feat: per-user OAuth2 connections (Strava, Spotify, GitHub, Google)

.env.example

@@ -23,3 +23,64 @@
 # SINGLE_USER_AUTO_LOGIN=true
 
 # ENABLE_PPROF=false
+
+# ----------------------------------------------------------------------------
+# Third-party OAuth2 connections (Strava, etc.)
+# ----------------------------------------------------------------------------
+# Apps like the Strava community app can pull user-specific data (recent
+# activity, etc.) once the user has connected their account. Tronbyt itself
+# brokers the OAuth dance; you (the server admin) provide the client
+# credentials per provider.
+#
+# Setup, per provider:
+#   1. Register an OAuth application with the provider.
+#   2. Set its redirect URI to https://<your-tronbyt>/oauth-callback
+#      (must match exactly — providers reject mismatches).
+#   3. Copy the client ID/secret here, redeploy.
+#   4. Users will see a "Connect <Provider>" button on each app's config
+#      page when the schema declares an OAuth2 field for that provider.
+#
+# Users manage their connections at /connections, or from the "Connect"
+# button on an app's config page.
+#
+# Strava — https://www.strava.com/settings/api
+# Set "Authorization Callback Domain" to the bare host you browse your
+# server with (e.g. tronbyt.local or 192.168.1.155) — no scheme, no port.
+# localhost and 127.0.0.1 are always accepted. New Strava apps start in
+# "Single Player Mode" (1 connected athlete); the dashboard has a
+# self-service upgrade to 10.
+# STRAVA_CLIENT_ID=
+# STRAVA_CLIENT_SECRET=
+#
+# GitHub — https://github.com/settings/developers (OAuth Apps)
+# Uses the DEVICE FLOW: no redirect URI to register and no client secret
+# needed — the client ID alone enables it. You must tick "Enable Device
+# Flow" on the OAuth app, or the connection fails with device_flow_disabled.
+# Users get a short code shown both in the browser and on the display, and
+# approve it at github.com/login/device.
+# GITHUB_CLIENT_ID=
+# GITHUB_CLIENT_SECRET=   # optional; only needed for the redirect flow
+#
+# Spotify — https://developer.spotify.com/dashboard
+# Redirect URI must be HTTPS, except literal loopback addresses:
+# http://127.0.0.1:8000/oauth-callback works, but "localhost", LAN IPs,
+# and .local names over plain http are rejected. Development Mode apps
+# allow up to 5 allowlisted users and require the app owner to have
+# Spotify Premium.
+# SPOTIFY_CLIENT_ID=
+# SPOTIFY_CLIENT_SECRET=
+#
+# Google — https://console.cloud.google.com/apis/credentials
+# Create an "OAuth client ID" of type "Web application" and add
+# https://<your-tronbyt>/oauth-callback as an authorized redirect URI.
+# Enable the APIs your apps use (e.g. the Google Analytics Data API for
+# GA4 apps) under "APIs & Services".
+# IMPORTANT: while the project's OAuth consent screen is in "Testing"
+# status, refresh tokens expire after 7 days and every user must be
+# reconnected weekly. Publish the consent screen to "In production"
+# (Audience page) for durable tokens — you do NOT need Google's
+# verification: users just click through an "unverified app" warning,
+# and the only cost is a 100-user lifetime cap, irrelevant for
+# self-hosting.
+# GOOGLE_CLIENT_ID=
+# GOOGLE_CLIENT_SECRET=

cmd/server/serve/cmd.go

@@ -53,7 +53,7 @@ func run(cmd *cobra.Command, args []string) error {
 	sanitizeDB(cmd.Context(), db)
 
 	// AutoMigrate (ensure schema exists)
-	if err := db.AutoMigrate(&data.User{}, &data.Device{}, &data.App{}, &data.WebAuthnCredential{}, &data.Setting{}, &data.OIDCIdentity{}); err != nil {
+	if err := db.AutoMigrate(&data.User{}, &data.Device{}, &data.App{}, &data.WebAuthnCredential{}, &data.Setting{}, &data.OIDCIdentity{}, &data.Connection{}); err != nil {
 		return fmt.Errorf("failed to migrate schema: %w", err)
 	}
 

