Add OAuth2 authentication

4 files changed, 126 insertions, 0 deletions

diff --git a/server/oauth2/google.go b/server/oauth2/google.go
new file mode 100644
index 0000000..5c63c75
--- /dev/null
+++ b/server/oauth2/google.go
@@ -0,0 +1,70 @@
+// Copyright 2017 Frédéric Guillot. All rights reserved.
+// Use of this source code is governed by the Apache 2.0
+// license that can be found in the LICENSE file.
+
+package oauth2
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"golang.org/x/oauth2"
+)
+
+type googleProfile struct {
+	Sub   string `json:"sub"`
+	Email string `json:"email"`
+}
+
+type googleProvider struct {
+	clientID     string
+	clientSecret string
+	redirectURL  string
+}
+
+func (g googleProvider) GetRedirectURL(state string) string {
+	return g.config().AuthCodeURL(state)
+}
+
+func (g googleProvider) GetProfile(code string) (*Profile, error) {
+	conf := g.config()
+	ctx := context.Background()
+	token, err := conf.Exchange(ctx, code)
+	if err != nil {
+		return nil, err
+	}
+
+	client := conf.Client(ctx, token)
+	resp, err := client.Get("https://www.googleapis.com/oauth2/v3/userinfo")
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	var user googleProfile
+	decoder := json.NewDecoder(resp.Body)
+	if err := decoder.Decode(&user); err != nil {
+		return nil, fmt.Errorf("unable to unserialize google profile: %v", err)
+	}
+
+	profile := &Profile{Key: "google_id", ID: user.Sub, Username: user.Email}
+	return profile, nil
+}
+
+func (g googleProvider) config() *oauth2.Config {
+	return &oauth2.Config{
+		RedirectURL:  g.redirectURL,
+		ClientID:     g.clientID,
+		ClientSecret: g.clientSecret,
+		Scopes:       []string{"email"},
+		Endpoint: oauth2.Endpoint{
+			AuthURL:  "https://accounts.google.com/o/oauth2/auth",
+			TokenURL: "https://accounts.google.com/o/oauth2/token",
+		},
+	}
+}
+
+func newGoogleProvider(clientID, clientSecret, redirectURL string) *googleProvider {
+	return &googleProvider{clientID: clientID, clientSecret: clientSecret, redirectURL: redirectURL}
+}
diff --git a/server/oauth2/manager.go b/server/oauth2/manager.go
new file mode 100644
index 0000000..08360a9
--- /dev/null
+++ b/server/oauth2/manager.go
@@ -0,0 +1,33 @@
+// Copyright 2017 Frédéric Guillot. All rights reserved.
+// Use of this source code is governed by the Apache 2.0
+// license that can be found in the LICENSE file.
+
+package oauth2
+
+import "errors"
+
+// Manager handles OAuth2 providers.
+type Manager struct {
+	providers map[string]Provider
+}
+
+// Provider returns the given provider.
+func (m *Manager) Provider(name string) (Provider, error) {
+	if provider, found := m.providers[name]; found {
+		return provider, nil
+	}
+
+	return nil, errors.New("oauth2 provider not found")
+}
+
+// AddProvider add a new OAuth2 provider.
+func (m *Manager) AddProvider(name string, provider Provider) {
+	m.providers[name] = provider
+}
+
+// NewManager returns a new Manager.
+func NewManager(clientID, clientSecret, redirectURL string) *Manager {
+	m := &Manager{providers: make(map[string]Provider)}
+	m.AddProvider("google", newGoogleProvider(clientID, clientSecret, redirectURL))
+	return m
+}
diff --git a/server/oauth2/profile.go b/server/oauth2/profile.go
new file mode 100644
index 0000000..488ffb2
--- /dev/null
+++ b/server/oauth2/profile.go
@@ -0,0 +1,12 @@
+// Copyright 2017 Frédéric Guillot. All rights reserved.
+// Use of this source code is governed by the Apache 2.0
+// license that can be found in the LICENSE file.
+
+package oauth2
+
+// Profile is the OAuth2 user profile.
+type Profile struct {
+	Key      string
+	ID       string
+	Username string
+}
diff --git a/server/oauth2/provider.go b/server/oauth2/provider.go
new file mode 100644
index 0000000..27ab22a
--- /dev/null
+++ b/server/oauth2/provider.go
@@ -0,0 +1,11 @@
+// Copyright 2017 Frédéric Guillot. All rights reserved.
+// Use of this source code is governed by the Apache 2.0
+// license that can be found in the LICENSE file.
+
+package oauth2
+
+// Provider is an interface for OAuth2 providers.
+type Provider interface {
+	GetRedirectURL(state string) string
+	GetProfile(code string) (*Profile, error)
+}