gitea-admin/gh-christianlouis-docuelevate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #558 from christianlouis/copilot/fix-user-specific-tokens

Browse Source 
feat(auth): make OAuth credentials user-specific via UserIntegration records
This commit is contained in:
Christian Krakau-Louis
2026-03-08 20:23:18 +01:00
committed by GitHub
parent 1ce9e97ad0 cfc52fd355
commit af696daf55
14 changed files with 282 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/views/dropbox.py
+3 -2
View File
@@ -2,7 +2,7 @@
Dropbox integration views for setup and OAuth callback.
"""
from fastapi import Request
from fastapi import Query, Request
from app.views.base import APIRouter, require_login, settings, templates
@@ -11,7 +11,7 @@ router = APIRouter()
@router.get("/dropbox-setup")
@require_login
async def dropbox_setup_page(request: Request):
async def dropbox_setup_page(request: Request, integration_id: int | None = Query(None)):
"""
Setup page for the Dropbox integration.
Shows configuration status and setup instructions.
@@ -28,6 +28,7 @@ async def dropbox_setup_page(request: Request):
"app_secret_value": settings.dropbox_app_secret if settings.dropbox_app_secret else "",
"refresh_token_value": settings.dropbox_refresh_token if settings.dropbox_refresh_token else "",
"folder_path": settings.dropbox_folder or "/Documents/Uploads", # Default folder path
"integration_id": integration_id,
},
)
app/views/google_drive.py
+3 -2
View File
@@ -4,7 +4,7 @@ Google Drive integration views for setup and OAuth callback.
import urllib.parse
from fastapi import Request
from fastapi import Query, Request
from fastapi.responses import RedirectResponse
from app.views.base import APIRouter, require_login, settings, templates
@@ -14,7 +14,7 @@ router = APIRouter()
@router.get("/google-drive-setup")
@require_login
async def google_drive_setup_page(request: Request):
async def google_drive_setup_page(request: Request, integration_id: int | None = Query(None)):
"""
Setup page for the Google Drive integration.
Shows configuration status and setup instructions.
@@ -55,6 +55,7 @@ async def google_drive_setup_page(request: Request):
"refresh_token_value": settings.google_drive_refresh_token or "",
"folder_id": settings.google_drive_folder_id or "",
"has_credentials_json": bool(settings.google_drive_credentials_json),
"integration_id": integration_id,
},
)
app/views/onedrive.py
+3 -2
View File
@@ -2,7 +2,7 @@
OneDrive integration views for setup and OAuth callback.
"""
from fastapi import Request
from fastapi import Query, Request
from app.views.base import APIRouter, require_login, settings, templates
@@ -11,7 +11,7 @@ router = APIRouter()
@router.get("/onedrive-setup")
@require_login
async def onedrive_setup_page(request: Request):
async def onedrive_setup_page(request: Request, integration_id: int | None = Query(None)):
"""
Setup page for the OneDrive integration.
Shows configuration status and setup instructions.
@@ -35,6 +35,7 @@ async def onedrive_setup_page(request: Request):
"refresh_token": bool(settings.onedrive_refresh_token),
"refresh_token_value": settings.onedrive_refresh_token if settings.onedrive_refresh_token else "",
"folder_path": settings.onedrive_folder_path or "Documents/Uploads", # Default folder path
"integration_id": integration_id,
},
)
frontend/templates/dropbox.html
+6
View File
@@ -216,6 +216,12 @@ DROPBOX_FOLDER={{ folder_path|default('/Documents/Uploads', true) }}</code></pre
{% block scripts %}
<script>
document.addEventListener('DOMContentLoaded', function() {
// Store integration_id if provided (for per-user OAuth flow)
const integrationId = "{{ integration_id or '' }}";
if (integrationId) {