internal/config/config.go

@@ -44,6 +44,36 @@ type Settings struct {
 	OIDCAdminGroupClaim  string `env:"OIDC_ADMIN_GROUP_CLAIM" envDefault:"groups"`
 	OIDCAdminGroupValue  string `env:"OIDC_ADMIN_GROUP_VALUE"`
 	OIDCUsernameClaim    string `env:"OIDC_USERNAME_CLAIM"    envDefault:"preferred_username"`
+
+	// Third-party OAuth2 connections (per-provider client credentials).
+	// Empty values disable that provider's "Connect" button.
+	StravaClientID      string `env:"STRAVA_CLIENT_ID"`
+	StravaClientSecret  string `env:"STRAVA_CLIENT_SECRET"`
+	SpotifyClientID     string `env:"SPOTIFY_CLIENT_ID"`
+	SpotifyClientSecret string `env:"SPOTIFY_CLIENT_SECRET"`
+	// GitHub uses the device flow, which needs no secret — a client id
+	// alone is enough to enable it.
+	GitHubClientID     string `env:"GITHUB_CLIENT_ID"`
+	GitHubClientSecret string `env:"GITHUB_CLIENT_SECRET"`
+	GoogleClientID     string `env:"GOOGLE_CLIENT_ID"`
+	GoogleClientSecret string `env:"GOOGLE_CLIENT_SECRET"`
+}
+
+// ConnectionClientCreds returns the (client_id, client_secret) pair for a
+// provider name, or empty strings if not configured.
+func (s *Settings) ConnectionClientCreds(provider string) (string, string) {
+	switch provider {
+	case "strava":
+		return s.StravaClientID, s.StravaClientSecret
+	case "spotify":
+		return s.SpotifyClientID, s.SpotifyClientSecret
+	case "github":
+		return s.GitHubClientID, s.GitHubClientSecret
+	case "google":
+		return s.GoogleClientID, s.GoogleClientSecret
+	default:
+		return "", ""
+	}
 }
 
 func (s *Settings) SystemAppsDir() string {

internal/connections/crypto.go

@@ -0,0 +1,62 @@
+// Package connections implements the third-party OAuth2 connection store
+// that lets pixlet apps (Strava, Spotify, Google Calendar, ...) render with
+// a fresh access token without users hand-pasting refresh tokens.
+package connections
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/sha256"
+	"errors"
+	"io"
+)
+
+// deriveKey turns the server's session secret_key (any length) into a stable
+// 32-byte AES-256 key. We use a fixed info string so rotating session keys
+// (which would also rotate this key) intentionally invalidates stored tokens.
+func deriveKey(secret string) [32]byte {
+	return sha256.Sum256([]byte("tronbyt-connections-v1\x00" + secret))
+}
+
+// Seal encrypts plaintext with AES-256-GCM. Output layout: nonce || ciphertext.
+func Seal(secret string, plaintext []byte) ([]byte, error) {
+	if len(plaintext) == 0 {
+		return nil, nil
+	}
+	key := deriveKey(secret)
+	block, err := aes.NewCipher(key[:])
+	if err != nil {
+		return nil, err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+		return nil, err
+	}
+	return gcm.Seal(nonce, nonce, plaintext, nil), nil
+}
+
+// Open reverses Seal. Empty input returns empty output (treated as "not set").
+func Open(secret string, sealed []byte) ([]byte, error) {
+	if len(sealed) == 0 {
+		return nil, nil
+	}
+	key := deriveKey(secret)
+	block, err := aes.NewCipher(key[:])
+	if err != nil {
+		return nil, err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+	if len(sealed) < gcm.NonceSize() {
+		return nil, errors.New("connections: sealed token too short")
+	}
+	nonce, ct := sealed[:gcm.NonceSize()], sealed[gcm.NonceSize():]
+	return gcm.Open(nil, nonce, ct, nil)
+}

internal/connections/crypto_test.go

@@ -0,0 +1,62 @@
+package connections
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSealOpenRoundtrip(t *testing.T) {
+	secret := "this-is-a-test-secret"
+	plaintext := []byte("strava-refresh-token-1234567890")
+
+	sealed, err := Seal(secret, plaintext)
+	require.NoError(t, err)
+	require.NotEmpty(t, sealed)
+	assert.False(t, bytes.Equal(sealed, plaintext), "sealed output should differ from plaintext")
+
+	opened, err := Open(secret, sealed)
+	require.NoError(t, err)
+	assert.Equal(t, plaintext, opened)
+}
+
+func TestSealNonDeterministic(t *testing.T) {
+	// AES-GCM uses a random nonce, so sealing the same plaintext twice
+	// must produce different ciphertexts. This guards against ECB-style
+	// regressions if anyone "simplifies" the implementation later.
+	secret := "secret"
+	plaintext := []byte("same-plaintext-each-time")
+
+	a, err := Seal(secret, plaintext)
+	require.NoError(t, err)
+	b, err := Seal(secret, plaintext)
+	require.NoError(t, err)
+	assert.False(t, bytes.Equal(a, b), "two seals of the same plaintext must differ")
+}
+
+func TestOpenWithWrongKey(t *testing.T) {
+	sealed, err := Seal("right-secret", []byte("payload"))
+	require.NoError(t, err)
+
+	_, err = Open("wrong-secret", sealed)
+	assert.Error(t, err, "opening with the wrong key must fail")
+}
+
+func TestSealOpenEmpty(t *testing.T) {
+	// Empty input is a legitimate "not set" state — round-trip without
+	// error so the service can store/clear tokens uniformly.
+	sealed, err := Seal("secret", nil)
+	require.NoError(t, err)
+	assert.Empty(t, sealed)
+
+	opened, err := Open("secret", nil)
+	require.NoError(t, err)
+	assert.Empty(t, opened)
+}
+
+func TestOpenTooShort(t *testing.T) {
+	_, err := Open("secret", []byte{1, 2, 3})
+	assert.Error(t, err)
+}

