fuomag9
3a16d6e9b1
- Replace next-auth v5 beta with better-auth v1.6.2 (stable releases)
- Add multi-provider OAuth support with admin UI configuration
- New oauthProviders table with encrypted secrets (AES-256-GCM)
- Env var bootstrap (OAUTH_*) syncs to DB, UI-created providers fully editable
- OAuth provider REST API: GET/POST/PUT/DELETE /api/v1/oauth-providers
- Settings page "Authentication Providers" section for admin management
- Account linking uses new accounts table (multi-provider per user)
- Username plugin for credentials sign-in (replaces email@localhost pattern)
- bcrypt password compatibility (existing hashes work)
- Database-backed sessions via Kysely adapter (bun:sqlite direct)
- Configurable rate limiting via AUTH_RATE_LIMIT_* env vars
- All DB columns migrated from snake_case to camelCase
- All TypeScript types/models migrated to camelCase properties
- Removed casing: "snake_case" from Drizzle config
- Callback URL format: {baseUrl}/api/auth/oauth2/callback/{providerId}
- package-lock.json removed and gitignored (using bun.lock)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
72 lines
2.4 KiB
TypeScript
72 lines
2.4 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { requireApiAdmin, apiErrorResponse } from "@/src/lib/api-auth";
|
|
import { listOAuthProviders, createOAuthProvider } from "@/src/lib/models/oauth-providers";
|
|
import type { OAuthProvider } from "@/src/lib/models/oauth-providers";
|
|
import { createAuditEvent } from "@/src/lib/models/audit";
|
|
import { invalidateProviderCache } from "@/src/lib/auth-server";
|
|
|
|
function redactSecrets(provider: OAuthProvider) {
|
|
const clientId = provider.clientId;
|
|
return {
|
|
...provider,
|
|
clientId: clientId.length > 4 ? "••••" + clientId.slice(-4) : "••••",
|
|
clientSecret: "••••••••",
|
|
};
|
|
}
|
|
|
|
export async function GET(request: NextRequest) {
|
|
try {
|
|
await requireApiAdmin(request);
|
|
const providers = await listOAuthProviders();
|
|
return NextResponse.json(providers.map(redactSecrets));
|
|
} catch (error) {
|
|
return apiErrorResponse(error);
|
|
}
|
|
}
|
|
|
|
export async function POST(request: NextRequest) {
|
|
try {
|
|
const { userId } = await requireApiAdmin(request);
|
|
const body = await request.json();
|
|
|
|
if (!body.name || typeof body.name !== "string") {
|
|
return NextResponse.json({ error: "name is required" }, { status: 400 });
|
|
}
|
|
if (!body.clientId || typeof body.clientId !== "string") {
|
|
return NextResponse.json({ error: "clientId is required" }, { status: 400 });
|
|
}
|
|
if (!body.clientSecret || typeof body.clientSecret !== "string") {
|
|
return NextResponse.json({ error: "clientSecret is required" }, { status: 400 });
|
|
}
|
|
|
|
const provider = await createOAuthProvider({
|
|
name: body.name,
|
|
type: body.type ?? "oidc",
|
|
clientId: body.clientId,
|
|
clientSecret: body.clientSecret,
|
|
issuer: body.issuer ?? null,
|
|
authorizationUrl: body.authorizationUrl ?? null,
|
|
tokenUrl: body.tokenUrl ?? null,
|
|
userinfoUrl: body.userinfoUrl ?? null,
|
|
scopes: body.scopes ?? "openid email profile",
|
|
autoLink: body.autoLink ?? false,
|
|
source: "ui",
|
|
});
|
|
|
|
invalidateProviderCache();
|
|
|
|
await createAuditEvent({
|
|
userId,
|
|
action: "create",
|
|
entityType: "oauth_provider",
|
|
entityId: null,
|
|
summary: `Created OAuth provider "${provider.name}"`,
|
|
data: JSON.stringify({ providerId: provider.id, name: provider.name, type: provider.type }),
|
|
});
|
|
|
|
return NextResponse.json(redactSecrets(provider), { status: 201 });
|
|
} catch (error) {
|
|
return apiErrorResponse(error);
|
|
}
|
|
}
|