sessionStorage.setItem('oauth_integration_id', integrationId);
}
// Elements
const startAuthFlowBtn = document.getElementById('start-auth-flow');
const testTokenBtn = document.getElementById('test-token');
frontend/templates/dropbox_callback.html
+45 -1
View File
@@ -97,6 +97,7 @@ document.addEventListener('DOMContentLoaded', function() {
const appKey = sessionStorage.getItem('dropbox_app_key') || "{{ app_key_value }}";
const appSecret = sessionStorage.getItem('dropbox_app_secret') || "{{ app_secret_value }}";
const folderPath = sessionStorage.getItem('dropbox_folder_path') || "{{ folder_path }}" || '/Documents/Uploads';
const integrationId = sessionStorage.getItem('oauth_integration_id');
const redirectUri = window.location.origin + "/dropbox-callback";
@@ -137,7 +138,50 @@ document.addEventListener('DOMContentLoaded', function() {
})
.then(data => {
if (data.refresh_token) {
// Update settings in memory
// Per-user flow: save to the user's integration record
if (integrationId) {
const creds = {
refresh_token: data.refresh_token,
app_key: appKey,
app_secret: appSecret,
};
const cfgUpdate = {};
if (folderPath) cfgUpdate.folder = folderPath;
const body = { credentials: creds };
if (Object.keys(cfgUpdate).length > 0) body.config = cfgUpdate;
document.getElementById('processing-message').innerHTML =
'<p>Saving credentials to your integration...</p>';
return fetch(`/api/integrations/${integrationId}`, {
method: 'PUT',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify(body),
}).then(response => {
if (!response.ok) {
return response.json().then(err => {
throw new Error('Failed to save credentials: ' + (err.detail || 'Unknown error'));
});
}
return response.json();
}).then(() => {
// Clean up
sessionStorage.removeItem('dropbox_app_key');
sessionStorage.removeItem('dropbox_app_secret');
sessionStorage.removeItem('dropbox_folder_path');
sessionStorage.removeItem('oauth_integration_id');
// Show brief success then redirect to integrations
document.getElementById('processing-message').innerHTML =
'<p class="text-green-600 font-semibold">✓ Dropbox authorized successfully!</p>' +
'<p class="text-sm text-gray-500 mt-2">Redirecting to Integrations...</p>';
document.querySelector('.animate-spin').parentNode.classList.add('hidden');
setTimeout(() => { window.location.href = '/integrations'; }, 2000);
});
}
// Global flow: update settings in memory
const updateFormData = new FormData();
updateFormData.append('refresh_token', data.refresh_token);
frontend/templates/google_drive.html
+6
View File
@@ -358,6 +358,12 @@ GOOGLE_DRIVE_FOLDER_ID={{ folder_id|default('YOUR_FOLDER_ID', true) }}
{% block scripts %}
<script>
document.addEventListener('DOMContentLoaded', function() {
// Store integration_id if provided (for per-user OAuth flow)
const integrationId = "{{ integration_id or '' }}";
if (integrationId) {
sessionStorage.setItem('oauth_integration_id', integrationId);
}
// Tab elements
const oauthTabBtn = document.getElementById('oauth-tab-btn');
const saTabBtn = document.getElementById('sa-tab-btn');
frontend/templates/google_drive_callback.html
+46 -1
View File
@@ -138,6 +138,7 @@ document.addEventListener('DOMContentLoaded', function() {
const clientId = sessionStorage.getItem('google_drive_client_id');
const clientSecret = sessionStorage.getItem('google_drive_client_secret');
const folderId = sessionStorage.getItem('google_drive_folder_id');
const integrationId = sessionStorage.getItem('oauth_integration_id');
const redirectUri = window.location.origin + "/google-drive-callback";
@@ -192,7 +193,51 @@ document.addEventListener('DOMContentLoaded', function() {
refreshToken = data.refresh_token;
accessToken = data.access_token;
