12.616:692]

    [% IF personaEnabled %]
      [% WRAPPER makeSubMenu title="Sign in" %]

[28.311]

[12.692]

    [% WRAPPER makeSubMenu title="Sign in" %]
      [% IF c.config.enable_google_login %]
        <li>
          <a><div class="g-signin2" data-onsuccess="onGoogleSignIn" data-theme="dark"></div></a>
        </li>
        <li class="divider"></li>
      [% END %]
      [% IF c.config.enable_persona %]

Deletion in src/root/topbar.tt at line 147 [27.6671]

B:BD[12.930] → [12.930:1044]

        <li>
          <a href="#hydra-signin" data-toggle="modal">Sign in with a Hydra account</a>
        </li>

Deletion in src/root/topbar.tt at line 148 [27.6671]
B:BD[12.1060] → [12.1060:1075]
```
    [% ELSE %]
```

Replacement in src/root/topbar.tt at line 149 [27.6671]

B:BD[25.339] → [12.1076:1140]

        <a href="#hydra-signin" data-toggle="modal">Sign in</a>

[25.339]

[25.418]

        <a href="#hydra-signin" data-toggle="modal">Sign in with a Hydra account</a>

Replacement in src/root/user.tt at line 56 [30.4561]

B:BD[11.5979] → [29.1750:1935]

        <input type="text" class="span3" name="emailaddress" [% IF !create && user.type == 'persona' %]disabled="disabled"[% END %] [%+ HTML.attributes(value => user.emailaddress) %]/>

[11.5979]

[11.6099]

        <input type="text" class="span3" name="emailaddress" [% IF !create && user.username.search('@') %]disabled="disabled"[% END %] [%+ HTML.attributes(value => user.emailaddress) %]/>

Add support for logging in via a Google account

Dependencies

In channels

Change contents

Insertion in release.nix at line 120 [9.1]

Insertion in src/lib/Hydra/Controller/Root.pm at line 16 [10.804]

Insertion in src/lib/Hydra/Controller/Root.pm at line 22 [10.804]

Deletion in src/lib/Hydra/Controller/Root.pm at line 40 [10.804]

Insertion in src/lib/Hydra/Controller/Root.pm at line 73 [10.804]

Insertion in src/lib/Hydra/Controller/User.pm at line 7 [11.252]