feat: Accounts_OAuth_Use_Modern_Flow Setting

apps/meteor/app/api/server/v1/settings.ts

@@ -178,6 +178,7 @@ API.v1.get(
 	},
 	async function action() {
 		const oAuthServicesEnabled = await LoginServiceConfigurationModel.find({}, { projection: { secret: 0 } }).toArray();
+		const isPassportFlowEnabled = settings.get<boolean>('Accounts_OAuth_Use_Modern_Flow');
 
 		return API.v1.success({
 			services: oAuthServicesEnabled.map((service) => {
@@ -195,7 +196,7 @@ API.v1.get(
 				}
 
 				if ((service as OAuthConfiguration).custom || (service.service && service.service === 'wordpress')) {
-					return { ...service, hideButtonOnMobile: true };
+					return { ...service, hideButtonOnMobile: isPassportFlowEnabled };
 				}
 
 				return {
@@ -209,7 +210,7 @@ API.v1.get(
 					buttonColor: service.buttonColor || '',
 					buttonLabelColor: service.buttonLabelColor || '',
 					custom: false,
-					hideButtonOnMobile: true,
+					hideButtonOnMobile: isPassportFlowEnabled,
 				};
 			}),
 		});

apps/meteor/app/dolphin/server/lib.ts

@@ -7,6 +7,7 @@ import _ from 'underscore';
 import { callbacks } from '../../../server/lib/callbacks';
 import { beforeCreateUserCallback } from '../../../server/lib/callbacks/beforeCreateUserCallback';
 import { addPassportCustomOAuth } from '../../../server/lib/oauth/addPassportCustomOAuth';
+import { CustomOAuth } from '../../custom-oauth/server/custom_oauth_server';
 import { settings } from '../../settings/server';
 
 const config: Partial<OAuthConfiguration> = {
@@ -22,6 +23,8 @@ const config: Partial<OAuthConfiguration> = {
 	accessTokenParam: 'access_token',
 };
 
+const Dolphin = new CustomOAuth('dolphin', config);
+
 function DolphinOnCreateUser(options: any, user?: IUser) {
 	// TODO: callbacks Fix this
 	if (user?.services?.dolphin?.NickName) {
@@ -46,14 +49,27 @@ const configureDolphinOAuth = () => {
 		return;
 	}
 
-	addPassportCustomOAuth('dolphin', { ...config, serverURL, clientId, clientSecret });
+	const completeConfig = { ...config, serverURL, clientId, clientSecret };
+
+	if (settings.get<boolean>('Accounts_OAuth_Use_Modern_Flow')) {
+		addPassportCustomOAuth('dolphin', completeConfig);
+		return;
+	}
+
+	Dolphin.configure(completeConfig);
 };
 
 Meteor.startup(async () => {
-	const updateConfig = () => _.debounce(configureDolphinOAuth, 300);
+	const updateConfig = _.debounce(configureDolphinOAuth, 300);
 
 	settings.watchMultiple(
-		['Accounts_OAuth_Dolphin', 'Accounts_OAuth_Dolphin_URL', 'Accounts_OAuth_Dolphin_id', 'Accounts_OAuth_Dolphin_secret'],
+		[
+			'Accounts_OAuth_Dolphin',
+			'Accounts_OAuth_Dolphin_URL',
+			'Accounts_OAuth_Dolphin_id',
+			'Accounts_OAuth_Dolphin_secret',
+			'Accounts_OAuth_Use_Modern_Flow',
+		],
 		updateConfig,
 	);
 

apps/meteor/app/drupal/server/lib.ts

@@ -4,9 +4,11 @@ import passport from 'passport';
 import _ from 'underscore';
 
 import { addPassportCustomOAuth } from '../../../server/lib/oauth/addPassportCustomOAuth';
+import { CustomOAuth } from '../../custom-oauth/server/custom_oauth_server';
 import { settings } from '../../settings/server';
 
 const config: Partial<OAuthConfiguration> = {
+	serverURL: '',
 	identityPath: '/oauth2/UserInfo',
 	authorizePath: '/oauth2/authorize',
 	tokenPath: '/oauth2/token',
@@ -21,6 +23,8 @@ const config: Partial<OAuthConfiguration> = {
 	accessTokenParam: 'access_token',
 };
 
+const Drupal = new CustomOAuth('drupal', config);
+
 const configureDrupalOAuth = () => {
 	passport.unuse('drupal');
 	const enabled = settings.get<boolean>('Accounts_OAuth_Drupal');
@@ -36,14 +40,27 @@ const configureDrupalOAuth = () => {
 		return;
 	}
 
