59f727d4f5
# What this PR does The following is deployed under a feature flag. **How it works** 1. The user clicks on the "Connect using your Google account" button in the user profile settings modal 2. The UI makes a call to `GET /api/internal/v1/login/google-oauth2`. The backend has now been configured to add `apps.social_auth.backends.GoogleOAuth2` as a "`social_auth` backend". 3. The backend will respond w/ a URL which points to the Google OAuth2 consent screen. The frontend then proceeds by sending the user to this page. This URL includes the following query parameters (amongst others): - `redirect_uri` - this will send the user back to `/api/internal/v1/complete/google-oauth2` (ie. make another API call to the OnCall backend to finalize the Google OAuth2 flow) - `state` - this represents an `apps.auth_token.models.GoogleOAuth2Token` token. This allows us to identify the OnCall user once they've linked their Google account. 4. Once redirected back to `/api/internal/v1/complete/google-oauth2`, this will complete the OAuth2 flow. At this point, the backend has access to several pieces of information about the Google user, including their `access_token` and `refresh_token`. We persist these (encrypted) for future use to fetch the user's out-of-office calendar events 5. The response from the API call in 4 above ☝️ is HTTP 302 (redirect) to `/a/grafana-oncall-app/users/me` (ie. open the user profile settings modal). At this point the user will see that their account has been connected and they can further configure the settings  ## Which issue(s) this PR closes Closes https://github.com/grafana/oncall-private/issues/2584 ## Checklist - [x] Unit, integration, and e2e (if applicable) tests updated - [x] Documentation added (or `pr:no public docs` PR label added if not required) - will be done in https://github.com/grafana/oncall-private/issues/2591 - [x] Added the relevant release notes label (see labels prefixed w/ `release:`). These labels dictate how your PR will show up in the autogenerated release notes. - will be done in https://github.com/grafana/oncall-private/issues/2591 --------- Co-authored-by: Dominik <dominik.broj@grafana.com> Co-authored-by: Maxim Mordasov <maxim.mordasov@grafana.com>
86 lines
3.2 KiB
Python
86 lines
3.2 KiB
Python
import logging
|
|
from urllib.parse import urljoin
|
|
|
|
from django.conf import settings
|
|
from django.contrib.auth import REDIRECT_FIELD_NAME
|
|
from django.http import HttpResponse, HttpResponseRedirect
|
|
from django.views.decorators.cache import never_cache
|
|
from django.views.decorators.csrf import csrf_exempt
|
|
from rest_framework.decorators import api_view, authentication_classes
|
|
from rest_framework.request import Request
|
|
from rest_framework.response import Response
|
|
from social_core.actions import do_auth, do_complete, do_disconnect
|
|
from social_core.backends.google import GoogleOAuth2
|
|
from social_django.utils import psa
|
|
from social_django.views import _do_login
|
|
|
|
from apps.auth_token.auth import GoogleTokenAuthentication, PluginAuthentication, SlackTokenAuthentication
|
|
from apps.social_auth.backends import LoginSlackOAuth2V2
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
@api_view(["GET"])
|
|
@authentication_classes([PluginAuthentication])
|
|
@never_cache
|
|
@psa("social:complete")
|
|
def overridden_login_social_auth(request: Request, backend: str) -> Response:
|
|
# We can't just redirect frontend here because we need to make a API call and pass tokens to this view from JS.
|
|
# So frontend can't follow our redirect.
|
|
# So wrapping and returning URL to redirect as a string.
|
|
if "slack" in backend and settings.SLACK_INTEGRATION_MAINTENANCE_ENABLED:
|
|
return Response(
|
|
"Grafana OnCall is temporary unable to connect your slack account or install OnCall to your slack workspace",
|
|
status=400,
|
|
)
|
|
|
|
url_to_redirect_to = do_auth(request.backend, redirect_name=REDIRECT_FIELD_NAME).url
|
|
return Response(url_to_redirect_to, 200)
|
|
|
|
|
|
@api_view(["GET"])
|
|
@authentication_classes([GoogleTokenAuthentication, SlackTokenAuthentication])
|
|
@never_cache
|
|
@csrf_exempt
|
|
@psa("social:complete")
|
|
def overridden_complete_social_auth(request: Request, backend: str, *args, **kwargs) -> Response:
|
|
"""Authentication complete view"""
|
|
if isinstance(request.backend, (LoginSlackOAuth2V2, GoogleOAuth2)):
|
|
# if this was a user login/linking account, redirect to profile
|
|
redirect_to = "/a/grafana-oncall-app/users/me"
|
|
else:
|
|
# InstallSlackOAuth2V2 backend
|
|
redirect_to = "/a/grafana-oncall-app/chat-ops"
|
|
|
|
kwargs.update(
|
|
user=request.user,
|
|
redirect_name=REDIRECT_FIELD_NAME,
|
|
request=request,
|
|
)
|
|
result = do_complete(
|
|
request.backend,
|
|
_do_login,
|
|
*args,
|
|
**kwargs,
|
|
)
|
|
|
|
# handle potential errors in the strategy pipeline
|
|
return_to = None
|
|
if isinstance(result, HttpResponse):
|
|
# check if there was a redirect set in the session
|
|
return_to = request.backend.strategy.session.get(REDIRECT_FIELD_NAME)
|
|
|
|
if return_to is None:
|
|
# We build the frontend url using org url since multiple stacks could be connected to one backend.
|
|
return_to = urljoin(request.user.organization.grafana_url, redirect_to)
|
|
return HttpResponseRedirect(return_to)
|
|
|
|
|
|
@api_view(["GET"])
|
|
@authentication_classes([PluginAuthentication])
|
|
@never_cache
|
|
@psa("social:disconnect")
|
|
def overridden_disconnect_social_auth(request: Request, backend: str) -> Response:
|
|
if backend == "google-oauth2":
|
|
do_disconnect(request.backend, request.user)
|
|
return Response("ok", 200)
|