stack-auth · fomalhautb · Jul 26, 2024 · Jul 25, 2024 · Jul 25, 2024 · Jul 26, 2024
diff --git a/apps/backend/prisma/migrations/20240726164717_removed_shared_spotify/migration.sql b/apps/backend/prisma/migrations/20240726164717_removed_shared_spotify/migration.sql
@@ -0,0 +1,14 @@
+/*
+  Warnings:
+
+  - The values [SPOTIFY] on the enum `ProxiedOAuthProviderType` will be removed. If these variants are still used in the database, this will fail.
+
+*/
+-- AlterEnum
+BEGIN;
+CREATE TYPE "ProxiedOAuthProviderType_new" AS ENUM ('GITHUB', 'FACEBOOK', 'GOOGLE', 'MICROSOFT');
+ALTER TABLE "ProxiedOAuthProviderConfig" ALTER COLUMN "type" TYPE "ProxiedOAuthProviderType_new" USING ("type"::text::"ProxiedOAuthProviderType_new");
+ALTER TYPE "ProxiedOAuthProviderType" RENAME TO "ProxiedOAuthProviderType_old";
+ALTER TYPE "ProxiedOAuthProviderType_new" RENAME TO "ProxiedOAuthProviderType";
+DROP TYPE "ProxiedOAuthProviderType_old";
+COMMIT;
diff --git a/apps/backend/prisma/schema.prisma b/apps/backend/prisma/schema.prisma
@@ -517,7 +517,6 @@ enum ProxiedOAuthProviderType {
  FACEBOOK
  GOOGLE
  MICROSOFT
-  SPOTIFY
 }

 model StandardOAuthProviderConfig {

diff --git a/apps/backend/src/app/api/v1/auth/oauth/authorize/[provider]/route.tsx b/apps/backend/src/app/api/v1/auth/oauth/authorize/[provider]/route.tsx
@@ -4,7 +4,6 @@ import { decodeAccessToken, oauthCookieSchema } from "@/lib/tokens";
 import { getProvider } from "@/oauth";
 import { prismaClient } from "@/prisma-client";
 import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
-import { sharedProviders } from "@stackframe/stack-shared/dist/interface/clientInterface";
 import { KnownErrors } from "@stackframe/stack-shared/dist/known-errors";
 import { yupNumber, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
 import { getNodeEnvironment } from "@stackframe/stack-shared/dist/utils/env";
@@ -77,7 +76,7 @@ export const GET = createSmartRouteHandler({
        throw new StatusError(StatusError.Forbidden, "The access token is not valid for this project");
      }

-      if (query.provider_scope && sharedProviders.includes(provider.type as any)) {
+      if (query.provider_scope && provider.type === "shared") {
        throw new KnownErrors.OAuthExtraScopeNotAvailableWithSharedOAuthKeys();
      }
      projectUserId = userId;

diff --git a/apps/backend/src/app/api/v1/auth/oauth/connected-accounts/[provider]/access-token/crud.tsx b/apps/backend/src/app/api/v1/auth/oauth/connected-accounts/[provider]/access-token/crud.tsx
@@ -4,7 +4,7 @@ import { createCrudHandlers } from "@/route-handlers/crud-handler";
 import { KnownErrors } from "@stackframe/stack-shared";
 import { providerAccessTokenCrud } from "@stackframe/stack-shared/dist/interface/crud/oauth";
 import { yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
-import { StackAssertionError, StatusError } from "@stackframe/stack-shared/dist/utils/errors";
+import { StackAssertionError } from "@stackframe/stack-shared/dist/utils/errors";
 import { extractScopes } from "@stackframe/stack-shared/dist/utils/strings";



