GitLab auth with PKCE missing functions and type to be exposed

[annaghi]

This is an attempt for GitLab auth with PKCE.

It was missing couple of functions and type, I had to copy them to make it work, please refer to FIXMEs in the comments:

• handleRequest, authorizationHeader
• OAuthConfig

Perhaps I misunderstood the #901 and #899 on how to use the OAuth helpers to support a new provider.

References:

• https://docs.gitlab.com/ee/api/oauth2.html
• https://docs.gitlab.com/ee/api/users.html#single-user
• https://github.com/nextauthjs/next-auth/blob/main/packages/next-auth/src/core/lib/oauth/checks.ts
• https://github.com/nextauthjs/next-auth/blob/main/packages/next-auth/src/providers/gitlab.ts

import {
    __experimental_createOAuth2AuthorizationUrlWithPKCE,
    providerUserAuth,
    __experimental_validateOAuth2AuthorizationCode,
} from '@lucia-auth/oauth';
import { handleRequest, authorizationHeader } from './request'; // FIXME 'request.ts' is copied from https://github.com/pilcrowOnPaper/lucia/blob/main/packages/oauth/src/request.ts

import type { Auth } from 'lucia';
import type { OAuthProvider } from '@lucia-auth/oauth';
import type { OAuthConfig } from './core'; // FIXME 'core.ts' is copied from https://github.com/pilcrowOnPaper/lucia/blob/main/packages/oauth/src/core.ts

const PROVIDER_ID = 'gitlab';

export const gitlab = <_Auth extends Auth>(auth: _Auth, config: Config) => {
    const getGitlabTokens = async (code: string, codeVerifier: string): Promise<Tokens> => {
        type ResponseBody =
            | {
                  access_token: string;
              }
            | {
                  access_token: string;
                  token_type: 'bearer';
                  expires_in: number;
                  refresh_token: string;
                  created_at: number;
              };

        const tokens = await __experimental_validateOAuth2AuthorizationCode<ResponseBody>(code, 'https://gitlab.com/oauth/token', {
            clientId: config.clientId,
            redirectUri: config.redirectUri,
            codeVerifier,
        });

        return {
            accessToken: tokens.access_token,
            accessTokenExpiresIn: null,
        };
    };

    const getGitlabUser = async (accessToken: string) => {
        const request = new Request('https://gitlab.com/api/v4/user', {
            headers: {
                Authorization: authorizationHeader('bearer', accessToken),
            },
        });
        const gitlabUser = await handleRequest<GitlabUser>(request);
        return gitlabUser;
    };

    return {
        getAuthorizationUrl: async () => {
            return await __experimental_createOAuth2AuthorizationUrlWithPKCE('https://gitlab.com/oauth/authorize', {
                clientId: config.clientId,
                scope: config.scope ?? [],
                redirectUri: config.redirectUri,
                codeChallengeMethod: 'S256',
            });
        },
        validateCallback: async (code: string, codeVerifier: string) => {
            const gitlabTokens = await getGitlabTokens(code, codeVerifier);
            const gitlabUser = await getGitlabUser(gitlabTokens.accessToken);
            const providerUserId = gitlabUser.id.toString();
            const gitlabUserAuth = await providerUserAuth(auth, PROVIDER_ID, providerUserId);
            return {
                ...gitlabUserAuth,
                gitlabUser,
                gitlabTokens,
            };
        },
    } as const satisfies OAuthProvider;
};

type Config = Omit<OAuthConfig, 'clientSecret'> & {
    redirectUri: string;
};

type Tokens =
    | {
          accessToken: string;
          accessTokenExpiresIn: null;
      }
    | {
          accessToken: string;
          accessTokenExpiresIn: number;
          refreshToken: string;
          refreshTokenExpiresIn: number;
      };

type GitlabUser = {
    id: number;
    username: string;
    email: string;
    name: string;
    state: string;
    avatar_url: string;
    web_url: string;
    created_at: string;
    bio: string;
    location?: string;
    public_email: string;
    skype: string;
    linkedin: string;
    twitter: string;
    website_url: string;
    organization: string;
    job_title: string;
    pronouns: string;
    bot: boolean;
    work_information?: string;
    followers: number;
    following: number;
    local_time: string;
    last_sign_in_at: string;
    confirmed_at: string;
    theme_id: number;
    last_activity_on: string;
    color_scheme_id: number;
    projects_limit: number;
    current_sign_in_at: string;
    identities: Array<{
        provider: string;
        extern_uid: string;
    }>;
    can_create_group: boolean;
    can_create_project: boolean;
    two_factor_enabled: boolean;
    external: boolean;
    private_profile: boolean;
    commit_email: string;
    shared_runners_minutes_limit: number;
    extra_shared_runners_minutes_limit: number;
};

Calling gitlab():

export const gitlabAuth = gitlab(auth, {
    clientId: GITLAB_APPLICATION_ID,
    scope: ['api'],
    redirectUri: 'http://localhost:3330/signin/gitlab/callback',
});

[pilcrowonpaper]

./core and ./request are internal utilizes. These are not public APIs.

[annaghi]

Fixed with custom request and custom config.