app/lib/google/oauth.server.ts

Functions

Imports

It imports app/db/schema.ts, app/lib/google/service-account.server.ts, app/lib/people.server.ts, app/lib/timed-fetch.server.ts. Imported by app/lib/google/drive.server.ts, app/lib/health.server.ts, app/routes/auth.google.ts, app/routes/editor.tsx, app/routes/home.tsx.

Source

1// Dustin's own Google grant (design decision 6): drive.file only, which reaches only files Carrel
2// itself created or he opened with it, used for Send to Docs and Import. The refresh token is kept in
3// D1 encrypted under a key from `wrangler secret`, so the database alone cannot use it.
4
5import { and, eq, lt } from "drizzle-orm";
6import { drizzle } from "drizzle-orm/d1";
7
8import { googleOauthStates, googleTokens } from "~/db/schema";
9import type { Viewer } from "~/lib/people.server";
10
11import { GOOGLE_TOKEN_URL, GoogleNotConnected } from "./service-account.server";
12import { timedFetch } from "~/lib/timed-fetch.server";
13
14const DRIVE_FILE_SCOPE = "https://www.googleapis.com/auth/drive.file";
15const AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
16const STATE_TTL_MS = 10 * 60_000;
17
18type Fetch = typeof fetch;
19
20export type OauthConnection =
21  | { state: "configured"; clientId: string; clientSecret: string; key: CryptoKey | null }
22  | { state: "not-configured"; detail: string }
23  | { state: "misconfigured"; detail: string };
24
25async function tokenKey(raw: string | undefined): Promise<CryptoKey | null> {
26  if (!raw?.trim()) return null;
27  let bytes: Uint8Array<ArrayBuffer>;
28  try {
29    bytes = Uint8Array.from(atob(raw.trim()), (c) => c.charCodeAt(0));
30  } catch {
31    return null;
32  }
33  if (bytes.length !== 32) return null;
34  return crypto.subtle.importKey("raw", bytes, "AES-GCM", false, ["encrypt", "decrypt"]);
35}
36
37export async function oauthConnection(env: Env): Promise<OauthConnection> {
38  const clientId = env.GOOGLE_OAUTH_CLIENT_ID?.trim();
39  const clientSecret = env.GOOGLE_OAUTH_CLIENT_SECRET?.trim();
40  if (!clientId && !clientSecret && !env.GOOGLE_TOKEN_KEY) {
41    return { state: "not-configured", detail: "Google sign-in for Send to Docs is not set up yet (GOOGLE_OAUTH_CLIENT_ID, GOOGLE_OAUTH_CLIENT_SECRET, GOOGLE_TOKEN_KEY)." };
42  }
43  if (!clientId || !clientSecret) return { state: "misconfigured", detail: "GOOGLE_OAUTH_CLIENT_ID and GOOGLE_OAUTH_CLIENT_SECRET must both be set." };
44  const key = await tokenKey(env.GOOGLE_TOKEN_KEY);
45  if (!key) return { state: "misconfigured", detail: "GOOGLE_TOKEN_KEY must be 32 random bytes in base64, so the refresh token can be stored encrypted." };
46  return { state: "configured", clientId, clientSecret, key };
47}
48
49async function configured(env: Env) {
50  const c = await oauthConnection(env);
51  if (c.state !== "configured" || !c.key) throw new GoogleNotConnected(c.state === "configured" ? "GOOGLE_TOKEN_KEY is missing." : c.detail);
52  return { clientId: c.clientId, clientSecret: c.clientSecret, key: c.key };
53}
54
55function b64(bytes: Uint8Array): string {
56  let s = "";
57  for (const b of bytes) s += String.fromCharCode(b);
58  return btoa(s);
59}
60
61function unb64(s: string): Uint8Array<ArrayBuffer> {
62  return Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
63}
64
65async function encryptToken(key: CryptoKey, token: string): Promise<{ data: string; iv: string }> {
66  const iv = crypto.getRandomValues(new Uint8Array(12));
67  const data = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, new TextEncoder().encode(token)));
68  return { data: b64(data), iv: b64(iv) };
69}
70
71export async function decryptToken(key: CryptoKey, data: string, iv: string): Promise<string> {
72  const plain = await crypto.subtle.decrypt({ name: "AES-GCM", iv: unb64(iv) }, key, unb64(data));
73  return new TextDecoder().decode(plain);
74}
75
76/** Dustin's grant is his alone: Send to Docs sends outside Carrel, the Owner's action. */
77function requireOwner(viewer: Viewer) {
78  if (!viewer.isOwner) throw new Response("Forbidden", { status: 403 });
79}
80
81/** Where Google sends the browser back: the browser door's own origin. */
82function redirectUri(origin: string): string {
83  return `${origin}/auth/google/callback`;
84}
85
86export async function startAuth(env: Env, viewer: Viewer, origin: string, now = new Date()): Promise<string> {
87  requireOwner(viewer);
88  const { clientId } = await configured(env);
89  const state = b64(crypto.getRandomValues(new Uint8Array(24))).replace(/[+/=]/g, "");
90  const d = drizzle(env.DB);
91  await d.delete(googleOauthStates).where(lt(googleOauthStates.createdAt, new Date(now.getTime() - STATE_TTL_MS).toISOString()));
92  await d.insert(googleOauthStates).values({ state, personId: viewer.id, createdAt: now.toISOString() });
93  const url = new URL(AUTH_URL);
94  url.search = new URLSearchParams({
95    client_id: clientId,
96    redirect_uri: redirectUri(origin),
97    response_type: "code",
98    scope: DRIVE_FILE_SCOPE,
