Attempting to add a Twitch provider

[secondubly]

Taking a break from banging my head against the wall with #111 and am trying to add a Twitch oauth2 provider - I saw that battlenet had one and figured it might help me get my bearings. I've got the following code down so far:

func NewTwitch(p Params) Oauth2Handler {
	return initOauth2Handler(p, Oauth2Handler{
		name:     "twitch",
		endpoint: twitch.Endpoint,
		scopes:   []string{},
		infoURL:  "https://api.twitch.tv/helix/users",
		mapUser: func(data UserData, _ []byte) token.User {
			userInfo := token.User{
				ID:      "twitch_" + token.HashID(sha1.New(), data.Value("id")),
				Name:    data.Value("display_name"),
				Picture: data.Value("profile_image_url"),
			}
			if userInfo.Name == "" {
				userInfo.Name = data.Value("login")
			}
			return userInfo
		},
	})
}

But when running it through the example page in the repo I get the following:

2022/02/21 23:24:38.262 [DEBUG] {provider/oauth2.go:83 provider.Oauth2Handler.LoginHandler} login with twitch
2022/02/21 23:24:38.262 [DEBUG] {provider/oauth2.go:128 provider.Oauth2Handler.LoginHandler} login url https://id.twitch.tv/oauth2/authorize?client_id=[redacted]&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fauth%2Ftwitch%2Fcallback&response_type=code&state=6410d9a8a3a0f24768db6d6a7206cb989ca7ad2b, claims={"exp":1645505678,"jti":"b49ba025e7de11a88b7b09bc1beb8d20d522a5b6","nbf":1645503818,"handshake":{"state":"6410d9a8a3a0f24768db6d6a7206cb989ca7ad2b","from":"http://localhost:8080/web/?close=true"}}
2022/02/21 23:24:38.262 [INFO]  {logger/logger.go:129 logger.(*Middleware).Handler.func1.1} GET - /auth/twitch/login?id=auth-example&from=http://localhost:8080/web/?close=true - localhost - [] - 302 (249) - 186.7µs
2022/02/21 23:24:38.452 [DEBUG] {provider/oauth2.go:155 provider.Oauth2Handler.AuthHandler} token with state 6410d9a8a3a0f24768db6d6a7206cb989ca7ad2b
2022/02/21 23:24:38.789 [DEBUG] {provider/oauth2.go:186 provider.Oauth2Handler.AuthHandler} got raw user info map[error:Unauthorized message:Client ID is missing status:401]
2022/02/21 23:24:38.798 [DEBUG] {avatar/avatar.go:51 avatar.(*Proxy).Put.func1} saved identicon avatar to 823a46f46424d0e55291fe93cfce00287e5398ff.image, user ""
2022/02/21 23:24:38.798 [DEBUG] {provider/oauth2.go:219 provider.Oauth2Handler.AuthHandler} user info {Name: ID:twitch_da39a3ee5e6b4b0d3255bfef95601890afd80709 Picture:http://localhost:8080/avatar/823a46f46424d0e55291fe93cfce00287e5398ff.image Audience: IP: Email: Attributes:map[] Role:}
2022/02/21 23:24:38.798 [INFO]  {logger/logger.go:129 logger.(*Middleware).Handler.func1.1} GET - /auth/twitch/callback?code=zjzkcpyddaxwem294urmfo1ds3ml3d&scope=&state=6410d9a8a3a0f24768db6d6a7206cb989ca7ad2b - localhost - [] - 307 (73) - 346.266395ms
2022/02/21 23:24:39.607 [INFO]  {logger/logger.go:129 logger.(*Middleware).Handler.func1.1} GET - /auth/user - localhost - [] - 200 (155) - 61.21µs
2022/02/21 23:24:39.618 [DEBUG] {middleware/auth.go:76 middleware.(*Authenticator).auth.func1} auth failed, user /twitch_da39a3ee5e6b4b0d3255bfef95601890afd80709 blocked
2022/02/21 23:24:39.618 [INFO]  {logger/logger.go:129 logger.(*Middleware).Handler.func1.1} GET - /private_data - localhost - [] - 401 (13) - 123.8µs

Note the: 2022/02/21 23:24:38.789 [DEBUG] {provider/oauth2.go:186 provider.Oauth2Handler.AuthHandler} got raw user info map[error:Unauthorized message:Client ID is missing status:401]

I'm not sure what's going on there but I feel like I'm missing something? The auth info is all laid out here pretty plainly, so I'm not 100% sure what I'm missing exactly

[secondubly]

Ah, I forgot, the endpoints are located here in this package: https://pkg.go.dev/golang.org/x/oauth2/twitch

[umputun]

to me, it looks like your infoURL is wrong or at least expects some parameters. Have you checked their API for something like /me or smth like this? I have no experience with Twitch API, but this one https://id.twitch.tv/oauth2/validate, for example, seems to provide some minimal info about user name and id.

[umputun]

not sure if helpful, but I have seen someone on the internet saying in regard to https://api.twitch.tv/helix/users - "I’ve tried to use the “OAuth Implicit Code Flow” instead of the " OAuth Authorization Code Flow" and it work!"

[secondubly]

After doing a bit more research, it doesn't look like I can use Twitch for social login in the way I want - the /validate endpoint provides minimal info like you mentioned, but I don't know if there's a way for me to take the code as-is and grab a user's profile picture. From my understanding, the oauth process works like so in the project:

1. Make a call to https://id.twitch.tv/oauth2/authorize with the client_id and redirect url
2. User gets taken to Twitch to login/approve access.
3. User gets taken to redirect url on approval.
4. Grab the user info and store it accordingly

I'm not sure if there's a way to add in a step there between 3 and 4 where I make another request to https://api.twitch.tv/helix/users (which seems to be the only way to get user data for a logged in user) to allow me to get the profile picture?

[secondubly]

As it turns out, there's actually a login auth flow that would allow me to get the information I need! I'd need to use the OIDC auth flow instead (docs here: https://dev.twitch.tv/docs/authentication/getting-tokens-oidc#oidc-authorization-code-flow) and add a claims but I'm not sure if this is something that this package can handle? I see there's a way to add a custom provider in the existing project but I don't know if that's sufficient? @umputun I'm not sure if you're familiar with this at all? I'm attempting to write up a provider for it, similar to the AppleProvider but if I can just use the built-in custom provider, that seems like a less time-consuming task

[paskal]

I think writing a new provider by copy-pasting some existing provider which has the most similar flow to the new one is a good and easiest way to go.