feat: OAuth2 registration with email completion flow - #10202
Open
JohnNiang wants to merge 22 commits into
Open
Conversation
@halo-dev/api-client
@halo-dev/components
@halo-dev/richtext-editor
@halo-dev/ui-shared
@halo-dev/ui-plugin-bundler-kit
commit: |
The post-processing of MapOAuth2AuthenticationFilter read the OAuth2 authentication from the reactive context, which is scoped to the OAuth2 login filter's own downstream and never reaches the filter's post-processing scope. As a result, binding never happened and the session was left with the raw OAuth2AuthenticationToken, so the user was redirected to /uc and then bounced to /login. Load the authentication from the session security context repository instead (falling back to the reactive context), and skip OAuth2AuthenticationToken when resolving the pre-authentication to bind with to avoid binding under the OAuth2 subject name.
- Show a provider identity card (logo, name) on the selection page - Promote bind to a full-width secondary button and explain when registration is closed - Add contextual hints, autocomplete/one-time-code attributes and an optional badge for the verification code on the complete profile page - Localize complete profile field errors via the central i18n bundle - Keep the implementation plan templates in sync
Resolve the username candidate from common user-info attribute keys (login, username, user_name, preferred_username, nickname) before falling back to OAuth2User.getName(), which is the opaque sub claim for OIDC providers and usually produces an unusable username.
JohnNiang
added
the
kind/feature
…ation-email-completion
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #10202 +/- ##
============================================
+ Coverage 59.55% 64.83% +5.27%
- Complexity 3812 4877 +1065
============================================
Files 677 750 +73
Lines 23248 26154 +2906
Branches 1500 1822 +322
============================================
+ Hits 13846 16956 +3110
+ Misses 8764 8314 -450
- Partials 638 884 +246 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
- fix: reject email completion when edited email differs from the one the code was sent to (complete-profile.error.email-mismatch) - fix: intercept non-GET HTML requests in EmailCompletionFilter and treat user lookup failures as intercepting (fail-closed) - fix: reuse the fetched system setting in DefaultOAuth2RegistrationService to avoid racing the email completion gate - rename: checkEmailInUse -> checkVerifiedEmailInUse in UserService - extract: AgreementPageFetcher, RedirectUtils, OAuth2AuthenticationSession to remove duplicated preauth/redirect/session-establish logic - test: cover email-in-use, email mismatch, send-code rate limiting, non-GET redirect, fail-closed interception and OAuth2 token cleanup after registration
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
What this PR does / why we need it:
OAuth2 未绑定用户可选择绑定已有账号或一键注册；注册无可用邮箱/未验证邮箱的用户被门禁引导到
/complete-profile页面补填邮箱（按"注册需验证邮箱"设置决定是否必须验证码），超级管理员豁免。Summary of changes:
@Schema(requiredMode = REQUIRED)，变为可选/login?oauth2_select) — 未绑定用户选择"一键注册"或"绑定已有账号"；POST /login/oauth2/register注册并登录（4 tests）/login?oauth2_bind改为/login?oauth2_select（1 test）/complete-profile) — 补填邮箱 + 验证码提交，含登出按钮和发送验证码错误处理修复（5 tests）/complete-profile，API 请求返回 403 (email-not-set)（8 tests）/complete-profile/**要求已认证Testing:
./gradlew build— BUILD SUCCESSFUL（263 api + 1612 application tests）pnpm -C ui typecheck && pnpm -C ui lint— PASSSpecial notes:
DefaultOAuth2RegistrationService构造注入Clock，在WebServerSecurityConfig中添加了@Bean Clock clock()switchIfEmpty→defaultIfEmpty(false)修复了原设计中的链式双调度 bugemailVerified=false（防止已验证邮箱替换导致密码重置账户接管）Fixes #8120