diff --git a/apps/backend/src/app/api/v1/internal/projects/crud.tsx b/apps/backend/src/app/api/v1/internal/projects/crud.tsx
@@ -1,9 +1,10 @@
 import { fullProjectInclude, listManagedProjectIds, projectPrismaToCrud } from "@/lib/projects";
+import { ensureSharedProvider, ensureStandardProvider } from "@/lib/request-checks";
 import { prismaClient } from "@/prisma-client";
 import { createCrudHandlers } from "@/route-handlers/crud-handler";
 import { KnownErrors } from "@stackframe/stack-shared";
 import { internalProjectsCrud } from "@stackframe/stack-shared/dist/interface/crud/projects";
-import { projectIdSchema, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
+import { projectIdSchema, yupObject } from "@stackframe/stack-shared/dist/schema-fields";
 import { StackAssertionError, throwErr } from "@stackframe/stack-shared/dist/utils/errors";
 import { createLazyProxy } from "@stackframe/stack-shared/dist/utils/proxies";
 import { typedToUppercase } from "@stackframe/stack-shared/dist/utils/strings";
@@ -49,12 +50,12 @@ export const internalProjectsCrudHandlers = createLazyProxy(() => createCrudHand
                  enabled: item.enabled,
                  proxiedOAuthConfig: item.type === "shared" ? {
                    create: {
-                      type: typedToUppercase(item.id),
+                      type: typedToUppercase(ensureSharedProvider(item.id)),
                    }
                  } : undefined,
                  standardOAuthConfig: item.type === "standard" ? {
                    create: {
-                      type: typedToUppercase(item.id),
+                      type: typedToUppercase(ensureStandardProvider(item.id)),
                      clientId: item.client_id ?? throwErr('client_id is required'),
                      clientSecret: item.client_secret ?? throwErr('client_secret is required'),
                    }

diff --git a/apps/backend/src/app/api/v1/projects/current/crud.tsx b/apps/backend/src/app/api/v1/projects/current/crud.tsx
@@ -1,12 +1,14 @@
 import { isTeamSystemPermission, listTeamPermissionDefinitions, teamSystemPermissionStringToDBType } from "@/lib/permissions";
 import { fullProjectInclude, projectPrismaToCrud } from "@/lib/projects";
+import { ensureSharedProvider } from "@/lib/request-checks";
 import { prismaClient } from "@/prisma-client";
 import { createCrudHandlers } from "@/route-handlers/crud-handler";
 import { projectsCrud } from "@stackframe/stack-shared/dist/interface/crud/projects";
 import { yupObject } from "@stackframe/stack-shared/dist/schema-fields";
 import { StatusError, throwErr } from "@stackframe/stack-shared/dist/utils/errors";
 import { createLazyProxy } from "@stackframe/stack-shared/dist/utils/proxies";
 import { typedToUppercase } from "@stackframe/stack-shared/dist/utils/strings";
+import { ensureStandardProvider } from "../../../../../lib/request-checks";

 export const projectsCrudHandlers = createLazyProxy(() => createCrudHandlers(projectsCrud, {
  paramsSchema: yupObject({}),
@@ -180,15 +182,15 @@ export const projectsCrudHandlers = createLazyProxy(() => createCrudHandlers(pro
            providerConfigUpdate = {
              proxiedOAuthConfig: {
                create: {
-                  type: typedToUppercase(providerUpdate.id),
+                  type: typedToUppercase(ensureSharedProvider(providerUpdate.id)),
                },
              },
            };
          } else {
            providerConfigUpdate = {
              standardOAuthConfig: {
                create: {
-                  type: typedToUppercase(providerUpdate.id),
+                  type: typedToUppercase(ensureStandardProvider(providerUpdate.id)),
                  clientId: providerUpdate.client_id ?? throwErr('client_id is required'),
                  clientSecret: providerUpdate.client_secret ?? throwErr('client_secret is required'),
                },
@@ -212,15 +214,15 @@ export const projectsCrudHandlers = createLazyProxy(() => createCrudHandlers(pro
            providerConfigData = {
              proxiedOAuthConfig: {
                create: {
-                  type: typedToUppercase(provider.update.id),
+                  type: typedToUppercase(ensureSharedProvider(provider.update.id)),
                },
              },
            };
          } else {
            providerConfigData = {
              standardOAuthConfig: {
                create: {
-                  type: typedToUppercase(provider.update.id),
+                  type: typedToUppercase(ensureStandardProvider(provider.update.id)),
                  clientId: provider.update.client_id ?? throwErr('client_id is required'),
                  clientSecret: provider.update.client_secret ?? throwErr('client_secret is required'),
                },

