@things-factory/auth-google 6.1.188 → 6.1.189

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-google",
-  "version": "6.1.188",
+  "version": "6.1.189",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -29,10 +29,11 @@
   "dependencies": {
     "@operato/graphql": "^1.0.0",
     "@operato/shell": "^1.0.0",
-    "@things-factory/auth-base": "^6.1.186",
-    "@things-factory/shell": "^6.1.186",
+    "@things-factory/auth-base": "^6.1.189",
+    "@things-factory/shell": "^6.1.189",
+    "googleapis": "^126.0.1",
     "passport": "^0.6.0",
     "passport-google-oauth20": "^2.0.0"
   },
-  "gitHead": "ae62986a327cfe158261052f0ae4f4586d4de55c"
+  "gitHead": "0a7d81fcf229582aa643223c56ece75a0432f7d8"
 }

package/server/controllers/get-oauth2-client.ts

@@ -0,0 +1,22 @@
+import { google } from 'googleapis'
+
+import { AuthProvider } from '@things-factory/auth-base'
+
+export async function getOauth2Client(authProvider: AuthProvider): Promise<any> {
+  try {
+    const { privateKey } = authProvider
+
+    const serviceAccount = JSON.parse(privateKey)
+
+    const client = new google.auth.JWT(serviceAccount.client_email, null, serviceAccount.private_key, [
+      'https://www.googleapis.com/auth/admin.directory.user'
+    ])
+
+    await client.authorize()
+
+    return client
+  } catch (error) {
+    console.error('Error fetching oauth2 client:', error)
+    return null
+  }
+}

package/server/controllers/subscribe-users-change.ts

@@ -1,34 +1,35 @@
 import fetch from 'node-fetch'
 
-import { getAccessToken } from './get-access-token'
+import { getOauth2Client } from './get-oauth2-client'
 import { AuthProvider } from '@things-factory/auth-base'
 
+/* TODO Implement with google */
 var clientState
 
 export function getClientState() {
   return clientState
 }
 
-export async function msgraphSubscriptions(authProvider: AuthProvider) {
-  const accessToken = await getAccessToken(authProvider)
-  const expirationDateTime = new Date(Date.now() + 3 * 24 * 60 * 60 * 1000)
+export async function googleSubscriptions(authProvider: AuthProvider) {
+  const client = await getOauth2Client(authProvider)
+  // const expirationDateTime = new Date(Date.now() + 3 * 24 * 60 * 60 * 1000)
 
-  clientState = `${authProvider.domainId}:${authProvider.id}` // TODO make secure
+  // clientState = `${authProvider.domainId}:${authProvider.id}` // TODO make secure
 
-  const response = await fetch('https://graph.microsoft.com/v1.0/subscriptions', {
-    method: 'POST',
-    headers: {
-      Authorization: `Bearer ${accessToken}`,
-      'Content-Type': 'application/json'
-    },
-    body: JSON.stringify({
-      changeType: 'created,updated',
-      notificationUrl: 'YOUR_WEBHOOK_ENDPOINT_BASE' + '/webhook/google-users',
-      resource: '/users',
-      expirationDateTime: expirationDateTime.toISOString() /* 최대 3일 이내, UTC 타임으로 설정 */,
-      clientState
-    })
-  })
+  // const response = await fetch('https://graph.microsoft.com/v1.0/subscriptions', {
+  //   method: 'POST',
+  //   headers: {
+  //     Authorization: `Bearer ${accessToken}`,
+  //     'Content-Type': 'application/json'
+  //   },
+  //   body: JSON.stringify({
+  //     changeType: 'created,updated',
+  //     notificationUrl: 'YOUR_WEBHOOK_ENDPOINT_BASE' + '/webhook/google-users',
+  //     resource: '/users',
+  //     expirationDateTime: expirationDateTime.toISOString() /* 최대 3일 이내, UTC 타임으로 설정 */,
+  //     clientState
+  //   })
+  // })
 
