From 1746cc171e0f389884eb2e1d23373df9a4f01e24 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Wed, 3 Jul 2024 23:26:41 -0400 Subject: [PATCH 1/5] add root resource path '/' to mobile oauth scheme --- docs/docs/administration/oauth.md | 12 ++++++------ mobile/lib/services/oauth.service.dart | 4 ++-- server/src/constants.ts | 2 +- server/src/services/auth.service.spec.ts | 8 +++++--- web/src/lib/i18n/en.json | 2 +- 5 files changed, 15 insertions(+), 13 deletions(-) diff --git a/docs/docs/administration/oauth.md b/docs/docs/administration/oauth.md index ab317787bc09c..432477064fd1d 100644 --- a/docs/docs/administration/oauth.md +++ b/docs/docs/administration/oauth.md @@ -3,7 +3,7 @@ This page contains details about using OAuth in Immich. :::tip -Unable to set `app.immich:/` as a valid redirect URI? See [Mobile Redirect URI](#mobile-redirect-uri) for an alternative solution. +Unable to set `app.immich:///` as a valid redirect URI? See [Mobile Redirect URI](#mobile-redirect-uri) for an alternative solution. ::: ## Overview @@ -30,7 +30,7 @@ Before enabling OAuth in Immich, a new client application needs to be configured The **Sign-in redirect URIs** should include: - - `app.immich:/` - for logging in with OAuth from the [Mobile App](/docs/features/mobile-app.mdx) + - `app.immich:///` - for logging in with OAuth from the [Mobile App](/docs/features/mobile-app.mdx) - `http://DOMAIN:PORT/auth/login` - for logging in with OAuth from the Web Client - `http://DOMAIN:PORT/user-settings` - for manually linking OAuth in the Web Client @@ -38,7 +38,7 @@ Before enabling OAuth in Immich, a new client application needs to be configured Mobile - - `app.immich:/` (You **MUST** include this for iOS and Android mobile apps to work properly) + - `app.immich:///` (You **MUST** include this for iOS and Android mobile apps to work properly) Localhost @@ -96,16 +96,16 @@ When Auto Launch is enabled, the login page will automatically redirect the user ## Mobile Redirect URI -The redirect URI for the mobile app is `app.immich:/`, which is a [Custom Scheme](https://developer.apple.com/documentation/xcode/defining-a-custom-url-scheme-for-your-app). If this custom scheme is an invalid redirect URI for your OAuth Provider, you can work around this by doing the following: +The redirect URI for the mobile app is `app.immich:///`, which is a [Custom Scheme](https://developer.apple.com/documentation/xcode/defining-a-custom-url-scheme-for-your-app). If this custom scheme is an invalid redirect URI for your OAuth Provider, you can work around this by doing the following: -1. Configure an http(s) endpoint to forwards requests to `app.immich:/` +1. Configure an http(s) endpoint to forwards requests to `app.immich:///` 2. Whitelist the new endpoint as a valid redirect URI with your provider. 3. Specify the new endpoint as the `Mobile Redirect URI Override`, in the OAuth settings. With these steps in place, you should be able to use OAuth from the [Mobile App](/docs/features/mobile-app.mdx) without a custom scheme redirect URI. :::info -Immich has a route (`/api/oauth/mobile-redirect`) that is already configured to forward requests to `app.immich:/`, and can be used for step 1. +Immich has a route (`/api/oauth/mobile-redirect`) that is already configured to forward requests to `app.immich:///`, and can be used for step 1. ::: ## Example Configuration diff --git a/mobile/lib/services/oauth.service.dart b/mobile/lib/services/oauth.service.dart index 807c88db8de50..d46705f05d41a 100644 --- a/mobile/lib/services/oauth.service.dart +++ b/mobile/lib/services/oauth.service.dart @@ -3,7 +3,7 @@ import 'package:logging/logging.dart'; import 'package:openapi/api.dart'; import 'package:flutter_web_auth/flutter_web_auth.dart'; -// Redirect URL = app.immich:// +// Redirect URL = app.immich:/// i.e., {scheme}://{resource} class OAuthService { final ApiService _apiService; @@ -18,7 +18,7 @@ class OAuthService { await _apiService.resolveAndSetEndpoint(serverUrl); final dto = await _apiService.oAuthApi.startOAuth( - OAuthConfigDto(redirectUri: '$callbackUrlScheme:/'), + OAuthConfigDto(redirectUri: '$callbackUrlScheme:///'), ); return dto?.url; } diff --git a/server/src/constants.ts b/server/src/constants.ts index f3a6c486ad058..c2b10b0969a0b 100644 --- a/server/src/constants.ts +++ b/server/src/constants.ts @@ -51,7 +51,7 @@ export const resourcePaths = { }, }; -export const MOBILE_REDIRECT = 'app.immich:/'; +export const MOBILE_REDIRECT = 'app.immich:///'; export const LOGIN_URL = '/auth/login?autoLaunch=0'; export enum AuthType { diff --git a/server/src/services/auth.service.spec.ts b/server/src/services/auth.service.spec.ts index ed73c5aa00256..26295c0b23d33 100644 --- a/server/src/services/auth.service.spec.ts +++ b/server/src/services/auth.service.spec.ts @@ -423,11 +423,13 @@ describe('AuthService', () => { describe('getMobileRedirect', () => { it('should pass along the query params', () => { - expect(sut.getMobileRedirect('http://immich.app?code=123&state=456')).toEqual('app.immich:/?code=123&state=456'); + expect(sut.getMobileRedirect('http://immich.app?code=123&state=456')).toEqual( + 'app.immich:///?code=123&state=456', + ); }); it('should work if called without query