Merge pull request #58 from techstartucalgary/linkedin-oauth

Add LinkedIn OAuth 2.0 authentication

Author: lnqminh3003

shatter-backend/package-lock.json

@@ -13,6 +13,7 @@
   "license": "ISC",
   "description": "",
   "dependencies": {
+    "axios": "^1.13.5",
     "bcryptjs": "^3.0.3",
     "cors": "^2.8.5",
     "dotenv": "^17.2.3",

shatter-backend/package.json

@@ -1,7 +1,12 @@
+import crypto from 'crypto';
+import jwt from 'jsonwebtoken';
 import { Request, Response } from 'express';
 import { User } from '../models/user_model';
 import { hashPassword, comparePassword } from '../utils/password_hash';
 import { generateToken } from '../utils/jwt_utils';
+import { getLinkedInAuthUrl, getLinkedInAccessToken, getLinkedInProfile } from '../utils/linkedin_oauth';
+
+const JWT_SECRET = process.env.JWT_SECRET || '';
 
 // Email validation regex
 const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/;
@@ -140,7 +145,12 @@ export const login = async (req: Request, res: Response) => {
 	    });
 	}
 
-	// 7 - verify password
+	// 7 - verify password (OAuth users won't have a passwordHash)
+	if (!user.passwordHash) {
+	    return res.status(401).json({
+		error: 'This account uses LinkedIn login. Please sign in with LinkedIn.',
+	    });
+	}
 	const isPasswordValid = await comparePassword(password, user.passwordHash);
 
 	if (!isPasswordValid) {
@@ -173,3 +183,117 @@ export const login = async (req: Request, res: Response) => {
     }
 };
 
+
+/**
+ * GET /api/auth/linkedin
+ * Initiates LinkedIn OAuth flow by redirecting to LinkedIn
+ */
+export const linkedinAuth = async (req: Request, res: Response) => {
+    try {
+	// Generate CSRF protection state token
+	const state = crypto.randomBytes(16).toString('hex');
+
+	// Encode state as JWT with 5-minute expiration (stateless validation)
+	const stateToken = jwt.sign({ state }, JWT_SECRET, { expiresIn: '5m' });
+
+	// Build LinkedIn authorization URL and redirect
+	const authUrl = getLinkedInAuthUrl(stateToken);
+	res.redirect(authUrl);
+    } catch (error) {
+	console.error('LinkedIn auth initiation error:', error);
+	res.status(500).json({ error: 'Failed to initiate LinkedIn authentication' });
+    }
+};
+
+
+/**
+ * GET /api/auth/linkedin/callback
+ * LinkedIn redirects here after user authorization
+ */
+export const linkedinCallback = async (req: Request, res: Response) => {
+    try {
+	const { code, state, error: oauthError } = req.query as {
+	    code?: string;
+	    state?: string;
+	    error?: string;
+	};
+
+	const frontendUrl = process.env.FRONTEND_URL || 'http://localhost:19006';
+
+	// Handle user denial
+	if (oauthError === 'user_cancelled_authorize') {
+	    return res.redirect(`${frontendUrl}/auth/error?message=Authorization cancelled`);
+	}
+
+	// Validate required parameters
+	if (!code || !state) {
+	    return res.status(400).json({ error: 'Missing code or state parameter' });
+	}
+
+	// Verify state token (CSRF protection)
+	try {
+	    jwt.verify(state, JWT_SECRET);
+	} catch {
+	    return res.status(401).json({ error: 'Invalid state parameter' });
+	}
+
+	// Exchange code for access token
+	const accessToken = await getLinkedInAccessToken(code);
+
+	// Fetch user profile from LinkedIn
+	const linkedinProfile = await getLinkedInProfile(accessToken);
+
+	// Validate email is provided
+	if (!linkedinProfile.email) {
+	    return res.status(400).json({
+		error: 'Email address required',
+		suggestion: 'Please make your email visible to third-party apps in LinkedIn settings',
+	    });
+	}
+
+	// Find existing user by LinkedIn ID
+	let user = await User.findOne({ linkedinId: linkedinProfile.sub });
+
+	if (!user) {
+	    // Check if email already exists with password auth (email conflict)
+	    const existingEmailUser = await User.findOne({
+		email: linkedinProfile.email.toLowerCase().trim(),
+	    });
+
+	    if (existingEmailUser) {
+		return res.redirect(
+		    `${frontendUrl}/auth/error?message=Email already registered with password&suggestion=Please login with your password`
+		);
+	    }
+
+	    // Create new user from LinkedIn data
+	    user = await User.create({
+		name: linkedinProfile.name,
+		email: linkedinProfile.email.toLowerCase().trim(),
+		linkedinId: linkedinProfile.sub,
+		profilePhoto: linkedinProfile.picture,
+		authProvider: 'linkedin',
+		lastLogin: new Date(),
+	    });
+	} else {
+	    // Update existing user's last login
+	    user.lastLogin = new Date();
+	    await user.save();
+	}
+
+	// Generate JWT token and redirect to frontend
+	const token = generateToken(user._id.toString());
+	return res.redirect(`${frontendUrl}/auth/callback?token=${token}&userId=${user._id}`);
+
+    } catch (error: any) {
+	console.error('LinkedIn callback error:', error);
+
+	const frontendUrl = process.env.FRONTEND_URL || 'http://localhost:19006';
+	if (error.message?.includes('LinkedIn')) {
+	    return res.redirect(`${frontendUrl}/auth/error?message=LinkedIn authentication failed`);
+	}
+
+	res.status(500).json({ error: 'Authentication failed. Please try again.' });
+    }
+};
+

