implement telegram auth

.env.example

@@ -0,0 +1,3 @@
+TELEGRAM_BOT_TOKEN=
+TELEGRAM_BOT_USERNAME=
+DEV_USER_ID=

.gitignore

@@ -49,3 +49,4 @@ devenv.local.yaml
 # pre-commit
 .pre-commit-config.yaml
 Session.vim
+.env

assets/js/app.js

@@ -29,6 +29,7 @@ import MilkdownEditor from "./hooks/milkdown.js";
 import { LayoutStickyToolbar } from "./hooks/layout-sticky-toolbar.js";
 import Wikimap from "./hooks/wikimap.js";
 import Wikitree from "./hooks/wikitree.js";
+import { TelegramLoginHook } from "./hooks/telegram_login.js"
 
 const csrfToken = document
 	.querySelector("meta[name='csrf-token']")
@@ -43,6 +44,7 @@ const liveSocket = new LiveSocket("/live", Socket, {
 		LayoutStickyToolbar,
 		Wikimap,
 		Wikitree,
+    TelegramLogin: TelegramLoginHook,
 	},
 });
 

assets/js/hooks/telegram_login.js

@@ -0,0 +1,24 @@
+export const TelegramLoginHook = {
+  mounted() {
+    if (this.el.dataset.inited === "1") return
+    this.el.dataset.inited = "1"
+
+    const bot = this.el.dataset.botUsername
+    const req = this.el.dataset.requestAccess || "write"
+    const size = this.el.dataset.size || "large"
+
+    const { pathname, search } = window.location
+    const returnTo = `${pathname}${search || ""}` // <- path-only
+    const authUrl = `/auth/telegram/callback?return_to=${encodeURIComponent(returnTo)}`
+
+    const s = document.createElement("script")
+    s.async = true
+    s.src = "https://telegram.org/js/telegram-widget.js?22"
+    s.dataset.telegramLogin = bot
+    s.dataset.authUrl = authUrl
+    s.dataset.requestAccess = req
+    s.dataset.size = size
+
+    this.el.appendChild(s)
+  },
+}

lib/wik/accounts/user.ex

@@ -8,8 +8,7 @@ defmodule Wik.Accounts.User do
 
   defimpl String.Chars do
     def to_string(user) do
-      [username, _] = Kernel.to_string(user.email) |> String.split("@", parts: 2)
-      username
+      Kernel.to_string(user.tg_username)
     end
   end
 
@@ -62,7 +61,7 @@ defmodule Wik.Accounts.User do
 
     create :create do
       primary? true
-      accept [:email]
+      accept [:email, :tg_id, :tg_first_name, :tg_last_name, :tg_username, :tg_photo_url]
     end
 
     create :sign_in_with_magic_link do
@@ -87,7 +86,7 @@ defmodule Wik.Accounts.User do
 
     action :request_magic_link do
       argument :email, :ci_string do
-        allow_nil? false
+        allow_nil? true
       end
 
       run AshAuthentication.Strategy.MagicLink.Request
@@ -111,13 +110,49 @@ defmodule Wik.Accounts.User do
                      )
                    )
     end
+
+    policy action_type(:create) do
+      authorize_if always()
+    end
   end
 
   attributes do
     uuid_primary_key :id
 
     attribute :email, :ci_string do
-      allow_nil? false
+      allow_nil? true
+      public? true
+    end
+
+    attribute :confirmed_at, :utc_datetime_usec
+
+    attribute :role, :atom do
+      public? true
+      constraints one_of: [:user, :admin, :moderator]
+      default :user
+    end
+
+    attribute :tz, :string do
+      public? true
+    end
+
+    attribute :tg_id, :string do
+      public? true
+    end
+
+    attribute :tg_first_name, :string do
+      public? true
+    end
+
+    attribute :tg_last_name, :string do
+      public? true
+    end
+
+    attribute :tg_username, :string do
+      public? true
+    end
+
+    attribute :tg_photo_url, :string do
       public? true
     end
   end
@@ -136,5 +171,6 @@ defmodule Wik.Accounts.User do
 
   identities do
     identity :unique_email, [:email]
+    identity :unique_tg_id, [:tg_id]
   end
 end

lib/wik_web/components/telegram/widgets.ex

@@ -0,0 +1,30 @@
+defmodule WikWeb.Components.Telegram.Widgets do
+  use Phoenix.Component
+
+  # Optional attrs if you want to override defaults
+  attr :class, :string, default: nil
+  attr :request_access, :string, default: "write"
+  attr :size, :string, default: "large", values: ~w(small medium large)
+
+  def login(assigns) do
+    bot_username =
+      System.get_env("TELEGRAM_BOT_USERNAME") ||
+        raise "TELEGRAM_BOT_USERNAME not set"
+
+    assigns =
+      assigns
+      |> assign(:bot_username, bot_username)
+
+    ~H"""
+    <div
+      id="telegram-login"
+      phx-hook="TelegramLogin"
+      phx-update="ignore"
+      class={@class}
+      data-bot-username={@bot_username}
+      data-request-access={@request_access}
+      data-size={@size}
+    />
+    """
+  end
+end

