Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FEATURE: Allow specifiying required paths when retrieving userinfo #96

Merged
merged 2 commits into from
Jan 31, 2024

Conversation

nattsw
Copy link
Contributor

@nattsw nattsw commented Jan 31, 2024

When retrieving userinfo with oauth2_fetch_user_details=true, we sometimes want to disallow account creation if an attribute is not fulfilled.

This PR adds a new register oauth2_basic_required_json_path which will kick in when retrieving userinfo. It can be used this way:

DiscoursePluginRegistry.register_oauth2_basic_required_json_path({
      path: "extra:account.is_allowed_member",
      required_value: true,
      error_message: I18n.t("login.unfulfilled_requirement"),
    }, self)

If the attribute does not satisfy the required value, we will see the specified error message when returning to the forum. The account is not created.

Screenshot 2024-01-31 at 12 45 44 PM

Alternatives

The alternatives I can think of is

  1. monkey patching
  2. creating a new authenticator

(1) is definitely brittle, and (2) does feel like there will be a lot of copy-work even within the method itself.

  1. David did point out on(:after_auth) exists. However the event happens slightly too late - the associated account would have been created already, and the result would not contain the required attribute.

plugin.rb Outdated Show resolved Hide resolved
@nattsw nattsw merged commit 895db12 into main Jan 31, 2024
3 checks passed
@nattsw nattsw deleted the oauth-required-path branch January 31, 2024 12:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
2 participants