diff --git a/apps/backend/src/lib/projects.tsx b/apps/backend/src/lib/projects.tsx
@@ -1,11 +1,12 @@
 import { usersCrudHandlers } from "@/app/api/v1/users/crud";
 import { prismaClient } from "@/prisma-client";
 import { CrudHandlerInvocationError } from "@/route-handlers/crud-handler";
-import { Prisma, ProxiedOAuthProviderType } from "@prisma/client";
+import { Prisma } from "@prisma/client";
 import { KnownErrors } from "@stackframe/stack-shared";
 import { ProjectsCrud } from "@stackframe/stack-shared/dist/interface/crud/projects";
 import { UsersCrud } from "@stackframe/stack-shared/dist/interface/crud/users";
 import { StackAssertionError, throwErr } from "@stackframe/stack-shared/dist/utils/errors";
+import { ProviderType } from "@stackframe/stack-shared/dist/utils/oauth";
 import { typedToLowercase } from "@stackframe/stack-shared/dist/utils/strings";
 import { fullPermissionInclude, teamPermissionDefinitionJsonFromDbType, teamPermissionDefinitionJsonFromTeamSystemDbType } from "./permissions";
 import { decodeAccessToken } from "./tokens";
@@ -61,7 +62,7 @@ export function projectPrismaToCrud(
 ): ProjectsCrud["Admin"]["Read"] {
  const oauthProviders = prisma.config.oauthProviderConfigs
    .flatMap((provider): {
-      id: Lowercase<ProxiedOAuthProviderType>,
+      id: ProviderType,
      enabled: boolean,
      type: 'standard' | 'shared',
      client_id?: string | undefined,

diff --git a/apps/backend/src/lib/request-checks.tsx b/apps/backend/src/lib/request-checks.tsx
@@ -1,7 +1,9 @@
+import { ProxiedOAuthProviderType, StandardOAuthProviderType } from "@prisma/client";
 import { KnownErrors } from "@stackframe/stack-shared";
-import { PrismaTransaction } from "./types";
-import { TeamSystemPermission, listUserTeamPermissions } from "./permissions";
 import { ProjectsCrud } from "@stackframe/stack-shared/dist/interface/crud/projects";
+import { ProviderType, sharedProviders, standardProviders } from "@stackframe/stack-shared/dist/utils/oauth";
+import { TeamSystemPermission, listUserTeamPermissions } from "./permissions";
+import { PrismaTransaction } from "./types";


 async function _getTeamMembership(
@@ -122,4 +124,22 @@ export async function ensureUserExist(
  if (!user) {
    throw new KnownErrors.UserNotFound();
  }
+}
+
+export function ensureSharedProvider(
+  providerId: ProviderType
+): Lowercase<ProxiedOAuthProviderType> {
+  if (!sharedProviders.includes(providerId as any)) {
+    throw new KnownErrors.InvalidSharedOAuthProviderId(providerId);
+  }
+  return providerId as any;
+}
+
+export function ensureStandardProvider(
+  providerId: ProviderType
+): Lowercase<StandardOAuthProviderType> {
+  if (!standardProviders.includes(providerId as any)) {
+    throw new KnownErrors.InvalidStandardOAuthProviderId(providerId);
+  }
+  return providerId as any;
 }
diff --git a/apps/dashboard/prisma/schema.prisma b/apps/dashboard/prisma/schema.prisma
@@ -517,7 +517,6 @@ enum ProxiedOAuthProviderType {
  FACEBOOK
  GOOGLE
  MICROSOFT
-  SPOTIFY
 }

