diff --git a/Pipfile b/Pipfile index afc294412..6d5c7f861 100644 --- a/Pipfile +++ b/Pipfile @@ -8,6 +8,7 @@ dateparser = "~=1.2" # WARNING: django does not use semver. # Only patch versions are guaranteed to not introduce breaking changes. django = "~=4.2.9" +django-allauth = "*" django-auditlog = "*" django-celery-results = "*" django-compression-middleware = "*" diff --git a/Pipfile.lock b/Pipfile.lock index ceef1c8a9..d177517c2 100644 --- a/Pipfile.lock +++ b/Pipfile.lock @@ -452,6 +452,14 @@ "markers": "python_version >= '3.8'", "version": "==4.2.9" }, + "django-allauth": { + "hashes": [ + "sha256:ec19efb80b34d2f18bd831eab9b10b6301f58d1cce9f39af35f497b7e5b0a141" + ], + "index": "pypi", + "markers": "python_version >= '3.7'", + "version": "==0.59.0" + }, "django-auditlog": { "hashes": [ "sha256:7bc2c87e4aff62dec9785d1b2359a2b27148f8c286f8a52b9114fc7876c5a9f7", diff --git a/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.html b/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.html index 394ba4449..b1b91b31e 100644 --- a/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.html +++ b/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.html @@ -49,6 +49,36 @@
Warning: changing the token cannot be undone
+ @if (socialAccounts?.length > 0) { +
+

Connected social accounts

+
+ +
Warning: changing the social accounts cannot be undone
+
+
+ } + @if (socialAccountProviders?.length > 0) { +
+

Available social account providers

+
+ +
Warning: changing the social account providers cannot be undone
+
+
+ }
diff --git a/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.spec.ts b/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.spec.ts index 5deb26c8d..ea8665d2a 100644 --- a/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.spec.ts +++ b/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.spec.ts @@ -21,13 +21,22 @@ import { ToastService } from 'src/app/services/toast.service' import { Clipboard } from '@angular/cdk/clipboard' import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons' +const socialAccount = { + id: 1, + provider: 'test_provider', + name: 'Test Provider', +} const profile = { email: 'foo@bar.com', password: '*********', first_name: 'foo', last_name: 'bar', auth_token: '123456789abcdef', + social_accounts: [socialAccount], } +const socialAccountProviders = [ + { name: 'Test Provider', login_url: 'https://example.com' }, +] describe('ProfileEditDialogComponent', () => { let component: ProfileEditDialogComponent @@ -64,6 +73,11 @@ describe('ProfileEditDialogComponent', () => { it('should get profile on init, display in form', () => { const getSpy = jest.spyOn(profileService, 'get') getSpy.mockReturnValue(of(profile)) + const getProvidersSpy = jest.spyOn( + profileService, + 'getSocialAccountProviders' + ) + getProvidersSpy.mockReturnValue(of(socialAccountProviders)) component.ngOnInit() expect(getSpy).toHaveBeenCalled() fixture.detectChanges() @@ -103,6 +117,11 @@ describe('ProfileEditDialogComponent', () => { expect(component.form.get('email_confirm').enabled).toBeFalsy() const getSpy = jest.spyOn(profileService, 'get') getSpy.mockReturnValue(of(profile)) + const getProvidersSpy = jest.spyOn( + profileService, + 'getSocialAccountProviders' + ) + getProvidersSpy.mockReturnValue(of(socialAccountProviders)) component.ngOnInit() component.form.get('email').patchValue('foo@bar2.com') component.onEmailKeyUp({ target: { value: 'foo@bar2.com' } } as any) @@ -134,6 +153,11 @@ describe('ProfileEditDialogComponent', () => { expect(component.form.get('password_confirm').enabled).toBeFalsy() const getSpy = jest.spyOn(profileService, 