Index: c/config/google.js =================================================================== --- src/config/google.js (revision 5b476195e7b9aa4c0435ef952a907772473898af) +++ (revision ) @@ -1,72 +1,0 @@ -// Google OAuth2 for LISTENERS (commenting). Per-instance: each self-hoster sets -// their OWN Google client. This way every site is tied to its own Google Cloud -// project — no central dependency, no shared liability. -// -// Config source (in this order): app_settings (set via Admin → Settings), -// otherwise env vars. Not configured → no "Login with Google" button; the rest -// of the site keeps working. Google login NEVER grants admin rights. -// -// The redirect URI is derived from PUBLIC_BASE_URL (/auth/google/callback), -// or explicitly via GOOGLE_REDIRECT_URI. That exact URL must be listed in Google Cloud. - -import { getSetting } from '../services/SettingsService.js'; - -const AUTH_URL = 'https://accounts.google.com/o/oauth2/v2/auth'; -const TOKEN_URL = 'https://oauth2.googleapis.com/token'; -const USERINFO_URL = 'https://openidconnect.googleapis.com/v1/userinfo'; - -// Read dynamically (UI changes take effect without a restart). app_settings wins, env = fallback. -function clientId() { - return getSetting('google_client_id', '') || process.env.GOOGLE_CLIENT_ID || ''; -} -function clientSecret() { - return getSetting('google_client_secret', '') || process.env.GOOGLE_CLIENT_SECRET || ''; -} -export function redirectUri() { - if (process.env.GOOGLE_REDIRECT_URI) return process.env.GOOGLE_REDIRECT_URI; - const base = (process.env.PUBLIC_BASE_URL || '').replace(/\/+$/, ''); - return base ? `${base}/auth/google/callback` : ''; -} - -export function currentClientId() { return clientId(); } // not secret, used for the settings form -export function clientSecretSet() { return !!clientSecret(); } -export function googleConfigured() { - return !!(clientId() && clientSecret() && redirectUri()); -} - -export function authorizeUrl(state) { - const p = new URLSearchParams({ - client_id: clientId(), - redirect_uri: redirectUri(), - response_type: 'code', - scope: 'openid email profile', - state, - access_type: 'online', - prompt: 'select_account', - }); - return `${AUTH_URL}?${p.toString()}`; -} - -export async function exchangeCode(code) { - const body = new URLSearchParams({ - code, - client_id: clientId(), - client_secret: clientSecret(), - redirect_uri: redirectUri(), - grant_type: 'authorization_code', - }); - const r = await fetch(TOKEN_URL, { - method: 'POST', - headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, - body, - }); - if (!r.ok) throw new Error(`Google token exchange failed: ${r.status}`); - return r.json(); // { access_token, id_token, ... } -} - -// Returns { sub, email, email_verified, name, picture }. -export async function fetchUserinfo(accessToken) { - const r = await fetch(USERINFO_URL, { headers: { Authorization: `Bearer ${accessToken}` } }); - if (!r.ok) throw new Error(`Google userinfo failed: ${r.status}`); - return r.json(); -} Index: src/routes/account.js =================================================================== --- src/routes/account.js (revision 5b476195e7b9aa4c0435ef952a907772473898af) +++ src/routes/account.js (revision 075185aec7ff8542aa40c1e84a7a70cb05f7599f) @@ -24,5 +24,4 @@ import { renderPage } from '../middleware/render.js'; import { requireAuth } from '../middleware/auth.js'; -import { googleConfigured } from '../config/google.js'; import { toWebp } from '../services/ImageWebpService.js'; import { SUPPORTED } from '../services/i18n.js'; @@ -65,5 +64,4 @@ `).get(req.session.user.id); const hasPassword = !!(account && account.password_hash && account.password_hash !== '!google-oauth'); - const googleLinked = !!