 model StandardOAuthProviderConfig {

diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/auth-methods/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/auth-methods/page-client.tsx
@@ -1,8 +1,9 @@
 "use client";
-import { useAdminApp } from "../use-admin-app";
-import { ProviderSettingSwitch, availableProviders } from "./providers";
-import { PageLayout } from "../page-layout";
 import { SettingCard, SettingSwitch } from "@/components/settings";
+import { allProviders } from "@stackframe/stack-shared/dist/utils/oauth";
+import { PageLayout } from "../page-layout";
+import { useAdminApp } from "../use-admin-app";
+import { ProviderSettingSwitch } from "./providers";

 export default function PageClient() {
  const stackAdminApp = useAdminApp();
@@ -37,7 +38,7 @@ export default function PageClient() {
      </SettingCard>

      <SettingCard title="OAuth Providers" description={`The "Sign in with XYZ" buttons on your app.`}>
-        {availableProviders.map((id) => {
+        {allProviders.map((id) => {
          const provider = oauthProviders.find((provider) => provider.id === id);
          return <ProviderSettingSwitch
            key={id}

diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/auth-methods/providers.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/auth-methods/providers.tsx
@@ -9,6 +9,7 @@ import { InlineCode } from "@/components/ui/inline-code";
 import { Label } from "@/components/ui/label";
 import Typography from "@/components/ui/typography";
 import { AdminProject } from "@stackframe/stack";
+import { sharedProviders, standardProviders } from "@stackframe/stack-shared/dist/utils/oauth";
 import { runAsynchronously } from "@stackframe/stack-shared/dist/utils/promises";
 import { useState } from "react";
 import * as yup from "yup";
@@ -19,7 +20,6 @@ type Props = {
  updateProvider: (provider: AdminProject['config']['oauthProviders'][number]) => Promise<void>,
 };

-export const availableProviders = ['github', 'google', 'facebook', 'microsoft', 'spotify'] as const;
 function toTitle(id: string) {
  return {
    github: "GitHub",
@@ -48,9 +48,10 @@ export const providerFormSchema = yup.object({

 export type ProviderFormValues = yup.InferType<typeof providerFormSchema>

-export function ProviderSettingDialog(props: Props) {
+export function ProviderSettingDialog(props: Props & { open: boolean, onClose: () => void }) {
+  const hasSharedKeys = sharedProviders.includes(props.id as any);
  const defaultValues = {
-    shared: props.provider?.type === 'shared',
+    shared: props.provider ? (props.provider.type === 'shared') : hasSharedKeys,
    clientId: (props.provider as any)?.clientId ?? "",
    clientSecret: (props.provider as any)?.clientSecret ?? "",
  };
@@ -74,17 +75,22 @@ export function ProviderSettingDialog(props: Props) {
      defaultValues={defaultValues}
      formSchema={providerFormSchema}
      onSubmit={onSubmit}
-      trigger={<SettingIconButton />}
+      open={props.open}
+      onClose={props.onClose}
      title={`${toTitle(props.id)} OAuth provider`}
      cancelButton
      okButton={{ label: 'Save' }}
      render={(form) => (
        <>
-          <SwitchField
-            control={form.control}
-            name="shared"
-            label="Shared keys"
-          />
+          {hasSharedKeys ?
+            <SwitchField
+              control={form.control}
+              name="shared"
+              label="Shared keys"
+            /> :
+            <Typography variant="secondary" type="footnote">
+              This OAuth provider does not support shared keys
+            </Typography>}