shatter-backend/src/controllers/auth_controller.ts

@@ -9,7 +9,11 @@ import { Schema, model } from "mongoose";
 export interface IUser {
   name: string;
   email: string;
-  passwordHash: string;
+  passwordHash?: string;
+  linkedinId?: string;
+  linkedinUrl?: string;
+  profilePhoto?: string;
+  authProvider: 'local' | 'linkedin';
   lastLogin?: Date;
   passwordChangedAt?: Date;
   createdAt?: Date;
@@ -42,9 +46,28 @@ const UserSchema = new Schema<IUser>(
     },
     passwordHash: {
       type: String,
-      required: true,
+      required: false,
       select: false, // Don't return in queries by default
     },
+    linkedinId: {
+      type: String,
+      unique: true,
+      sparse: true, // allows null but enforces uniqueness when set
+    },
+    linkedinUrl: {
+      type: String,
+      unique: true,
+      sparse: true,
+    },
+    profilePhoto: {
+      type: String,
+    },
+    authProvider: {
+      type: String,
+      enum: ['local', 'linkedin'],
+      default: 'local',
+      required: true,
+    },
     lastLogin: {
       type: Date,
       default: null,
@@ -68,7 +91,15 @@ const UserSchema = new Schema<IUser>(
   }
 );
 
-// Add middleware to auto-update passwordChangedAt
+// Ensure local auth users have a password
+UserSchema.pre("save", function (next) {
+  if (this.authProvider === "local" && !this.passwordHash) {
+    return next(new Error("Password required for local authentication"));
+  }
+  next();
+});
+
+// Auto-update passwordChangedAt
 UserSchema.pre("save", function (next) {
   if (this.isModified("passwordHash") && !this.isNew) {
     this.passwordChangedAt = new Date();

shatter-backend/src/models/user_model.ts

@@ -1,5 +1,5 @@
 import { Router } from 'express';
-import { signup, login } from '../controllers/auth_controller';
+import { signup, login, linkedinAuth, linkedinCallback } from '../controllers/auth_controller';
 
 const router = Router();
 
@@ -9,4 +9,8 @@ router.post('/signup', signup);
 // POST /api/auth/login - authenticate user
 router.post('/login', login);
 
+// LinkedIn OAuth routes
+router.get('/linkedin', linkedinAuth);
+router.get('/linkedin/callback', linkedinCallback);
+
 export default router;

shatter-backend/src/routes/auth_routes.ts

@@ -7,6 +7,21 @@ const MONGODB_URI = process.env.MONGO_URI;
 
 async function start() {
   try {
+    // Validate required environment variables
+    const requiredEnvVars = [
+      'MONGO_URI',
+      'JWT_SECRET',
+      'LINKEDIN_CLIENT_ID',
+      'LINKEDIN_CLIENT_SECRET',
+      'LINKEDIN_CALLBACK_URL',
+    ];
+
+    for (const envVar of requiredEnvVars) {
+      if (!process.env[envVar]) {
+        throw new Error(`Missing required environment variable: ${envVar}`);
+      }
+    }
+
     if (!MONGODB_URI) {
       throw new Error("MONGO_URI is not set");
     }

shatter-backend/src/server.ts

@@ -0,0 +1,78 @@
+import axios from 'axios';
+
+const LINKEDIN_AUTH_URL = 'https://www.linkedin.com/oauth/v2/authorization';
+const LINKEDIN_TOKEN_URL = 'https://www.linkedin.com/oauth/v2/accessToken';
+const LINKEDIN_PROFILE_URL = 'https://api.linkedin.com/v2/userinfo';
+
+export interface LinkedInProfile {
+  sub: string;          // LinkedIn user ID
+  name: string;         // Full name
+  email: string;        // Email address
+  picture?: string;     // Profile picture URL
+}
+
+/**
+ * Generate LinkedIn authorization URL
+ */
+export const getLinkedInAuthUrl = (state: string): string => {
+  const params = new URLSearchParams({
+    response_type: 'code',
+    client_id: process.env.LINKEDIN_CLIENT_ID!,
+    redirect_uri: process.env.LINKEDIN_CALLBACK_URL!,
+    state: state,
+    scope: 'openid profile email',
+  });
+
+  return `${LINKEDIN_AUTH_URL}?${params.toString()}`;
+};
+
+/**
+ * Exchange authorization code for access token
+ */
+export const getLinkedInAccessToken = async (code: string): Promise<string> => {
+  try {
+    const response = await axios.post(
+      LINKEDIN_TOKEN_URL,
+      new URLSearchParams({
+        grant_type: 'authorization_code',
+        code: code,
+        client_id: process.env.LINKEDIN_CLIENT_ID!,
+        client_secret: process.env.LINKEDIN_CLIENT_SECRET!,
+        redirect_uri: process.env.LINKEDIN_CALLBACK_URL!,
+      }),
+      {
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      }
+    );
+
+    return response.data.access_token;
+  } catch (error: any) {
+    console.error('LinkedIn token exchange error:', error.response?.data || error.message);
+    throw new Error('Failed to obtain LinkedIn access token');
+  }
+};
+
+/**
+ * Fetch user profile from LinkedIn using access token
+ */
+export const getLinkedInProfile = async (accessToken: string): Promise<LinkedInProfile> => {
+  try {
+    const response = await axios.get(LINKEDIN_PROFILE_URL, {
+      headers: { Authorization: `Bearer ${accessToken}` },
+    });
+
+    if (!response.data || !response.data.sub) {
+      throw new Error('Invalid LinkedIn API response format');
+    }
+
+    return {
+      sub: response.data.sub,
+      name: response.data.name || 'LinkedIn User',
+      email: response.data.email || '',
+      picture: response.data.picture,
+    };
+  } catch (error: any) {
+    console.error('LinkedIn profile fetch error:', error.response?.data || error.message);
+    throw new Error('Failed to fetch LinkedIn profile');
+  }
+};