// Update settings in memory first
// Per-user flow: save to the user's integration record
if (integrationId) {
const creds = {
client_id: clientId,
client_secret: clientSecret,
refresh_token: data.refresh_token,
};
const cfgUpdate = {};
if (folderId) cfgUpdate.folder_id = folderId;
const body = { credentials: creds };
if (Object.keys(cfgUpdate).length > 0) body.config = cfgUpdate;
document.getElementById('processing-message').innerHTML =
'<p>Saving credentials to your integration...</p>';
return fetch(`/api/integrations/${integrationId}`, {
method: 'PUT',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify(body),
}).then(response => {
if (!response.ok) {
return response.json().then(err => {
throw new Error('Failed to save credentials: ' + (err.detail || 'Unknown error'));
});
}
return response.json();
}).then(() => {
// Clean up
sessionStorage.removeItem('google_drive_client_id');
sessionStorage.removeItem('google_drive_client_secret');
sessionStorage.removeItem('google_drive_folder_id');
sessionStorage.removeItem('google_drive_use_oauth');
sessionStorage.removeItem('oauth_integration_id');
// Show brief success then redirect to integrations
document.getElementById('processing-message').innerHTML =
'<p class="text-green-600 font-semibold">✓ Google Drive authorized successfully!</p>' +
'<p class="text-sm text-gray-500 mt-2">Redirecting to Integrations...</p>';
document.querySelector('.animate-spin').parentNode.classList.add('hidden');
setTimeout(() => { window.location.href = '/integrations'; }, 2000);
});
}
// Global flow: update settings in memory first
const updateFormData = new FormData();
updateFormData.append('refresh_token', data.refresh_token);
frontend/templates/integrations_dashboard.html
+27 -6
View File
@@ -206,6 +206,16 @@
</div>
<!-- Actions -->
<div class="flex items-center gap-2 shrink-0">
<template x-if="isOAuthType(intg.integration_type) && !intg.has_credentials">
<a
:href="oauthLink(intg.integration_type) + '?integration_id=' + intg.id"
class="inline-flex items-center px-3 py-1.5 text-xs font-medium rounded border border-yellow-400 text-yellow-700 bg-yellow-50 hover:bg-yellow-100 focus:outline-none focus:ring-2 focus:ring-yellow-500"
style="min-height:36px;"
:aria-label="`Authorize ${intg.name}`"
>
<i class="fas fa-key mr-1" aria-hidden="true"></i>Authorize
</a>
</template>
<button
type="button"
@click="testSavedIntegration(intg)"
@@ -279,6 +289,16 @@
</div>
<!-- Actions -->
<div class="flex items-center gap-2 shrink-0">
<template x-if="isOAuthType(intg.integration_type) && !intg.has_credentials">
<a
:href="oauthLink(intg.integration_type) + '?integration_id=' + intg.id"
class="inline-flex items-center px-3 py-1.5 text-xs font-medium rounded border border-yellow-400 text-yellow-700 bg-yellow-50 hover:bg-yellow-100 focus:outline-none focus:ring-2 focus:ring-yellow-500"
style="min-height:36px;"
:aria-label="`Authorize ${intg.name}`"
>
<i class="fas fa-key mr-1" aria-hidden="true"></i>Authorize
</a>
</template>
<button
type="button"
@click="testSavedIntegration(intg)"
@@ -561,9 +581,8 @@
</div>
<div class="bg-blue-50 dark:bg-blue-900/30 rounded-md p-3 text-sm text-blue-700 dark:text-blue-300">
<i class="fas fa-info-circle mr-1" aria-hidden="true"></i>
OAuth tokens can be configured via the dedicated
<a :href="oauthLink(form.integration_type)" class="underline hover:text-blue-900 dark:hover:text-blue-100" x-text="typeLabel(form.integration_type) + ' setup page'"></a>.
Once authorised, the token is stored automatically.
Save this integration first, then use the <strong>Authorize</strong> button to complete the OAuth flow.
Your credentials will be stored securely in your personal integration record.