          {form.watch("shared") ?
            <Typography variant="secondary" type="footnote">
@@ -155,6 +161,7 @@ export function ProviderSettingSwitch(props: Props) {
  const enabled = !!props.provider?.enabled;
  const isShared = props.provider?.type === 'shared';
  const [TurnOffProviderDialogOpen, setTurnOffProviderDialogOpen] = useState(false);
+  const [ProviderSettingDialogOpen, setProviderSettingDialogOpen] = useState(false);

  const updateProvider = async (checked: boolean) => {
    await props.updateProvider({
@@ -184,10 +191,10 @@ export function ProviderSettingSwitch(props: Props) {
            setTurnOffProviderDialogOpen(true);
            return;
          } else {
-            await updateProvider(checked);
+            setProviderSettingDialogOpen(true);
          }
        }}
-        actions={<ProviderSettingDialog {...props} />}
+        actions={<SettingIconButton onClick={() => setProviderSettingDialogOpen(true)} />}
        onlyShowActionsWhenChecked
      />

@@ -197,6 +204,8 @@ export function ProviderSettingSwitch(props: Props) {
        providerId={props.id}
        onConfirm={() => runAsynchronously(updateProvider(false))}
      />
+
+      <ProviderSettingDialog {...props} open={ProviderSettingDialogOpen} onClose={() => setProviderSettingDialogOpen(false)} />
    </>
  );
 }
diff --git a/apps/dashboard/src/app/api/v1/auth/access-token/[provider]/route.tsx b/apps/dashboard/src/app/api/v1/auth/access-token/[provider]/route.tsx
@@ -1,8 +1,8 @@
 import { getProvider } from "@/oauth";
 import { prismaClient } from "@/prisma-client";
 import { createCrudHandlers } from "@/route-handlers/crud-handler";
+import { sharedProviders } from "@/temporary-types";
 import { KnownErrors } from "@stackframe/stack-shared";
-import { sharedProviders } from "@stackframe/stack-shared/dist/interface/clientInterface";
 import { accessTokenCrud } from "@stackframe/stack-shared/dist/interface/crud-deprecated/oauth";
 import { StackAssertionError, StatusError } from "@stackframe/stack-shared/dist/utils/errors";
 import { extractScopes } from "@stackframe/stack-shared/dist/utils/strings";

diff --git a/apps/dashboard/src/app/api/v1/auth/authorize/[provider]/route.tsx b/apps/dashboard/src/app/api/v1/auth/authorize/[provider]/route.tsx
@@ -10,8 +10,8 @@ import { getProject } from "@/lib/projects";
 import { checkApiKeySet } from "@/lib/api-keys";
 import { KnownErrors } from "@stackframe/stack-shared";
 import { decodeAccessToken, oauthCookieSchema } from "@/lib/tokens";
-import { sharedProviders } from "@stackframe/stack-shared/dist/interface/clientInterface";
 import { prismaClient } from "@/prisma-client";
+import { sharedProviders } from "@/temporary-types";


 const expireMinutes = 10;

diff --git a/apps/dashboard/src/components/data-table/user-table.tsx b/apps/dashboard/src/components/data-table/user-table.tsx
@@ -1,11 +1,14 @@
 'use client';
+import { useAdminApp } from '@/app/(main)/(protected)/projects/[projectId]/use-admin-app';
 import { ServerUser } from '@stackframe/stack';
-import { standardProviders } from "@stackframe/stack-shared/dist/interface/clientInterface";
-import { jsonStringOrEmptySchema, jsonStringSchema } from "@stackframe/stack-shared/dist/schema-fields";
+import { jsonStringOrEmptySchema } from "@stackframe/stack-shared/dist/schema-fields";
+import { allProviders } from '@stackframe/stack-shared/dist/utils/oauth';
+import { deindent } from '@stackframe/stack-shared/dist/utils/strings';
 import { ColumnDef, Row, Table } from "@tanstack/react-table";
 import { useMemo, useState } from "react";
 import * as yup from "yup";
 import { ActionDialog } from "../action-dialog";
+import { CopyField } from '../copy-field';
 import { FormDialog } from "../form-dialog";
 import { DateField, InputField, SwitchField, TextAreaField } from "../form-fields";
 import { SimpleTooltip } from "../simple-tooltip";
@@ -16,10 +19,6 @@ import { DataTable } from "./elements/data-table";
 import { DataTableFacetedFilter } from "./elements/faceted-filter";
 import { SearchToolbarItem } from "./elements/toolbar-items";
 import { arrayFilterFn, standardFilterFn } from "./elements/utils";
-import { wait } from '@stackframe/stack-shared/dist/utils/promises';
-import { CopyField } from '../copy-field';
-import { deindent } from '@stackframe/stack-shared/dist/utils/strings';
-import { useAdminApp } from '@/app/(main)/(protected)/projects/[projectId]/use-admin-app';

