Changeset 075185a in Klonkt

Timestamp:

06/24/2026 02:16:57 PM (3 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

2e9773f

Parents:

5b47619

Message:

refactor(auth): remove Google login (listeners now interact via the fediverse)

Removes config/google.js, the /auth/google* routes, the admin Google config page
+ links, the account link/unlink, and the public Google login button. /login and
/auth/admin both show the admin password form. SEO/Search-Console Google is
untouched. (Native comments removed next.)

Co-Authored-By: Claude <noreply@…>

Location:

src

Files:

• config/google.js (deleted)
• routes/account.js (modified) (4 diffs)
• routes/admin-settings.js (modified) (3 diffs)
• routes/auth.js (modified) (4 diffs)
• views/pages/account.ejs (modified) (1 diff)
• views/pages/admin-google.ejs (deleted)
• views/pages/admin-settings.ejs (modified) (1 diff)
• views/pages/admin.ejs (modified) (1 diff)
• views/pages/auth-login.ejs (modified) (1 diff)

src/routes/account.js

@@ -24 +24 @@
 import { renderPage } from '../middleware/render.js';
 import { requireAuth } from '../middleware/auth.js';
-import { googleConfigured } from '../config/google.js';
 import { toWebp } from '../services/ImageWebpService.js';
 import { SUPPORTED } from '../services/i18n.js';
@@ -65 +64 @@
   `).get(req.session.user.id);
   const hasPassword = !!(account && account.password_hash && account.password_hash !== '!google-oauth');
-  const googleLinked = !!(account && account.google_sub);
   if (account) { delete account.password_hash; delete account.google_sub; } // don't leak to the view
 
@@ -74 +72 @@
     account,
     hasPassword,
-    googleLinked,
-    googleAvailable: googleConfigured(),
     editableSite,
     // Display fallback: when you have no own account avatar, show your site's photo.
@@ -204 +200 @@
 });
 
-// Unlink Google account. Only allowed if a password is set,
-// otherwise the user would lock themselves out (no login method left).
-router.post('/google/unlink', requireAuth, (req, res) => {
-  const row = db.prepare('SELECT password_hash, google_sub FROM users WHERE id = ?').get(req.session.user.id);
-  if (!row || !row.google_sub) {
-    return res.redirect('/account?error=' + encodeURIComponent('Er is geen Google-account gekoppeld'));
-  }
-  if (!row.password_hash || row.password_hash === '!google-oauth') {
-    return res.redirect('/account?error=' + encodeURIComponent('Stel eerst een wachtwoord in — anders kun je niet meer inloggen.'));
-  }
-  db.prepare('UPDATE users SET google_sub = NULL, updated_at = CURRENT_TIMESTAMP WHERE id = ?').run(req.session.user.id);
-  res.redirect('/account?success=' + encodeURIComponent('Google-account ontkoppeld'));
-});
-
 // ==================== UPLOAD AVATAR ====================
 router.post('/avatar', requireAuth, (req, res) => {

src/routes/admin-settings.js

@@ -25 +25 @@
 import { mailerStatus, sendMail } from '../config/mailer.js';
 import { entitlementStatus, premiumUnlocked } from '../services/PatreonService.js';
-import { googleConfigured, redirectUri, currentClientId, clientSecretSet } from '../config/google.js';
 import { toWebp } from '../services/ImageWebpService.js';
 
@@ -81 +80 @@
     defaultLang: getSetting('default_lang') || '',
     premium: entitlementStatus(),
-    google: {
-      configured: googleConfigured(),
-      redirectUri: redirectUri(),
-      clientId: currentClientId(),
-      secretSet: clientSecretSet(),
-    },
     smtp: mailerStatus(),
     footerNewsletter: getSetting('footer_newsletter') === '1',
@@ -155 +148 @@
 });
 
-// Google login on its own admin page (separate from the general settings).
-router.get('/google', requireGod, (req, res) => {
-  renderPage(req, res, 'pages/admin-google', {
-    pageTitle: 'Google-login',
-    bodyClass: 'on-admin',
-    google: {
-      configured: googleConfigured(),
-      redirectUri: redirectUri(),
-      clientId: currentClientId(),
-      secretSet: clientSecretSet(),
-    },
-    success: req.query.success || null,
-    error: req.query.error || null,
-  });
-});
-
-// Configure Google login (listeners) — Client ID + Secret in app_settings.
-// The redirect URI is derived from PUBLIC_BASE_URL (see config/google.js).
-router.post('/google', requireGod, (req, res) => {
-  if (req.body.clear === '1') {
-    setSetting('google_client_id', '');
-    setSetting('google_client_secret', '');
-    return res.redirect('/admin/settings?success=' + encodeURIComponent('Google-login losgekoppeld'));
-  }
-  setSetting('google_client_id', (req.body.google_client_id || '').toString().trim());
-  // Only overwrite the secret if a new value was entered (empty = leave as-is).
-  const secret = (req.body.google_client_secret || '').toString().trim();
-  if (secret) setSetting('google_client_secret', secret);
-  res.redirect('/admin/settings?success=' + encodeURIComponent('Google-login opgeslagen'));
-});
-
 // ── SMTP / e-mail-instellingen ────────────────────────────────────
 router.post('/smtp', requireGod, (req, res) => {