</div>
</div>
</template>
@@ -742,6 +761,7 @@ function integrationsDashboard() {
const SOURCE_TYPES = ['IMAP', 'WATCH_FOLDER', 'WEBHOOK'];
const DEST_TYPES = ['S3', 'DROPBOX', 'GOOGLE_DRIVE', 'ONEDRIVE', 'WEBDAV', 'NEXTCLOUD', 'FTP', 'SFTP', 'EMAIL', 'PAPERLESS', 'RCLONE'];
const TYPES_WITH_FORM_FIELDS = new Set(['IMAP', 'S3', 'WEBDAV', 'NEXTCLOUD', 'FTP', 'SFTP', 'DROPBOX', 'GOOGLE_DRIVE', 'ONEDRIVE', 'EMAIL', 'WATCH_FOLDER', 'PAPERLESS']);
const OAUTH_TYPES = new Set(['DROPBOX', 'GOOGLE_DRIVE', 'ONEDRIVE']);
const TYPE_LABELS = {
IMAP: 'IMAP Email',
@@ -838,11 +858,12 @@ function integrationsDashboard() {
typeLabel(t) { return TYPE_LABELS[t] || t; },
typeIcon(t) { return TYPE_ICONS[t] || 'fa-plug text-gray-400'; },
hasFormFields(t) { return TYPES_WITH_FORM_FIELDS.has(t); },
isOAuthType(t) { return OAUTH_TYPES.has(t); },
oauthLink(t) {
if (t === 'DROPBOX') return '/dropbox';
if (t === 'GOOGLE_DRIVE') return '/google-drive';
if (t === 'ONEDRIVE') return '/onedrive';
if (t === 'DROPBOX') return '/dropbox-setup';
if (t === 'GOOGLE_DRIVE') return '/google-drive-setup';
if (t === 'ONEDRIVE') return '/onedrive-setup';
return '#';
},
frontend/templates/onedrive.html
+6
View File
@@ -237,6 +237,12 @@ ONEDRIVE_FOLDER_PATH={{ folder_path|default('Documents/Uploads', true) }}</code>
{% block scripts %}
<script>
document.addEventListener('DOMContentLoaded', function() {
// Store integration_id if provided (for per-user OAuth flow)
const integrationId = "{{ integration_id or '' }}";
if (integrationId) {
sessionStorage.setItem('oauth_integration_id', integrationId);
}
// Elements
const startAuthFlowBtn = document.getElementById('start-auth-flow');
const testTokenBtn = document.getElementById('test-token');
frontend/templates/onedrive_callback.html
+47 -1
View File
@@ -98,6 +98,7 @@ document.addEventListener('DOMContentLoaded', function() {
const clientSecret = sessionStorage.getItem('onedrive_client_secret') || "{{ client_secret_value }}";
const tenantId = sessionStorage.getItem('onedrive_tenant_id') || "{{ tenant_id }}" || "common";
const folderPath = sessionStorage.getItem('onedrive_folder_path') || "";
const integrationId = sessionStorage.getItem('oauth_integration_id');
const redirectUri = window.location.origin + "/onedrive-callback";
@@ -140,7 +141,52 @@ document.addEventListener('DOMContentLoaded', function() {
})
.then(data => {
if (data.refresh_token) {
// Instead of saving to .env file, update settings in memory
// Per-user flow: save to the user's integration record
if (integrationId) {
const creds = {
client_id: clientId,
client_secret: clientSecret,
refresh_token: data.refresh_token,
tenant_id: tenantId,
};
const cfgUpdate = {};
if (folderPath) cfgUpdate.folder_path = folderPath;
const body = { credentials: creds };
if (Object.keys(cfgUpdate).length > 0) body.config = cfgUpdate;
document.getElementById('processing-message').innerHTML =
'<p>Saving credentials to your integration...</p>';
return fetch(`/api/integrations/${integrationId}`, {
method: 'PUT',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify(body),
}).then(response => {
if (!response.ok) {
return response.json().then(err => {
throw new Error('Failed to save credentials: ' + (err.detail || 'Unknown error'));
});
}
return response.json();
}).then(() => {
// Clean up
sessionStorage.removeItem('onedrive_client_id');
sessionStorage.removeItem('onedrive_client_secret');
sessionStorage.removeItem('onedrive_tenant_id');
sessionStorage.removeItem('onedrive_folder_path');
sessionStorage.removeItem('oauth_integration_id');
// Show brief success then redirect to integrations
document.getElementById('processing-message').innerHTML =
'<p class="text-green-600 font-semibold">✓ OneDrive authorized successfully!</p>' +
'<p class="text-sm text-gray-500 mt-2">Redirecting to Integrations...</p>';
document.querySelector('.animate-spin').parentNode.classList.add('hidden');
setTimeout(() => { window.location.href = '/integrations'; }, 2000);
});
}
// Global flow: update settings in memory
const updateFormData = new FormData();
updateFormData.append('refresh_token', data.refresh_token);
tests/test_views_dropbox.py
+18
View File
@@ -26,3 +26,21 @@ class TestDropboxViews:
"""Test the Dropbox OAuth callback with auth code."""
response = client.get("/dropbox-callback?code=test_code")
assert response.status_code == 200
def test_dropbox_setup_page_with_integration_id(self, client):
"""Test the Dropbox setup page accepts integration_id query param."""
response = client.get("/dropbox-setup?integration_id=42")
assert response.status_code == 200
# The template should store the integration_id for per-user OAuth flow
assert b"oauth_integration_id" in response.content
assert b"42" in response.content
def test_dropbox_setup_page_without_integration_id(self, client):
"""Test the Dropbox setup page works without integration_id (global flow)."""