'get') getSpy.mockReturnValue(of(profile)) + const getProvidersSpy = jest.spyOn( + profileService, + 'getSocialAccountProviders' + ) + getProvidersSpy.mockReturnValue(of(socialAccountProviders)) component.ngOnInit() component.form.get('password').patchValue('new*pass') component.onPasswordKeyUp({ @@ -167,6 +191,11 @@ describe('ProfileEditDialogComponent', () => { it('should logout on save if password changed', fakeAsync(() => { const getSpy = jest.spyOn(profileService, 'get') getSpy.mockReturnValue(of(profile)) + const getProvidersSpy = jest.spyOn( + profileService, + 'getSocialAccountProviders' + ) + getProvidersSpy.mockReturnValue(of(socialAccountProviders)) component.ngOnInit() component['newPassword'] = 'new*pass' component.form.get('password').patchValue('new*pass') @@ -189,6 +218,11 @@ describe('ProfileEditDialogComponent', () => { it('should support auth token copy', fakeAsync(() => { const getSpy = jest.spyOn(profileService, 'get') getSpy.mockReturnValue(of(profile)) + const getProvidersSpy = jest.spyOn( + profileService, + 'getSocialAccountProviders' + ) + getProvidersSpy.mockReturnValue(of(socialAccountProviders)) component.ngOnInit() const copySpy = jest.spyOn(clipboard, 'copy') component.copyAuthToken() @@ -220,4 +254,42 @@ describe('ProfileEditDialogComponent', () => { ) expect(component.form.get('auth_token').value).toEqual(newToken) }) + + it('should get social account providers on init', () => { + const getSpy = jest.spyOn(profileService, 'get') + getSpy.mockReturnValue(of(profile)) + const getProvidersSpy = jest.spyOn( + profileService, + 'getSocialAccountProviders' + ) + getProvidersSpy.mockReturnValue(of(socialAccountProviders)) + component.ngOnInit() + expect(getProvidersSpy).toHaveBeenCalled() + }) + + it('should remove disconnected social account from component', async () => { + const disconnectSpy = jest.spyOn(profileService, 'disconnectSocialAccount') + disconnectSpy.mockReturnValue(of(socialAccount.id)) + + let resolve + const p = new Promise((r) => (resolve = r)) + + const getSpy = jest.spyOn(profileService, 'get') + getSpy.mockImplementation(() => { + resolve() + return of(profile) + }) + + component.ngOnInit() + + await p + + expect(getSpy).toHaveBeenCalled() + expect(component.socialAccounts).toContainEqual(socialAccount) + + component.disconnectSocialAccount(socialAccount.id) + + expect(disconnectSpy).toHaveBeenCalled() + expect(component.socialAccounts).not.toContainEqual(socialAccount) + }) }) diff --git a/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.ts b/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.ts index d89d49829..bfa7ffdec 100644 --- a/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.ts +++ b/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.ts @@ -2,6 +2,7 @@ import { Component, OnDestroy, OnInit } from '@angular/core' import { FormControl, FormGroup } from '@angular/forms' import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap' import { ProfileService } from 'src/app/services/profile.service' +import { SocialAccount, SocialAccountProvider } from 'src/app/data/user-profile' import { ToastService } from 'src/app/services/toast.service' import { Subject, takeUntil } from 'rxjs' import { Clipboard } from '@angular/cdk/clipboard' @@ -38,6 +39,9 @@ export class ProfileEditDialogComponent implements OnInit, OnDestroy { public copied: boolean = false + public socialAccounts: SocialAccount[] = [] + public socialAccountProviders: SocialAccountProvider[] = [] + constructor( private profileService: ProfileService, public activeModal: NgbActiveModal, @@ -63,6 +67,14 @@ export class ProfileEditDialogComponent implements OnInit, OnDestroy { this.newPassword = newPassword this.onPasswordChange() }) + this.socialAccounts = profile.social_accounts + }) + + this.profileService + .getSocialAccountProviders() + .pipe(takeUntil(this.unsubscribeNotifier)) + .subscribe((providers) => { + this.socialAccountProviders = providers }) } @@ -182,4 +194,18 @@ export class ProfileEditDialogComponent implements OnInit, OnDestroy { this.copied = false }, 3000) } + + disconnectSocialAccount(id: number): void { + this.profileService.disconnectSocialAccount(id).subscribe({ + next: (id: number) => { + this.socialAccounts = this.socialAccounts.filter((a) => a.id != id) + }, + error: (error) => { + this.toastService.showError( + $localize`Error disconnecting social account`, + error + ) + }, + }) + } } diff --git a/src-ui/src/app/data/user-profile.ts b/src-ui/src/app/data/user-profile.ts index 94012925a..fdaff4689 100644 --- a/src-ui/src/app/data/user-profile.ts +++ b/src-ui/src/app/data/user-profile.ts @@ -1,7 +1,19 @@ +export interface SocialAccount { + id: number + provider: string + name: string +} + +export interface SocialAccountProvider { + name: string + login_url: string +} + export interface PaperlessUserProfile { email?: string password?: string first_name?: string last_name?: string auth_token?: string + social_accounts?: SocialAccount[] } diff --git a/src-ui/src/app/services/profile.service.spec.ts b/src-ui/src/app/services/profile.service.spec.ts index f19a1312e..538911ac3 100644 --- a/src-ui/src/app/services/profile.service.spec.ts +++ b/src-ui/src/app/services/profile.service.spec.ts @@ -51,4 +51,20 @@ describe('ProfileService', () => { ) expect(req.request.method).toEqual('POST') }) + + it('supports disconnecting a social account', () => { + service.disconnectSocialAccount(1).subscribe() + const req = httpTestingController.expectOne( + `${environment.apiBaseUrl}profile/disconnect_social_account/` + ) + expect(req.request.method).toEqual('POST') + }) + + it('calls get social account provider endpoint', () => { + service.getSocialAccountProviders().subscribe() + const req = httpTestingController.expectOne( + `${environment.apiBaseUrl}profile/social_account_providers/` + ) + expect(req.request.method).toEqual('GET') + }) }) diff --git a/src-ui/src/app/services/profile.service.ts b/src-ui/src/app/services/profile.service.ts index de5aeb7a4..32e06cce0 100644 --- a/src-ui/src/app/services/profile.service.ts +++ b/src-ui/src/app/services/profile.service.ts @@ -1,7 +1,10 @@ import { HttpClient } from '@angular/common/http' import { Injectable } from '@angular/core' import { Observable } from 'rxjs' -import { PaperlessUserProfile } from '../data/user-profile' +import { + PaperlessUserProfile, + SocialAccountProvider, +} from '../data/user-profile' import { environment } from 'src/environments/environment' @Injectable({ @@ -31,4 +34,17 @@ export class ProfileService { {} ) } + + disconnectSocialAccount(id: number): Observable { + return this.http.post( + `${environment.apiBaseUrl}${this.endpoint}/disconnect_social_account/`, + { id: id } + ) + } + + getSocialAccountProviders(): Observable { + return this.http.get( + `${environment.apiBaseUrl}${this.endpoint}/social_account_providers/` + ) + } } diff --git a/src/documents/tests/test_api_profile.py b/src/documents/tests/test_api_profile.py index 9e12b1ed3..8b7dfb0e4 100644 --- a/src/documents/tests/test_api_profile.py +++ b/src/documents/tests/test_api_profile.py @@ -1,3 +1,5 @@ +from allauth.socialaccount.models import SocialAccount +from allauth.socialaccount.models import SocialApp from django.contrib.auth.models import User from rest_framework import status from rest_framework.authtoken.models