params', () => { - expect(sut.getMobileRedirect('http://immich.app')).toEqual('app.immich:/?'); + expect(sut.getMobileRedirect('http://immich.app')).toEqual('app.immich:///?'); }); }); @@ -493,7 +495,7 @@ describe('AuthService', () => { userMock.getByOAuthId.mockResolvedValue(userStub.user1); sessionMock.create.mockResolvedValue(sessionStub.valid); - await sut.callback({ url: `app.immich:/?code=abc123` }, loginDetails); + await sut.callback({ url: `app.immich:///?code=abc123` }, loginDetails); expect(callbackMock).toHaveBeenCalledWith('http://mobile-redirect', { state: 'state' }, { state: 'state' }); }); diff --git a/web/src/lib/i18n/en.json b/web/src/lib/i18n/en.json index d8d0c3f8c87b9..7d60e5d66a057 100644 --- a/web/src/lib/i18n/en.json +++ b/web/src/lib/i18n/en.json @@ -172,7 +172,7 @@ "oauth_issuer_url": "Issuer URL", "oauth_mobile_redirect_uri": "Mobile redirect URI", "oauth_mobile_redirect_uri_override": "Mobile redirect URI override", - "oauth_mobile_redirect_uri_override_description": "Enable when 'app.immich:/' is an invalid redirect URI.", + "oauth_mobile_redirect_uri_override_description": "Enable when 'app.immich:///' is an invalid redirect URI.", "oauth_profile_signing_algorithm": "Profile signing algorithm", "oauth_profile_signing_algorithm_description": "Algorithm used to sign the user profile.", "oauth_scope": "Scope", From 1d2500e11bcbfe71387e8bbaa77a4241e8c94d92 Mon Sep 17 00:00:00 2001 From: Jason Rasmussen Date: Wed, 28 Aug 2024 09:58:43 -0400 Subject: [PATCH 2/5] chore: add oauth-callback path --- docs/docs/administration/oauth.md | 12 +++--- .../android/app/src/main/AndroidManifest.xml | 4 +- mobile/lib/services/oauth.service.dart | 4 +- server/src/constants.ts | 2 +- server/src/services/auth.service.spec.ts | 40 +++++++++---------- server/src/services/auth.service.ts | 2 +- .../settings/auth/auth-settings.svelte | 4 +- web/src/lib/i18n/en.json | 2 +- 8 files changed, 35 insertions(+), 35 deletions(-) diff --git a/docs/docs/administration/oauth.md b/docs/docs/administration/oauth.md index 432477064fd1d..96dca68e4fa9d 100644 --- a/docs/docs/administration/oauth.md +++ b/docs/docs/administration/oauth.md @@ -3,7 +3,7 @@ This page contains details about using OAuth in Immich. :::tip -Unable to set `app.immich:///` as a valid redirect URI? See [Mobile Redirect URI](#mobile-redirect-uri) for an alternative solution. +Unable to set `app.immich:///oauth-callback` as a valid redirect URI? See [Mobile Redirect URI](#mobile-redirect-uri) for an alternative solution. ::: ## Overview @@ -30,7 +30,7 @@ Before enabling OAuth in Immich, a new client application needs to be configured The **Sign-in redirect URIs** should include: - - `app.immich:///` - for logging in with OAuth from the [Mobile App](/docs/features/mobile-app.mdx) + - `app.immich:///oauth-callback` - for logging in with OAuth from the [Mobile App](/docs/features/mobile-app.mdx) - `http://DOMAIN:PORT/auth/login` - for logging in with OAuth from the Web Client - `http://DOMAIN:PORT/user-settings` - for manually linking OAuth in the Web Client @@ -38,7 +38,7 @@ Before enabling OAuth in Immich, a new client application needs to be configured Mobile - - `app.immich:///` (You **MUST** include this for iOS and Android mobile apps to work properly) + - `app.immich:///oauth-callback` (You **MUST** include this for iOS and Android mobile apps to work properly) Localhost @@ -96,16 +96,16 @@ When Auto Launch is enabled, the login page will automatically redirect the user ## Mobile Redirect URI -The redirect URI for the mobile app is `app.immich:///`, which is a [Custom Scheme](https://developer.apple.com/documentation/xcode/defining-a-custom-url-scheme-for-your-app). If this custom scheme is an invalid redirect URI for your OAuth Provider, you can work around this by doing the following: +The redirect URI for the mobile app is `app.immich:///oauth-callback`, which is a [Custom Scheme](https://developer.apple.com/documentation/xcode/defining-a-custom-url-scheme-for-your-app). If this custom scheme is an invalid redirect URI for your OAuth Provider, you can work around this by doing the following: -1. Configure an http(s) endpoint to forwards requests to `app.immich:///` +1. Configure an http(s) endpoint to forwards requests to `app.immich:///oauth-callback` 2. Whitelist the new endpoint as a valid redirect URI with your provider. 3. Specify the new endpoint as the `Mobile Redirect URI Override`, in the OAuth settings. With these steps in place, you should be able to use OAuth from the [Mobile App](/docs/features/mobile-app.mdx) without a custom scheme redirect URI. :::info -Immich has a route (`/api/oauth/mobile-redirect`) that is already configured to forward requests to `app.immich:///`, and can be used for step 1. +Immich has a route (`/api/oauth/mobile-redirect`) that is already configured to forward requests to `app.immich:///oauth-callback`, and can be used for step 1. ::: ## Example Configuration diff --git a/mobile/android/app/src/main/AndroidManifest.xml b/mobile/android/app/src/main/AndroidManifest.xml index edb41510f0156..e5e3e2a396b5e 100644 --- a/mobile/android/app/src/main/AndroidManifest.xml +++ b/mobile/android/app/src/main/AndroidManifest.xml @@ -69,7 +69,7 @@ - +