lib/wik_web/controllers/auth_controller/dev.ex

@@ -0,0 +1,36 @@
+defmodule WikWeb.AuthController.Dev do
+  use WikWeb, :controller
+  require Ash.Query
+  require Logger
+  alias AshAuthentication.Jwt
+  alias AshAuthentication.Plug.Helpers, as: AuthHelpers
+
+  def login(conn, _params) do
+    return_to = "/"
+
+    id = System.get_env("DEV_USER_ID", "000000000")
+
+    img =
+      "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABwAAAAcBAMAAACAI8KnAAABg2lDQ1BJQ0MgcHJvZmlsZQAAKJF9kT1Iw0AcxV9TpSKVDlYQcQhSneyioo61CkWoEGqFVh1Mrp/QpCFJcXEUXAsOfixWHVycdXVwFQTBDxB3wUnRRUr8X1JoEePBcT/e3XvcvQOERoWpZlcMUDXLSCXiYia7KgZeISCEAYxgRmamPidJSXiOr3v4+HoX5Vne5/4cfbm8yQCfSBxjumERbxBPb1o6533iMCvJOeJz4nGDLkj8yHXF5TfORYcFnhk20ql54jCxWOxgpYNZyVCJp4gjOVWjfCHjco7zFme1UmOte/IXBvPayjLXaQ4jgUUsQYIIBTWUUYGFKK0aKSZStB/38A85folcCrnKYORYQBUqZMcP/ge/uzULkxNuUjAOdL/Y9scoENgFmnXb/j627eYJ4H8GrrS2v9oAZj9Jr7e1yBEQ2gYurtuasgdc7gCDT7psyI7kpykUCsD7GX1TFui/BXrX3N5a+zh9ANLUVfIGODgExoqUve7x7p7O3v490+rvB903ctGnToVWAAAAIVBMVEVKHBxKHD5vKl68TqDKcrS8oE5OvLyFvE6eynK62Zv36fNZSEXTAAAAAWJLR0QAiAUdSAAAAAlwSFlzAAAuIwAALiMBeKU/dgAAAAd0SU1FB+kCDxUqHL67UiAAAAAZdEVYdENvbW1lbnQAQ3JlYXRlZCB3aXRoIEdJTVBXgQ4XAAAAZklEQVQY02OYiQDT0mYy4OROSw1NQ+e6IIBbmgsBrrGxCULAGJ3LYGzitWoVkOm1aolLBzbuQkEg11GKMLcDL7cc2d5yIrjOxiBg4l6OyS0vBjKVjJWUjc2xcSECxiAeMVwEQOMCAM+GiLYSTcf8AAAAAElFTkSuQmCC"
+
+    attrs = %{
+      tg_id: id,
+      tg_first_name: "Testuser",
+      tg_last_name: "Testuser",
+      tg_username: "Testuser",
+      tg_photo_url: img
+    }
+
+    db_user =
+      Wik.Accounts.User
+      |> Ash.Changeset.for_create(:create, attrs)
+      |> Ash.create!(upsert?: true, upsert_identity: :unique_tg_id)
+
+    {:ok, token, _claims} = Jwt.token_for_user(db_user)
+    db_user = Ash.Resource.set_metadata(db_user, %{token: token})
+
+    conn
+    |> AuthHelpers.store_in_session(db_user)
+    |> redirect(to: return_to)
+  end
+end

