oauth2

src/models/_entities/mod.rs

@@ -4,6 +4,7 @@ pub mod prelude;
 
 pub mod audit_logs;
 pub mod categories;
+pub mod o_auth2_sessions;
 pub mod order_items;
 pub mod orders;
 pub mod product_images;

src/models/_entities/o_auth2_sessions.rs

@@ -0,0 +1,36 @@
+//! `SeaORM` Entity for loco-oauth2 sessions. Hand-written to match the
+//! `o_auth2_sessions` migration (the rest of `_entities/` is codegen; this table
+//! is owned by the loco-oauth2 integration).
+
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq, Serialize, Deserialize)]
+#[sea_orm(table_name = "o_auth2_sessions")]
+pub struct Model {
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    pub session_id: String,
+    pub expires_at: DateTimeUtc,
+    pub user_id: i32,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {
+    #[sea_orm(
+        belongs_to = "super::users::Entity",
+        from = "Column::UserId",
+        to = "super::users::Column::Id",
+        on_update = "Cascade",
+        on_delete = "Cascade"
+    )]
+    Users,
+}
+
+impl Related<super::users::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::Users.def()
+    }
+}

src/models/_entities/prelude.rs

@@ -2,6 +2,7 @@
 
 pub use super::audit_logs::Entity as AuditLogs;
 pub use super::categories::Entity as Categories;
+pub use super::o_auth2_sessions::Entity as OAuth2Sessions;
 pub use super::order_items::Entity as OrderItems;
 pub use super::orders::Entity as Orders;
 pub use super::product_images::Entity as ProductImages;

src/models/mod.rs

@@ -8,6 +8,7 @@ pub mod _entities;
 
 pub mod audit_logs;
 pub mod categories;
+pub mod o_auth2_sessions;
 pub mod order_items;
 pub mod orders;
 pub mod product_images;

src/models/o_auth2_sessions.rs

@@ -0,0 +1,79 @@
+pub use super::_entities::o_auth2_sessions::{ActiveModel, Column, Entity, Model};
+use crate::models::{o_auth2_sessions, users};
+use async_trait::async_trait;
+use chrono::Utc;
+use loco_oauth2::base_oauth2::{basic::BasicTokenResponse, TokenResponse};
+use loco_oauth2::models::oauth2_sessions::OAuth2SessionsTrait;
+use loco_rs::prelude::*;
+use sea_orm::entity::prelude::*;
+
+pub type OAuth2Sessions = Entity;
+
+#[async_trait::async_trait]
+impl ActiveModelBehavior for ActiveModel {
+    async fn before_save<C>(self, _db: &C, insert: bool) -> std::result::Result<Self, DbErr>
+    where
+        C: ConnectionTrait,
+    {
+        if !insert && self.updated_at.is_unchanged() {
+            let mut this = self;
+            this.updated_at = sea_orm::ActiveValue::Set(Utc::now());
+            Ok(this)
+        } else {
+            Ok(self)
+        }
+    }
+}
+
+#[async_trait]
+impl OAuth2SessionsTrait<users::Model> for Model {
+    /// Whether the session identified by `session_id` has expired.
+    async fn is_expired(db: &DatabaseConnection, session_id: &str) -> ModelResult<bool> {
+        let session = o_auth2_sessions::Entity::find()
+            .filter(o_auth2_sessions::Column::SessionId.eq(session_id))
+            .one(db)
+            .await?
+            .ok_or_else(|| ModelError::EntityNotFound)?;
+        Ok(session.expires_at < Utc::now())
+    }
+
+    /// Create or refresh the session row for `user` from the provider token.
+    async fn upsert_with_oauth2(
+        db: &DatabaseConnection,
+        token: &BasicTokenResponse,
+        user: &users::Model,
+    ) -> ModelResult<Self> {
+        let txn = db.begin().await?;
+        let session_id = token.access_token().secret().clone();
+        let expires_at = Utc::now()
+            + token
+                .expires_in()
+                .unwrap_or(std::time::Duration::from_secs(3600));
+
+        let session = match o_auth2_sessions::Entity::find()
+            .filter(o_auth2_sessions::Column::UserId.eq(user.id))
+            .one(&txn)
+            .await?
+        {
+            Some(session) => {
+                let mut session: o_auth2_sessions::ActiveModel = session.into();
+                session.session_id = ActiveValue::set(session_id);
+                session.expires_at = ActiveValue::set(expires_at);
+                session.updated_at = ActiveValue::set(Utc::now());
+                session.update(&txn).await?
+            }
+            None => {
+                o_auth2_sessions::ActiveModel {
+                    session_id: ActiveValue::set(session_id),
+                    expires_at: ActiveValue::set(expires_at),
+                    user_id: ActiveValue::set(user.id),
+                    ..Default::default()
+                }
+                .insert(&txn)
+                .await?
+            }
+        };
+        txn.commit().await?;
+        Ok(session)
+    }
+}