internal/connections/github.go

@@ -0,0 +1,75 @@
+package connections
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strconv"
+	"time"
+
+	"golang.org/x/oauth2"
+)
+
+// GitHub returns the GitHub provider. GitHub is the marquee device-flow
+// provider: the token exchange needs only a client id, so an admin can
+// enable it with a single env var and no secret.
+//
+// Note for admins: "Enable Device Flow" must be ticked on the OAuth app
+// (Settings → Developer settings → OAuth Apps); without it the flow
+// fails with device_flow_disabled.
+func GitHub() *Provider {
+	return &Provider{
+		Name:                  "github",
+		DisplayName:           "GitHub",
+		AuthorizeURL:          "https://github.com/login/oauth/authorize",
+		TokenURL:              "https://github.com/login/oauth/access_token",
+		DeviceAuthURL:         "https://github.com/login/device/code",
+		DeviceAuthNeedsSecret: false,
+		AuthStyle:             oauth2.AuthStyleInParams,
+		DefaultScopes:         []string{"read:user"},
+		Identify:              identifyGitHub,
+	}
+}
+
+// identifyGitHub calls /user for the account id and a display name.
+func identifyGitHub(ctx context.Context, accessToken string) (externalID, displayName string, err error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://api.github.com/user", nil)
+	if err != nil {
+		return "", "", err
+	}
+	req.Header.Set("Authorization", "Bearer "+accessToken)
+	req.Header.Set("Accept", "application/vnd.github+json")
+	req.Header.Set("X-GitHub-Api-Version", "2022-11-28")
+
+	client := &http.Client{Timeout: 15 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return "", "", err
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		return "", "", fmt.Errorf("github /user returned %d", resp.StatusCode)
+	}
+
+	var body struct {
+		ID    int64  `json:"id"`
+		Login string `json:"login"`
+		Name  string `json:"name"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+		return "", "", err
+	}
+
+	externalID = strconv.FormatInt(body.ID, 10)
+	switch {
+	case body.Login != "":
+		displayName = body.Login
+	case body.Name != "":
+		displayName = body.Name
+	default:
+		displayName = formatExternalID("github", externalID)
+	}
+	return externalID, displayName, nil
+}

internal/connections/google.go

@@ -0,0 +1,48 @@
+package connections
+
+import (
+	"golang.org/x/oauth2"
+)
+
+// Google returns the Google OAuth2 provider definition. Endpoints from
+// https://developers.google.com/identity/protocols/oauth2/web-server.
+// Redirect (authorization code) flow only: Google's device flow has a
+// small scope allowlist (TV-class scopes like YouTube and Drive) that
+// excludes the API scopes apps actually declare — analytics.readonly,
+// calendar.readonly, and friends — so DeviceAuthURL stays empty.
+//
+// Google only issues a refresh token when the authorize redirect carries
+// access_type=offline, and only guarantees one on re-auth when
+// prompt=consent forces the consent screen. Those two are pinned in
+// AuthCodeParams rather than inherited from the default options: the
+// default happens to spell the same thing today, but it goes through
+// oauth2.ApprovalForce, whose spelling has changed before (it used to be
+// approval_prompt=force — a parameter Google now rejects when prompt is
+// present). Refresh responses do not rotate the refresh token — the
+// omitted-refresh-token path in Service.refresh keeps the stored one.
+//
+// No Identify: the userinfo endpoint needs an email/profile scope on the
+// token, and we request only what the app's schema declares. ExternalID
+// stays empty; the connections page shows a plain "Connected" state and
+// the app config page falls back to the provider display name.
+//
+// Note for admins: a Cloud project whose OAuth consent screen is in
+// "Testing" status issues refresh tokens that EXPIRE AFTER 7 DAYS. Publish
+// the consent screen to "In production" for durable tokens — staying
+// unverified is fine (users click through a warning screen), it just caps
+// the app at 100 lifetime users, which doesn't matter for self-hosting.
+// See .env.example.
+func Google() *Provider {
+	return &Provider{
+		Name:         "google",
+		DisplayName:  "Google",
+		AuthorizeURL: "https://accounts.google.com/o/oauth2/v2/auth",
+		TokenURL:     "https://oauth2.googleapis.com/token",
+		AuthStyle:    oauth2.AuthStyleInParams,
+		AuthCodeParams: []oauth2.AuthCodeOption{
+			oauth2.AccessTypeOffline,
+			oauth2.SetAuthURLParam("prompt", "consent"),
+		},
+		DefaultScopes: []string{"https://www.googleapis.com/auth/analytics.readonly"},
+	}
+}