Finish implementing OAuth & test it

[RossComputerGuy]

Definitely should be unit tests for OAuth and the rest of the OAuth model spec from this webpage should be implemented.

[RossComputerGuy]

Right now, only password grant is supported. Would be better having all grants implemented.

[RossComputerGuy]

~ > curl -L "http://172.18.0.4:3000/v1/user/token" -X POST -d "grant_type=password&client_id=0&client_secret=0&username=test&password=12345678" | jq           ~
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   152  100    63  100    89    851   1202 --:--:-- --:--:-- --:--:--  2054
{
  "error": "server_error",
  "error_description": "Invalid resource"
}

Another problem, figuring out how to fix some errors are difficult.

server_api_1   | debug: receving request from http://172.18.0.4/v1/user/token (POST)
server_api_1   | debug: Getting client: 0 *
server_api_1   | Executing (default): SELECT `id`, `secret`, `grants`, `createdAt`, `updatedAt` FROM `clients` AS `client` WHERE `client`.`id` = 0 AND `client`.`secret` = '0';
server_api_1   | debug: Getting user: test ********
server_api_1   | Executing (default): SELECT `uuid`, `username`, `password`, `birthdate`, `email`, `createdAt`, `updatedAt` FROM `users` AS `user` WHERE `user`.`username` = 'test';
server_api_1   | Executing (default): INSERT INTO `accessTokens` (`token`,`uuid`,`expires`,`client_id`,`createdAt`,`updatedAt`) VALUES (?,?,?,?,?,?);
server_api_1   | Executing (default): SELECT `id`, `secret`, `grants`, `createdAt`, `updatedAt` FROM `clients` AS `client` WHERE `client`.`id` = '0';
server_api_1   | Executing (default): SELECT `uuid`, `username`, `password`, `birthdate`, `email`, `createdAt`, `updatedAt` FROM `users` AS `user` WHERE `user`.`uuid` = '0'

[andersevenrud]

Another problem, figuring out how to fix some errors are difficult.

I have a comment about exactly this here: 0e2016a

This needs to be improved. Once database relations are properly set up, you can actually do a join query, which means that you will basically only have one database call which will make this a lot easier to handle and you can dump the errors straight into winston.

The reason I left the error message generic ("invalid resource") is because this is what the end-user will see.

I would have done this myself, but I did not feel comfortable touching the oauth stuff in my rebase PR.

[andersevenrud]

But you can actually pinpoint the problem from your log there. The last SELECT query probably did not return a result, and you can see where that occured pretty easily from the source:

website/packages/api/src/oauth.ts

Line 94 in ca09625

const tokenUser = await User.findOne({ where: { uuid: client.id } })

[RossComputerGuy]

Looks like a typo there.

[RossComputerGuy]

I fixed the typo and now OAuth is working, will leave this issue open until all OAuth grants are implemented.

[andersevenrud]

Also, add tests ;)

[RossComputerGuy]

That too

[RossComputerGuy]

These grants are currently implemented:

• authorization_code
• password

The other standard types supported by oauth2-server still need to be implemented. These grants are:

• client_credentials
• implicit
• refresh_token

[RossComputerGuy]

No longer relevant with how the website functions now