Create user registrations for upstream OAuth registrations

Author: sandhose

crates/handlers/src/upstream_oauth2/link.rs

@@ -26,7 +26,6 @@ use mas_policy::Policy;
 use mas_router::UrlBuilder;
 use mas_storage::{
     BoxRepository, RepositoryAccess,
-    queue::{ProvisionUserJob, QueueJobRepositoryExt as _},
     upstream_oauth2::{UpstreamOAuthLinkRepository, UpstreamOAuthSessionRepository},
     user::{BrowserSessionRepository, UserEmailRepository, UserRepository},
 };
@@ -46,7 +45,7 @@ use super::{
 };
 use crate::{
     BoundActivityTracker, METER, PreferredLanguage, SiteConfig, impl_from_error_for_route,
-    views::shared::OptionalPostAuthAction,
+    views::{register::UserRegistrationSessionsCookie, shared::OptionalPostAuthAction},
 };
 
 static LOGIN_COUNTER: LazyLock<Counter<u64>> = LazyLock::new(|| {
@@ -610,10 +609,6 @@ pub(crate) async fn post(
         .lookup_link(link_id)
         .map_err(|_| RouteError::MissingCookie)?;
 
-    let post_auth_action = OptionalPostAuthAction {
-        post_auth_action: post_auth_action.cloned(),
-    };
-
     let link = repo
         .upstream_oauth_link()
         .lookup(link_id)
@@ -641,15 +636,35 @@ pub(crate) async fn post(
     let maybe_user_session = user_session_info.load_active_session(&mut repo).await?;
     let form_state = form.to_form_state();
 
-    let session = match (maybe_user_session, link.user_id, form) {
+    match (maybe_user_session, link.user_id, form) {
         (Some(session), None, FormData::Link) => {
             // The user is already logged in, the link is not linked to any user, and the
             // user asked to link their account.
             repo.upstream_oauth_link()
                 .associate_to_user(&link, &session.user)
                 .await?;
 
-            session
+            let upstream_session = repo
+                .upstream_oauth_session()
+                .consume(&clock, upstream_session)
+                .await?;
+
+            repo.browser_session()
+                .authenticate_with_upstream(&mut rng, &clock, &session, &upstream_session)
+                .await?;
+
+            let post_auth_action = OptionalPostAuthAction {
+                post_auth_action: post_auth_action.cloned(),
+            };
+
+            let cookie_jar = sessions_cookie
+                .consume_link(link_id)?
+                .save(cookie_jar, &clock);
+            let cookie_jar = cookie_jar.set_session(&session);
+
+            repo.save().await?;
+
+            Ok((cookie_jar, post_auth_action.go_next(&url_builder)).into_response())
         }
 
         (None, None, FormData::Link) => {
@@ -714,14 +729,38 @@ pub(crate) async fn post(
                     return Err(RouteError::InvalidFormAction);
                 }
                 UpstreamOAuthProviderOnConflict::Add => {
-                    //add link to the user
+                    // Add link to the user
                     repo.upstream_oauth_link()
                         .associate_to_user(&link, &user)
                         .await?;
 
-                    repo.browser_session()
+                    // And sign in the user
+                    let session = repo
+                        .browser_session()
                         .add(&mut rng, &clock, &user, user_agent)
-                        .await?
+                        .await?;
+
+                    let upstream_session = repo
+                        .upstream_oauth_session()
+                        .consume(&clock, upstream_session)
+                        .await?;
+
+                    repo.browser_session()
+                        .authenticate_with_upstream(&mut rng, &clock, &session, &upstream_session)
+                        .await?;
+
+                    let post_auth_action = OptionalPostAuthAction {
+                        post_auth_action: post_auth_action.cloned(),
+                    };
+
+                    let cookie_jar = sessions_cookie
+                        .consume_link(link_id)?
+                        .save(cookie_jar, &clock);
+                    let cookie_jar = cookie_jar.set_session(&session);
+
+                    repo.save().await?;
+
+                    Ok((cookie_jar, post_auth_action.go_next(&url_builder)).into_response())
                 }
             }
         }
@@ -950,61 +989,84 @@ pub(crate) async fn post(
 