response = client.get("/dropbox-setup")
assert response.status_code == 200
# The template should not set integration_id when not provided
body = response.text
assert "oauth_integration_id" in body # The JS code is always present
# But integration_id template var should be empty
assert 'const integrationId = ""' in body
tests/test_views_google_drive.py
+16
View File
@@ -30,6 +30,22 @@ class TestGoogleDriveViews:
response = client.get("/google-drive-callback?code=test_code")
assert response.status_code == 200
def test_google_drive_setup_page_with_integration_id(self, client):
"""Test the Google Drive setup page accepts integration_id query param."""
response = client.get("/google-drive-setup?integration_id=99")
assert response.status_code == 200
# The template should store the integration_id for per-user OAuth flow
assert b"oauth_integration_id" in response.content
assert b"99" in response.content
def test_google_drive_setup_page_without_integration_id(self, client):
"""Test the Google Drive setup page works without integration_id (global flow)."""
response = client.get("/google-drive-setup")
assert response.status_code == 200
body = response.text
assert "oauth_integration_id" in body
assert 'const integrationId = ""' in body
def test_google_drive_callback_with_code_and_state(self, client):
"""Test the Google Drive OAuth callback with code and state."""
response = client.get("/google-drive-callback?code=test_code&state=test_state")
tests/test_views_integrations.py
+40
View File
@@ -63,6 +63,46 @@ class TestIntegrationsDashboardView:
assert response.status_code == 200
assert b"integrationsDashboard" in response.content
def test_integrations_page_oauth_links_point_to_setup_pages(self, client):
"""oauthLink() must reference the correct -setup URLs, not bare paths."""
response = client.get("/integrations")
assert response.status_code == 200
body = response.text
assert "'/dropbox-setup'" in body or '"/dropbox-setup"' in body
assert "'/google-drive-setup'" in body or '"/google-drive-setup"' in body
assert "'/onedrive-setup'" in body or '"/onedrive-setup"' in body
# Ensure the old broken paths are gone
assert "return '/dropbox'" not in body.replace("/dropbox-setup", "")
assert "return '/google-drive'" not in body.replace("/google-drive-setup", "")
assert "return '/onedrive'" not in body.replace("/onedrive-setup", "")
def test_integrations_page_contains_authorize_button(self, client):
"""GET /integrations page includes per-user Authorize button for OAuth types."""
response = client.get("/integrations")
assert response.status_code == 200
body = response.text
assert "isOAuthType" in body
assert "Authorize" in body
assert "integration_id=" in body
def test_integrations_page_contains_oauth_types_constant(self, client):
"""GET /integrations includes OAUTH_TYPES Set constant."""
response = client.get("/integrations")
assert response.status_code == 200
body = response.text
assert "OAUTH_TYPES" in body
assert "'DROPBOX'" in body
assert "'GOOGLE_DRIVE'" in body
assert "'ONEDRIVE'" in body
def test_integrations_page_modal_info_box_per_user(self, client):
"""The create modal info box instructs to save first then authorize."""
response = client.get("/integrations")
assert response.status_code == 200
body = response.text
assert "Save this integration first" in body
assert "personal integration record" in body
def test_integrations_page_contains_quota_indicators(self, client):
"""GET /integrations page includes quota labels."""
response = client.get("/integrations")
tests/test_views_onedrive.py
+16
View File
@@ -26,3 +26,19 @@ class TestOnedriveViews:
"""Test the OneDrive OAuth callback with auth code."""
response = client.get("/onedrive-callback?code=test_code")
assert response.status_code == 200
def test_onedrive_setup_page_with_integration_id(self, client):
"""Test the OneDrive setup page accepts integration_id query param."""
response = client.get("/onedrive-setup?integration_id=77")
assert response.status_code == 200
# The template should store the integration_id for per-user OAuth flow
assert b"oauth_integration_id" in response.content
assert b"77" in response.content
def test_onedrive_setup_page_without_integration_id(self, client):
"""Test the OneDrive setup page works without integration_id (global flow)."""
response = client.get("/onedrive-setup")
assert response.status_code == 200
body = response.text
assert "oauth_integration_id" in body
assert 'const integrationId = ""' in body