 export type ExtendedServerUser = ServerUser & {
  authTypes: string[],
@@ -33,7 +32,7 @@ function userToolbarRender<TData>(table: Table<TData>) {
      <DataTableFacetedFilter
        column={table.getColumn("authTypes")}
        title="Auth Method"
-        options={['email', 'password', ...standardProviders].map((provider) => ({
+        options={['email', 'password', ...allProviders].map((provider) => ({
          value: provider,
          label: provider,
        }))}

diff --git a/apps/dashboard/src/lib/projects.tsx b/apps/dashboard/src/lib/projects.tsx
@@ -1,15 +1,13 @@
-import * as yup from "yup";
-import { OAuthProviderConfigJson, ProjectJson, ServerUserJson, EmailConfigJson } from "@/temporary-types";
-import { Prisma, ProxiedOAuthProviderType, StandardOAuthProviderType } from "@prisma/client";
 import { prismaClient } from "@/prisma-client";
+import { EmailConfigJson, OAuthProviderConfigJson, OAuthProviderUpdateOptions, ProjectJson, ProjectUpdateOptions, ServerUserJson, SharedProvider, StandardProvider, sharedProviders, standardProviders } from "@/temporary-types";
+import { Prisma, ProxiedOAuthProviderType, StandardOAuthProviderType } from "@prisma/client";
+import { KnownErrors } from "@stackframe/stack-shared";
+import { StackAssertionError, StatusError, captureError, throwErr } from "@stackframe/stack-shared/dist/utils/errors";
+import { generateUuid } from "@stackframe/stack-shared/dist/utils/uuids";
+import * as yup from "yup";
+import { fullPermissionInclude, isTeamSystemPermission, listServerPermissionDefinitions, serverPermissionDefinitionJsonFromDbType, serverPermissionDefinitionJsonFromTeamSystemDbType, teamPermissionIdSchema, teamSystemPermissionStringToDBType } from "./permissions";
 import { decodeAccessToken } from "./tokens";
 import { getServerUser } from "./users";
-import { generateUuid } from "@stackframe/stack-shared/dist/utils/uuids";
-import { SharedProvider, StandardProvider, sharedProviders, standardProviders } from "@stackframe/stack-shared/dist/interface/clientInterface";
-import { OAuthProviderUpdateOptions, ProjectUpdateOptions } from "@/temporary-types";
-import { StackAssertionError, StatusError, captureError, throwErr } from "@stackframe/stack-shared/dist/utils/errors";
-import { fullPermissionInclude, isTeamSystemPermission, listServerPermissionDefinitions, serverPermissionDefinitionJsonFromDbType, serverPermissionDefinitionJsonFromTeamSystemDbType, teamDBTypeToSystemPermissionString, teamPermissionIdSchema, teamSystemPermissionStringToDBType } from "./permissions";
-import { KnownErrors } from "@stackframe/stack-shared";

 function toDBSharedProvider(type: SharedProvider): ProxiedOAuthProviderType {
  return ({
@@ -18,7 +16,7 @@ function toDBSharedProvider(type: SharedProvider): ProxiedOAuthProviderType {
    "shared-facebook": "FACEBOOK",
    "shared-microsoft": "MICROSOFT",
    "shared-spotify": "SPOTIFY",
-  } as const)[type];
+  } as any)[type];
 }

 function toDBStandardProvider(type: StandardProvider): StandardOAuthProviderType {