Google OAuth Authentication

[nelsonic]

As a person who has a Google Account (for personal or work reasons),
I want the ability sign into the @dwyl App using my Google Account
so that I don't have to waste time registering or remembering another password.

Todo

• Create an Elixir Module https://github.com/dwyl/elixir-auth-google that does only one thing well.
• Publish it to Hex.pm using the @dwyl user [I'm happy to do this part as I have it setup on my Mac]
• Write detailed step-by-step documentation that any (reasonably competent developer) can follow to have Google OAuth up-and-running in less than 10 minutes. Write Docs & Publish Package in Hex.pm elixir-auth-google#10
• Use the Elixir module in the @dwyl App to allow people to Authenticate effortlessly.
  • Add a blue #4285F4 button to our App as a CTA to Auth with Google Google Auth Button Appearance > Blue #249
  • Basic wireframe to follow shortly. ⏳
• Save the requested email address encrypted in the person.email field. (so that we can email the person to remind them of their progress on a task, sending email will be in Sprint 3)
  • Save email hashed in email_hash so that the address can be looked up.
    To see why this is needed, GOTO: BUG: New Person inserted each time I authenticate with Google mvp#29
• Store any other relevant data returned by the Google auth see: Google OAuth Authentication #247 (comment)
  • picture - so we can display the person's avatar in the App.
  • givenName - So we can address the person "Welcome Simon!"
  • familyName - Useful when differentiating people with the same givenName in a team/org.
  • status=1 - the email address has been verified.
  • locale - the language to display in the UI. (translations to follow in future)
• Use Phoenix Sessions to maintain the person's session Use Phoenix Sessions #252

We have implemented this before: https://github.com/dwyl/hapi-auth-google this can be used as a reference.

[SimonLab]

Recap on how "Sign in with Google" works

Google provide OAuth protocol to allow user to signin with an application.
OAuth allow users first to identify themself with their Google credentials, this is the authorization step.
Google then create a token for each users which can be used by the application (ie dwyl app ian our case) to access Google API endpoints on behalf of the users. The tokens let the application know that the user is a "real user" (ie users' credentials valid) and the application can now authenticate the users.

The Google documentation ( Using OAuth 2.0 to Access Google APIs) contains the following schemas which describe in a bit more details the steps of authorization:

So once a Google token is created for a user, the application will create a session for the user with put_session function (note that the SECRET_KEY_BASE is used to encrypt the session)

Because the signin process will create a google token and a client session we need to remember to verify that both of this items are still valid and especially checking that they have not expired.

[SimonLab]

I'm currently testing the elixir_auth_google package on the application by adding it as a dependency using the Github link and branch name:

  defp deps do
    [
      {:phoenix, "~> 1.4.10"},
      {:phoenix_pubsub, "~> 1.1"},
      {:phoenix_ecto, "~> 4.0"},
      {:ecto_sql, "~> 3.1"},
      {:postgrex, ">= 0.0.0"},
      {:phoenix_html, "~> 2.11"},
      {:phoenix_live_reload, "~> 1.2", only: :dev},
      {:gettext, "~> 0.11"},
      {:jason, "~> 1.0"},
      {:plug_cowboy, "~> 2.0"},
      {:elixir_auth_google, git: "https://github.com/dwyl/elixir-auth-google.git", branch: "initialise-app" }
    ]
  end

⚠️ if the code on the branch has been updated mix deps.get will not get the new code automatically. You need to force mix to get the latest change (deleting the deps folder and run mix deps.get force the dependencies to be udpated)

[nelsonic]

@SimonLab indeed because the git dependency doesn't have a version/hash updates are manual. 😞 (hopefully not too tedious until we are able to publish it to Hex.pm...) 👍

[SimonLab]

Now that we have a working elixir package to get a Google token with OAuth we can create a session with Phoenix for the user.

• On first signin get Google token and save it in Postgres in the user table along the user profile information
• Create a Pheonix session
• If the phoenix session has expired, The user needs to signin with Google again. A new token will be created and will replace the old one in the database.
• If the google token lifetime has expired, we can use the refresh_token (which should also be saved in Postgres) to get a new valid token.

[SimonLab]

How to save the token in the Google database?
I think we should hash the token when saving them but we also need a way to get the original token from the database to be able to use it with for the Google API. We have use comeonin to hash password on previous Phoenix applications however I don't this this let you get back the original token.