             REGISTRATION_COUNTER.add(1, &[KeyValue::new(PROVIDER, provider.id.to_string())]);
 
-            // Now we can create the user
-            let user = repo.user().add(&mut rng, &clock, username).await?;
+            let mut registration = repo
+                .user_registration()
+                .add(
+                    &mut rng,
+                    &clock,
+                    username,
+                    None,
+                    user_agent,
+                    post_auth_action.map(|action| serde_json::json!(action)),
+                )
+                .await?;
 
             if let Some(terms_url) = &site_config.tos_uri {
-                repo.user_terms()
-                    .accept_terms(&mut rng, &clock, &user, terms_url.clone())
+                registration = repo
+                    .user_registration()
+                    .set_terms_url(registration, terms_url.clone())
                     .await?;
             }
 
-            // And schedule the job to provision it
-            let mut job = ProvisionUserJob::new(&user);
+            // If we have an email, add an email authentication and complete it
+            if let Some(email) = email {
+                let authentication = repo
+                    .user_email()
+                    .add_authentication_for_registration(&mut rng, &clock, email, &registration)
+                    .await?;
+                let authentication = repo
+                    .user_email()
+                    .complete_authentication_with_upstream(
+                        &clock,
+                        authentication,
+                        &upstream_session,
+                    )
+                    .await?;
 
-            // If we have a display name, set it during provisioning
-            if let Some(name) = display_name {
-                job = job.set_display_name(name);
+                registration = repo
+                    .user_registration()
+                    .set_email_authentication(registration, &authentication)
+                    .await?;
             }
 
-            repo.queue_job().schedule_job(&mut rng, &clock, job).await?;
-
-            // If we have an email, add it to the user
-            if let Some(email) = email {
-                repo.user_email()
-                    .add(&mut rng, &clock, &user, email)
+            // If we have a display name, add it to the registration
+            if let Some(name) = display_name {
+                registration = repo
+                    .user_registration()
+                    .set_display_name(registration, name)
                     .await?;
             }
 
-            repo.upstream_oauth_link()
-                .associate_to_user(&link, &user)
+            let registration = repo
+                .user_registration()
+                .set_upstream_oauth_authorization_session(registration, &upstream_session)
                 .await?;
 
-            repo.browser_session()
-                .add(&mut rng, &clock, &user, user_agent)
-                .await?
-        }
+            repo.upstream_oauth_session()
+                .consume(&clock, upstream_session)
+                .await?;
 
-        _ => return Err(RouteError::InvalidFormAction),
-    };
+            let registrations = UserRegistrationSessionsCookie::load(&cookie_jar);
 
-    let upstream_session = repo
-        .upstream_oauth_session()
-        .consume(&clock, upstream_session)
-        .await?;
+            let cookie_jar = sessions_cookie
+                .consume_link(link_id)?
+                .save(cookie_jar, &clock);
 
-    repo.browser_session()
-        .authenticate_with_upstream(&mut rng, &clock, &session, &upstream_session)
-        .await?;
+            let cookie_jar = registrations.add(&registration).save(cookie_jar, &clock);
 
-    let cookie_jar = sessions_cookie
-        .consume_link(link_id)?
-        .save(cookie_jar, &clock);
-    let cookie_jar = cookie_jar.set_session(&session);
+            repo.save().await?;
 
-    repo.save().await?;
+            // Redirect to the user registration flow, in case we have any other step to
+            // finish
+            Ok((
+                cookie_jar,
+                url_builder.redirect(&mas_router::RegisterFinish::new(registration.id)),
+            )
+                .into_response())
+        }
 
-    Ok((cookie_jar, post_auth_action.go_next(&url_builder)).into_response())
+        _ => Err(RouteError::InvalidFormAction),
+    }
 }
 
 #[cfg(test)]

crates/handlers/src/views/register/mod.rs

@@ -21,6 +21,8 @@ mod cookie;
 pub(crate) mod password;
 pub(crate) mod steps;
 
+pub use self::cookie::UserRegistrationSessions as UserRegistrationSessionsCookie;
+
 #[tracing::instrument(name = "handlers.views.register.get", skip_all)]
 pub(crate) async fn get(
     mut rng: BoxRng,