pixelfed/app/Http/Controllers/RemoteOidcController.php

<?php

namespace App\Http\Controllers;

use App\Models\User;
use App\Models\UserOidcMapping;
use App\Rules\EmailNotBanned;
use App\Rules\ValidUsername;
use App\Services\EmailService;
use App\Services\UserOidcService;
use Illuminate\Auth\Events\Registered;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Str;
use Purify;

class RemoteOidcController extends Controller
{
    protected $fractal;

    public function start(UserOidcService $provider, Request $request): RedirectResponse
    {
        abort_unless((bool) config('remote-auth.oidc.enabled'), 404);
        if ($request->user()) {
            return redirect('/');
        }

        $url = $provider->getAuthorizationUrl([
            'scope' => $provider->getDefaultScopes(),
        ]);

        $request->session()->put('oauth2state', $provider->getState());

        return redirect($url);
    }

    public function handleCallback(UserOidcService $provider, Request $request): RedirectResponse
    {
        abort_unless((bool) config('remote-auth.oidc.enabled'), 404);

        if ($request->user()) {
            return redirect('/');
        }

        abort_unless($request->input('state'), 400);
        abort_unless($request->input('code'), 400);

        abort_unless(hash_equals((string) $request->session()->pull('oauth2state'), (string) $request->input('state')), 400, 'invalid state');

        $accessToken = $provider->getAccessToken('authorization_code', [
            'code' => $request->input('code'),
        ]);

        $userInfo = $provider->getResourceOwner($accessToken);
        $userInfoId = $userInfo->getId();
        $userInfoData = $userInfo->toArray();

        $mappedUser = UserOidcMapping::where('oidc_id', $userInfoId)->first();
        if ($mappedUser) {
            $this->guarder()->login($mappedUser->user);

            // OIDC accounts have a random, unknowable password, so they can
            // never satisfy the sudo-mode (RequirePassword / dangerzone) prompt.
            // Mark the session password-confirmed at SSO login so they can reach
            // dangerzone-gated settings within the normal confirmation window.
            $request->session()->passwordConfirmed();

            return redirect('/');
        }

        abort_if(EmailService::isBanned($userInfoData['email']), 400, 'Banned email.');

        $user = $this->createUser([
            'username' => $this->ensure_valid_username($userInfoData[config('remote-auth.oidc.field_username')]),
            'name' => $userInfoData['name'] ?? $userInfoData['display_name'] ?? $userInfoData[config('remote-auth.oidc.field_username')] ?? null,
            'email' => $userInfoData['email'],
        ]);

        UserOidcMapping::create([
            'user_id' => $user->id,
            'oidc_id' => $userInfoId,
        ]);

        // See note above: mark the freshly-registered OIDC session
        // password-confirmed so dangerzone routes are reachable.
        $request->session()->passwordConfirmed();

        return redirect('/');
    }

    protected function createUser($data)
    {
        $this->validate(new Request($data), [
            'email' => [
                'required',
                'string',
                'email:strict,filter_unicode,dns,spoof',
                'max:255',
                'unique:users',
                new EmailNotBanned,
            ],
            'username' => [
                'required',
                'min:2',
                'max:30',
                'unique:users,username',
                new ValidUsername,
            ],
            'name' => 'nullable|max:30',
        ]);

        event(new Registered($user = User::create([
            'name' => Purify::clean($data['name']),
            'username' => $data['username'],
            'email' => $data['email'],
            'password' => Hash::make(Str::password()),
            'email_verified_at' => now(),
            'app_register_ip' => request()->ip(),
            'register_source' => 'oidc',
        ])));

        $this->guarder()->login($user);

        return $user;
    }

    protected function guarder()
    {
        return Auth::guard();
    }

    private function ensure_valid_username($starting_username): string
    {
        $starting_username = explode('@', $starting_username)[0];
        $temp_username = preg_replace('/[^a-z0-9_]+/i', '', $starting_username);

        return substr($temp_username, 0, 30);
    }
}