[Support Request]: Disable profile page for users with social login

[androbey]

Attempted Debugging

• I have read the debugging page

Searched GitHub Issues

• I have searched GitHub for the issue.

Describe the Scenario

Hi all,

I implemented a custom Oauth2 Provider and used the Theme System for it.
This works very well.

However, I want to achieve that those users, who can login via Oauth2 (Social Login) are not able to edit their profile at all.
Goal is that those users can only login via the Oauth2 provider and not change their name, avatar and so on..

I don't think this is much related to e.g. #1090 as I still want login for certain users with email/password and those user's should be able to edit their profile.

As far as I can tell current state of Theme system does not provide a way to hook into the render process, does it? (So that I can conditionally throw "No Access error" if user has social login connected).

Exact BookStack Version

v21.12.1

Log Content

No response

PHP Version

8.0

Hosting Environment

Ubuntun 20.04 (VPS, manual installation)

[ssddanbrown]

Hi @androbey,
Good to hear of someone successfully using the theme system!

As far as I can tell current state of Theme system does not provide a way to hook into the render process, does it?

The visual theme system allows override of any view used by BookStack so you could use that to modify the user edit page/view as required.

Alternatively, using the logical theme system, you could maybe use the before middleware hook to look for user updates and block them if the condition meets your requirement. As an example:

<?php

use BookStack\Facades\Theme;
use BookStack\Theming\ThemeEvents;
use Illuminate\Http\Request;
use Illuminate\Support\Str;

Theme::listen(ThemeEvents::WEB_MIDDLEWARE_BEFORE, function(Request $request) {
    $makingUserUpdate = $request->method() === 'PUT' && Str::endsWith($request->path(), 'settings/users/' . user()->id);
    if ($makingUserUpdate && user()->hasSocialAccount('google')) {
        session()->flash('error', 'Not allowed to update your profile');
        return redirect('/');
    }
});

As with all advanced logical theme usage, you'll need to keep an eye on changes or test this upon large updates as the internal APIs & paths could change.

[androbey]

Hi @ssddanbrown,

ok wow, this is amazing! Thank you very much, it works as expected.

Obviously the WEB_MIDDLEWARE_BEFORE event is very powerful. Sorry to bother with this issue, my bad. Obviously did not read ThemeEvents code comments enough.

[ssddanbrown]

No bother at all, glad that helped!

[demlak]

Hey.. i am interested in disabling profile-settings for my OIDC users.. is there any api-documentation for functions like hasSocialAccount() for adapting this code?

[ssddanbrown]

@demlak No, not really, since it's just all internal code, not really a supported API of any type.

That specific function is just a method on the user model:

BookStack/app/Users/Models/User.php

Lines 210 to 225 in 387c786

	/**
	* Check if the user has a social account,
	* If a driver is passed it checks for that single account type.
	*
	* @param bool|string $socialDriver
	*
	* @return bool
	*/
	public function hasSocialAccount($socialDriver = false)
	{
	if ($socialDriver === false) {
	return $this->socialAccounts()->count() > 0;
	}
	return $this->socialAccounts()->where('driver', '=', $socialDriver)->exists();
	}

[demlak]

thx for this very fast reply =)

do you recommend a way of archiving my goal? maybe checking if external_auth_id is set?

in my case, i currently only have oidc users..

[ssddanbrown]

@demlak I don't really understand what your goal is to be honest.
Feel free to open a new support issue, to fully describe what you're attempting to achieve (and what you've got/attempted so far).