9f376c43b5
This makes account signup enforcement consistent when signup is disabled at the installation level. Email signup and Google signup now stay blocked regardless of whether the config value is stored as a string or a boolean. This effectively covers the config-loader path, where `YAML.safe_load` reads `value: false` from `installation_config.yml` as a native boolean and persists it that way. - Normalized the account signup check so disabled signup is handled consistently across config value types. - Reused the same check across API signup and Google signup entry points. - Added regression coverage for the disabled-signup cases in the existing controller specs. --------- Co-authored-by: Vishnu Narayanan <iamwishnu@gmail.com>
90 lines
3.1 KiB
Ruby
90 lines
3.1 KiB
Ruby
class DeviseOverrides::OmniauthCallbacksController < DeviseTokenAuth::OmniauthCallbacksController
|
|
include EmailHelper
|
|
|
|
def omniauth_success
|
|
get_resource_from_auth_hash
|
|
|
|
@resource.present? ? sign_in_user : sign_up_user
|
|
end
|
|
|
|
private
|
|
|
|
def sign_in_user
|
|
@resource.skip_confirmation! if confirmable_enabled?
|
|
|
|
# once the resource is found and verified
|
|
# we can just send them to the login page again with the SSO params
|
|
# that will log them in
|
|
encoded_email = ERB::Util.url_encode(@resource.email)
|
|
redirect_to login_page_url(email: encoded_email, sso_auth_token: @resource.generate_sso_auth_token)
|
|
end
|
|
|
|
def sign_in_user_on_mobile
|
|
@resource.skip_confirmation! if confirmable_enabled?
|
|
|
|
# once the resource is found and verified
|
|
# we can just send them to the login page again with the SSO params
|
|
# that will log them in
|
|
encoded_email = ERB::Util.url_encode(@resource.email)
|
|
params = { email: encoded_email, sso_auth_token: @resource.generate_sso_auth_token }.to_query
|
|
|
|
mobile_deep_link_base = GlobalConfigService.load('MOBILE_DEEP_LINK_BASE', 'chatwootapp')
|
|
redirect_to "#{mobile_deep_link_base}://auth/saml?#{params}", allow_other_host: true
|
|
end
|
|
|
|
def sign_up_user
|
|
return redirect_to login_page_url(error: 'no-account-found') unless account_signup_allowed?
|
|
return redirect_to login_page_url(error: 'business-account-only') unless validate_signup_email_is_business_domain?
|
|
|
|
create_account_for_user
|
|
token = @resource.send(:set_reset_password_token)
|
|
frontend_url = ENV.fetch('FRONTEND_URL', nil)
|
|
redirect_to "#{frontend_url}/app/auth/password/edit?config=default&reset_password_token=#{token}"
|
|
end
|
|
|
|
def login_page_url(error: nil, email: nil, sso_auth_token: nil)
|
|
frontend_url = ENV.fetch('FRONTEND_URL', nil)
|
|
params = { email: email, sso_auth_token: sso_auth_token }.compact
|
|
params[:error] = error if error.present?
|
|
|
|
"#{frontend_url}/app/login?#{params.to_query}"
|
|
end
|
|
|
|
def account_signup_allowed?
|
|
GlobalConfigService.account_signup_enabled?
|
|
end
|
|
|
|
def resource_class(_mapping = nil)
|
|
User
|
|
end
|
|
|
|
def get_resource_from_auth_hash # rubocop:disable Naming/AccessorMethodName
|
|
email = auth_hash.dig('info', 'email')
|
|
@resource = resource_class.from_email(email)
|
|
end
|
|
|
|
def validate_signup_email_is_business_domain?
|
|
# return true if the user is a business account, false if it is a blocked domain account
|
|
Account::SignUpEmailValidationService.new(auth_hash['info']['email']).perform
|
|
rescue CustomExceptions::Account::InvalidEmail
|
|
false
|
|
end
|
|
|
|
def create_account_for_user
|
|
@resource, @account = AccountBuilder.new(
|
|
account_name: extract_domain_without_tld(auth_hash['info']['email']),
|
|
user_full_name: auth_hash['info']['name'],
|
|
email: auth_hash['info']['email'],
|
|
locale: I18n.locale,
|
|
confirmed: auth_hash['info']['email_verified']
|
|
).perform
|
|
Avatar::AvatarFromUrlJob.perform_later(@resource, auth_hash['info']['image'])
|
|
end
|
|
|
|
def default_devise_mapping
|
|
'user'
|
|
end
|
|
end
|
|
|
|
DeviseOverrides::OmniauthCallbacksController.prepend_mod_with('DeviseOverrides::OmniauthCallbacksController')
|