@medusajs/auth-google 0.0.1

package/README.md

@@ -0,0 +1,11 @@
+## Testing
+
+In order to manually test the flow, you can do the following:
+
+1. Register an app in `https://console.cloud.google.com/apis/credentials/consent`
+2. Generate clientID and clientSecret credentials in the console
+3. Replace the values in the test with your credentials
+4. Remove the `server.listen()` call
+5. Run the tests, get the `location` value from the `authenticate` test, open the browser
+6. Once redirected, copy the `code` param from the URL, and add it in one of the `callback` success tests
+7. Once you run the tests, you should get back an access token, id token, and so on.

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+import { ModuleProviderExports } from "@medusajs/types";
+declare const providerExport: ModuleProviderExports;
+export default providerExport;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAKvD,QAAA,MAAM,cAAc,EAAE,qBAErB,CAAA;AAED,eAAe,cAAc,CAAA"}

package/dist/index.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const google_1 = require("./services/google");
+const services = [google_1.GoogleAuthService];
+const providerExport = {
+    services,
+};
+exports.default = providerExport;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFDQSw4Q0FBcUQ7QUFFckQsTUFBTSxRQUFRLEdBQUcsQ0FBQywwQkFBaUIsQ0FBQyxDQUFBO0FBRXBDLE1BQU0sY0FBYyxHQUEwQjtJQUM1QyxRQUFRO0NBQ1QsQ0FBQTtBQUVELGtCQUFlLGNBQWMsQ0FBQSJ9

package/dist/services/google.d.ts

@@ -0,0 +1,27 @@
+import { Logger, GoogleAuthProviderOptions, AuthenticationResponse, AuthenticationInput, AuthIdentityProviderService } from "@medusajs/types";
+import { AbstractAuthModuleProvider } from "@medusajs/utils";
+type InjectedDependencies = {
+    logger: Logger;
+};
+interface LocalServiceConfig extends GoogleAuthProviderOptions {
+}
+export declare class GoogleAuthService extends AbstractAuthModuleProvider {
+    protected config_: LocalServiceConfig;
+    protected logger_: Logger;
+    constructor({ logger }: InjectedDependencies, options: GoogleAuthProviderOptions);
+    authenticate(req: AuthenticationInput): Promise<AuthenticationResponse>;
+    validateCallback(req: AuthenticationInput, authIdentityService: AuthIdentityProviderService): Promise<AuthenticationResponse>;
+    verify_(idToken: string | undefined, authIdentityService: AuthIdentityProviderService): Promise<{
+        success: boolean;
+        error: any;
+        authIdentity?: undefined;
+    } | {
+        success: boolean;
+        authIdentity: any;
+        error?: undefined;
+    }>;
+    private getRedirect;
+    private validateConfig;
+}
+export {};
+//# sourceMappingURL=google.d.ts.map

package/dist/services/google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../src/services/google.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,yBAAyB,EACzB,sBAAsB,EACtB,mBAAmB,EACnB,2BAA2B,EAC5B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,0BAA0B,EAAe,MAAM,iBAAiB,CAAA;AAGzE,KAAK,oBAAoB,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED,UAAU,kBAAmB,SAAQ,yBAAyB;CAAG;AAGjE,qBAAa,iBAAkB,SAAQ,0BAA0B;IAC/D,SAAS,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACrC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAA;gBAGvB,EAAE,MAAM,EAAE,EAAE,oBAAoB,EAChC,OAAO,EAAE,yBAAyB;IAQ9B,YAAY,CAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,sBAAsB,CAAC;IAW5B,gBAAgB,CACpB,GAAG,EAAE,mBAAmB,EACxB,mBAAmB,EAAE,2BAA2B,GAC/C,OAAO,CAAC,sBAAsB,CAAC;IAmD5B,OAAO,CACX,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,mBAAmB,EAAE,2BAA2B;;;;;;;;;IAmDlD,OAAO,CAAC,WAAW;IAkBnB,OAAO,CAAC,cAAc;CAavB"}

