feat: OAuth login using login codes

apps/meteor/app/api/server/index.ts

@@ -46,6 +46,7 @@ import './v1/teams';
 import './v1/moderation';
 import './v1/uploads';
 import './v1/twoFactorChallenges';
+import './v1/loginCode';
 // This has to come last so all endpoints are registered before generating the OpenAPI documentation
 import './default/openApi';
 

apps/meteor/app/api/server/v1/loginCode.ts

@@ -0,0 +1,38 @@
+import { LoginCodes } from '@rocket.chat/models';
+import { isLoginCodeRedeemParamsPOST } from '@rocket.chat/rest-typings';
+import { Accounts } from 'meteor/accounts-base';
+
+import { API } from '../api';
+
+API.v1.addRoute(
+	'loginCode.redeem',
+	{
+		authRequired: false,
+		validateParams: isLoginCodeRedeemParamsPOST,
+		rateLimiterOptions: { intervalTimeInMS: 60000, numRequestsAllowed: 10 },
+	},
+	{
+		async post() {
+			const { code } = this.bodyParams;
+
+			const loginCode = await LoginCodes.findOneNotExpiredByCode(code);
+
+			if (!loginCode) {
+				throw new Meteor.Error('error-invalid-code', 'Invalid or expired login code');
+			}
+
+			//single-use: remove code before issuing the token
+			await LoginCodes.removeByCode(code);
+
+			const { userId } = loginCode;
+
+			const stampedToken = Accounts._generateStampedLoginToken();
+			await Accounts._insertLoginToken(userId, stampedToken);
+
+			return API.v1.success({
+				loginToken: stampedToken.token,
+				userId,
+			});
+		},
+	},
+);

apps/meteor/client/views/root/AppLayout.tsx

@@ -31,6 +31,7 @@ import { useLoginOtherClients } from './hooks/useLoginOtherClients';
 import { useLoginViaQuery } from './hooks/useLoginViaQuery';
 import { useMessageLinkClicks } from './hooks/useMessageLinkClicks';
 import { useNotificationPermission } from './hooks/useNotificationPermission';
+import { useOAuthLogin } from './hooks/useOAuthLogin';
 import { useRedirectToSetupWizard } from './hooks/useRedirectToSetupWizard';
 import { useSettingsOnLoadSiteUrl } from './hooks/useSettingsOnLoadSiteUrl';
 import { useShareSessionWithOtherClients } from './hooks/useShareSessionWithOtherClients';
@@ -73,6 +74,7 @@ const AppLayout = () => {
 	useCodeHighlight();
 	useLoginViaQuery();
 	useLoginOtherClients();
+	useOAuthLogin();
 	useShareSessionWithOtherClients();
 	useLoadMissedMessages();
 	useDesktopFavicon();

apps/meteor/client/views/root/hooks/useLoginViaQuery.ts

@@ -7,17 +7,12 @@ export const useLoginViaQuery = () => {
 
 	useEffect(() => {
 		const handleLogin = async () => {
-			const { resumeToken, loginClient } = router.getSearchParameters();
+			const { resumeToken } = router.getSearchParameters();
 
 			if (!resumeToken) {
 				return;
 			}
 
-			//Case handled by useLoginOtherClients, we don't want to login here.
-			if (loginClient) {
-				return;
-			}
-
 			try {
 				await loginWithToken(resumeToken);
 

apps/meteor/client/views/root/hooks/useOAuthLogin.ts

@@ -0,0 +1,49 @@
+import { useEndpoint, useRouter, useSearchParameter, useLoginWithToken } from '@rocket.chat/ui-contexts';
+import { useEffect } from 'react';
+
+import { buildDeepLinkURL } from '../../../lib/buildAuthDeeplinkURL';
+
+export const useOAuthLogin = () => {
+	const router = useRouter();
+	const loginCode = useSearchParameter('loginCode');
+	const loginClient = useSearchParameter('loginClient');
+	const redeemLoginCode = useEndpoint('POST', '/v1/loginCode.redeem');
+	const loginWithToken = useLoginWithToken();
+
+	useEffect(() => {
+		if (!loginCode) {
+			return;
+		}
+
+		let timeout: ReturnType<typeof setTimeout>;
+
+		const handleLogin = async () => {
+			try {
+				const { loginToken, userId } = await redeemLoginCode({ code: loginCode });
+
+				if (!loginToken || !userId) {
+					throw new Error('Invalid response from login code redemption');
+				}
+
+				if (loginClient === 'desktop' || loginClient === 'mobile') {
+					const loginURL = buildDeepLinkURL(loginToken, userId);
+					window.location.href = loginURL;
+					return;
+				}
+
+				await loginWithToken(loginToken);
+			} catch (error) {
+				console.error('Failed to redeem login code for client redirect', error);
+				router.navigate('/login', { replace: true });
+			} finally {
+				timeout = setTimeout(() => {
+					router.navigate('/home', { replace: true });
+				}, 0);
+			}
+		};
+
+		handleLogin();
+
+		return () => clearTimeout(timeout);
+	}, [loginCode, router, redeemLoginCode, loginWithToken, loginClient]);
+};

