From 7cac2fc2fea589c60b8619b92809bb30c42f5b6f Mon Sep 17 00:00:00 2001
From: GreenmeisterDavid <david@oxygensoftware.net>
Date: Mon, 14 Oct 2024 17:32:32 +0200
Subject: [PATCH 1/4] =?UTF-8?q?Feat:=20Add=20Google=20oauth=20=20-=20?=
 =?UTF-8?q?=F0=9F=9A=A7=20=20Work=20in=20progress?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .env.example                                  |   3 +
 app/components/Auth/Form.vue                  |   1 +
 .../Profile/ProfileSectionProviders.vue       |  14 +-
 auth.d.ts                                     |   2 +
 .../api/me/providers/[providerName].delete.ts |  10 ++
 .../migrations/0001_illegal_talos.sql         |   3 +
 .../migrations/meta/0001_snapshot.json        | 153 ++++++++++++++++++
 server/database/migrations/meta/_journal.json |   7 +
 server/database/schema.ts                     |   2 +
 server/routes/auth/google.get.ts              |  77 +++++++++
 server/utils/user.ts                          |   4 +
 11 files changed, 274 insertions(+), 2 deletions(-)
 create mode 100644 server/database/migrations/0001_illegal_talos.sql
 create mode 100644 server/database/migrations/meta/0001_snapshot.json
 create mode 100644 server/routes/auth/google.get.ts

diff --git a/.env.example b/.env.example
index 2cdba70..3841e37 100644
--- a/.env.example
+++ b/.env.example
@@ -11,4 +11,7 @@ NUXT_OAUTH_TWITCH_CLIENT_ID=
 NUXT_OAUTH_TWITCH_CLIENT_SECRET=
 NUXT_OAUTH_TWITCH_REDIRECT_URL=http://localhost
 
+NUXT_OAUTH_GOOGLE_CLIENT_ID=
+NUXT_OAUTH_GOOGLE_CLIENT_SECRET=
+
 NUXT_SESSION_PASSWORD=
diff --git a/app/components/Auth/Form.vue b/app/components/Auth/Form.vue
index c4debde..0e45e35 100644
--- a/app/components/Auth/Form.vue
+++ b/app/components/Auth/Form.vue
@@ -13,6 +13,7 @@ defineProps<{
     :providers="[
       { label: 'GitHub', icon: 'i-simple-icons-github', color: 'gray', external: true, to: '/auth/github' },
       { label: 'Twitch', icon: 'i-simple-icons-twitch', color: 'gray', external: true, to: '/auth/twitch' },
+      { label: 'Google', icon: 'i-simple-icons-google', color: 'gray', external: true, to: '/auth/google' },
     ]"
   >
     <template #footer>
diff --git a/app/components/Profile/ProfileSectionProviders.vue b/app/components/Profile/ProfileSectionProviders.vue
index 6ddd38c..8674d51 100644
--- a/app/components/Profile/ProfileSectionProviders.vue
+++ b/app/components/Profile/ProfileSectionProviders.vue
@@ -5,11 +5,11 @@ const { user } = useUserSession()
 
 const isTwitchConnected = computed(() => Boolean(user.value?.twitchId))
 const isGithubConnected = computed(() => Boolean(user.value?.githubId))
-
+const isGoogleConnected = computed(() => Boolean(user.value?.googleId))
 const { $csrfFetch } = useNuxtApp()
 const { fetch: fetchUserSession } = useUserSession()
 