-  const data = await response.json()
+  // const data = await response.json()
 }

package/server/controllers/sync-user-info.ts

@@ -1,25 +1,36 @@
 import fetch from 'node-fetch'
-
-import { AuthProvider, User, UserStatus, UsersAuthProviders } from '@things-factory/auth-base'
-import { getAccessToken } from './get-access-token'
+import { google } from 'googleapis'
+
+import {
+  AuthProvider,
+  User,
+  UserStatus,
+  UsersAuthProviders,
+  encryptState,
+  decryptState
+} from '@things-factory/auth-base'
+import { config } from '@things-factory/env'
+import { getOauth2Client } from './get-oauth2-client'
 
 export async function syncAllUserInfo(authProvider: AuthProvider, context: ResolverContext) {
-  const accessToken = await getAccessToken(authProvider)
+  const oauth2Client = await getOauth2Client(authProvider)
 
-  if (!accessToken) {
-    throw new Error('Failed to obtain access token')
-  }
+  const service = google.admin({ version: 'directory_v1', auth: oauth2Client })
 
-  const latestData = await fetch('https://graph.microsoft.com/v1.0/users', {
-    headers: {
-      Authorization: `Bearer ${accessToken}`
-    }
-  }).then(res => res.json())
+  const res = await service.users.list({
+    customer: 'my_customer' /* 'my_customer'는 G Suite 도메인의 모든 사용자를 나타내는 특수 문자열입니다 */,
+    maxResults: 10,
+    orderBy: 'email'
+  })
 
-  for (const user of latestData.value) {
-    if (user.mail) {
+  const users = res.data.users
+
+  if (users && users.length) {
+    for (const user of users) {
       await updateUserInfo(authProvider, user, context)
     }
+  } else {
+    console.log('No users found.')
   }
 }
 
@@ -27,39 +38,57 @@ export async function updateUserInfo(authProvider: AuthProvider, userInfo, conte
   const { tx, domain, user } = context.state
 
   // {
-  //   "id": "d290f1ee-6c54-4b01-90e6-d701748f0851",
-  //   "businessPhones": [
-  //     "+1 412 555 0109"
+  //   "kind": "admin#directory#user",
+  //   "id": "user's unique ID",
+  //   "etag": "etag of this resource",
+  //   "primaryEmail": "user@example.com",
+  //   "name": {
+  //     "givenName": "First",
+  //     "familyName": "Last",
+  //     "fullName": "First Last"
+  //   },
+  //   "isAdmin": false,
+  //   "isDelegatedAdmin": false,
+  //   "lastLoginTime": "2021-04-05T12:07:41.000Z",
+  //   "creationTime": "2017-05-26T10:57:00.000Z",
+  //   "agreedToTerms": true,
+  //   "suspended": false,
+  //   "archived": false,
+  //   "changePasswordAtNextLogin": false,
+  //   "ipWhitelisted": false,
+  //   "emails": [
+  //     {
+  //       "address": "user@example.com",
+  //       "type": "work",
+  //       "customType": "",
+  //       "primary": true
+  //     }
+  //   ],
+  //   "organizations": [
+  //     {
+  //       "name": "Department Name",
+  //       "title": "Job Title",
+  //       "type": "work",
+  //       "primary": true
+  //     }
+  //   ],
+  //   "phones": [
+  //     {
+  //       "value": "+1 xxx-xxx-xxxx",
+  //       "type": "work",
+  //       "primary": true
+  //     }
   //   ],
-  //   "displayName": "John Doe",
-  //   "givenName": "John",
-  //   "jobTitle": "Developer",
-  //   "mail": "john.doe@contoso.com",
-  //   "mobilePhone": "+1 412 555 0109",
-  //   "officeLocation": "Floor 2",
-  //   "preferredLanguage": "en-US",
-  //   "surname": "Doe",
-  //   "userPrincipalName": "john.doe@contoso.com"
+  //   "aliases": ["alias@example.com"],
+  //   // ... 다른 필드들
   // }
-  const {
-    id,
-    businessPhones,
-    displayName,
-    givenName,
-    surname,
-    jobTitle,
-    mail,
-    mobilePhone,
-    officeLocation,
-    preferredLanguage,
-    userPricipalName
-  } = userInfo
+  const { id, name, primaryEmail } = userInfo
 
   const repository = tx.getRepository(User)
 