99    access_type: "offline",
100    // Consent each time, so Google returns a refresh token even for a second connection.
101    prompt: "consent",
102    include_granted_scopes: "false",
103    state,
104  }).toString();
105  return url.toString();
106}
107
108/**
109 * Finishes the round trip: the state must be one Carrel issued to this person in the last ten
110 * minutes, used once; the grant must be drive.file and nothing wider.
111 */
112export async function finishAuth(env: Env, viewer: Viewer, params: URLSearchParams, origin: string, fetcher: Fetch = timedFetch, now = new Date()) {
113  requireOwner(viewer);
114  const { clientId, clientSecret, key } = await configured(env);
115  const d = drizzle(env.DB);
116  const state = params.get("state") ?? "";
117  const used = await d
118    .delete(googleOauthStates)
119    .where(and(eq(googleOauthStates.state, state), eq(googleOauthStates.personId, viewer.id)))
120    .returning({ createdAt: googleOauthStates.createdAt });
121  if (!used[0] || Date.parse(used[0].createdAt) < now.getTime() - STATE_TTL_MS) {
122    return { ok: false as const, message: "That sign-in link was not started here, or has expired. Start again from Carrel." };
123  }
124  const error = params.get("error");
125  if (error) return { ok: false as const, message: `Google did not grant access (${error}).` };
126  const code = params.get("code");
127  if (!code) return { ok: false as const, message: "Google sent no code back." };
128
129  const res = await fetcher(GOOGLE_TOKEN_URL, {
130    method: "POST",
131    headers: { "Content-Type": "application/x-www-form-urlencoded" },
132    body: new URLSearchParams({ code, client_id: clientId, client_secret: clientSecret, redirect_uri: redirectUri(origin), grant_type: "authorization_code" }).toString(),
133  });
134  if (!res.ok) return { ok: false as const, message: `Google refused the code (${res.status}).` };
135  const body = (await res.json()) as { refresh_token?: string; scope?: string };
136  const scopes = (body.scope ?? "").split(/\s+/).filter(Boolean);
137  // Anything beyond drive.file (bar the identity scopes Google may add) is not what Carrel asked for.
138  const extra = scopes.filter((s) => s !== DRIVE_FILE_SCOPE && !["openid", "email", "profile"].includes(s) && !s.endsWith("/userinfo.email") && !s.endsWith("/userinfo.profile"));
139  if (!scopes.includes(DRIVE_FILE_SCOPE) || extra.length > 0) {
140    return { ok: false as const, message: `Google granted ${scopes.join(", ") || "nothing"}; Carrel keeps only a drive.file grant. Nothing was stored.` };
141  }
142  if (!body.refresh_token) return { ok: false as const, message: "Google returned no refresh token. Remove Carrel's access in your Google account and connect again." };
143  const sealed = await encryptToken(key, body.refresh_token);
144  await d
145    .insert(googleTokens)
146    .values({ personId: viewer.id, refreshToken: sealed.data, iv: sealed.iv, scope: DRIVE_FILE_SCOPE, connectedAt: now.toISOString() })
147    .onConflictDoUpdate({ target: googleTokens.personId, set: { refreshToken: sealed.data, iv: sealed.iv, scope: DRIVE_FILE_SCOPE, connectedAt: now.toISOString(), lastError: null } });
148  return { ok: true as const };
149}
150
151export async function isConnected(db: D1Database, viewer: Viewer): Promise<boolean> {
152  return Boolean(await drizzle(db).select({ id: googleTokens.personId }).from(googleTokens).where(eq(googleTokens.personId, viewer.id)).get());
153}
154
155/** An access token from the stored grant. A revoked grant is recorded, so the health check can say so. */
156export async function userAccessToken(env: Env, personId: number, fetcher: Fetch = timedFetch): Promise<string> {
157  const { clientId, clientSecret, key } = await configured(env);
158  const d = drizzle(env.DB);
159  const row = await d.select().from(googleTokens).where(eq(googleTokens.personId, personId)).get();
160  if (!row) throw new GoogleNotConnected("Google is not connected for Send to Docs yet. Connect it from the home page.");
161  const refresh = await decryptToken(key, row.refreshToken, row.iv);
162  const res = await fetcher(GOOGLE_TOKEN_URL, {
163    method: "POST",
164    headers: { "Content-Type": "application/x-www-form-urlencoded" },
165    body: new URLSearchParams({ client_id: clientId, client_secret: clientSecret, refresh_token: refresh, grant_type: "refresh_token" }).toString(),
166  });
167  if (!res.ok) {
168    const body = (await res.json().catch(() => ({}))) as { error?: string };
169    const message = `Google refused the drive.file grant (${res.status} ${body.error ?? ""}). Connect Google again from the home page.`;
170    await d.update(googleTokens).set({ lastError: message }).where(eq(googleTokens.personId, personId));
171    throw new GoogleNotConnected(message);
172  }
173  if (row.lastError) await d.update(googleTokens).set({ lastError: null }).where(eq(googleTokens.personId, personId));
174  return ((await res.json()) as { access_token: string }).access_token;
175}