(account && account.google_sub); if (account) { delete account.password_hash; delete account.google_sub; } // don't leak to the view @@ -74,6 +72,4 @@ account, hasPassword, - googleLinked, - googleAvailable: googleConfigured(), editableSite, // Display fallback: when you have no own account avatar, show your site's photo. @@ -204,18 +200,4 @@ }); -// Unlink Google account. Only allowed if a password is set, -// otherwise the user would lock themselves out (no login method left). -router.post('/google/unlink', requireAuth, (req, res) => { - const row = db.prepare('SELECT password_hash, google_sub FROM users WHERE id = ?').get(req.session.user.id); - if (!row || !row.google_sub) { - return res.redirect('/account?error=' + encodeURIComponent('Er is geen Google-account gekoppeld')); - } - if (!row.password_hash || row.password_hash === '!google-oauth') { - return res.redirect('/account?error=' + encodeURIComponent('Stel eerst een wachtwoord in — anders kun je niet meer inloggen.')); - } - db.prepare('UPDATE users SET google_sub = NULL, updated_at = CURRENT_TIMESTAMP WHERE id = ?').run(req.session.user.id); - res.redirect('/account?success=' + encodeURIComponent('Google-account ontkoppeld')); -}); - // ==================== UPLOAD AVATAR ==================== router.post('/avatar', requireAuth, (req, res) => { Index: src/routes/admin-settings.js =================================================================== --- src/routes/admin-settings.js (revision 5b476195e7b9aa4c0435ef952a907772473898af) +++ src/routes/admin-settings.js (revision 075185aec7ff8542aa40c1e84a7a70cb05f7599f) @@ -25,5 +25,4 @@ import { mailerStatus, sendMail } from '../config/mailer.js'; import { entitlementStatus, premiumUnlocked } from '../services/PatreonService.js'; -import { googleConfigured, redirectUri, currentClientId, clientSecretSet } from '../config/google.js'; import { toWebp } from '../services/ImageWebpService.js'; @@ -81,10 +80,4 @@ defaultLang: getSetting('default_lang') || '', premium: entitlementStatus(), - google: { - configured: googleConfigured(), - redirectUri: redirectUri(), - clientId: currentClientId(), - secretSet: clientSecretSet(), - }, smtp: mailerStatus(), footerNewsletter: getSetting('footer_newsletter') === '1', @@ -155,35 +148,4 @@ }); -// Google login on its own admin page (separate from the general settings). -router.get('/google', requireGod, (req, res) => { - renderPage(req, res, 'pages/admin-google', { - pageTitle: 'Google-login', - bodyClass: 'on-admin', - google: { - configured: googleConfigured(), - redirectUri: redirectUri(), - clientId: currentClientId(), - secretSet: clientSecretSet(), - }, - success: req.query.success || null, - error: req.query.error || null, - }); -}); - -// Configure Google login (listeners) — Client ID + Secret in app_settings. -// The redirect URI is derived from PUBLIC_BASE_URL (see config/google.js). -router.post('/google', requireGod, (req, res) => { - if (req.body.clear === '1') { - setSetting('google_client_id', ''); - setSetting('google_client_secret', ''); - return res.redirect('/admin/settings?success=' + encodeURIComponent('Google-login losgekoppeld')); - } - setSetting('google_client_id', (req.body.google_client_id || '').toString().trim()); - // Only overwrite the secret if a new value was entered (empty = leave as-is). - const secret = (req.body.google_client_secret || '').toString().trim(); - if (secret) setSetting('google_client_secret', secret); - res.redirect('/admin/settings?success=' + encodeURIComponent('Google-login opgeslagen')); -}); - // ── SMTP / e-mail-instellingen ──────────────────────────────────── router.post('/smtp', requireGod, (req, res) => { Index: src/routes/auth.js =================================================================== --- src/routes/auth.js (revision 5b476195e7b9aa4c0435ef952a907772473898af) +++ src/routes/auth.js (revision 075185aec7ff8542aa40c1e84a7a70cb05f7599f) @@ -7,13 +7,4 @@ import { loginLimiter, registerLimiter } from '../middleware/rate-limit.js'; import { safeNext, requireAuth } from '../middleware/auth.js'; -import { googleConfigured, authorizeUrl, exchangeCode, fetchUserinfo } from '../config/google.js'; -import { premiumUnlocked } from '../services/PatreonService.js'; - -// Fan login (listeners signing in with Google to comment) is a premium feature: -// available when Google is configured AND the premium layer is unlocked -// (premium off = open to all; on = Patreon required). -function fanLoginReady() { - return googleConfigured() && premiumUnlocked(); -} import { mailerConfigured, sendMail } from '../config/mailer.js'; import { resolveLang, t } from '../services/i18n.js'; @@ -47,7 +38,6 @@ // ==================== LOGIN ==================== -// Public login page: for VISITORS only Google-login (listeners/fans). -// The admin login (password) is intentionally NOT here — it lives hidden at -// /auth/admin (see below), so the admin login is not visible where visitors land. +// Single login = admin/owner password (no public/listener login anymore; social +// interaction happens via the fediverse). /login and /auth/admin both show it. router.get('/login', (req, res) => { const next = safeNext(req.query.next) || ''; @@ -58,9 +48,9 @@ bodyClass: 'on-special on-auth', error: req.query.error || null, - gerr: req.query.gerr || null, // foutcode voor een rijkere uitleg (bv. 'admin') + gerr: null, success: req.query.success || null, username: '', - adminLogin: false, - googleReady: fanLoginReady(), + adminLogin: true, + googleReady: false, next, }); @@ -265,130 +255,4 @@ }); -// ==================== GOOGLE LOGIN (listeners/commenters) ==================== -// Per-instance, own Google client. ALWAYS grants role member — never admin. -router.get('/google', (req, res) => { - if (!fanLoginReady()) { - return res.redirect('/auth/login?gerr=unavailable'); - } - const state = crypto.randomBytes(16).toString('hex'); - req.session.oauthState = state; - req.session.oauthNext = safeNext(req.query.next) || ''; - delete req.session.oauthLink; - res.redirect(authorizeUrl(state)); -}); - -// LINK Google to the current (logged-in) account — e.g. an admin who also wants -// to log in with Google. Requires being already logged in (with password); the -// link stores the google_sub on their own account. -// Only googleConfigured() needed (no premium gate — this is not fan login). -router.get('/google/link', requireAuth, (req, res) => { - if (!googleConfigured()) { - return res.redirect('/account?error=' + encodeURIComponent('Google-login is op deze site niet ingesteld.')); - } - const state = crypto.randomBytes(16).toString('hex'); - req.session.oauthState = state; - req.session.oauthLink = true; // link mode instead of login mode - res.redirect(authorizeUrl(state)); -}); - -function uniqueUsername(base) { - let u = String(base || 'luisteraar').toLowerCase().replace(/[^a-z0-9_-]/g, '').slice(0, 28); - if (u.length < 3) u = 'luisteraar'; - let candidate = u, n = 1; - while (db.prepare('SELECT 1 FROM users WHERE username = ?').get(candidate)) { - candidate = (u.slice(0, 26) + n).slice(0, 32); - n++; - } - return candidate; -} - -router.get('/google/callback', async (req, res) => { - const linking = !!req.session.oauthLink; - const failLogin = (code) => res.redirect('/auth/login?gerr=' + code); - const failLink = (msg) => res.redirect('/account?error=' + encodeURIComponent(msg)); - - try { - const { code, state } = req.query; - if (!code || !state || state !== req.session.oauthState) { - delete req.session.oauthState; delete req.session.oauthLink; delete req.session.oauthNext; - return linking ? failLink('Google-koppeling afgebroken of sessie verlopen. Probeer opnieuw.') : failLogin('session'); - } - - const tok = await exchangeCode(String(code)); - const info = await fetchUserinfo(tok.access_token); - const email = (info.email || '').trim().toLowerCase(); - - // ── LINK MODE: attach Google to the current (logged-in) account ── - if (linking) { - delete req.session.oauthState; delete req.session.oauthLink; - if (!req.session.user) return failLogin('session'); - if (!info.sub) return failLink('Google gaf geen account-id