Trust custom oauth providers in order to create unknown users in private mode

[chrnin]

Issue: #838

I was wandering around, pretty bored, so I took a more deep look to this and tried something…
TLDR; here's a first try at trusting custom oauth providers that still needs work to be good… But this functionality fits exactly what I described in the issue.

what I did:

• This PR updates the database model to add is_trusted (bool) to oauth_providers table.
• In addition, this field is added in go models and oauth functions to take account of this new field.
• I also added a new option (always visible even if site is not private, maybe this could be improved to prevent bugging admins of public sites) in custom oauth providers screen.
• I manually tested that I was able to log-in in a private site with an unknown user on a trusted provider: success !
• I also manually tested that I was not able to sign in a private site with an unknown user on a not trusted provider: that failed and this is a success !

what I did'nt

• Unfortunately, my setup doesn't seem to take account of tests and mage test dies with a lot of garbage messages so I'm not able to run unit tests for the moment, that point needs further investigations :(
• I didn't test that pre-configured providers (google etc) are still working…

what I shouldn't have done

• My PR contains a huge diff for package-lock.json… I thought this file would have been ignored and didn't pay attention… My bad !
• I don't like much how I accessed customOAuthProvider in OAuthToken(), but as I understood it, this object is not loaded in this context at this moment… There are probably much more nice things to do.

Regards,

Christophe.

[chrnin]

I took a look at CI that ran tests for me, and there are errors (color me surprised)… So I'll try to get a running test suit at home to fix that !

[goenning]

Thanks for the PR, it’s looking good and that’s a nice feature to have. Do you need any help with tests and the build?

[chrnin]

Hi, thanks for your interest in this PR, for the moment I deployed a patch in my system that does the trick, so you officialy have a new user in the french administration (projet signaux-faibles at beta.gouv.fr !) ;)

I have been quite overbooked these days… I hope I can take a further look soon.
For the moment I have an issue running local test… Maybe the fix is trivial with some luck so here are some informations… :)

The first part of the tests (with .ts files) looks fine…

The end of the many lines I have looks like this:

[... lot of lines like these]
runtime.racefini: relocation target __tsan_fini not defined
runtime.racemapshadow: relocation target __tsan_map_shadow not defined
runtime.racegostart: relocation target __tsan_go_start not defined
runtime.raceacquireg: relocation target __tsan_acquire not defined
runtime.racereleaseg: relocation target __tsan_release not defined
runtime.racereleasemergeg: relocation target __tsan_release_merge not defined
runtime.stackalloc: relocation target __tsan_malloc not defined
runtime.raceread: relocation target __tsan_read not defined
runtime.racereadpc: relocation target __tsan_read_pc not defined
/usr/lib/go-1.12/pkg/tool/linux_amd64/link: too many errors
FAIL	github.com/getfider/fider/app/services/sqlstore/postgres [build failed]
FAIL	github.com/getfider/fider/app/tasks [build failed]
2020/01/28 19:44:44 exit status 2
Error: running "godotenv -f .test.env go test ./... -race" failed with exit code 1

Have you any idea ? A thing that looks odd to me is that it talks about github.com/getfider/fider, but I forked the project in my own repo and have put it in a local folder in home (not in $GOROOT) … Would that cause trouble ?

Regards,

Christophe.

[goenning]

Sorry for the lack of responsiveness, I'll continue this on a separate PR so I can rebase, fix tests and get this merged. Big thanks for the contribution. If you're still using Fider you might be able to soon get rid of that patch 😀