Building a GitHub OAuth application​

defmodule GitHubOAuth.MixProject do
  # ...

  defp deps do
    [
      {:phoenix, "~> 1.6.9"},
      {:phoenix_ecto, "~> 4.4"},
      {:esbuild, "~> 0.4", runtime: Mix.env() == :dev},
      {:telemetry_metrics, "~> 0.6"},
      {:telemetry_poller, "~> 1.0"},
      {:jason, "~> 1.2"},
      {:plug_cowboy, "~> 2.5"},
      {:edgedb, "~> 0.3.0"},
      {:edgedb_ecto, git: "https://github.com/nsidnev/edgedb_ecto"},
      {:mint, "~> 1.0"}  # we need mint to write the GitHub client
    ]
  end

  # ...
end

defmodule GitHubOAuth.EdgeDB do
  use EdgeDBEcto,
    name: __MODULE__,
    queries: true,
    otp_app: :github_oauth

  def child_spec(_opts \\ []) do
    %{
      id: __MODULE__,
      start: {EdgeDB, :start_link, [[name: __MODULE__]]}
    }
  end
end

defmodule GitHubOAuth.Application do
  # ...

  @impl true
  def start(_type, _args) do
    children = [
      # Start the EdgeDB driver
      GitHubOAuth.EdgeDB,
      # Start the Telemetry supervisor
      GitHubOAuthWeb.Telemetry,
      # Start the PubSub system
      {Phoenix.PubSub, name: GitHubOAuth.PubSub},
      # Start the Endpoint (http/https)
      GitHubOAuthWeb.Endpoint
      # Start a worker by calling: GitHubOAuth.Worker.start_link(arg)
      # {GitHubOAuth.Worker, arg}
    ]

    # ...
  end

  # ...
end

defmodule GitHubOAuth.Accounts.User do
  use Ecto.Schema
  use EdgeDBEcto.Mapper

  alias GitHubOAuth.Accounts.Identity

  @primary_key {:id, :binary_id, autogenerate: false}

  schema "default::User" do
    field :email, :string
    field :name, :string
    field :username, :string
    field :avatar_url, :string
    field :external_homepage_url, :string

    has_many :identities, Identity

    timestamps()
  end
end

defmodule GitHubOAuth.Accounts.Identity do
  use Ecto.Schema
  use EdgeDBEcto.Mapper

  alias GitHubOAuth.Accounts.User

  @primary_key {:id, :binary_id, autogenerate: false}

  schema "default::Identity" do
    field :provider, :string
    field :provider_token, :string
    field :provider_email, :string
    field :provider_login, :string
    field :provider_name, :string, virtual: true
    field :provider_id, :string
    field :provider_meta, :map

    belongs_to :user, User

    timestamps()
  end
end

defmodule GitHubOAuth.Accounts.Identity do
  # ...
  import Ecto.Changeset

  alias GitHubOAuth.Accounts.{Identity, User}

  @github "github"

  # ...

  def github_registration_changeset(info, primary_email, emails, token) do
    params = %{
      "provider_token" => token,
      "provider_id" => to_string(info["id"]),
      "provider_login" => info["login"],
      "provider_name" => info["name"] || info["login"],
      "provider_email" => primary_email
    }

    %Identity{}
    |> cast(params, [
      :provider_token,
      :provider_email,
      :provider_login,
      :provider_name,
      :provider_id
    ])
    |> put_change(:provider, @github)
    |> put_change(:provider_meta, %{"user" => info, "emails" => emails})
    |> validate_required([
      :provider_token,
      :provider_email,
      :provider_name,
      :provider_id
    ])
  end
end

defmodule GitHubOAuth.Accounts.User do
  # ...

  import Ecto.Changeset

  alias GitHubOAuth.Accounts.{User, Identity}

  # ...

  def github_registration_changeset(info, primary_email, emails, token) do
    %{
      "login" => username,
      "avatar_url" => avatar_url,
      "html_url" => external_homepage_url
    } = info

    identity_changeset =
      Identity.github_registration_changeset(
        info,
        primary_email,
        emails,
        token
      )

    if identity_changeset.valid? do
      params = %{
        "username" => username,
        "email" => primary_email,
        "name" => get_change(identity_changeset, :provider_name),
        "avatar_url" => avatar_url,
        "external_homepage_url" => external_homepage_url
      }