-async function disconnect(providerName: 'github' | 'twitch') {
+async function disconnect(providerName: 'github' | 'twitch' | 'google') {
   try {
     await $csrfFetch(`/api/me/providers/${providerName}`, {
       method: 'DELETE',
@@ -55,6 +55,16 @@ async function disconnect(providerName: 'github' | 'twitch') {
         >
           {{ user?.twitchId ? 'Remove connection' : 'Connect Twitch' }}
         </UButton>
+
+        <UButton
+          color="gray"
+          :to="isGoogleConnected ? undefined : '/auth/google'"
+          external
+          icon="i-simple-icons-google"
+          @click="isGoogleConnected ? disconnect('google') : undefined"
+        >
+          {{ user?.googleId ? 'Remove connection' : 'Connect Google' }}
+        </UButton>
       </div>
     </ucard>
   </ProfileSection>
diff --git a/auth.d.ts b/auth.d.ts
index 3a38fbd..800b893 100644
--- a/auth.d.ts
+++ b/auth.d.ts
@@ -7,6 +7,8 @@ declare module '#auth-utils' {
     avatar: string | null
     githubId?: number | null
     twitchId?: string | null
+    googleId?: string | null
+    googleToken?: string | null
     verifiedAt: string | null
     emailToVerify?: string | null
   }
diff --git a/server/api/me/providers/[providerName].delete.ts b/server/api/me/providers/[providerName].delete.ts
index 1d67297..5031852 100644
--- a/server/api/me/providers/[providerName].delete.ts
+++ b/server/api/me/providers/[providerName].delete.ts
@@ -33,6 +33,16 @@ export default defineEventHandler(async (event) => {
       githubId: null,
     })
   }
+  else if (providerName === 'google') {
+    await updateUser(user.id, {
+      googleId: null,
+      googleToken: null,
+    })
+    await updateUserSession(event, {
+      ...user,
+      googleId: null,
+    })
+  }
   else {
     throw createError({
       statusCode: 400,
diff --git a/server/database/migrations/0001_illegal_talos.sql b/server/database/migrations/0001_illegal_talos.sql
new file mode 100644
index 0000000..cb84401
--- /dev/null
+++ b/server/database/migrations/0001_illegal_talos.sql
@@ -0,0 +1,3 @@
+ALTER TABLE `users` ADD `google_id` text;--> statement-breakpoint
+ALTER TABLE `users` ADD `google_token` text;--> statement-breakpoint
+CREATE UNIQUE INDEX `users_google_id_unique` ON `users` (`google_id`);
\ No newline at end of file
diff --git a/server/database/migrations/meta/0001_snapshot.json b/server/database/migrations/meta/0001_snapshot.json
new file mode 100644
index 0000000..462d307
--- /dev/null
+++ b/server/database/migrations/meta/0001_snapshot.json
@@ -0,0 +1,153 @@
+{
+  "version": "6",
+  "dialect": "sqlite",
+  "id": "019e873c-a77c-4a0c-8738-5275cad42d63",
+  "prevId": "e9773c29-81a1-4979-847b-e4c5982902bc",
+  "tables": {
+    "users": {
+      "name": "users",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "email_to_verify": {
+          "name": "email_to_verify",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "avatar": {
+          "name": "avatar",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "github_id": {
+          "name": "github_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "github_token": {
+          "name": "github_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "twitch_id": {
+          "name": "twitch_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "twitch_token": {
+          "name": "twitch_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "google_id": {
+          "name": "google_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "google_token": {
+          "name": "google_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "verified_at": {
+          "name": "verified_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "users_email_unique": {
+          "name": "users_email_unique",
+          "columns": [
+            "email"
+          ],
+          "isUnique": true
+        },
+        "users_github_id_unique": {
+          "name": "users_github_id_unique",
+          "columns": [
+            "github_id"
+          ],
+          "isUnique": true
+        },
+        "users_twitch_id_unique": {
+          "name": "users_twitch_id_unique",
+          "columns": [
+            "twitch_id"
+          ],
+          "isUnique": true
+        },
+        "users_google_id_unique": {
