[6.x] OAuth Improvements (#14899)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: jasonvarga

composer.json

@@ -46,6 +46,7 @@
         "fakerphp/faker": "~1.10",
         "google/cloud-translate": "^1.6",
         "laravel/pint": "1.16.0",
+        "laravel/socialite": "^5.28",
         "mockery/mockery": "^1.6.10",
         "orchestra/testbench": "^10.8 || ^11.0",
         "phpunit/phpunit": "^11.5.3",

config/oauth.php

@@ -13,6 +13,7 @@
     'routes' => [
         'login' => 'oauth/{provider}',
         'callback' => 'oauth/{provider}/callback',
+        'disconnect' => 'oauth/{provider}/disconnect',
     ],
 
     /*

lang/en/messages.php

@@ -188,6 +188,12 @@
     'navigation_documentation_instructions' => 'Learn about building, configuring, and rendering navigations',
     'navigation_link_to_entry_instructions' => 'Add a link to an entry. Enable linking to additional collections in the config area.',
     'navigation_link_to_url_instructions' => 'Add a link to any internal or external URL. Enable linking to entries in the config area.',
+    'oauth_email_exists' => 'An account with this email address already exists. Sign in and connect this provider from your account settings.',
+    'oauth_already_connected' => 'Your :provider account is already connected.',
+    'oauth_belongs_to_another_user' => 'This :provider account is already connected to a different user.',
+    'oauth_connect_unsupported' => 'This provider does not support connecting accounts.',
+    'oauth_connected' => 'Connected your :provider account.',
+    'oauth_disconnected' => 'Disconnected your :provider account.',
     'outpost_error_422' => 'Error communicating with statamic.com.',
     'outpost_error_429' => 'Too many requests to statamic.com.',
     'outpost_issue_try_later' => 'There was an issue communicating with statamic.com. Please try again later.',

resources/js/components/users/PublishForm.vue

@@ -19,6 +19,7 @@
                     <DropdownMenu>
                         <DropdownItem :text="__('Edit Blueprint')" icon="blueprint-edit" v-if="canEditBlueprint" :href="actions.editBlueprint" />
                         <DropdownItem :text="__('Passkeys')" icon="key" :href="cp_url('passkeys')" />
+                        <DropdownItem v-if="oauthEnabled" :text="__('Sign-in Providers')" icon="sign-in" :href="cp_url('oauth')" />
                         <DropdownSeparator v-if="canEditBlueprint && itemActions.length" />
                         <DropdownItem
                             v-for="action in itemActions"
@@ -120,6 +121,7 @@ export default {
         method: String,
         canEditPassword: Boolean,
         canEditBlueprint: Boolean,
+        oauthEnabled: Boolean,
         requiresCurrentPassword: Boolean,
         twoFactor: Object,
     },

resources/js/pages/users/Edit.vue

@@ -11,6 +11,7 @@ defineProps([
     'meta',
     'canEditPassword',
     'canEditBlueprint',
+    'oauthEnabled',
     'requiresCurrentPassword',
     'itemActions',
     'itemActionUrl',
@@ -33,6 +34,7 @@ defineProps([
             :initial-meta="meta"
             :can-edit-password="canEditPassword"
             :can-edit-blueprint="canEditBlueprint"
+            :oauth-enabled="oauthEnabled"
             :requires-current-password="requiresCurrentPassword"
             :initial-item-actions="itemActions"
             :item-action-url="itemActionUrl"