import Token @@ -17,6 +19,15 @@ class TestApiProfile(DirectoriesMixin, APITestCase): first_name="firstname", last_name="surname", ) + SocialApp.objects.create( + name="Keycloak", + provider="openid_connect", + provider_id="keycloak-test", + ) + self.user.socialaccount_set.add( + SocialAccount(uid="123456789", provider="keycloak-test"), + bulk=False, + ) self.client.force_authenticate(user=self.user) def test_get_profile(self): @@ -103,3 +114,42 @@ class TestApiProfile(DirectoriesMixin, APITestCase): response = self.client.post(f"{self.ENDPOINT}generate_auth_token/") self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED) + + def test_get_social_account_providers(self): + """ + GIVEN: + - Configured user + WHEN: + - API call is made to get social account providers + THEN: + - Social account providers are returned + """ + + response = self.client.get(f"{self.ENDPOINT}social_account_providers") + + self.assertEqual(response.status_code, status.HTTP_200_OK) + + def test_disconnect_social_account(self): + """ + GIVEN: + - Configured user + WHEN: + - API call is made to disconnect a social account + THEN: + - Social account is deleted from the user + """ + + social_account_id = self.user.socialaccount_set.all()[0].pk + + response = self.client.post( + f"{self.ENDPOINT}disconnect_social_account/", + {"id": social_account_id}, + ) + + self.assertEqual(response.status_code, status.HTTP_200_OK) + self.assertEqual(response.data, str(social_account_id)) + + self.assertEqual( + len(self.user.socialaccount_set.filter(pk=social_account_id)), + 0, + ) diff --git a/src/paperless/adapter.py b/src/paperless/adapter.py new file mode 100644 index 000000000..75942dff7 --- /dev/null +++ b/src/paperless/adapter.py @@ -0,0 +1,26 @@ +from allauth.account.adapter import DefaultAccountAdapter +from allauth.socialaccount.adapter import DefaultSocialAccountAdapter +from django.conf import settings +from django.urls import reverse + + +class CustomAccountAdapter(DefaultAccountAdapter): + def is_open_for_signup(self, request): + allow_signups = super().is_open_for_signup(request) + # Override with setting, otherwise default to super. + return getattr(settings, "ACCOUNT_ALLOW_SIGNUPS", allow_signups) + + +class CustomSocialAccountAdapter(DefaultSocialAccountAdapter): + def is_open_for_signup(self, request, sociallogin): + allow_signups = super().is_open_for_signup(request, sociallogin) + # Override with setting, otherwise default to super. + return getattr(settings, "SOCIALACCOUNT_ALLOW_SIGNUPS", allow_signups) + + def get_connect_redirect_url(self, request, socialaccount): + """ + Returns the default URL to redirect to after successfully + connecting a social account. + """ + url = reverse("base") + return url diff --git a/src/paperless/serialisers.py b/src/paperless/serialisers.py index b724dd451..b664061d3 100644 --- a/src/paperless/serialisers.py +++ b/src/paperless/serialisers.py @@ -1,5 +1,6 @@ import logging +from allauth.socialaccount.models import SocialAccount from django.contrib.auth.models import Group from django.contrib.auth.models import Permission from django.contrib.auth.models import User @@ -105,10 +106,30 @@ class GroupSerializer(serializers.ModelSerializer): ) +class SocialAccountSerializer(serializers.ModelSerializer): + name = serializers.SerializerMethodField() + + class Meta: + model = SocialAccount + fields = ( + "id", + "provider", + "name", + ) + + def get_name(self, obj): + return obj.get_provider_account().to_str() + + class ProfileSerializer(serializers.ModelSerializer): email = serializers.EmailField(allow_null=False) password = ObfuscatedUserPasswordField(required=False, allow_null=False) auth_token = serializers.SlugRelatedField(read_only=True, slug_field="key") + social_accounts = SocialAccountSerializer( + many=True, + read_only=True, + source="socialaccount_set", + ) class Meta: model = User @@ -118,6 +139,7 @@ class ProfileSerializer(serializers.ModelSerializer): "first_name", "last_name", "auth_token", + "social_accounts", ) diff --git a/src/paperless/settings.py b/src/paperless/settings.py index 17ec2765d..e21de21ca 100644 --- a/src/paperless/settings.py +++ b/src/paperless/settings.py @@ -303,6 +303,10 @@ INSTALLED_APPS = [ "django_filters", "django_celery_results", "guardian", + "allauth", + "allauth.account", + "allauth.socialaccount", + "allauth.socialaccount.providers.openid_connect", *env_apps, ] @@ -339,6 +343,7 @@ MIDDLEWARE = [ "django.contrib.auth.middleware.AuthenticationMiddleware", "django.contrib.messages.middleware.MessageMiddleware", "django.middleware.clickjacking.XFrameOptionsMiddleware", + "allauth.account.middleware.AccountMiddleware", ] # Optional to enable compression @@ -410,8 +415,38 @@ CHANNEL_LAYERS = { AUTHENTICATION_BACKENDS = [ "guardian.backends.ObjectPermissionBackend", "django.contrib.auth.backends.ModelBackend", + "allauth.account.auth_backends.AuthenticationBackend", ] +SOCIALACCOUNT_PROVIDERS = { + # "openid_connect": { + # "APPS": [ + # { + # "provider_id": "keycloak", + # "name": "Keycloak", + # "client_id": "paperless", + # "secret": "", + # "settings": { + # "server_url": "https:///realms//.well-known/openid-configuration", + # }, + # }, + # ], + # }, +} + +ACCOUNT_LOGOUT_ON_GET = True + +ACCOUNT_ADAPTER = "paperless.adapter.CustomAccountAdapter" +ACCOUNT_ALLOW_SIGNUPS = __get_boolean("PAPERLESS_ACCOUNT_ALLOW_SIGNUPS") + +SOCIALACCOUNT_ADAPTER = "paperless.adapter.CustomSocialAccountAdapter" +SOCIALACCOUNT_ALLOW_SIGNUPS = __get_boolean( + "PAPERLESS_SOCIALACCOUNT_ALLOW_SIGNUPS", + "yes", +) +SOCIALACCOUNT_AUTO_SIGNUP = __get_boolean("PAPERLESS_SOCIAL_AUTO_SIGNUP") + + AUTO_LOGIN_USERNAME = os.getenv("PAPERLESS_AUTO_LOGIN_USERNAME") if AUTO_LOGIN_USERNAME: diff --git a/src/paperless/templates/account/login.html b/src/paperless/templates/account/login.html new file mode 100644 index 000000000..22e1ff53b --- /dev/null +++ b/src/paperless/templates/account/login.html @@ -0,0 +1,100 @@ + + +{% load static %} +{% load i18n %} + + + + + + + + + + {% translate "Paperless-ngx sign in" %} + + + + + + +
+ +{% load allauth socialaccount %} +{% get_providers as socialaccount_providers %} +{% if socialaccount_providers %} +

{% translate "or sign in via" %}

+
    + {% for provider in socialaccount_providers %} + {% if provider.id == "openid" %} + {% for brand in provider.get_brands %} + {% provider_login_url provider openid=brand.openid_url process=process as href %} +
  • {{ brand.name }}
    • + {% endfor %} + {% else %} + {% provider_login_url provider process=process scope=scope auth_params=auth_params as href %} +
  • +
    + {% csrf_token %} + +
    +
    • + {% endif %} + {% endfor %} +
+{% endif %} +
+ + diff --git a/src/paperless/templates/socialaccount/login.html b/src/paperless/templates/socialaccount/login.html new file mode 100644 index 000000000..dc852d047 --- /dev/null +++ b/src/paperless/templates/socialaccount/login.html @@ -0,0 +1,52 @@ + + +{% load static %} +{% load i18n %} +{% load allauth %} + + + + + + + + + + {% translate "Paperless-ngx sign in" %} + + + + + + +
+ +
+ + diff --git a/src/paperless/templates/socialaccount/signup.html b/src/paperless/templates/socialaccount/signup.html new file mode 100644 index 000000000..e60f010fb --- /dev/null +++ b/src/paperless/templates/socialaccount/signup.html @@ -0,0 +1,77 @@ + + +{% load static %} +{% load i18n %} + + + + + + + + + + {% translate "Paperless-ngx sign up" %} + + + + + + +