package/dist/services/google.js

@@ -0,0 +1,127 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GoogleAuthService = void 0;
+const utils_1 = require("@medusajs/utils");
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+// TODO: Add state param that is stored in Redis, to prevent CSRF attacks
+class GoogleAuthService extends utils_1.AbstractAuthModuleProvider {
+    constructor({ logger }, options) {
+        super({}, { provider: "google", displayName: "Google Authentication" });
+        this.validateConfig(options);
+        this.config_ = options;
+        this.logger_ = logger;
+    }
+    async authenticate(req) {
+        if (req.query?.error) {
+            return {
+                success: false,
+                error: `${req.query.error_description}, read more at: ${req.query.error_uri}`,
+            };
+        }
+        return this.getRedirect(this.config_);
+    }
+    async validateCallback(req, authIdentityService) {
+        if (req.query && req.query.error) {
+            return {
+                success: false,
+                error: `${req.query.error_description}, read more at: ${req.query.error_uri}`,
+            };
+        }
+        const code = req.query?.code ?? req.body?.code;
+        if (!code) {
+            return { success: false, error: "No code provided" };
+        }
+        const params = `client_id=${this.config_.clientID}&client_secret=${this.config_.clientSecret}&code=${code}&redirect_uri=${encodeURIComponent(this.config_.callbackURL)}&grant_type=authorization_code`;
+        const exchangeTokenUrl = new URL(`https://oauth2.googleapis.com/token?${params}`);
+        try {
+            const response = await fetch(exchangeTokenUrl.toString(), {
+                method: "POST",
+            }).then((r) => {
+                if (!r.ok) {
+                    throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, `Could not exchange token, ${r.status}, ${r.statusText}`);
+                }
+                return r.json();
+            });
+            const { authIdentity, success } = await this.verify_(response.id_token, authIdentityService);
+            return {
+                success,
+                authIdentity,
+                successRedirectUrl: this.config_.successRedirectUrl,
+            };
+        }
+        catch (error) {
+            return { success: false, error: error.message };
+        }
+    }
+    async verify_(idToken, authIdentityService) {
+        if (!idToken) {
+            return { success: false, error: "No ID found" };
+        }
+        const jwtData = jsonwebtoken_1.default.decode(idToken, {
+            complete: true,
+        });
+        const payload = jwtData.payload;
+        if (!payload.email_verified) {
+            throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "Email not verified, cannot proceed with authentication");
+        }
+        // TODO: We should probably use something else than email here, like the `sub` field (which is more constant than the email)
+        const entity_id = payload.email;
+        const userMetadata = {
+            name: payload.name,
+            picture: payload.picture,
+            given_name: payload.given_name,
+            family_name: payload.family_name,
+        };
+        let authIdentity;
+        try {
+            authIdentity = await authIdentityService.retrieve({
+                entity_id,
+            });
+        }
+        catch (error) {
+            if (error.type === utils_1.MedusaError.Types.NOT_FOUND) {
+                const createdAuthIdentity = await authIdentityService.create({
+                    entity_id,
+                    user_metadata: userMetadata,
+                });
+                authIdentity = createdAuthIdentity;
+            }
+            else {
+                return { success: false, error: error.message };
+            }
+        }
+        return {
+            success: true,