      %User{}
      |> cast(params, [
        :email,
        :name,
        :username,
        :avatar_url,
        :external_homepage_url
      ])
      |> validate_required([:email, :name, :username])
      |> validate_username()
      |> validate_email()
      |> put_assoc(:identities, [identity_changeset])
    else
      %User{}
      |> change()
      |> Map.put(:valid?, false)
      |> put_assoc(:identities, [identity_changeset])
    end
  end

  defp validate_email(changeset) do
    changeset
    |> validate_required([:email])
    |> validate_format(
      :email,
      ~r/^[^\s]+@[^\s]+$/,
      message: "must have the @ sign and no spaces"
    )
    |> validate_length(:email, max: 160)
  end

  defp validate_username(changeset) do
    validate_format(changeset, :username, ~r/^[a-zA-Z0-9_-]{2,32}$/)
  end
end

defmodule GitHubOAuth.Accounts do
  import Ecto.Changeset

  alias GitHubOAuth.Accounts.{User, Identity}

  def get_user(id) do
    GitHubOAuth.EdgeDB.Accounts.get_user_by_id(id: id)
  end

  def register_github_user(primary_email, info, emails, token) do
    if user = get_user_by_provider(:github, primary_email) do
      update_github_token(user, token)
    else
      info
      |> User.github_registration_changeset(primary_email, emails, token)
      |> EdgeDBEcto.insert(
        &GitHubOAuth.EdgeDB.Accounts.register_github_user/1,
        nested: true
      )
    end
  end

  def get_user_by_provider(provider, email) when provider in [:github] do
    GitHubOAuth.EdgeDB.Accounts.get_user_by_provider(
      provider: to_string(provider),
      email: String.downcase(email)
    )
  end

  defp update_github_token(%User{} = user, new_token) do
    identity =
      GitHubOAuth.EdgeDB.Accounts.get_identity_for_user(
        user_id: user.id,
        provider: "github"
      )

    {:ok, _} =
      identity
      |> change()
      |> put_change(:provider_token, new_token)
      |> EdgeDBEcto.update(
        &GitHubOAuth.EdgeDB.Accounts.update_identity_token/1
      )

    identity = %Identity{identity | provider_token: new_token}
    {:ok, %User{user | identities: [identity]}}
  end
end

# ...

config :github_oauth, :github,
  client_id: System.fetch_env!("GITHUB_CLIENT_ID"),
  client_secret: System.fetch_env!("GITHUB_CLIENT_SECRET")

# ...

defmodule GitHubOAuthWeb.UserController do
  use GitHubOAuthWeb, :controller

  alias GitHubOAuth.Accounts

  plug :fetch_current_user

  def index(conn, _params) do
    if conn.assigns.current_user do
      json(conn, %{name: conn.assigns.current_user.name})
    else
      redirect(conn, external: GitHubOAuth.GitHub.authorize_url())
    end
  end

  defp fetch_current_user(conn, _opts) do
    user_id = get_session(conn, :user_id)
    user = user_id && Accounts.get_user(user_id)
    assign(conn, :current_user, user)
  end
end

defmodule GitHubOAuthWeb.OAuthCallbackController do
  use GitHubOAuthWeb, :controller

  alias GitHubOAuth.Accounts

  require Logger

  def new(
        conn,
        %{"provider" => "github", "code" => code, "state" => state}
      ) do
    client = github_client(conn)

    with {:ok, info} <-
          client.exchange_access_token(code: code, state: state),
        %{
          info: info,
          primary_email: primary,
          emails: emails,
          token: token
        } = info,
        {:ok, user} <-
          Accounts.register_github_user(primary, info, emails, token) do
      conn
      |> log_in_user(user)
      |> redirect(to: "/")
    else
      {:error, %Ecto.Changeset{} = changeset} ->
        Logger.debug("failed GitHub insert #{inspect(changeset.errors)}")

        error =
          "We were unable to fetch the necessary information from " <>
            "your GitHub account"

        json(conn, %{error: error})

      {:error, reason} ->
        Logger.debug("failed GitHub exchange #{inspect(reason)}")

        json(conn, %{
          error: "We were unable to contact GitHub. Please try again later"
        })
    end
  end

  def new(conn, %{"provider" => "github", "error" => "access_denied"}) do
    json(conn, %{error: "Access denied"})
  end

  defp github_client(conn) do
    conn.assigns[:github_client] || GitHubOAuth.GitHub
  end

  defp log_in_user(conn, user) do
    conn
    |> assign(:current_user, user)
    |> configure_session(renew: true)
    |> clear_session()
    |> put_session(:user_id, user.id)
  end
end

defmodule GitHubOAuthWeb.Router do
  # ...

  pipeline :api do
    # ...
    plug :fetch_session
  end

  scope "/", GitHubOAuthWeb do
    pipe_through :api

    get "/", UserController, :index
    get "/oauth/callbacks/:provider", OAuthCallbackController, :new
  end

  # ...
end