-	addPassportCustomOAuth('drupal', { ...config, serverURL, clientId, clientSecret });
+	const completeConfig = { ...config, serverURL, clientId, clientSecret };
+
+	if (settings.get<boolean>('Accounts_OAuth_Use_Modern_Flow')) {
+		addPassportCustomOAuth('drupal', completeConfig);
+		return;
+	}
+
+	Drupal.configure(completeConfig);
 };
 
 Meteor.startup(() => {
 	const updateConfig = _.debounce(configureDrupalOAuth, 300);
 
 	settings.watchMultiple(
-		['Accounts_OAuth_Drupal', 'API_Drupal_URL', 'Accounts_OAuth_Drupal_id', 'Accounts_OAuth_Drupal_secret'],
+		[
+			'Accounts_OAuth_Drupal',
+			'API_Drupal_URL',
+			'Accounts_OAuth_Drupal_id',
+			'Accounts_OAuth_Drupal_secret',
+			'Accounts_OAuth_Use_Modern_Flow',
+		],
 		updateConfig,
 	);
 });

apps/meteor/app/gitlab/server/lib.ts

@@ -4,6 +4,7 @@ import passport from 'passport';
 import _ from 'underscore';
 
 import { addPassportCustomOAuth } from '../../../server/lib/oauth/addPassportCustomOAuth';
+import { CustomOAuth } from '../../custom-oauth/server/custom_oauth_server';
 import { settings } from '../../settings/server';
 
 const config: Partial<OAuthConfiguration> = {
@@ -18,6 +19,8 @@ const config: Partial<OAuthConfiguration> = {
 	accessTokenParam: 'access_token',
 };
 
+const Gitlab = new CustomOAuth('gitlab', config);
+
 const configureGitlabOAuth = () => {
 	passport.unuse('gitlab');
 
@@ -36,7 +39,14 @@ const configureGitlabOAuth = () => {
 		return;
 	}
 
-	addPassportCustomOAuth('gitlab', { ...config, clientId, clientSecret, serverURL, identityPath, mergeUsers });
+	const completeConfig = { ...config, clientId, clientSecret, serverURL, identityPath, mergeUsers };
+
+	if (settings.get<boolean>('Accounts_OAuth_Use_Modern_Flow')) {
+		addPassportCustomOAuth('gitlab', completeConfig);
+		return;
+	}
+
+	Gitlab.configure(completeConfig);
 };
 
 Meteor.startup(() => {
@@ -50,6 +60,7 @@ Meteor.startup(() => {
 			'Accounts_OAuth_Gitlab_secret',
 			'Accounts_OAuth_Gitlab_identity_path',
 			'Accounts_OAuth_Gitlab_merge_users',
+			'Accounts_OAuth_Use_Modern_Flow',
 		],
 		updateConfig,
 	);

apps/meteor/app/nextcloud/server/lib.ts

@@ -1,10 +1,13 @@
 import type { OAuthConfiguration } from '@rocket.chat/core-typings';
 import { Meteor } from 'meteor/meteor';
+import passport from 'passport';
 
 import { addPassportCustomOAuth } from '../../../server/lib/oauth/addPassportCustomOAuth';
+import { CustomOAuth } from '../../custom-oauth/server/custom_oauth_server';
 import { settings } from '../../settings/server/cached';
 
 const NEXTCLOUD_PATHS = {
+	serverURL: '',
 	tokenPath: '/index.php/apps/oauth2/api/v1/token',
 	tokenSentVia: 'header' as OAuthConfiguration['tokenSentVia'],
 	authorizePath: '/index.php/apps/oauth2/authorize',
@@ -16,7 +19,10 @@ const NEXTCLOUD_PATHS = {
 	},
 };
 
+const Nextcloud = new CustomOAuth('nextcloud', NEXTCLOUD_PATHS);
+
 function configureNextcloudOAuth(): void {
+	passport.unuse('nextcloud');
 	const enabled = settings.get<boolean>('Accounts_OAuth_Nextcloud');
 	if (!enabled) {
 		return;
@@ -30,17 +36,25 @@ function configureNextcloudOAuth(): void {
 		return;
 	}
 
-	addPassportCustomOAuth('nextcloud', {
-		...NEXTCLOUD_PATHS,
-		serverURL,
-		clientId,
-		clientSecret,
-	});
+	const config = { ...NEXTCLOUD_PATHS, serverURL, clientId, clientSecret };
+
+	if (settings.get<boolean>('Accounts_OAuth_Use_Modern_Flow')) {
+		addPassportCustomOAuth('nextcloud', config);
+		return;
+	}
+
+	Nextcloud.configure(config);
 }
 