+          "name": "users_google_id_unique",
+          "columns": [
+            "google_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {}
+    }
+  },
+  "enums": {},
+  "_meta": {
+    "schemas": {},
+    "tables": {},
+    "columns": {}
+  },
+  "internal": {
+    "indexes": {}
+  }
+}
\ No newline at end of file
diff --git a/server/database/migrations/meta/_journal.json b/server/database/migrations/meta/_journal.json
index db8270a..03624be 100644
--- a/server/database/migrations/meta/_journal.json
+++ b/server/database/migrations/meta/_journal.json
@@ -8,6 +8,13 @@
       "when": 1724098052504,
       "tag": "0000_grey_nova",
       "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "6",
+      "when": 1728919411090,
+      "tag": "0001_illegal_talos",
+      "breakpoints": true
     }
   ]
 }
\ No newline at end of file
diff --git a/server/database/schema.ts b/server/database/schema.ts
index c0318a5..a3c5aa6 100644
--- a/server/database/schema.ts
+++ b/server/database/schema.ts
@@ -10,6 +10,8 @@ export const users = sqliteTable('users', {
   githubToken: text('github_token'),
   twitchId: text('twitch_id').unique(),
   twitchToken: text('twitch_token'),
+  googleId: text('google_id').unique(),
+  googleToken: text('google_token'),
   verifiedAt: text('verified_at'),
   createdAt: text('created_at')
     .notNull()
diff --git a/server/routes/auth/google.get.ts b/server/routes/auth/google.get.ts
new file mode 100644
index 0000000..39e045a
--- /dev/null
+++ b/server/routes/auth/google.get.ts
@@ -0,0 +1,77 @@
+export default oauthGoogleEventHandler({
+  config: {
+    // Example:
+    scope: ['email', 'openid', 'profile'],
+  },
+  async onSuccess(event, { user: googleUser, tokens }) {
+
+    // Fetch the current session if the user is already signed in
+    const { user: userSession } = await getUserSession(event)
+
+    // If the user is signed in, link the Google account to the existing user
+    if (userSession?.id) {
+      const existingUser = await findUserById(userSession.id)
+      if (existingUser) {
+        await updateUser(userSession.id, {
+          googleId: googleUser.sub,
+          googleToken: tokens.access_token,
+        })
+        await updateUserSession(event, { ...userSession, googleId: googleUser.sub })
+        return sendRedirect(event, '/profile')
+      }
+    }
+
+    // Check if there's an existing user with this Google ID or email
+    let user = await findUserByGoogleId(googleUser.sub)
+    if (user) {
+      await updateUser(user.id, {
+        googleId: googleUser.sub,
+        googleToken: tokens.access_token,
+      })
+      await updateUserSession(event, {
+        ...user,
+        googleId: googleUser.sub,
+      })
+      return sendRedirect(event, '/profile')
+    }
+
+    user = await findUserBy(
+      and(
+        eq(tables.users.email, googleUser.email),
+        isNull(tables.users.googleId),
+      ),
+    )
+    if (user) {
+      await updateSession(event,
+        {
+          password: useRuntimeConfig(event).session.password,
+        },
+        {
+          message: 'An existing account for this email already exists. Please login and visit your profile settings to add support for Google authentication.',
+        })
+      return sendRedirect(event, '/login')
+    }
+
+    // If the user is not signed in and no user exists with that Google ID, create a new user
+    const createdUser = await createUser({
+      name: (googleUser.given_name || 'no name') as string,
+      email: googleUser.email as string,
+      avatar: googleUser.profile_image_url as string,
+      googleId: googleUser.sub as string,
+      googleToken: tokens.access_token as string,
+      verifiedAt: new Date().toUTCString(),
+    })
+
+    await updateUserSession(event, {
+      id: createdUser.id,
+      name: createdUser.name,
+      email: createdUser.email,
+      avatar: createdUser.avatar,
+      verifiedAt: createdUser.verifiedAt,
+      googleId: googleUser.sub,
+    })
+    return sendRedirect(event, '/profile')
+  },
+
+},
+)
diff --git a/server/utils/user.ts b/server/utils/user.ts
index 0728e60..564300e 100644
--- a/server/utils/user.ts
+++ b/server/utils/user.ts
@@ -25,6 +25,10 @@ export async function findUserByTwitchId(twitchId: string) {
     .get()
 }
 