   // 1. 사용자를 찾는다.(email 정보로)
   const existingUser = await repository.findOne({
-    where: { email: mail },
+    where: { email: primaryEmail },
     relations: ['domains']
   })
 
@@ -72,16 +101,15 @@ export async function updateUserInfo(authProvider: AuthProvider, userInfo, conte
 
     const createdUser = await repository.save({
       id,
-      name: displayName,
-      email: mail,
+      name: name.fullName,
+      email: primaryEmail,
       creator: user,
       updater: user,
       domains: domain ? [domain] : [],
       roles: [],
       salt,
       userType: 'user',
-      // ssoId: id,
-      locale: preferredLanguage,
+      // locale: preferredLanguage,
       status: UserStatus.ACTIVATED,
       passwordUpdatedAt: new Date(),
       password: User.encode(password, salt)
@@ -105,10 +133,9 @@ export async function updateUserInfo(authProvider: AuthProvider, userInfo, conte
 
     const updatedUser = await repository.save({
       ...existingUser,
-      name: displayName,
-      // ssoId: id,
+      name: name.fullName,
       domains,
-      locale: preferredLanguage,
+      // locale: preferredLanguage,
       updater: user
     })
 

package/server/router/auth-google-router.ts

@@ -3,11 +3,13 @@ import Router from 'koa-router'
 import passport from 'koa-passport'
 import { authGoogleMiddleware } from '../middlewares'
 
+import { encryptState, decryptState } from '@things-factory/auth-base'
+
 export const authGoogleRouter = new Router()
 
 authGoogleRouter.get(
   '/auth/callback-auth-google',
-  passport.authenticate('google', { failureRedirect: '/auth/signin' }),
+  passport.authenticate('google', { failureRedirect: '/auth/signin', successRedirect: '/auth/checkin' }),
   ctx => {
     ctx.redirect('/auth/checkin')
   }

package/server/router/auth-google-webhook-router.ts

@@ -4,17 +4,18 @@ import fetch from 'node-fetch'
 import { getRepository, getDataSource } from '@things-factory/shell'
 
 import { updateUserInfo } from '../controllers/sync-user-info'
-import { getAccessToken } from '../controllers/get-access-token'
+import { getOauth2Client } from '../controllers/get-oauth2-client'
 import { AuthProvider } from '@things-factory/auth-base'
 
 export const authGoogleWebhookRouter = new Router()
 
 // Microsoft Graph에서 발송되는 알림을 처리하기 위한 타입 정의
-interface Notification {
-  resourceData: {
-    id: string
-  }
-}
+// TODO implement with google
+// interface Notification {
+//   resourceData: {
+//     id: string
+//   }
+// }
 
 authGoogleWebhookRouter.post('/webhook/google-users', async context => {
   const notifications: Notification[] = context.request.body.value
@@ -50,46 +51,46 @@ authGoogleWebhookRouter.post('/webhook/google-users', async context => {
       return
     }
 