+            authIdentity,
+        };
+    }
+    getRedirect({ clientID, callbackURL }) {
+        const redirectUrlParam = `redirect_uri=${encodeURIComponent(callbackURL)}`;
+        const clientIdParam = `client_id=${clientID}`;
+        const responseTypeParam = "response_type=code";
+        const scopeParam = "scope=email+profile+openid";
+        const authUrl = new URL(`https://accounts.google.com/o/oauth2/v2/auth?${[
+            redirectUrlParam,
+            clientIdParam,
+            responseTypeParam,
+            scopeParam,
+        ].join("&")}`);
+        return { success: true, location: authUrl.toString() };
+    }
+    validateConfig(config) {
+        if (!config.clientID) {
+            throw new Error("Google clientID is required");
+        }
+        if (!config.clientSecret) {
+            throw new Error("Google clientSecret is required");
+        }
+        if (!config.callbackURL) {
+            throw new Error("Google callbackUrl is required");
+        }
+    }
+}
+exports.GoogleAuthService = GoogleAuthService;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ29vZ2xlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3NlcnZpY2VzL2dvb2dsZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFPQSwyQ0FBeUU7QUFDekUsZ0VBQThDO0FBUTlDLHlFQUF5RTtBQUN6RSxNQUFhLGlCQUFrQixTQUFRLGtDQUEwQjtJQUkvRCxZQUNFLEVBQUUsTUFBTSxFQUF3QixFQUNoQyxPQUFrQztRQUVsQyxLQUFLLENBQUMsRUFBRSxFQUFFLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxXQUFXLEVBQUUsdUJBQXVCLEVBQUUsQ0FBQyxDQUFBO1FBQ3ZFLElBQUksQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDLENBQUE7UUFDNUIsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUE7UUFDdEIsSUFBSSxDQUFDLE9BQU8sR0FBRyxNQUFNLENBQUE7SUFDdkIsQ0FBQztJQUVELEtBQUssQ0FBQyxZQUFZLENBQ2hCLEdBQXdCO1FBRXhCLElBQUksR0FBRyxDQUFDLEtBQUssRUFBRSxLQUFLLEVBQUUsQ0FBQztZQUNyQixPQUFPO2dCQUNMLE9BQU8sRUFBRSxLQUFLO2dCQUNkLEtBQUssRUFBRSxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsaUJBQWlCLG1CQUFtQixHQUFHLENBQUMsS0FBSyxDQUFDLFNBQVMsRUFBRTthQUM5RSxDQUFBO1FBQ0gsQ0FBQztRQUVELE9BQU8sSUFBSSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUE7SUFDdkMsQ0FBQztJQUVELEtBQUssQ0FBQyxnQkFBZ0IsQ0FDcEIsR0FBd0IsRUFDeEIsbUJBQWdEO1FBRWhELElBQUksR0FBRyxDQUFDLEtBQUssSUFBSSxHQUFHLENBQUMsS0FBSyxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ2pDLE9BQU87Z0JBQ0wsT0FBTyxFQUFFLEtBQUs7Z0JBQ2QsS0FBSyxFQUFFLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxpQkFBaUIsbUJBQW1CLEdBQUcsQ0FBQyxLQUFLLENBQUMsU0FBUyxFQUFFO2FBQzlFLENBQUE7UUFDSCxDQUFDO1FBRUQsTUFBTSxJQUFJLEdBQUcsR0FBRyxDQUFDLEtBQUssRUFBRSxJQUFJLElBQUksR0FBRyxDQUFDLElBQUksRUFBRSxJQUFJLENBQUE7UUFDOUMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ1YsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLGtCQUFrQixFQUFFLENBQUE7UUFDdEQsQ0FBQztRQUVELE1BQU0sTUFBTSxHQUFHLGFBQWEsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLGtCQUMvQyxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQ2YsU0FBUyxJQUFJLGlCQUFpQixrQkFBa0IsQ0FDOUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQ3pCLGdDQUFnQyxDQUFBO1FBQ2pDLE1BQU0sZ0JBQWdCLEdBQUcsSUFBSSxHQUFHLENBQzlCLHVDQUF1QyxNQUFNLEVBQUUsQ0FDaEQsQ0FBQTtRQUVELElBQUksQ0FBQztZQUNILE1BQU0sUUFBUSxHQUFHLE1BQU0sS0FBSyxDQUFDLGdCQUFnQixDQUFDLFFBQVEsRUFBRSxFQUFFO2dCQUN4RCxNQUFNLEVBQUUsTUFBTTthQUNmLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRTtnQkFDWixJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDO29CQUNWLE1BQU0sSUFBSSxtQkFBVyxDQUNuQixtQkFBVyxDQUFDLEtBQUssQ0FBQyxZQUFZLEVBQzlCLDZCQUE2QixDQUFDLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQyxVQUFVLEVBQUUsQ0FDekQsQ0FBQTtnQkFDSCxDQUFDO2dCQUVELE9BQU8sQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFBO1lBQ2pCLENBQUMsQ0FBQyxDQUFBO1lBRUYsTUFBTSxFQUFFLFlBQVksRUFBRSxPQUFPLEVBQUUsR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQ2xELFFBQVEsQ0FBQyxRQUFrQixFQUMzQixtQkFBbUIsQ0FDcEIsQ0FBQTtZQUVELE9BQU87Z0JBQ0wsT0FBTztnQkFDUCxZQUFZO2dCQUNaLGtCQUFrQixFQUFFLElBQUksQ0FBQyxPQUFPLENBQUMsa0JBQWtCO2FBQ3BELENBQUE7UUFDSCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxLQUFLLENBQUMsT0FBTyxFQUFFLENBQUE7UUFDakQsQ0FBQztJQUNILENBQUM7SUFFRCxLQUFLLENBQUMsT0FBTyxDQUNYLE9BQTJCLEVBQzNCLG1CQUFnRDtRQUVoRCxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDYixPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsYUFBYSxFQUFFLENBQUE7UUFDakQsQ0FBQztRQUVELE1BQU0sT0FBTyxHQUFHLHNCQUFHLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRTtZQUNsQyxRQUFRLEVBQUUsSUFBSTtTQUNmLENBQWUsQ0FBQTtRQUNoQixNQUFNLE9BQU8sR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFBO1FBRS9CLElBQUksQ0FBQyxPQUFPLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDNUIsTUFBTSxJQUFJLG1CQUFXLENBQ25CLG1CQUFXLENBQUMsS0FBSyxDQUFDLFlBQVksRUFDOUIsd0RBQXdELENBQ3pELENBQUE7UUFDSCxDQUFDO1FBRUQsNEhBQTRIO1FBQzVILE1BQU0sU0FBUyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUE7UUFDL0IsTUFBTSxZQUFZLEdBQUc7WUFDbkIsSUFBSSxFQUFFLE9BQU8sQ0FBQyxJQUFJO1lBQ2xCLE9BQU8sRUFBRSxPQUFPLENBQUMsT0FBTztZQUN4QixVQUFVLEVBQUUsT0FBTyxDQUFDLFVBQVU7WUFDOUIsV0FBVyxFQUFFLE9BQU8sQ0FBQyxXQUFXO1NBQ2pDLENBQUE7UUFFRCxJQUFJLFlBQVksQ0FBQTtRQUVoQixJQUFJLENBQUM7WUFDSCxZQUFZLEdBQUcsTUFBTSxtQkFBbUIsQ0FBQyxRQUFRLENBQUM7Z0JBQ2hELFNBQVM7YUFDVixDQUFDLENBQUE7UUFDSixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxtQkFBVyxDQUFDLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQztnQkFDL0MsTUFBTSxtQkFBbUIsR0FBRyxNQUFNLG1CQUFtQixDQUFDLE1BQU0sQ0FBQztvQkFDM0QsU0FBUztvQkFDVCxhQUFhLEVBQUUsWUFBWTtpQkFDNUIsQ0FBQyxDQUFBO2dCQUNGLFlBQVksR0FBRyxtQkFBbUIsQ0FBQTtZQUNwQyxDQUFDO2lCQUFNLENBQUM7Z0JBQ04sT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQTtZQUNqRCxDQUFDO1FBQ0gsQ0FBQztRQUVELE9BQU87WUFDTCxPQUFPLEVBQUUsSUFBSTtZQUNiLFlBQVk7U0FDYixDQUFBO0lBQ0gsQ0FBQztJQUVPLFdBQVcsQ0FBQyxFQUFFLFFBQVEsRUFBRSxXQUFXLEVBQXNCO1FBQy9ELE1BQU0sZ0JBQWdCLEdBQUcsZ0JBQWdCLGtCQUFrQixDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUE7UUFDMUUsTUFBTSxhQUFhLEdBQUcsYUFBYSxRQUFRLEVBQUUsQ0FBQTtRQUM3QyxNQUFNLGlCQUFpQixHQUFHLG9CQUFvQixDQUFBO1FBQzlDLE1BQU0sVUFBVSxHQUFHLDRCQUE0QixDQUFBO1FBRS9DLE1BQU0sT0FBTyxHQUFHLElBQUksR0FBRyxDQUNyQixnREFBZ0Q7WUFDOUMsZ0JBQWdCO1lBQ2hCLGFBQWE7WUFDYixpQkFBaUI7WUFDakIsVUFBVTtTQUNYLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQ2QsQ0FBQTtRQUVELE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxPQUFPLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQTtJQUN4RCxDQUFDO0lBRU8sY0FBYyxDQUFDLE1BQTBCO1FBQy9DLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDckIsTUFBTSxJQUFJLEtBQUssQ0FBQyw2QkFBNkIsQ0FBQyxDQUFBO1FBQ2hELENBQUM7UUFFRCxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ3pCLE1BQU0sSUFBSSxLQUFLLENBQUMsaUNBQWlDLENBQUMsQ0FBQTtRQUNwRCxDQUFDO1FBRUQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUN4QixNQUFNLElBQUksS0FBSyxDQUFDLGdDQUFnQyxDQUFDLENBQUE7UUFDbkQsQ0FBQztJQUNILENBQUM7Q0FDRjtBQXJLRCw4Q0FxS0MifQ==

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@medusajs/auth-google",
+  "version": "0.0.1",
+  "description": "Google OAuth authentication provider for Medusa",
+  "main": "dist/index.js",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/medusajs/medusa",
+    "directory": "packages/modules/providers/auth-google"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "author": "Medusa",
+  "license": "MIT",
+  "scripts": {
+    "prepublishOnly": "cross-env NODE_ENV=production tsc --build",
+    "test": "jest --passWithNoTests src",
+    "test:integration": "jest --forceExit -- integration-tests/**/__tests__/**/*.spec.ts",
+    "build": "rimraf dist && tsc -p ./tsconfig.json",
+    "watch": "tsc --watch"
+  },
+  "devDependencies": {
+    "@medusajs/types": "^1.11.16",
+    "@types/simple-oauth2": "^5.0.7",
+    "cross-env": "^5.2.1",
+    "jest": "^29.7.0",
+    "msw": "^2.3.0",
+    "rimraf": "^5.0.1",
+    "typescript": "^5.1.6"
+  },
+  "dependencies": {
+    "@medusajs/utils": "^1.11.7",
+    "jsonwebtoken": "^9.0.2"
+  },
+  "keywords": [
+    "medusa-provider",
+    "medusa-provider-auth-google"
+  ]
+}