 Meteor.startup(() => {
 	settings.watchMultiple(
-		['Accounts_OAuth_Nextcloud', 'Accounts_OAuth_Nextcloud_URL', 'Accounts_OAuth_Nextcloud_id', 'Accounts_OAuth_Nextcloud_secret'],
+		[
+			'Accounts_OAuth_Nextcloud',
+			'Accounts_OAuth_Nextcloud_URL',
+			'Accounts_OAuth_Nextcloud_id',
+			'Accounts_OAuth_Nextcloud_secret',
+			'Accounts_OAuth_Use_Modern_Flow',
+		],
 		configureNextcloudOAuth,
 	);
 });

apps/meteor/app/wordpress/server/lib.ts

@@ -5,6 +5,7 @@ import passport from 'passport';
 import _ from 'underscore';
 
 import { addPassportCustomOAuth } from '../../../server/lib/oauth/addPassportCustomOAuth';
+import { CustomOAuth } from '../../custom-oauth/server/custom_oauth_server';
 import { settings } from '../../settings/server';
 
 const config: Partial<OAuthConfiguration> = {
@@ -20,6 +21,8 @@ const config: Partial<OAuthConfiguration> = {
 
 const serviceKey = 'wordpress';
 
+const WordPress = new CustomOAuth(serviceKey, config);
+
 const fillSettings = _.debounce(async (): Promise<void> => {
 	config.serverURL = settings.get('API_Wordpress_URL');
 	if (!config.serverURL) {
@@ -66,7 +69,20 @@ const fillSettings = _.debounce(async (): Promise<void> => {
 			break;
 	}
 
-	addPassportCustomOAuth(serviceKey, config);
+	const clientId = settings.get<string>('Accounts_OAuth_Wordpress_id');
+	const clientSecret = settings.get<string>('Accounts_OAuth_Wordpress_secret');
+
+	if (!clientId || !clientSecret) {
+		return;
+	}
+
+	const completeConfig = { ...config, clientId, clientSecret };
+
+	if (settings.get<boolean>('Accounts_OAuth_Use_Modern_Flow')) {
+		addPassportCustomOAuth(serviceKey, completeConfig);
+	} else {
+		WordPress.configure(completeConfig);
+	}
 
 	const enabled = settings.get('Accounts_OAuth_Wordpress');
 	if (enabled) {
@@ -86,5 +102,6 @@ const fillSettings = _.debounce(async (): Promise<void> => {
 }, 1000);
 
 Meteor.startup(() => {
-	return settings.watchByRegex(/(API\_Wordpress\_URL)?(Accounts\_OAuth\_Wordpress\_)?/, () => fillSettings());
+	settings.watchByRegex(/(API\_Wordpress\_URL)?(Accounts\_OAuth\_Wordpress\_)?/, () => fillSettings());
+	settings.watch('Accounts_OAuth_Use_Modern_Flow', () => fillSettings());
 });

apps/meteor/server/configuration/configurePassport.ts

@@ -84,6 +84,10 @@ export const configurePassport = (settings: ICachedSettings) => {
 	});
 
 	settings.watchByRegex(/^(Accounts_OAuth_)[a-z0-9_]+$/i, () => {
+		if (settings.get<boolean>('Accounts_OAuth_Use_Modern_Flow')) {
+			return;
+		}
+
 		const services = getOAuthServices(settings);
 		const oauthServiceConfigs = createOAuthServiceConfig(settings, services);
 		configureOAuthServices(oauthServiceConfigs, settings);

apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts

@@ -47,7 +47,15 @@ export const addPassportCustomOAuth = (serviceName: string, config: Partial<OAut
 
 	oAuthRouter.get(
 		`/_oauth/${serviceName}`,
-		passport.authenticate(serviceName, { failureRedirect: '/login', failureFlash: true, failWithError: true, keepSessionInfo: true }),
+		(_req, _res, next) => {
+			const isPassportFlowEnabled = settings.get<boolean>('Accounts_OAuth_Use_Modern_Flow');
+			if (isPassportFlowEnabled) {
+				next();
+			} else {
+				next('router');
+			}
+		},
+		passport.authenticate(serviceName, { failureRedirect: '/login', failWithError: true, keepSessionInfo: true }),
 		passportOAuthCallback(siteUrl),
 	);
 };

