add github oauth

Author: Sheldenburg

.github/workflows/fastapi-to-gcr.yml

@@ -43,6 +43,6 @@ jobs:
           gcloud run deploy $SERVICE_NAME \
             --image ${{ env.DOCKER_IMAGE_URL }}:latest \
             --platform managed \
-            --set-env-vars POSTGRES_SERVER=${{ secrets.POSTGRES_SERVER }},POSTGRES_PORT=${{ secrets.POSTGRES_PORT }},POSTGRES_DB=${{ secrets.POSTGRES_DB }},POSTGRES_USER=${{ secrets.POSTGRES_USER }},POSTGRES_PASSWORD=${{ secrets.POSTGRES_PASSWORD }},ENCRYPTION_KEY=${{ secrets.ENCRYPTION_KEY }},PROJECT_NAME=${{ env.PROJECT_ID }},FIRST_SUPERUSER=${{ secrets.FIRST_SUPERUSER }},FIRST_SUPERUSER_PASSWORD=${{ secrets.FIRST_SUPERUSER_PASSWORD }},USERS_OPEN_REGISTRATION=${{ env.USERS_OPEN_REGISTRATION }},GOOGLE_CLIENT_ID=${{ secrets.GOOGLE_CLIENT_ID }},GOOGLE_CLIENT_SECRET=${{ secrets.GOOGLE_CLIENT_SECRET }},GOOGLE_REDIRECT_URI=${{ secrets.GOOGLE_REDIRECT_URI }} \
+            --set-env-vars POSTGRES_SERVER=${{ secrets.POSTGRES_SERVER }},POSTGRES_PORT=${{ secrets.POSTGRES_PORT }},POSTGRES_DB=${{ secrets.POSTGRES_DB }},POSTGRES_USER=${{ secrets.POSTGRES_USER }},POSTGRES_PASSWORD=${{ secrets.POSTGRES_PASSWORD }},ENCRYPTION_KEY=${{ secrets.ENCRYPTION_KEY }},PROJECT_NAME=${{ env.PROJECT_ID }},FIRST_SUPERUSER=${{ secrets.FIRST_SUPERUSER }},FIRST_SUPERUSER_PASSWORD=${{ secrets.FIRST_SUPERUSER_PASSWORD }},USERS_OPEN_REGISTRATION=${{ env.USERS_OPEN_REGISTRATION }},GOOGLE_CLIENT_ID=${{ secrets.GOOGLE_CLIENT_ID }},GOOGLE_CLIENT_SECRET=${{ secrets.GOOGLE_CLIENT_SECRET }},GOOGLE_REDIRECT_URI=${{ secrets.GOOGLE_REDIRECT_URI }},GH_CLIENT_ID=${{ secrets.GH_CLIENT_ID }},GH_CLIENT_SECRET=${{ secrets.GH_CLIENT_SECRET }} \
             --region australia-southeast1 \
             --allow-unauthenticated

backend/src/app/api/routes/login.py

@@ -141,7 +141,7 @@ def login_google():
 
 # Handle Google OAuth callback
 @router.get("/auth/google")
-def auth(session: SessionDep, code: str, response: Response):
+def google_oauth(session: SessionDep, code: str, response: Response):
     token_url = "https://oauth2.googleapis.com/token"
     token_data = {
         "code": code,
@@ -206,3 +206,73 @@ def auth(session: SessionDep, code: str, response: Response):
         httponly=True,
     )
     return response
+
+
+# Handle Github OAuth callback
+@router.get("/auth/github")
+def github_oauth(session: SessionDep, code: str, response: Response):
+    token_url = "https://github.com/login/oauth/access_token"
+    token_data = {
+        "code": code,
+        "client_id": settings.GITHUB_CLIENT_ID,
+        "client_secret": settings.GITHUB_CLIENT_SECRET,
+    }
+    headers = {"Accept": "application/json"}
+
+    token_r = requests.post(token_url, data=token_data, headers=headers)
+    token_json = token_r.json()
+    if "error" in token_json:
+        raise HTTPException(
+            status_code=400, detail="Failed to retrieve token from Github"
+        )
+    access_token = token_json["access_token"]
+    # Get user info from Github
+    user_info = requests.get(
+        "https://api.github.com/user",
+        headers={"Authorization": f"Bearer {access_token}"},
+    ).json()
+
+    user_emails = requests.get(
+        "https://api.github.com/user/emails",
+        headers={"Authorization": f"Bearer {access_token}"},
+    ).json()
+
+    # Check if the user already exists
+    user = crud.get_user_by_email(session=session, email=user_emails[0]["email"])
+    access_token_expires = timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
+    if user:
+        response = RedirectResponse("http://localhost:3000/dashboard")
+        response.set_cookie(
+            key="access_token",
+            value=security.create_access_token(
+                user.id, expires_delta=access_token_expires
+            ),
+            httponly=True,
+        )
+        return response
+
+    # Check if the app is open for new user registration
+    if not settings.USERS_OPEN_REGISTRATION:
+        raise HTTPException(
+            status_code=403,
+            detail="Open user registration is forbidden on this server",
+        )
+    # Create a new user
+    user_create = UserCreateOauth.model_validate(
+        {
+            "email": user_emails[0]["email"],
+            "is_active": True,
+            "is_superuser": False,
+            "full_name": user_info["login"],
+            "provider": "github",
+        }
+    )
+    user = crud.create_user_oauth(session=session, user_create=user_create)
+
+    response = RedirectResponse("http://localhost:3000/dashboard")
+    response.set_cookie(
+        key="access_token",
+        value=security.create_access_token(user.id, expires_delta=access_token_expires),
+        httponly=True,
+    )
+    return response

backend/src/app/core/config.py

@@ -122,5 +122,8 @@ def _enforce_non_default_secrets(self) -> Self:
     GOOGLE_CLIENT_SECRET: str
     GOOGLE_REDIRECT_URI: str
 
+    GH_CLIENT_ID: str
+    GH_CLIENT_SECRET: str
+
 
 settings = Settings()  # type: ignore

frontend/components/oauth-login.tsx

@@ -11,9 +11,18 @@ export function OAuthLogin() {
       console.error("Google Client ID or Redirect URI is not defined");
     }
     const googleAuthUrl = `https://accounts.google.com/o/oauth2/v2/auth?client_id=${GOOGLE_CLIENT_ID}&redirect_uri=${GOOGLE_REDIRECT_URI}&response_type=code&scope=email%20profile`;
-    console.log(googleAuthUrl);
     window.location.href = googleAuthUrl;
   }
+  async function loginGithub() {
+    const GITHUB_CLIENT_ID = process.env.NEXT_PUBLIC_GITHUB_CLIENT_ID;
+    const GITHUB_REDIRECT_URI = process.env.NEXT_PUBLIC_GITHUB_REDIRECT_URI;
+
+    if (!GITHUB_CLIENT_ID || !GITHUB_REDIRECT_URI) {
+      console.error("GitHub Client ID or Redirect URI is not defined");
+    }
+    const githubAuthUrl = `https://github.com/login/oauth/authorize?client_id=${GITHUB_CLIENT_ID}&scope=read:user user:email`;
+    window.location.href = githubAuthUrl;
+  }
   return (
     <div className="grid grid-cols-2 gap-6 mt-3">
       <Button variant="outline" onClick={loginGoogle}>
@@ -38,7 +47,7 @@ export function OAuthLogin() {
         </svg>
         Google
       </Button>
-      <Button variant="outline">
+      <Button variant="outline" onClick={loginGithub}>
         <Github className="mr-2 h-4 w-4" />
         GitHub
       </Button>