+export async function findUserByGoogleId(googleId: string) {
+  return useDrizzle().select().from(tables.users).where(eq(tables.users.googleId, googleId)).get()
+}
+
 export async function findUserBy(query: SQL | undefined) {
   return useDrizzle().select().from(tables.users).where(query).get()
 }

From fe4c3ec1e1bf430d3a6a514b057f41331c8d48c5 Mon Sep 17 00:00:00 2001
From: GreenmeisterDavid <david@oxygensoftware.net>
Date: Mon, 14 Oct 2024 17:39:13 +0200
Subject: [PATCH 2/4] Add support for Google profile avatar

---
 nuxt.config.ts                   | 2 +-
 server/routes/auth/google.get.ts | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/nuxt.config.ts b/nuxt.config.ts
index 4d40dd3..c000324 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -56,7 +56,7 @@ export default defineNuxtConfig({
     },
     headers: {
       contentSecurityPolicy: {
-        'img-src': ['\'self\'', 'data:', 'https://avatars.githubusercontent.com', 'https://static-cdn.jtvnw.net/'],
+        'img-src': ['\'self\'', 'data:', 'https://avatars.githubusercontent.com', 'https://static-cdn.jtvnw.net', 'https://lh3.googleusercontent.com'],
         'script-src': ['\'self\'', 'https', '\'nonce-{{nonce}}\'', 'https://static.cloudflareinsights.com'],
       },
       crossOriginEmbedderPolicy: isProd ? 'credentialless' : false,
diff --git a/server/routes/auth/google.get.ts b/server/routes/auth/google.get.ts
index 39e045a..c213fcc 100644
--- a/server/routes/auth/google.get.ts
+++ b/server/routes/auth/google.get.ts
@@ -56,7 +56,7 @@ export default oauthGoogleEventHandler({
     const createdUser = await createUser({
       name: (googleUser.given_name || 'no name') as string,
       email: googleUser.email as string,
-      avatar: googleUser.profile_image_url as string,
+      avatar: googleUser.picture as string,
       googleId: googleUser.sub as string,
       googleToken: tokens.access_token as string,
       verifiedAt: new Date().toUTCString(),

From 57c15d223a7a67ec92ad2acaaea3707a645a01ad Mon Sep 17 00:00:00 2001
From: GreenmeisterDavid <david@oxygensoftware.net>
Date: Mon, 14 Oct 2024 17:40:09 +0200
Subject: [PATCH 3/4] Fix: make eslint happy

---
 server/routes/auth/google.get.ts | 1 -
 1 file changed, 1 deletion(-)

diff --git a/server/routes/auth/google.get.ts b/server/routes/auth/google.get.ts
index c213fcc..3267cde 100644
--- a/server/routes/auth/google.get.ts
+++ b/server/routes/auth/google.get.ts
@@ -4,7 +4,6 @@ export default oauthGoogleEventHandler({
     scope: ['email', 'openid', 'profile'],
   },
   async onSuccess(event, { user: googleUser, tokens }) {
-
     // Fetch the current session if the user is already signed in
     const { user: userSession } = await getUserSession(event)
 

From 333bd88ee85983757bac5aa231ad2e9b7875c34a Mon Sep 17 00:00:00 2001
From: GreenmeisterDavid <david@oxygensoftware.net>
Date: Mon, 14 Oct 2024 18:34:57 +0200
Subject: [PATCH 4/4] Fix #28

---
 server/api/me/providers/[providerName].delete.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/api/me/providers/[providerName].delete.ts b/server/api/me/providers/[providerName].delete.ts
index 5031852..38ca96c 100644
--- a/server/api/me/providers/[providerName].delete.ts
+++ b/server/api/me/providers/[providerName].delete.ts
@@ -4,7 +4,7 @@ export default defineEventHandler(async (event) => {
   const providerName = getRouterParam(event, 'providerName')
 
   // A user must have at least one provider linked
-  const providers = (['twitch', 'github'] as const).filter(provider => user[`${provider}Id`])
+  const providers = (['twitch', 'github', 'google'] as const).filter(provider => user[`${provider}Id`])
 
   if (providers.length === 1) {
     throw createError({