src/routes/auth.js

@@ -7 +7 @@
 import { loginLimiter, registerLimiter } from '../middleware/rate-limit.js';
 import { safeNext, requireAuth } from '../middleware/auth.js';
-import { googleConfigured, authorizeUrl, exchangeCode, fetchUserinfo } from '../config/google.js';
-import { premiumUnlocked } from '../services/PatreonService.js';
-
-// Fan login (listeners signing in with Google to comment) is a premium feature:
-// available when Google is configured AND the premium layer is unlocked
-// (premium off = open to all; on = Patreon required).
-function fanLoginReady() {
-  return googleConfigured() && premiumUnlocked();
-}
 import { mailerConfigured, sendMail } from '../config/mailer.js';
 import { resolveLang, t } from '../services/i18n.js';
@@ -47 +38 @@
 
 // ==================== LOGIN ====================
-// Public login page: for VISITORS only Google-login (listeners/fans).
-// The admin login (password) is intentionally NOT here — it lives hidden at
-// /auth/admin (see below), so the admin login is not visible where visitors land.
+// Single login = admin/owner password (no public/listener login anymore; social
+// interaction happens via the fediverse). /login and /auth/admin both show it.
 router.get('/login', (req, res) => {
   const next = safeNext(req.query.next) || '';
@@ -58 +48 @@
     bodyClass: 'on-special on-auth',
     error: req.query.error || null,
-    gerr: req.query.gerr || null, // foutcode voor een rijkere uitleg (bv. 'admin')
+    gerr: null,
     success: req.query.success || null,
     username: '',
-    adminLogin: false,
-    googleReady: fanLoginReady(),
+    adminLogin: true,
+    googleReady: false,
     next,
   });
@@ -265 +255 @@
 });
 