+ +
+ + diff --git a/src/paperless/urls.py b/src/paperless/urls.py index d45a7bf22..74f6fc108 100644 --- a/src/paperless/urls.py +++ b/src/paperless/urls.py @@ -41,10 +41,12 @@ from documents.views import WorkflowTriggerViewSet from documents.views import WorkflowViewSet from paperless.consumers import StatusConsumer from paperless.views import ApplicationConfigurationViewSet +from paperless.views import DisconnectSocialAccountView from paperless.views import FaviconView from paperless.views import GenerateAuthTokenView from paperless.views import GroupViewSet from paperless.views import ProfileView +from paperless.views import SocialAccountProvidersView from paperless.views import UserViewSet from paperless_mail.views import MailAccountTestView from paperless_mail.views import MailAccountViewSet @@ -132,6 +134,14 @@ urlpatterns = [ name="bulk_edit_object_permissions", ), path("profile/generate_auth_token/", GenerateAuthTokenView.as_view()), + path( + "profile/disconnect_social_account/", + DisconnectSocialAccountView.as_view(), + ), + path( + "profile/social_account_providers/", + SocialAccountProvidersView.as_view(), + ), re_path( "^profile/", ProfileView.as_view(), @@ -192,7 +202,7 @@ urlpatterns = [ ), # TODO: with localization, this is even worse! :/ # login, logout - path("accounts/", include("django.contrib.auth.urls")), + path("accounts/", include("allauth.urls")), # Root of the Frontend re_path( r".*", diff --git a/src/paperless/views.py b/src/paperless/views.py index 0f417b9ab..0510cce59 100644 --- a/src/paperless/views.py +++ b/src/paperless/views.py @@ -1,6 +1,7 @@ import os from collections import OrderedDict +from allauth.socialaccount.adapter import get_adapter from django.contrib.auth.models import Group from django.contrib.auth.models import User from django.db.models.functions import Lower @@ -14,6 +15,7 @@ from rest_framework.pagination import PageNumberPagination from rest_framework.permissions import DjangoObjectPermissions from rest_framework.permissions import IsAuthenticated from rest_framework.response import Response +from rest_framework.views import APIView from rest_framework.viewsets import ModelViewSet from documents.permissions import PaperlessObjectPermissions @@ -168,3 +170,55 @@ class ApplicationConfigurationViewSet(ModelViewSet): serializer_class = ApplicationConfigurationSerializer permission_classes = (IsAuthenticated, DjangoObjectPermissions) + + +class DisconnectSocialAccountView(GenericAPIView): + """ + Disconnects a social account provider from the user account + """ + + permission_classes = [IsAuthenticated] + + def post(self, request, *args, **kwargs): + user = self.request.user + + user.socialaccount_set.get(pk=request.data["id"]).delete() + + return Response( + request.data["id"], + ) + + +class SocialAccountProvidersView(APIView): + """ + List of social account providers + """ + + permission_classes = [IsAuthenticated] + + def get(self, request, *args, **kwargs): + adapter = get_adapter() + providers = adapter.list_providers(request) + resp = [ + {"name": p.name, "login_url": p.get_login_url(request, process="connect")} + for p in providers + if p.id != "openid" + ] + + if ( + openid_provider := next(filter(lambda p: p.id == "openid", providers), None) + is not None + ): + resp += [ + { + "name": b.name, + "login_url": openid_provider.get_login_url( + request, + process="connect", + openid=b.openid_url, + ), + } + for b in openid_provider.get_brands() + ] + + return Response(sorted(resp, key=lambda p: p["name"]))