apps/meteor/server/lib/oauth/passportOAuthCallback.ts

@@ -1,7 +1,7 @@
 import type { IUser } from '@rocket.chat/core-typings';
 import { Logger } from '@rocket.chat/logger';
+import { LoginCodes } from '@rocket.chat/models';
 import type { Request, Response } from 'express';
-import { Accounts } from 'meteor/accounts-base';
 
 import { doesUserRequire2FA } from './twoFactorAuth';
 
@@ -29,13 +29,11 @@ export const passportOAuthCallback = (siteUrl: string) => async (req: Request, r
 		return res.redirect(twoFARedirectUrl.toString());
 	}
 
-	const stampedToken = Accounts._generateStampedLoginToken();
-	await Accounts._insertLoginToken(oAuthUser._id, stampedToken);
+	const loginCode = await LoginCodes.createCode(oAuthUser._id);
 
 	const redirectUrl = new URL(`/home`, siteUrl);
 
-	redirectUrl.searchParams.set('resumeToken', stampedToken.token);
-	redirectUrl.searchParams.set('userId', oAuthUser._id);
+	redirectUrl.searchParams.set('loginCode', loginCode);
 
 	if (loginClient) {
 		redirectUrl.searchParams.set('loginClient', loginClient);

apps/meteor/server/models.ts

@@ -50,6 +50,7 @@ import {
 	OAuthAccessTokensRaw,
 	OAuthAppsRaw,
 	OAuthAuthCodesRaw,
+	LoginCodesRaw,
 	OAuthRefreshTokensRaw,
 	OEmbedCacheRaw,
 	PermissionsRaw,
@@ -138,6 +139,7 @@ registerModel('INpsVoteModel', new NpsVoteRaw(db));
 registerModel('IOAuthAccessTokensModel', new OAuthAccessTokensRaw(db));
 registerModel('IOAuthAppsModel', new OAuthAppsRaw(db));
 registerModel('IOAuthAuthCodesModel', new OAuthAuthCodesRaw(db));
+registerModel('ILoginCodesModel', new LoginCodesRaw(db));
 registerModel('IOAuthRefreshTokensModel', new OAuthRefreshTokensRaw(db));
 registerModel('IOEmbedCacheModel', new OEmbedCacheRaw(db));
 registerModel('IPermissionsModel', new PermissionsRaw(db, trashCollection));

packages/core-typings/src/ILoginCode.ts

@@ -0,0 +1,6 @@
+export interface ILoginCode {
+	_id: string;
+	userId: string;
+	createdAt: Date;
+	expireAt: Date;
+}

packages/core-typings/src/index.ts

@@ -53,6 +53,7 @@ export type * from './IEmojiCustom';
 export type * from './ICustomEmojiDescriptor';
 export type * from './IAnalytics';
 export type * from './ICredentialToken';
+export type * from './ILoginCode';
 export type * from './IAvatar';
 export type * from './ICustomUserStatus';
 export type * from './IEmailMessageHistory';

packages/model-typings/src/index.ts

@@ -6,6 +6,7 @@ export type * from './models/IBaseModel';
 export type * from './models/IBaseUploadsModel';
 export type * from './models/ICannedResponseModel';
 export type * from './models/ICredentialTokensModel';
+export type * from './models/ILoginCodesModel';
 export type * from './models/ICustomSoundsModel';
 export type * from './models/ICustomUserStatusModel';
 export type * from './models/IEmailInboxModel';

packages/model-typings/src/models/ILoginCodesModel.ts

@@ -0,0 +1,10 @@
+import type { ILoginCode } from '@rocket.chat/core-typings';
+import type { DeleteResult } from 'mongodb';
+
+import type { IBaseModel } from './IBaseModel';
+
+export interface ILoginCodesModel extends IBaseModel<ILoginCode> {
+	createCode(userId: string): Promise<string>;
+	findOneNotExpiredByCode(code: string): Promise<ILoginCode | null>;
+	removeByCode(code: string): Promise<DeleteResult>;
+}