terug. Probeer opnieuw.'); - if (info.email && info.email_verified === false) return failLink('Je Google-adres is niet geverifieerd.'); - // This Google account must not already be linked to a DIFFERENT account. - const other = db.prepare('SELECT id FROM users WHERE google_sub = ? AND id != ?').get(info.sub, req.session.user.id); - if (other) return failLink('Dit Google-account is al aan een andere gebruiker gekoppeld.'); - db.prepare(` - UPDATE users SET google_sub = ?, avatar_url = COALESCE(avatar_url, ?), - updated_at = CURRENT_TIMESTAMP WHERE id = ? - `).run(info.sub, info.picture || null, req.session.user.id); - return res.redirect('/account?success=' + encodeURIComponent('Google-account gekoppeld — je kunt nu ook met Google inloggen.')); - } - - // ── LOGIN MODE (listeners/fans + linked admin) ── - if (!fanLoginReady()) return failLogin('unavailable'); - const next = safeNext(req.session.oauthNext) || ''; - delete req.session.oauthState; delete req.session.oauthNext; - if (!email || info.email_verified === false) return failLogin('email'); - - // Look FIRST by linked Google account (google_sub). A sub-match is explicit - // proof of the link → log in with their own role, EVEN IF the Google email - // differs from the account email (e.g. an admin who linked a different Gmail). - // Only then fall back to email lookup. - let user = info.sub ? db.prepare('SELECT * FROM users WHERE google_sub = ?').get(info.sub) : null; - - if (user) { - // Linked account found → keep their own role. Update avatar if empty. - db.prepare(` - UPDATE users SET avatar_url = COALESCE(avatar_url, ?), updated_at = CURRENT_TIMESTAMP WHERE id = ? - `).run(info.picture || null, user.id); - } else { - user = db.prepare('SELECT * FROM users WHERE LOWER(email) = ?').get(email); - if (user && (user.role === 'god' || user.role === 'admin')) { - // Admin found by email but WITHOUT a linked sub → Google never grants admin. - // Must first link via Account → Sign in with Google. - return failLogin('admin'); - } else if (user) { - // Existing listener: link google_sub/avatar if missing. - db.prepare(` - UPDATE users SET google_sub = COALESCE(google_sub, ?), avatar_url = COALESCE(avatar_url, ?), - updated_at = CURRENT_TIMESTAMP WHERE id = ? - `).run(info.sub || null, info.picture || null, user.id); - } else { - // New listener — always member. - const userId = uuid(); - const username = uniqueUsername(info.name || email.split('@')[0]); - db.prepare(` - INSERT INTO users (id, username, email, password_hash, role, avatar_url, theme, palette, google_sub) - VALUES (?, ?, ?, '!google-oauth', 'member', ?, 'dark', 'sage', ?) - `).run(userId, username, info.email || email, info.picture || null, info.sub || null); - user = db.prepare('SELECT * FROM users WHERE id = ?').get(userId); - } - } - - req.session.user = { - id: user.id, username: user.username, email: user.email, role: user.role, - avatar_url: user.avatar_url, palette: user.palette, theme: user.theme, - readonly: !!user.readonly, - }; - res.redirect(next || '/'); - } catch (e) { - console.error('[auth/google/callback]', e.message); - delete req.session.oauthState; delete req.session.oauthLink; delete req.session.oauthNext; - return linking - ? res.redirect('/account?error=' + encodeURIComponent('Google koppelen mislukt — probeer opnieuw.')) - : failLogin('failed'); - } -}); - // ==================== LOGOUT ==================== router.get('/logout', (req, res) => { req.session.destroy(() => res.redirect('/')); }); Index: src/views/pages/account.ejs =================================================================== --- src/views/pages/account.ejs (revision 5b476195e7b9aa4c0435ef952a907772473898af) +++ src/views/pages/account.ejs (revision 075185aec7ff8542aa40c1e84a7a70cb05f7599f) @@ -163,18 +163,4 @@ - <% if (typeof googleAvailable !== 'undefined' && googleAvailable) { %> -
-
<%= t('acct.google_login') %>
- <% if (typeof googleLinked !== 'undefined' && googleLinked) { %> -

