snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/server/lib/auth-providers/oauth/facebook.js

@@ -0,0 +1,68 @@
+import crypto from 'node:crypto';
+
+import { serverFetch as fetch } from '@rocket.chat/server-fetch';
+import { Match, check } from 'meteor/check';
+import { OAuth } from 'meteor/oauth';
+import _ from 'underscore';
+
+import { registerAccessTokenService } from './oauth';
+
+const whitelisted = ['id', 'email', 'name', 'first_name', 'last_name', 'link', 'gender', 'locale', 'age_range'];
+
+const FB_API_VERSION = 'v2.9';
+const FB_URL = 'https://graph.facebook.com';
+
+const getIdentity = async function (accessToken, fields, secret) {
+	const hmac = crypto.createHmac('sha256', OAuth.openSecret(secret));
+	hmac.update(accessToken);
+
+	try {
+		const request = await fetch(`${FB_URL}/${FB_API_VERSION}/me`, {
+			params: {
+				access_token: accessToken,
+				appsecret_proof: hmac.digest('hex'),
+				fields: fields.join(','),
+			},
+		});
+
+		if (!request.ok) {
+			throw new Error(await request.text());
+		}
+
+		return request.json();
+	} catch (err) {
+		throw _.extend(new Error(`Failed to fetch identity from Facebook. ${err.message}`), {
+			response: err.message,
+		});
+	}
+};
+
+registerAccessTokenService('facebook', async (options) => {
+	check(
+		options,
+		Match.ObjectIncluding({
+			accessToken: String,
+			secret: String,
+			expiresIn: Match.Integer,
+		}),
+	);
+
+	const identity = await getIdentity(options.accessToken, whitelisted, options.secret);
+
+	const serviceData = {
+		accessToken: options.accessToken,
+		expiresAt: +new Date() + 1000 * parseInt(options.expiresIn, 10),
+	};
+
+	const fields = _.pick(identity, whitelisted);
+	_.extend(serviceData, fields);
+
+	return {
+		serviceData,
+		options: {
+			profile: {
+				name: identity.name,
+			},
+		},
+	};
+});

apps/meteor/server/lib/auth-providers/oauth/google.js

@@ -0,0 +1,83 @@
+import { serverFetch as fetch } from '@rocket.chat/server-fetch';
+import { Match, check } from 'meteor/check';
+import { Google } from 'meteor/google-oauth';
+import _ from 'underscore';
+
+import { registerAccessTokenService } from './oauth';
+
+async function getIdentity(accessToken) {
+	try {
+		const request = await fetch('https://www.googleapis.com/oauth2/v1/userinfo', {
+			params: { access_token: accessToken },
+		});
+
+		if (!request.ok) {
+			throw new Error(await request.text());
+		}
+
+		return request.json();
+	} catch (err) {
+		throw _.extend(new Error(`Failed to fetch identity from Google. ${err.message}`), {
+			response: err.message,
+		});
+	}
+}
+
+async function getScopes(accessToken) {
+	try {
+		const request = await fetch('https://www.googleapis.com/oauth2/v1/tokeninfo', {
+			params: { access_token: accessToken },
+		});
+
+		if (!request.ok) {
+			throw new Error(await request.text());
+		}
+
+		return (await request.json()).scope.split(' ');
+	} catch (err) {
+		throw _.extend(new Error(`Failed to fetch tokeninfo from Google. ${err.message}`), {
+			response: err.message,
+		});
+	}
+}
+
+registerAccessTokenService('google', async (options) => {
+	check(
+		options,
+		Match.ObjectIncluding({
+			accessToken: String,
+			idToken: String,
+			expiresIn: Match.Integer,
+			scope: Match.Maybe(String),
+			identity: Match.Maybe(Object),
+		}),
+	);
+
+	const identity = await getIdentity(options.accessToken);
+
+	const serviceData = {
+		accessToken: options.accessToken,
+		idToken: options.idToken,
+		expiresAt: +new Date() + 1000 * parseInt(options.expiresIn, 10),
+		scope: options.scopes || (await getScopes(options.accessToken)),
+	};
+
+	const fields = _.pick(identity, Google.whitelistedFields);
+	_.extend(serviceData, fields);
+
+	// only set the token in serviceData if it's there. this ensures
+	// that we don't lose old ones (since we only get this on the first
+	// log in attempt)
+	if (options.refreshToken) {
+		serviceData.refreshToken = options.refreshToken;
+	}
+
+	return {
+		serviceData,
+		options: {
+			profile: {
+				name: identity.name,
+			},
+		},
+	};
+});