packages/models/src/index.ts

@@ -40,6 +40,7 @@ import type {
 	IOAuthAppsModel,
 	IOAuthAuthCodesModel,
 	IOAuthAccessTokensModel,
+	ILoginCodesModel,
 	IOAuthRefreshTokensModel,
 	IOEmbedCacheModel,
 	IPushTokenModel,
@@ -174,6 +175,7 @@ export const NpsVote = proxify<INpsVoteModel>('INpsVoteModel');
 export const OAuthApps = proxify<IOAuthAppsModel>('IOAuthAppsModel');
 export const OAuthAuthCodes = proxify<IOAuthAuthCodesModel>('IOAuthAuthCodesModel');
 export const OAuthAccessTokens = proxify<IOAuthAccessTokensModel>('IOAuthAccessTokensModel');
+export const LoginCodes = proxify<ILoginCodesModel>('ILoginCodesModel');
 export const OAuthRefreshTokens = proxify<IOAuthRefreshTokensModel>('IOAuthRefreshTokensModel');
 export const OEmbedCache = proxify<IOEmbedCacheModel>('IOEmbedCacheModel');
 export const PushToken = proxify<IPushTokenModel>('IPushTokenModel');

packages/models/src/modelClasses.ts

@@ -41,6 +41,7 @@ export * from './models/NpsVote';
 export * from './models/OAuthAccessTokens';
 export * from './models/OAuthApps';
 export * from './models/OAuthAuthCodes';
+export * from './models/LoginCodes';
 export * from './models/OAuthRefreshTokens';
 export * from './models/OEmbedCache';
 export * from './models/Permissions';

packages/models/src/models/LoginCodes.ts

@@ -0,0 +1,42 @@
+import { randomBytes } from 'crypto';
+
+import type { ILoginCode } from '@rocket.chat/core-typings';
+import type { ILoginCodesModel } from '@rocket.chat/model-typings';
+import type { Db, DeleteResult, IndexDescription } from 'mongodb';
+
+import { BaseRaw } from './BaseRaw';
+
+const CODE_TTL_SECONDS = 60;
+
+export class LoginCodesRaw extends BaseRaw<ILoginCode> implements ILoginCodesModel {
+	constructor(db: Db) {
+		super(db, 'login_codes');
+	}
+
+	override modelIndexes(): IndexDescription[] {
+		return [{ key: { expireAt: 1 }, expireAfterSeconds: 0 }];
+	}
+
+	async createCode(userId: string): Promise<string> {
+		const now = new Date();
+		const code = randomBytes(32).toString('hex');
+		await this.insertOne({
+			_id: code,
+			userId,
+			createdAt: now,
+			expireAt: new Date(now.getTime() + CODE_TTL_SECONDS * 1000),
+		});
+		return code;
+	}
+
+	findOneNotExpiredByCode(code: string): Promise<ILoginCode | null> {
+		return this.findOne({
+			_id: code,
+			expireAt: { $gt: new Date() },
+		});
+	}
+
+	removeByCode(code: string): Promise<DeleteResult> {
+		return this.deleteOne({ _id: code });
+	}
+}

packages/rest-typings/src/index.ts

@@ -27,6 +27,7 @@ import type { IntegrationHooksEndpoints } from './v1/integrations/hooks';
 import type { InvitesEndpoints } from './v1/invites';
 import type { LDAPEndpoints } from './v1/ldap';
 import type { LicensesEndpoints } from './v1/licenses';
+import type { LoginCodeEndpoints } from './v1/loginCode';
 import type { MailerEndpoints } from './v1/mailer';
 import type { MeEndpoints } from './v1/me';
 import type { MiscEndpoints } from './v1/misc';
@@ -92,6 +93,7 @@ export interface Endpoints
 		ImportEndpoints,
 		ServerEventsEndpoints,
 		TwoFactorChallengesEndpoints,
+		LoginCodeEndpoints,
 		DefaultEndpoints {}
 
 type OperationsByPathPatternAndMethod<
@@ -267,6 +269,7 @@ export * from './v1/cloud';
 export * from './v1/banners';
 export * from './default';
 export * from './v1/twoFactorChallenges';
+export * from './v1/loginCode';
 
 // Export the ajv instance for use in other packages
 export * from './v1/Ajv';

packages/rest-typings/src/v1/loginCode.ts

@@ -0,0 +1,20 @@
+import { ajv } from './Ajv';
+
+type LoginCodeRedeemParams = { code: string };
+
+const LoginCodeRedeemSchema = {
+	type: 'object',
+	properties: {
+		code: { type: 'string' },
+	},
+	required: ['code'],
+	additionalProperties: false,
+};
+
+export const isLoginCodeRedeemParamsPOST = ajv.compile<LoginCodeRedeemParams>(LoginCodeRedeemSchema);
+
+export type LoginCodeEndpoints = {
+	'/v1/loginCode.redeem': {
+		POST: (params: LoginCodeRedeemParams) => { loginToken: string; userId: string };
+	};
+};