<%= t('acct.google_linked') %>

-
- -
- <% } else { %> -

<%= t('acct.google_link_hint') %>

- <%= t('acct.google_link') %> - <% } %> -
- <% } %> <% } else { %>
Index: c/views/pages/admin-google.ejs =================================================================== --- src/views/pages/admin-google.ejs (revision 5b476195e7b9aa4c0435ef952a907772473898af) +++ (revision ) @@ -1,131 +1,0 @@ -
-

<%= t('agoog.title') %>

-

← <%= t('agoog.back') %>

- - <% if (success) { %>
<%= success %>
<% } %> - <% if (typeof error !== 'undefined' && error) { %>
<%= error %>
<% } %> - -
-

<%= t('agoog.card_title') %>

-

<%- t('agoog.intro') %> - <% if (google && google.configured) { %><%= t('agoog.status_set') %><% } else { %><%= t('agoog.status_unset') %><% } %>

- -
    -
  1. - 1 -
    <%- t('agoog.g1') %> Google Cloud Console ↗
    -
    2. -
  2. - 2 -
    <%- t('agoog.g2') %>
    -
    3. -
  3. - 3 -
    <%- t('agoog.g3') %>
    -
    4. -
  4. - 4 -
    - <%- t('agoog.g4') %> - <% if (google && google.redirectUri) { %> -
    - <%= google.redirectUri %> - -
    -

    <%- t('agoog.warn_short') %>

    - <% } else { %> -

    <%- t('agoog.need_baseurl') %>

    - <% } %> -
    -
    5. -
  5. - 5 -
    <%- t('agoog.g5') %>
    -
    6. -
-

<%- t('agoog.no_api_note') %>

- -
- - -
- - <% if (google && (google.clientId || google.secretSet)) { %> - - <% } %> -
-
- <% if (typeof premiumEnabled !== 'undefined' && premiumEnabled && !isPremium) { %> -

<%= t('agoog.premium_locked') %>

- <% } %> -
-
- - - Index: src/views/pages/admin-settings.ejs =================================================================== --- src/views/pages/admin-settings.ejs (revision 5b476195e7b9aa4c0435ef952a907772473898af) +++ src/views/pages/admin-settings.ejs (revision 075185aec7ff8542aa40c1e84a7a70cb05f7599f) @@ -161,12 +161,4 @@
<% } %> - - <%# Google login has its own admin page (compact link shown here). %> -
-

<%= t('aset.google_login') %>

-

<%= t('aset.google_login_help') %> - <% if (google && google.configured) { %><%= t('aset.status_set') %> ✓<% } else { %><%= t('aset.not_set_yet') %><% } %>

-
<%= t('aset.google_login_setup') %> →
-
<%# Newsletter signup in the footer (premium). %> Index: src/views/pages/admin.ejs =================================================================== --- src/views/pages/admin.ejs (revision 5b476195e7b9aa4c0435ef952a907772473898af) +++ src/views/pages/admin.ejs (revision 075185aec7ff8542aa40c1e84a7a70cb05f7599f) @@ -59,5 +59,4 @@ <%= t('admin.b_agenda') %> <% } %> - <%= t('admin.b_google') %> <%= t('admin.b_updates') %> <%= t('admin.b_help') %> Index: src/views/pages/auth-login.ejs =================================================================== --- src/views/pages/auth-login.ejs (revision 5b476195e7b9aa4c0435ef952a907772473898af) +++ src/views/pages/auth-login.ejs (revision 075185aec7ff8542aa40c1e84a7a70cb05f7599f) @@ -48,30 +48,4 @@

<%= t('auth.forgot') %>

- <% } else if (googleReady) { %> - <%# Public login: Google only, for listeners/fans. %> -

<%= t('auth.public_sub') %>

- - - <%= t('auth.google_btn') %> - - <% } else { %> -
<%= t('auth.google_unavail') %>
- <% } %> - - <% if (!_admin) { %> - <%# Clickable box for the admin → navigates to the hidden password login. %> - - - - <%= t('auth.admin_box_q') %> - <%= t('auth.admin_box_sub') %> - - - <% } %>