0513e67838
Adds Microsoft 365 + Google OAuth providers (separate from the existing generic OIDC SSO at src/auth/sso.py) and a passwordless magic-link login flow. New OAuth signups capture Loi 25 art. 14 consents (4 granular checkboxes) BEFORE creating the User row via /auth/oauth/finish-signup. Per compatibility-audit.md C2: - No src/auth_extended/ directory — extends src/auth/ in place - No new User columns — reuses sso_provider/sso_subject + email_verified - Magic-link tokens via itsdangerous URLSafeTimedSerializer (15-min, no DB) - All routes added to existing auth_bp; templates extend marketing/base.html - Anti-enumeration on /auth/magic-link (generic flash for unknown OR unverified emails) and /auth/magic-link/<token> (same flash for invalid/expired/unverified-user) Files added: - src/auth/oauth_providers.py — Microsoft + Google OAuth registration, is_oauth_provider_enabled(), find_user_by_oauth(), create_oauth_user_with_consent() - src/auth/magic_link.py — generate/consume magic-link tokens - templates/auth/magic_link_request.html, templates/auth/oauth_finish_signup.html - tests/test_oauth_magic_link.py + tests/_run_oauth_magic_link_windows.py (16 tests) - config/env.oauth.example Files modified: - src/api/auth.py — 5 new routes (oauth_provider_login/callback, oauth_finish_signup, magic_link_request/consume); login flashes translated FR; oauth_*_enabled flags passed to login template - src/app.py — wires init_oauth_providers(app) after blueprint registration - src/services/email.py — adds send_magic_link_email() (FR + DictIA brand) - templates/login.html — refondu IN PLACE (was 178 lines legacy Vue/TW3) to extend marketing/base.html with OAuth buttons, password form, magic-link CTA, signup link - templates/auth/check_email.html — adds action='magic_link' branch - static/css/tailwind.config.js — adds templates/login.html to content - static/css/marketing.css — rebuilt Tests: 16/16 PASS via Windows manual driver. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
70 lines
3.5 KiB
Plaintext
70 lines
3.5 KiB
Plaintext
###############################################################################
|
|
# OAuth Providers — Microsoft 365 + Google (B-2.4)
|
|
###############################################################################
|
|
#
|
|
# These providers complement (do NOT replace) the generic OIDC SSO at
|
|
# config/env.sso.example. Both can be enabled simultaneously: users see
|
|
# Microsoft 365, Google, and SSO buttons on /login, plus the magic-link
|
|
# fallback that does not require any OAuth provider.
|
|
#
|
|
# IMPORTANT — Loi 25 art. 14 (consent must be granular, free, informed):
|
|
# OAuth signups still require Loi 25 consent capture via
|
|
# /auth/oauth/finish-signup BEFORE the User row is created. Existing
|
|
# users (matched by sso_subject or email) skip the consent page and log
|
|
# in directly.
|
|
#
|
|
# Magic-link login (/auth/magic-link, /auth/magic-link/<token>) reuses
|
|
# the SMTP settings from env.email.example — no additional env vars needed.
|
|
|
|
###############################################################################
|
|
# Microsoft 365 (Microsoft Entra ID, formerly Azure AD)
|
|
###############################################################################
|
|
# 1. Register a new app at https://entra.microsoft.com
|
|
# > Identity > Applications > App registrations > New registration
|
|
# 2. Set the redirect URI to:
|
|
# https://your-domain.example/auth/oauth/microsoft/callback
|
|
# 3. Generate a client secret under Certificates & secrets > Client secrets
|
|
# 4. Set MS_CLIENT_ID to the Application (client) ID
|
|
# 5. Set MS_CLIENT_SECRET to the secret VALUE (NOT the secret ID)
|
|
#
|
|
# Tenant restriction: by default the OAuth flow accepts users from any
|
|
# Microsoft tenant (server_metadata_url uses /common/). To restrict to a
|
|
# specific organization, edit src/auth/oauth_providers.py and replace
|
|
# /common/ with your tenant ID (e.g. /your-tenant-id-guid/).
|
|
#
|
|
# MS_CLIENT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
|
|
# MS_CLIENT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
|
|
|
###############################################################################
|
|
# Google (Google Cloud Console)
|
|
###############################################################################
|
|
# 1. Create an OAuth client at https://console.cloud.google.com
|
|
# > APIs & Services > Credentials > Create Credentials > OAuth client ID
|
|
# Application type: "Web application"
|
|
# 2. Set the redirect URI to:
|
|
# https://your-domain.example/auth/oauth/google/callback
|
|
# 3. Configure the OAuth consent screen in the same console
|
|
# (must be in "Production" status to accept users outside the test list)
|
|
# 4. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET from the credentials page
|
|
#
|
|
# GOOGLE_CLIENT_ID=xxxxxxxxxxxx-xxxxxxxxxxxx.apps.googleusercontent.com
|
|
# GOOGLE_CLIENT_SECRET=GOCSPX-xxxxxxxxxxxxxxxxxxxx
|
|
|
|
###############################################################################
|
|
# Notes
|
|
###############################################################################
|
|
#
|
|
# Token storage:
|
|
# - sso_provider stores the literal string "microsoft" or "google"
|
|
# - sso_subject stores the OAuth `sub` claim (provider-issued user ID)
|
|
# - email_verified is set to True automatically (the provider has
|
|
# already verified the email address)
|
|
# - password is NULL for OAuth-only accounts; users can set a password
|
|
# later via /forgot-password if they want a fallback login method
|
|
#
|
|
# Magic-link tokens:
|
|
# - Stateless via itsdangerous.URLSafeTimedSerializer
|
|
# - 15-minute expiry, signed with SECRET_KEY + salt 'magic-link-login'
|
|
# - No DB column — tokens are not single-use within the 15-min window
|
|
# - SMTP must be configured (see env.email.example) for the link to send
|