mirror of
https://github.com/coollabsio/coolify.git
synced 2026-11-06 13:10:37 -04:00
Andras BacsaiandClaude Opus 5.5
3dabda5c56
- Only password-less users from before OAuth identities skip the provider email verification claim. Otherwise an unverified provider account with the email of a password user (including root) could sign in as them. - Build the default callback URL from the instance URL, not the request Host header, and do not save it during a login. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
102 lines
3.0 KiB
PHP
102 lines
3.0 KiB
PHP
<?php
|
|
|
|
use App\Auth\GitlabProvider;
|
|
use App\Auth\Oidc\OidcConfig;
|
|
use App\Models\OauthSetting;
|
|
use Laravel\Socialite\Facades\Socialite;
|
|
use Laravel\Socialite\Two\BitbucketProvider;
|
|
use Laravel\Socialite\Two\GithubProvider;
|
|
use SocialiteProviders\Discord\Provider;
|
|
use SocialiteProviders\Manager\Config;
|
|
|
|
/**
|
|
* Callback URL built from the instance URL, never from the request Host header.
|
|
*/
|
|
function oauth_default_redirect_uri(string $provider): string
|
|
{
|
|
return rtrim(base_url(), '/').route('auth.callback', $provider, false);
|
|
}
|
|
|
|
function get_socialite_provider(string $provider)
|
|
{
|
|
$oauth_setting = OauthSetting::firstWhere('provider', $provider);
|
|
|
|
if (! filled($oauth_setting->redirect_uri)) {
|
|
$oauth_setting->redirect_uri = oauth_default_redirect_uri($provider);
|
|
}
|
|
|
|
if ($provider === 'azure') {
|
|
$azure_config = new Config(
|
|
$oauth_setting->client_id,
|
|
$oauth_setting->client_secret,
|
|
$oauth_setting->redirect_uri,
|
|
['tenant' => $oauth_setting->tenant],
|
|
);
|
|
|
|
return Socialite::driver('azure')->setConfig($azure_config);
|
|
}
|
|
|
|
if ($provider == 'authentik' || $provider == 'clerk') {
|
|
$authentik_clerk_config = new Config(
|
|
$oauth_setting->client_id,
|
|
$oauth_setting->client_secret,
|
|
$oauth_setting->redirect_uri,
|
|
['base_url' => $oauth_setting->base_url],
|
|
);
|
|
|
|
return Socialite::driver($provider)->setConfig($authentik_clerk_config);
|
|
}
|
|
|
|
if ($provider == 'zitadel') {
|
|
$zitadel_config = new Config(
|
|
$oauth_setting->client_id,
|
|
$oauth_setting->client_secret,
|
|
$oauth_setting->redirect_uri,
|
|
['base_url' => $oauth_setting->base_url],
|
|
);
|
|
|
|
return Socialite::driver('zitadel')->setConfig($zitadel_config);
|
|
}
|
|
|
|
if ($provider === 'oidc') {
|
|
return Socialite::driver('oidc')->setConfig(OidcConfig::fromOauthSetting($oauth_setting));
|
|
}
|
|
|
|
if ($provider == 'google') {
|
|
$google_config = new Config(
|
|
$oauth_setting->client_id,
|
|
$oauth_setting->client_secret,
|
|
$oauth_setting->redirect_uri
|
|
);
|
|
|
|
return Socialite::driver('google')
|
|
->setConfig($google_config)
|
|
->with(['hd' => $oauth_setting->tenant]);
|
|
}
|
|
|
|
$config = [
|
|
'client_id' => $oauth_setting->client_id,
|
|
'client_secret' => $oauth_setting->client_secret,
|
|
'redirect' => $oauth_setting->redirect_uri,
|
|
];
|
|
|
|
$provider_class_map = [
|
|
'bitbucket' => BitbucketProvider::class,
|
|
'discord' => Provider::class,
|
|
'github' => GithubProvider::class,
|
|
'gitlab' => GitlabProvider::class,
|
|
'infomaniak' => SocialiteProviders\Infomaniak\Provider::class,
|
|
];
|
|
|
|
$socialite = Socialite::buildProvider(
|
|
$provider_class_map[$provider],
|
|
$config
|
|
);
|
|
|
|
if ($provider == 'gitlab' && ! empty($oauth_setting->base_url)) {
|
|
$socialite->setHost($oauth_setting->base_url);
|
|
}
|
|
|
|
return $socialite;
|
|
}
|