apps/meteor/server/lib/oauth/configureOAuthServices.ts

@@ -80,7 +80,15 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 		);
 		oAuthRouter.get(
 			`/_oauth/${config.provider}`,
-			passport.authenticate(config.provider, { failureRedirect: '/login', failureFlash: true, failWithError: true, keepSessionInfo: true }),
+			(_req, _res, next) => {
+				const isPassportFlowEnabled = settings.get<boolean>('Accounts_OAuth_Use_Modern_Flow');
+				if (isPassportFlowEnabled) {
+					next();
+				} else {
+					next('router');
+				}
+			},
+			passport.authenticate(config.provider, { failureRedirect: '/login', failWithError: true, keepSessionInfo: true }),
 			passportOAuthCallback(siteUrl),
 		);
 	});

apps/meteor/server/settings/oauth.ts

@@ -4,6 +4,13 @@ import { settingsRegistry } from '../../app/settings/server';
 
 export const createOauthSettings = () =>
 	settingsRegistry.addGroup('OAuth', async function () {
+		await this.add('Accounts_OAuth_Use_Modern_Flow', true, {
+			type: 'boolean',
+			public: true,
+			i18nLabel: 'Accounts_OAuth_Use_Modern_Flow_Label',
+			i18nDescription: 'Accounts_OAuth_Use_Modern_Flow_Description',
+		});
+
 		await this.section('Drupal', async function () {
 			const enableQuery = {
 				_id: 'Accounts_OAuth_Drupal',

packages/i18n/src/locales/en.i18n.json

@@ -358,6 +358,8 @@
   "Accounts_OAuth_Wordpress_server_type_wordpress_com": "Wordpress.com",
   "Accounts_OAuth_Wordpress_server_type_wp_oauth_server": "WP OAuth Server Plugin",
   "Accounts_OAuth_Wordpress_token_path": "Token Path",
+  "Accounts_OAuth_Use_Modern_Flow_Label": "Use Modern OAuth Flow",
+  "Accounts_OAuth_Use_Modern_Flow_Description": "When enabled, OAuth authentication uses the modern Passport-based flow with system browser support on mobile and deep-link callbacks (recommended). When disabled, the original Meteor OAuth implementation is used for backward compatibility.",
   "Accounts_PasswordReset": "Password Reset",
   "Accounts_Password_Policy_AtLeastOneLowercase": "At Least One Lowercase",
   "Accounts_Password_Policy_AtLeastOneLowercase_Description": "Enforce that a password contain at least one lowercase character.",
@@ -3156,6 +3158,7 @@
   "Leave_the_current_channel": "Leave the current channel",
   "Leave_the_description_field_blank_if_you_dont_want_to_show_the_role": "Leave the description field blank if you don't want to show the role",
   "Left": "Left",
+  "Legacy_Meteor_OAuth": "Legacy Meteor OAuth",
   "Let_moderators_know_what_the_issue_is": "Let moderators know what the issue is",
   "Let_them_know": "Let them know",
   "Lets_get_you_new_one_": "Let's get you a new one!",
@@ -3664,6 +3667,7 @@
   "Moderation_User_deactivated": "User deactivated",
   "Moderation_User_deleted_warning": "The user who sent the message(s) no longer exists or has been removed.",
   "Moderators": "Moderators",
+  "Modern_OAuth_System_Browser_and_Deep_Links_Recommended": "Modern OAuth (System Browser & Deep Links) (Recommended)",
   "Monday": "Monday",
   "MongoDB": "MongoDB",
   "MongoDB_Deprecated": "MongoDB Deprecated",

packages/web-ui-registration/src/LoginServices.tsx

@@ -18,8 +18,9 @@ const LoginServices = ({
 	const { t } = useTranslation();
 	const services = useLoginServices();
 	const showFormLogin = useSetting('Accounts_ShowFormLogin');
+	const enableModernOAuthFlow = useSetting('Accounts_OAuth_Use_Modern_Flow', true);
 
-	const isDesktopApp = !!window.RocketChatDesktop?.openInBrowser;
+	const isDesktopApp = !!window.RocketChatDesktop?.openInBrowser && enableModernOAuthFlow;
 
 	const servicesToShow = useMemo(
 		() => (isDesktopApp ? services.filter(({ service }) => servicesToBeShownOnDesktop.includes(service)) : services),
@@ -52,7 +53,13 @@ const LoginServices = ({
 			{servicesToShow.length > 0 && (
 				<ButtonGroup vertical stretch small>
 					{servicesToShow.map((service) => (
-						<LoginServicesButton disabled={disabled} key={service.service} {...service} setError={setError} />
+						<LoginServicesButton
+							disabled={disabled}
+							key={service.service}
+							{...service}
+							setError={setError}
+							enableModernOAuthFlow={enableModernOAuthFlow}
+						/>
 					))}
 				</ButtonGroup>
 			)}