OIDC token auth

core/web/apiv2/auth.py

@@ -1,4 +1,5 @@
 import datetime
+import json
 
 from authlib.integrations.starlette_client import OAuth, OAuthError
 from fastapi import APIRouter, Depends, HTTPException, Response, Security, status
@@ -9,6 +10,9 @@
     OAuth2PasswordBearer,
     OAuth2PasswordRequestForm,
 )
+from google.auth import exceptions as google_exceptions
+from google.auth.transport import requests as google_requests
+from google.oauth2 import id_token as google_oauth_id_token
 from jose import JWTError, jwt
 from starlette.requests import Request
 
@@ -179,6 +183,54 @@ async def oidc_callback(request: Request) -> RedirectResponse:
         SESSION_STORE.add(access_token)
         return response
 
+    @router.post("/oidc-callback-token")
+    async def oidc_api_callback(request: Request):
+        try:
+            req_body = await request.body()
+            id_token = json.loads(req_body)["id_token"]
+            idinfo = google_oauth_id_token.verify_oauth2_token(
+                id_token, google_requests.Request()
+            )
+        except (google_exceptions.GoogleAuthError, ValueError, KeyError) as error:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail=f"Invalid token provided: {error}",
+                headers={"WWW-Authenticate": "Bearer"},
+            )
+
+        audience_client_ids = set(
+            yeti_config.get("auth", "oidc_extra_client_audiences", "").split(",")
+        )
+        audience_client_ids.add(yeti_config.get("auth", "oidc_client_id"))
+
+        if idinfo["aud"] not in audience_client_ids:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Token is not intended for this application (audience mismatch)",
+                headers={"WWW-Authenticate": "Bearer"},
+            )
+
+        user = UserSensitive.find(username=idinfo["email"])
+        if not user:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Invalid user. Please contact your server admin.",
+                headers={"WWW-Authenticate": "Bearer"},
+            )
+
+        if not user.enabled:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="User account disabled. Please contact your server admin.",
+                headers={"WWW-Authenticate": "Bearer"},
+            )
+
+        access_token = create_access_token(
+            data={"sub": user.username, "enabled": user.enabled},
+            expires_delta=ACCESS_TOKEN_EXPIRE_MINUTES,
+        )
+        return {"access_token": access_token, "token_type": "bearer"}
+
 
 # We only want certain endpoints to be defined depending on the auth module.
 if AUTH_MODULE == "local":