Feature Request: oAuth Login

[tionis]

Different login methods like via oAuth2 or OpenID would simplify integrating this with existing systems.
I would be interested to try take a stab at it, in a few weeks.
@JordanKnott As there are no contributing docs I would like to ask if there are any things to consider when writing code for this project.

[JordanKnott]

Do you have an oAuth2 provider or OpenID provider in mind?

One thing I would eventually like to add (I seem to be saying this a lot) is being able to login with a Google Account. Though this isn't very high priority at the moment.

As far as things to consider when adding code,

For implementing what you're talking about I imagine you would mostly be dealing with the authentication flow.

How it currently works is that when you log in, you get a refresh token (sent as a cookie, set to HttpOnly) and a JWT access token in the response body. The refresh token is long lived (7 days) and is only used to obtain new access tokens. The access token is send in an Authorization header (in the form of Bearer <TOKEN>) in order to actually be able to access any protected API endpoint (AKA everything).

The access token only lives for about 15 minutes before expiring, so the React client is setup to try and re-fetch a token if a request fails due to authentication issues.

This is all mostly implemented in frontend/src/index.tsx and internal/routes/auth.go

As far as coding style, there is an eslint and prettier config that pretty much covers the style.

Commit messages should follow the conventional commit guide.

[tionis]

I see, I personally would use this with my own gitea instance, but for most people a Google/GitHub login is probably sufficient.
What about a few specific login modules like Google or GitHub and a generic oAuth option in which you have to specify everything? CodiMD for example works like this.

[JordanKnott]

That would probably be doable and easier for people, they can choose what they want to use.

[maximuskowalski]

Authelia would be worth considering too. If I can get the docker image into my working stack I will give this a try.

[maxxie85]

It would be awesome if you could add any OAuth2 provider. As long as it conform's to the standard I so no reason why that wouldn't be possible.

For instance, Grafana lets you add any OAuth2 provider. You could use Nextcloud or in my case I would like to use mailcow.