-// ==================== GOOGLE LOGIN (listeners/commenters) ====================
-// Per-instance, own Google client. ALWAYS grants role member — never admin.
-router.get('/google', (req, res) => {
-  if (!fanLoginReady()) {
-    return res.redirect('/auth/login?gerr=unavailable');
-  }
-  const state = crypto.randomBytes(16).toString('hex');
-  req.session.oauthState = state;
-  req.session.oauthNext = safeNext(req.query.next) || '';
-  delete req.session.oauthLink;
-  res.redirect(authorizeUrl(state));
-});
-
-// LINK Google to the current (logged-in) account — e.g. an admin who also wants
-// to log in with Google. Requires being already logged in (with password); the
-// link stores the google_sub on their own account.
-// Only googleConfigured() needed (no premium gate — this is not fan login).
-router.get('/google/link', requireAuth, (req, res) => {
-  if (!googleConfigured()) {
-    return res.redirect('/account?error=' + encodeURIComponent('Google-login is op deze site niet ingesteld.'));
-  }
-  const state = crypto.randomBytes(16).toString('hex');
-  req.session.oauthState = state;
-  req.session.oauthLink = true; // link mode instead of login mode
-  res.redirect(authorizeUrl(state));
-});
-
-function uniqueUsername(base) {
-  let u = String(base || 'luisteraar').toLowerCase().replace(/[^a-z0-9_-]/g, '').slice(0, 28);
-  if (u.length < 3) u = 'luisteraar';
-  let candidate = u, n = 1;
-  while (db.prepare('SELECT 1 FROM users WHERE username = ?').get(candidate)) {
-    candidate = (u.slice(0, 26) + n).slice(0, 32);
-    n++;
-  }
-  return candidate;
-}
-
-router.get('/google/callback', async (req, res) => {
-  const linking = !!req.session.oauthLink;
-  const failLogin = (code) => res.redirect('/auth/login?gerr=' + code);
-  const failLink = (msg) => res.redirect('/account?error=' + encodeURIComponent(msg));
-
-  try {
-    const { code, state } = req.query;
-    if (!code || !state || state !== req.session.oauthState) {
-      delete req.session.oauthState; delete req.session.oauthLink; delete req.session.oauthNext;
-      return linking ? failLink('Google-koppeling afgebroken of sessie verlopen. Probeer opnieuw.') : failLogin('session');
-    }
-
-    const tok = await exchangeCode(String(code));
-    const info = await fetchUserinfo(tok.access_token);
-    const email = (info.email || '').trim().toLowerCase();
-
-    // ── LINK MODE: attach Google to the current (logged-in) account ──
-    if (linking) {
-      delete req.session.oauthState; delete req.session.oauthLink;
-      if (!req.session.user) return failLogin('session');
-      if (!info.sub) return failLink('Google gaf geen account-id terug. Probeer opnieuw.');
-      if (info.email && info.email_verified === false) return failLink('Je Google-adres is niet geverifieerd.');
-      // This Google account must not already be linked to a DIFFERENT account.
-      const other = db.prepare('SELECT id FROM users WHERE google_sub = ? AND id != ?').get(info.sub, req.session.user.id);
-      if (other) return failLink('Dit Google-account is al aan een andere gebruiker gekoppeld.');
-      db.prepare(`
-        UPDATE users SET google_sub = ?, avatar_url = COALESCE(avatar_url, ?),
-          updated_at = CURRENT_TIMESTAMP WHERE id = ?
-      `).run(info.sub, info.picture || null, req.session.user.id);
-      return res.redirect('/account?success=' + encodeURIComponent('Google-account gekoppeld — je kunt nu ook met Google inloggen.'));
-    }
-
-    // ── LOGIN MODE (listeners/fans + linked admin) ──
-    if (!fanLoginReady()) return failLogin('unavailable');
-    const next = safeNext(req.session.oauthNext) || '';
-    delete req.session.oauthState; delete req.session.oauthNext;
-    if (!email || info.email_verified === false) return failLogin('email');
-
-    // Look FIRST by linked Google account (google_sub). A sub-match is explicit
-    // proof of the link → log in with their own role, EVEN IF the Google email
-    // differs from the account email (e.g. an admin who linked a different Gmail).
-    // Only then fall back to email lookup.
-    let user = info.sub ? db.prepare('SELECT * FROM users WHERE google_sub = ?').get(info.sub) : null;
-
-    if (user) {
-      // Linked account found → keep their own role. Update avatar if empty.
-      db.prepare(`
-        UPDATE users SET avatar_url = COALESCE(avatar_url, ?), updated_at = CURRENT_TIMESTAMP WHERE id = ?
-      `).run(info.picture || null, user.id);
-    } else {
-      user = db.prepare('SELECT * FROM users WHERE LOWER(email) = ?').get(email);
-      if (user && (user.role === 'god' || user.role === 'admin')) {
-        // Admin found by email but WITHOUT a linked sub → Google never grants admin.
-        // Must first link via Account → Sign in with Google.
-        return failLogin('admin');
-      } else if (user) {
-        // Existing listener: link google_sub/avatar if missing.
-        db.prepare(`
-          UPDATE users SET google_sub = COALESCE(google_sub, ?), avatar_url = COALESCE(avatar_url, ?),
-            updated_at = CURRENT_TIMESTAMP WHERE id = ?
-        `).run(info.sub || null, info.picture || null, user.id);
-      } else {
-        // New listener — always member.
-        const userId = uuid();
-        const username = uniqueUsername(info.name || email.split('@')[0]);
-        db.prepare(`
-          INSERT INTO users (id, username, email, password_hash, role, avatar_url, theme, palette, google_sub)
-          VALUES (?, ?, ?, '!google-oauth', 'member', ?, 'dark', 'sage', ?)
-        `).run(userId, username, info.email || email, info.picture || null, info.sub || null);
-        user = db.prepare('SELECT * FROM users WHERE id = ?').get(userId);
-      }
-    }
-
-    req.session.user = {
-      id: user.id, username: user.username, email: user.email, role: user.role,
-      avatar_url: user.avatar_url, palette: user.palette, theme: user.theme,
-      readonly: !!user.readonly,
-    };
-    res.redirect(next || '/');
-  } catch (e) {
-    console.error('[auth/google/callback]', e.message);
-    delete req.session.oauthState; delete req.session.oauthLink; delete req.session.oauthNext;
-    return linking
-      ? res.redirect('/account?error=' + encodeURIComponent('Google koppelen mislukt — probeer opnieuw.'))
-      : failLogin('failed');
-  }
-});
-
 // ==================== LOGOUT ====================
 router.get('/logout', (req, res) => { req.session.destroy(() => res.redirect('/')); });