resources/js/pages/users/OAuth.vue

@@ -0,0 +1,73 @@
+<script setup>
+import { router } from '@inertiajs/vue3';
+import axios from 'axios';
+import Head from '@/pages/layout/Head.vue';
+import { Header, Button, Listing } from '@ui';
+import { toast } from '@api';
+import { requireElevatedSession } from '@/components/elevated-sessions';
+
+defineProps(['providers']);
+
+const columns = [
+    { label: __('Provider'), field: 'label' },
+    { label: '', field: 'actions' },
+];
+
+function connect(provider) {
+    requireElevatedSession()
+        .then(() => (window.location = provider.connectUrl))
+        .catch(() => toast.error(__('statamic::messages.elevated_session_required')));
+}
+
+function disconnect(provider) {
+    requireElevatedSession()
+        .then(() => performDisconnect(provider))
+        .catch(() => toast.error(__('statamic::messages.elevated_session_required')));
+}
+
+function performDisconnect(provider) {
+    axios.delete(provider.disconnectUrl).then(() => {
+        toast.success(__('statamic::messages.oauth_disconnected', { provider: provider.label }));
+        router.reload();
+    });
+}
+</script>
+
+<template>
+    <Head :title="__('Sign-in Providers')" />
+
+    <div class="max-w-5xl 3xl:max-w-6xl mx-auto" data-max-width-wrapper>
+        <Header :title="__('Sign-in Providers')" icon="sign-in" />
+
+        <Listing
+            :items="providers"
+            :columns
+            :allow-search="false"
+            :allow-customizing-columns="false"
+        >
+            <template #cell-label="{ row }">
+                <div class="flex items-center gap-2">
+                    <span v-if="row.icon" class="flex size-4 items-center [&_svg]:size-4" v-html="row.icon" />
+                    <span>{{ row.label }}</span>
+                </div>
+            </template>
+
+            <template #cell-actions="{ row }">
+                <div class="text-right">
+                    <Button
+                        v-if="row.connected"
+                        size="xs"
+                        :text="__('Disconnect')"
+                        @click="disconnect(row)"
+                    />
+                    <Button
+                        v-else
+                        size="xs"
+                        :text="__('Connect')"
+                        @click="connect(row)"
+                    />
+                </div>
+            </template>
+        </Listing>
+    </div>
+</template>

resources/svg/icons/sign-in.svg

@@ -1,6 +1,7 @@
 <?php
 
 use Illuminate\Support\Facades\Route;
+use Statamic\Facades\OAuth;
 use Statamic\Facades\TwoFactor;
 use Statamic\Facades\Utility;
 use Statamic\Http\Controllers\CP\Addons\AddonsController;
@@ -23,6 +24,7 @@
 use Statamic\Http\Controllers\CP\Auth\ForgotPasswordController;
 use Statamic\Http\Controllers\CP\Auth\ImpersonationController;
 use Statamic\Http\Controllers\CP\Auth\LoginController;
+use Statamic\Http\Controllers\CP\Auth\OAuthController;
 use Statamic\Http\Controllers\CP\Auth\PasskeyController;
 use Statamic\Http\Controllers\CP\Auth\PasskeyLoginController;
 use Statamic\Http\Controllers\CP\Auth\ResetPasswordController;
@@ -113,6 +115,7 @@
 use Statamic\Http\Controllers\CP\Users\UsersController;
 use Statamic\Http\Controllers\CP\Users\UserWizardController;
 use Statamic\Http\Controllers\CP\Utilities\UtilitiesController;
+use Statamic\Http\Controllers\OAuthController as FrontendOAuthController;
 use Statamic\Http\Controllers\User\TwoFactorRecoveryCodesController;
 use Statamic\Http\Middleware\CP\RedirectIfTwoFactorSetupIncomplete;
 use Statamic\Http\Middleware\CP\RequireElevatedSession;
@@ -436,6 +439,11 @@
         Route::delete('{id}', [PasskeyController::class, 'destroy'])->name('passkeys.destroy');
     });
 
+    if (OAuth::enabled()) {
+        Route::get('oauth', [OAuthController::class, 'index'])->name('oauth');
+        Route::delete('oauth/{provider}/disconnect', [FrontendOAuthController::class, 'disconnect'])->middleware(RequireElevatedSession::class)->name('oauth.disconnect');
+    }
+
     Route::get('themes', [ThemeController::class, 'index']);
     Route::get('themes/refresh', [ThemeController::class, 'refresh']);
     Route::post('themes/share', ShareThemeController::class);

routes/cp.php

@@ -114,6 +114,9 @@
         Route::match(['get', 'post'], config('statamic.oauth.routes.callback'), [OAuthController::class, 'handleProviderCallback'])
             ->withoutMiddleware(['App\Http\Middleware\VerifyCsrfToken', 'Illuminate\Foundation\Http\Middleware\VerifyCsrfToken'])
             ->name('oauth.callback');
+        Route::delete(config('statamic.oauth.routes.disconnect', 'oauth/{provider}/disconnect'), [OAuthController::class, 'disconnect'])
+            ->middleware([AuthGuard::class, 'auth', RequireElevatedSession::class])
+            ->name('oauth.disconnect');
     }
 });
 

routes/web.php

@@ -0,0 +1,13 @@
+<?php
+
+namespace Statamic\Exceptions;
+
+use Exception;
+
+class OAuthEmailExistsException extends Exception
+{
+    public function __construct()
+    {
+        parent::__construct('A user already exists with the OAuth email.');
+    }
+}