-    const accessToken = await getAccessToken(authProvider)
-
-    for (const notification of notifications) {
-      const userId = notification.resourceData.id
-
-      try {
-        const userResponse = await fetch(`https://graph.microsoft.com/v1.0/users/${userId}`, {
-          headers: {
-            Authorization: `Bearer ${accessToken}`
-          }
-        })
-
-        if (!userResponse.ok) {
-          throw new Error(`Failed to fetch user data: ${userResponse.statusText}`)
-        }
-
-        const userInfo = await userResponse.json()
-
-        // {
-        //   "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users/$entity",
-        //   "businessPhones": ["+1 412 555 0109"],
-        //   "displayName": "Megan Bowen",
-        //   "givenName": "Megan",
-        //   "jobTitle": "Auditor",
-        //   "mail": "MeganB@M365x214355.onmicrosoft.com",
-        //   "mobilePhone": "+1 412 555 0109",
-        //   "officeLocation": "12/1110",
-        //   "preferredLanguage": "en-US",
-        //   "surname": "Bowen",
-        //   "userPrincipalName": "MeganB@M365x214355.onmicrosoft.com",
-        //   "id": "48d31887-5fad-4d73-a9f5-3c356e68a038"
-        // }
-
-        // webhook 호출로부터 호출한 tenant를 알 수 있다면, 매핑된 도메인 정보를 포함할 수 있을 것 같은데..
-
-        await updateUserInfo(authProvider, userInfo, wrap)
-      } catch (error) {
-        console.error('Error fetching user data from Microsoft Graph:', error)
-      }
-    }
+    const oauth2Client = await getOauth2Client(authProvider)
+
+    // for (const notification of notifications) {
+    //   const userId = notification.resourceData.id
+
+    //   try {
+    //     const userResponse = await fetch(`https://graph.microsoft.com/v1.0/users/${userId}`, {
+    //       headers: {
+    //         Authorization: `Bearer ${accessToken}`
+    //       }
+    //     })
+
+    //     if (!userResponse.ok) {
+    //       throw new Error(`Failed to fetch user data: ${userResponse.statusText}`)
+    //     }
+
+    //     const userInfo = await userResponse.json()
+
+    //     // {
+    //     //   "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users/$entity",
+    //     //   "businessPhones": ["+1 412 555 0109"],
+    //     //   "displayName": "Megan Bowen",
+    //     //   "givenName": "Megan",
+    //     //   "jobTitle": "Auditor",
+    //     //   "mail": "MeganB@M365x214355.onmicrosoft.com",
+    //     //   "mobilePhone": "+1 412 555 0109",
+    //     //   "officeLocation": "12/1110",
+    //     //   "preferredLanguage": "en-US",
+    //     //   "surname": "Bowen",
+    //     //   "userPrincipalName": "MeganB@M365x214355.onmicrosoft.com",
+    //     //   "id": "48d31887-5fad-4d73-a9f5-3c356e68a038"
+    //     // }
+
+    //     // webhook 호출로부터 호출한 tenant를 알 수 있다면, 매핑된 도메인 정보를 포함할 수 있을 것 같은데..
+
+    //     await updateUserInfo(authProvider, userInfo, wrap)
+    //   } catch (error) {
+    //     console.error('Error fetching user data from Microsoft Graph:', error)
+    //   }
+    // }
   })
 
   context.status = 202

package/server/controllers/get-access-token.ts

@@ -1,30 +0,0 @@
-import fetch from 'node-fetch'
-
-import { AuthProvider } from '@things-factory/auth-base'
-
-const authorityHostUrl = 'https://login.microsoftonline.com'
-
-export async function getAccessToken(authProvider: AuthProvider): Promise<string | null> {
-  try {
-    const { clientId, clientSecret, tenantId } = authProvider
-
-    const authorityUrl = `${authorityHostUrl}/${tenantId}`
-    const resource = 'https://graph.microsoft.com'
-    const OAUTH2_URL = `${authorityUrl}/oauth2/token?api-version=1.0`
-
-    const tokenResponse = await fetch(OAUTH2_URL, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/x-www-form-urlencoded'
-      },
-      body: `client_id=${clientId}&resource=${resource}&client_secret=${clientSecret}&grant_type=client_credentials`
-    })
-
-    const result = await tokenResponse.json()
-    const { access_token } = result
-    return access_token
-  } catch (error) {
-    console.error('Error fetching access token:', error)
-    return null
-  }
-}