src/views/pages/account.ejs

@@ -163 +163 @@
   </section>
 
-  <% if (typeof googleAvailable !== 'undefined' && googleAvailable) { %>
-  <section class="ax-card">
-    <div class="ax-card-title"><%= t('acct.google_login') %></div>
-    <% if (typeof googleLinked !== 'undefined' && googleLinked) { %>
-      <p class="ax-tagline" style="margin:0 0 1rem"><%= t('acct.google_linked') %></p>
-      <form action="/account/google/unlink" method="post">
-        <button type="submit" class="ax-btn"><%= t('acct.google_unlink') %></button>
-      </form>
-    <% } else { %>
-      <p class="ax-tagline" style="margin:0 0 1rem"><%= t('acct.google_link_hint') %></p>
-      <a href="/auth/google/link" class="ax-btn ax-btn-primary" data-full-load><%= t('acct.google_link') %></a>
-    <% } %>
-  </section>
-  <% } %>
   <% } else { %>
   <section class="ax-card">

src/views/pages/admin-settings.ejs

@@ -161 +161 @@
   </section>
   <% } %>
-
-  <%# Google login has its own admin page (compact link shown here). %>
-  <section class="set-card" style="margin-top:1rem">
-    <h2><%= t('aset.google_login') %></h2>
-    <p class="set-help"><%= t('aset.google_login_help') %>
-      <% if (google && google.configured) { %><strong><%= t('aset.status_set') %>&nbsp;✓</strong><% } else { %><%= t('aset.not_set_yet') %><% } %></p>
-    <div class="set-actions"><a href="/admin/settings/google" class="btn btn-primary"><%= t('aset.google_login_setup') %> &rarr;</a></div>
-  </section>
 
   <%# Newsletter signup in the footer (premium). %>

src/views/pages/admin.ejs

@@ -59 +59 @@
       <a href="/admin/shows" class="btn"><%= t('admin.b_agenda') %></a>
     <% } %>
-    <a href="/admin/settings/google" class="btn"><%= t('admin.b_google') %></a>
     <a href="/admin/updates" class="btn"><%= t('admin.b_updates') %></a>
     <a href="/admin/handleiding" class="btn"><%= t('admin.b_help') %></a>

src/views/pages/auth-login.ejs

@@ -48 +48 @@
       <p class="auth-link auth-link-muted"><a href="/auth/reset-request"><%= t('auth.forgot') %></a></p>
     </form>
-  <% } else if (googleReady) { %>
-    <%# Public login: Google only, for listeners/fans. %>
-    <p class="auth-sub"><%= t('auth.public_sub') %></p>
-    <a class="btn btn-google" href="/auth/google<%= (typeof next !== 'undefined' && next) ? '?next=' + encodeURIComponent(next) : '' %>">
-      <svg class="g-icon" width="18" height="18" viewBox="0 0 18 18" aria-hidden="true">
-        <path fill="#4285F4" d="M17.64 9.2c0-.64-.06-1.25-.16-1.84H9v3.48h4.84a4.14 4.14 0 0 1-1.8 2.72v2.26h2.92c1.7-1.57 2.68-3.88 2.68-6.62z"/>
-        <path fill="#34A853" d="M9 18c2.43 0 4.47-.8 5.96-2.18l-2.92-2.26c-.8.54-1.84.86-3.04.86-2.34 0-4.32-1.58-5.03-3.7H.96v2.33A9 9 0 0 0 9 18z"/>
-        <path fill="#FBBC05" d="M3.97 10.72a5.4 5.4 0 0 1 0-3.44V4.95H.96a9 9 0 0 0 0 8.1l3.01-2.33z"/>
-        <path fill="#EA4335" d="M9 3.58c1.32 0 2.5.45 3.44 1.35l2.58-2.58A9 9 0 0 0 .96 4.95l3.01 2.33C4.68 5.16 6.66 3.58 9 3.58z"/>
-      </svg>
-      <span><%= t('auth.google_btn') %></span>
-    </a>
-  <% } else { %>
-    <div class="alert"><%= t('auth.google_unavail') %></div>
-  <% } %>
-
-  <% if (!_admin) { %>
-    <%# Clickable box for the admin → navigates to the hidden password login. %>
-    <a class="auth-admin-box" href="/auth/admin<%= (typeof next !== 'undefined' && next) ? '?next=' + encodeURIComponent(next) : '' %>">
-      <span class="auth-admin-box-icon" aria-hidden="true">🔑</span>
-      <span class="auth-admin-box-text">
-        <strong><%= t('auth.admin_box_q') %></strong>
-        <small><%= t('auth.admin_box_sub') %></small>
-      </span>
-      <span class="auth-admin-box-arrow" aria-hidden="true">&rarr;</span>
-    </a>
   <% } %>
 </div>