Changes for Google auth provider

[nicksp]

• I have created my request on the Product Board before I submitted this issue
• I have looked at all the other requests on the Product Board before I submitted this issue

Please describe your feature request:

Google is going to shut down the consumer version of Google+ over the next several months and that means that Google provider will stop working as it relies on Google+ as I can see. Are there any plans to migrate existing Google provider to use a recommended Google Sign-In API? Existing apps using Google provider might be impacted once Google+ is taken down. Or do I miss anything and existing provider won't require any changes given the announcement?

[derrickmehaffy]

This is honestly a good question. After the plugin framework rewrite is finished I believe the plan was to move over to using passport.js and split each provider into their own separate plugins.

I'm sure there is probably one that doesn't use the G+ API but my guess is even though Google is shutting down + they will keep the API alive or offload users to the normal one.

[mccrodp]

I think this is more of a hard shutdown due to security concerns with the Google+ APIs, so when they say they are shutting it down, might be risky to bank on them offloading requests to another newer API. https://www.theverge.com/2018/12/10/18134541/google-plus-privacy-api-data-leak-developers

We've updated our app recently to migrate to a more recent Google API and were considering integrating with Strapi via Google Auth as our first steps to making it our new CMS, but this is a blocker at the moment.

If the solution we used using Sign-in API is of benefit it'd be great to share any detail on that here, @nicksp. I cannot remember if we used a custom approach to implementing that, or an available npm solution, but it's working well.

Looking forward to hearing more on this and if there's anything the open source community can do to help, let us know here also. Cheers

[mccrodp]

Hey @lauriejim, had you any thoughts on this one / the above? Have you had any users complain of dropped connections yet here, is this a common feature in Strapi? I'm not sure if APIs are failing yet, but looks like a hard shutdown in March, so I'm curious why it's labelled as an enhancement if things might break here very soon for anyone using Strapi via Google Auth. https://developers.google.com/+/api-shutdown

[lauriejim]

We will work on it soon as we can. For now we are busy on other tasks.
If you want to make the update to make it work with the Google+ shut down you can submit a PR.

• Here is the Grant configuration
• Here is Purest configuration

We really appreciate if you can submit a PR.

[mccrodp]

Great, thanks for the update here, @lauriejim, that is completely understandable. I will definitely see if we can fit this into our upcoming roadmap. Will sync up with you here soon if we can proceed with that (I really hope so!)

[lauriejim]

Thank you @mccrodp !

[horstleung]

Here is my hot fix, waiting for passport ver.:

case 'google': {
      
      const config = {
        "google": {
          "https://www.googleapis.com": {
            "__domain": {
              "auth": {
                "auth": {"bearer": "[0]"}
              }
            },
            "{endpoint}": {
              "__path": {
                "alias": "__default"
              }
            },
            "oauth/[version]/{endpoint}": {
              "__path": {
                "alias": "oauth",
                "version": "v3"
              }
            }
          }
        }
      }
      var google = new Purest({provider: 'google', config})

      google.query('oauth').get('tokeninfo').qs({id_token: access_token}).request((err, res, body) => {
        if (err) {
          callback(err);
        } else {
          const { name, email, issued_to } = body;
          const clientIDs = [IOS_CLIENT, ANDROID_CLIENT, WEB_CLIENT];
          if(_.findIndex(clientIDs, function(o) { return o === issued_to; }) >= 0) {
            callback(null, {
              username: body.email.split("@")[0],
              email: email,
              name: name
            });
          } else {
            callback(new Error("Invalid client ids"));
          }
        }
      });
      break;
    }

[derrickmehaffy]

@fattomhk good for a PR as the passport stuff will still be a while, likely after the beta (as the plugin framework rewrite is included in the beta PR)

[octopusOnJellyfish]

Here is my hot fix, waiting for passport ver.:

case 'google': {
      
      const config = {
        "google": {
          "https://www.googleapis.com": {
            "__domain": {
              "auth": {
                "auth": {"bearer": "[0]"}
              }
            },
            "{endpoint}": {
              "__path": {
                "alias": "__default"
              }
            },
            "oauth/[version]/{endpoint}": {
              "__path": {
                "alias": "oauth",
                "version": "v3"
              }
            }
          }
        }
      }
      var google = new Purest({provider: 'google', config})

      google.query('oauth').get('tokeninfo').qs({id_token: access_token}).request((err, res, body) => {
        if (err) {
          callback(err);
        } else {
          const { name, email, issued_to } = body;
          const clientIDs = [IOS_CLIENT, ANDROID_CLIENT, WEB_CLIENT];
          if(_.findIndex(clientIDs, function(o) { return o === issued_to; }) >= 0) {
            callback(null, {
              username: body.email.split("@")[0],
              email: email,
              name: name
            });
          } else {
            callback(new Error("Invalid client ids"));
          }
        }
      });
      break;
    }

I tried this but did not work, however this one works for me:

case 'google': {

  const config = {
    "google": {
      "https://www.googleapis.com": {
        "__domain": {
          "auth": {
            "auth": {"bearer": "[0]"}
          }
        },
        "{endpoint}": {
          "__path": {
            "alias": "__default"
          }
        },
        "oauth/[version]/{endpoint}": {
          "__path": {
            "alias": "oauth",
            "version": "v3"
          }
        }
      }
    }
  }
  var google = new Purest({provider: 'google', config})
  
  google.query('oauth').get('tokeninfo').qs({access_token}).request((err, res, body) => {
    if (err) {
      callback(err);
    } else {
      callback(null, {           
        username: body.email.split("@")[0],
        email: body.email
      });
    }
  });
  break;
}

[horstleung]

@rnasif it is because i don't know how to setup the client ids in config page.

I added a checking here for security:

 const clientIDs = [IOS_CLIENT, ANDROID_CLIENT, WEB_CLIENT];
          if(_.findIndex(clientIDs, function(o) { return o === issued_to; }) >= 0) {
            ...
          }

Simply replace the enums to your client ids would be fine.