lib/wik_web/controllers/auth_controller/telegram.ex

@@ -0,0 +1,97 @@
+defmodule WikWeb.AuthController.Telegram do
+  use WikWeb, :controller
+  require Ash.Query
+  require Logger
+  alias AshAuthentication.Jwt
+  alias AshAuthentication.Plug.Helpers, as: AuthHelpers
+  alias Assent.Strategy.Telegram
+
+  defp config do
+    [
+      bot_token: System.get_env("TELEGRAM_BOT_TOKEN"),
+      # `, may be one of `:login_widget` or `:web_mini_app`
+      authorization_channel: :login_widget,
+      origin: ""
+      # return_to: "/"
+      # client_id: "REPLACE_WITH_CLIENT_ID",
+      # client_secret: "REPLACE_WITH_CLIENT_SECRET",
+      # redirect_uri: "http://localhost:4000/auth/telegram /callback"
+    ]
+  end
+
+  def request(conn) do
+    config()
+    |> Telegram.authorize_url()
+    |> case do
+      {:ok, %{url: url, session_params: session_params}} ->
+        conn = put_session(conn, :session_params, session_params)
+
+        # Redirect end-user to Telegram to authorize access to their account
+        conn
+        |> put_resp_header("location", url)
+        |> send_resp(302, "")
+
+      {:error, error} ->
+        Logger.error("""
+          Error in AuthController.Telegram.authorize_url()
+          #{inspect(error)}
+        """)
+
+        nil
+    end
+  end
+
+  def callback(conn, params) do
+    return_to = params["return_to"]
+    params = params |> Map.delete("return_to")
+    session_params = get_session(conn, :session_params)
+
+    config()
+    # Session params should be added to the config so the strategy can use them
+    |> Keyword.put(:session_params, session_params)
+    |> Telegram.callback(params)
+    |> case do
+      {:ok, %{user: user_from_telegram}} ->
+        attrs = %{
+          tg_id: user_from_telegram["sub"] |> to_string(),
+          tg_first_name: user_from_telegram["given_name"],
+          tg_last_name: user_from_telegram["family_name"],
+          tg_username: user_from_telegram["preferred_username"],
+          tg_photo_url: user_from_telegram["picture"]
+        }
+
+        db_user =
+          Wik.Accounts.User
+          |> Ash.Changeset.for_create(:create, attrs)
+          |> Ash.create!(upsert?: true, upsert_identity: :unique_tg_id)
+
+        {:ok, token, _claims} = Jwt.token_for_user(db_user)
+        db_user = Ash.Resource.set_metadata(db_user, %{token: token})
+
+        # current_user = %{
+        #   id: db_user.id,
+        #   first_name: db_user.telegram_first_name,
+        #   last_name: db_user.telegram_last_name,
+        #   username: db_user.telegram_username,
+        #   photo_url: db_user.telegram_photo_url,
+        #   role: db_user.role
+        # }
+
+        conn
+        |> AuthHelpers.store_in_session(db_user)
+        |> redirect(to: return_to)
+
+      {:error, error} ->
+        error_id = :rand.uniform(10_000)
+
+        Logger.error("""
+          Error #{error_id} in AuthController.Telegram.callback()
+          #{inspect(error)}
+        """)
+
+        conn
+        |> put_flash(:error, "Authentication failed. Error id: #{error_id}")
+        |> redirect(to: return_to)
+    end
+  end
+end

lib/wik_web/live/sign_in_live.ex

@@ -0,0 +1,27 @@
+defmodule WikWeb.SignInLive do
+  @moduledoc """
+  """
+
+  use WikWeb, :live_view
+  alias WikWeb.Components.RealtimeToast
+  alias WikWeb.Components
+
+  @impl true
+  def render(assigns) do
+    ~H"""
+    <div>
+      <Components.Telegram.Widgets.login />
+      <div :if={Mix.env() == :dev} class="text-center mt-4">
+        <.link class="btn btn-primary" navigate="/dev/login">dev login</.link>
+      </div>
+    </div>
+    """
+  end
+
+  @impl true
+  def mount(_params, _session, socket) do
+    dbg("🔴")
+    dbg(socket.assigns)
+    {:ok, socket}
+  end
+end

lib/wik_web/router.ex

@@ -34,18 +34,19 @@ defmodule WikWeb.Router do
   scope "/", WikWeb do
     pipe_through :browser
 
+    get "/auth/telegram/callback", AuthController.Telegram, :callback
     auth_routes AuthController, Wik.Accounts.User, path: "/auth"
     sign_out_route AuthController
 
-    # Remove these if you'd like to use your own authentication views
-    sign_in_route register_path: "/register",
-                  reset_path: "/reset",
-                  auth_routes_prefix: "/auth",
-                  on_mount: [{WikWeb.LiveUserAuth, :live_no_user}],
-                  overrides: [
-                    WikWeb.AuthOverrides,
-                    Elixir.AshAuthentication.Phoenix.Overrides.DaisyUI
-                  ]
+    # # Remove these if you'd like to use your own authentication views
+    # sign_in_route register_path: "/register",
+    #               reset_path: "/reset",
+    #               auth_routes_prefix: "/auth",
+    #               on_mount: [{WikWeb.LiveUserAuth, :live_no_user}],
+    #               overrides: [
+    #                 WikWeb.AuthOverrides,
+    #                 Elixir.AshAuthentication.Phoenix.Overrides.DaisyUI
+    #               ]
 
     # Remove this if you do not want to use the reset password feature
     reset_route auth_routes_prefix: "/auth",
@@ -64,6 +65,8 @@ defmodule WikWeb.Router do
       auth_routes_prefix: "/auth",
       overrides: [WikWeb.AuthOverrides, Elixir.AshAuthentication.Phoenix.Overrides.DaisyUI]
     )
+
+    live "/sign-in", SignInLive, :show
   end
 
   scope "/", WikWeb do
@@ -125,6 +128,8 @@ defmodule WikWeb.Router do
     scope "/dev" do
       pipe_through :browser
 
+      get "/login", WikWeb.AuthController.Dev, :login
+      live "/telegram", WikWeb.TelegramLive.BotUpdates, :index
       live_dashboard "/dashboard", metrics: WikWeb.Telemetry
       forward "/mailbox", Plug.Swoosh.MailboxPreview
     end