apps/meteor/server/lib/auth-providers/oauth/oauth.js

@@ -0,0 +1,55 @@
+import { Accounts } from 'meteor/accounts-base';
+import { Match, check } from 'meteor/check';
+import { Meteor } from 'meteor/meteor';
+import { ServiceConfiguration } from 'meteor/service-configuration';
+import _ from 'underscore';
+
+const AccessTokenServices = {};
+
+export const registerAccessTokenService = function (serviceName, handleAccessTokenRequest) {
+	AccessTokenServices[serviceName] = {
+		serviceName,
+		handleAccessTokenRequest,
+	};
+};
+
+// Listen to calls to `login` with an oauth option set. This is where
+// users actually get logged in to meteor via oauth.
+Accounts.registerLoginHandler(async (options) => {
+	if (!options.accessToken) {
+		return undefined; // don't handle
+	}
+
+	check(
+		options,
+		Match.ObjectIncluding({
+			serviceName: String,
+		}),
+	);
+
+	const service = AccessTokenServices[options.serviceName];
+
+	// Skip everything if there's no service set by the oauth middleware
+	if (!service) {
+		throw new Error(`Unexpected AccessToken service ${options.serviceName}`);
+	}
+
+	// Make sure we're configured
+	if (!(await ServiceConfiguration.configurations.findOneAsync({ service: options.serviceName }))) {
+		throw new Accounts.ConfigError();
+	}
+
+	if (!_.contains(Accounts.oauth.serviceNames(), service.serviceName)) {
+		// serviceName was not found in the registered services list.
+		// This could happen because the service never registered itself or
+		// unregisterService was called on it.
+		return {
+			type: 'oauth',
+			error: new Meteor.Error(Accounts.LoginCancelledError.numericError, `No registered oauth service found for: ${service.serviceName}`),
+		};
+	}
+
+	const oauthResult = await service.handleAccessTokenRequest(options);
+
+	return Accounts.updateOrCreateUserFromExternalService(service.serviceName, oauthResult.serviceData, oauthResult.options);
+});

apps/meteor/server/lib/auth-providers/oauth/proxy.js

@@ -0,0 +1,12 @@
+import { OAuth } from 'meteor/oauth';
+import _ from 'underscore';
+
+import { settings } from '../../../settings';
+
+OAuth._redirectUri = _.wrap(OAuth._redirectUri, (func, serviceName, ...args) => {
+	const proxy = settings.get('Accounts_OAuth_Proxy_services').replace(/\s/g, '').split(',');
+	if (proxy.includes(serviceName)) {
+		return `${settings.get('Accounts_OAuth_Proxy_host')}/oauth_redirect`;
+	}
+	return func(serviceName, ...args);
+});

apps/meteor/server/lib/auth-providers/oauth/twitter.js

@@ -0,0 +1,55 @@
+import { Match, check } from 'meteor/check';
+import { TwitterApi } from 'twitter-api-v2';
+import _ from 'underscore';
+
+import { registerAccessTokenService } from './oauth';
+
+const whitelistedFields = ['id', 'name', 'description', 'profile_image_url', 'profile_image_url_https', 'lang', 'email'];
+
+const getIdentity = async function (accessToken, appId, appSecret, accessTokenSecret) {
+	const client = new TwitterApi({
+		appKey: appId,
+		appSecret,
+		accessToken,
+		accessSecret: accessTokenSecret,
+	});
+	try {
+		return await client.v1.verifyCredentials({ include_email: true });
+	} catch (err) {
+		throw _.extend(new Error(`Failed to fetch identity from Twitter. ${err.message}`), {
+			data: err.data ?? err.response,
+		});
+	}
+};
+
+registerAccessTokenService('twitter', async (options) => {
+	check(
+		options,
+		Match.ObjectIncluding({
+			accessToken: String,
+			appSecret: String,
+			appId: String,
+			accessTokenSecret: String,
+			expiresIn: Match.Integer,
+		}),
+	);
+
+	const identity = await getIdentity(options.accessToken, options.appId, options.appSecret, options.accessTokenSecret);
+
+	const serviceData = {
+		accessToken: options.accessToken,
+		expiresAt: +new Date() + 1000 * parseInt(options.expiresIn, 10),
+	};
+
+	const fields = _.pick(identity, whitelistedFields);
+	_.extend(serviceData, fields);
+
+	return {
+		serviceData,
+		options: {
+			profile: {
+				name: identity.name,
+			},
+		},
+	};
+});