src/models/users.rs

@@ -1,10 +1,13 @@
 use async_trait::async_trait;
 use chrono::{offset::Local, Duration};
+use loco_oauth2::models::users::OAuth2UserTrait;
 use loco_rs::{auth::jwt, hash, prelude::*};
+use passwords::PasswordGenerator;
 use serde::{Deserialize, Serialize};
 use serde_json::Map;
 use uuid::Uuid;
 
+use crate::models::_entities::o_auth2_sessions;
 pub use crate::models::_entities::users::{self, ActiveModel, Entity, Model};
 
 pub const MAGIC_LINK_LENGTH: i8 = 32;
@@ -367,3 +370,93 @@ impl ActiveModel {
         self.update(db).await.map_err(ModelError::from)
     }
 }
+
+/// Google OpenID Connect user profile (the fields our scopes request).
+/// <https://developers.google.com/identity/openid-connect/openid-connect#obtainuserinfo>
+#[derive(Serialize, Deserialize, Clone, Debug)]
+pub struct OAuth2UserProfile {
+    pub email: String,
+    pub name: String,
+    pub sub: String,
+    pub email_verified: bool,
+    pub given_name: Option<String>,
+    pub family_name: Option<String>,
+    pub picture: Option<String>,
+    pub locale: Option<String>,
+}
+
+#[async_trait]
+impl OAuth2UserTrait<OAuth2UserProfile> for Model {
+    /// Resolve the user behind an active OAuth2 session id.
+    async fn find_by_oauth2_session_id(
+        db: &DatabaseConnection,
+        session_id: &str,
+    ) -> ModelResult<Self> {
+        let session = o_auth2_sessions::Entity::find()
+            .filter(o_auth2_sessions::Column::SessionId.eq(session_id))
+            .one(db)
+            .await?
+            .ok_or_else(|| ModelError::EntityNotFound)?;
+        users::Entity::find_by_id(session.user_id)
+            .one(db)
+            .await?
+            .ok_or_else(|| ModelError::EntityNotFound)
+    }
+
+    /// Find-or-create the local user for a verified OAuth2 profile.
+    ///
+    /// Per security advisory LOC-2025-04, OAuth2-created accounts get a strong
+    /// RANDOM password (never the provider `sub`) — they sign in via the
+    /// provider, and the random secret just satisfies the NOT NULL column.
+    /// Google has already verified the email, so we mark it verified.
+    async fn upsert_with_oauth(
+        db: &DatabaseConnection,
+        profile: &OAuth2UserProfile,
+    ) -> ModelResult<Self> {
+        let txn = db.begin().await?;
+        let user = match users::Entity::find()
+            .filter(users::Column::Email.eq(&profile.email))
+            .one(&txn)
+            .await?
+        {
+            Some(user) => user,
+            None => {
+                let password = PasswordGenerator::new()
+                    .length(16)
+                    .numbers(true)
+                    .lowercase_letters(true)
+                    .uppercase_letters(true)
+                    .symbols(true)
+                    .exclude_similar_characters(true)
+                    .strict(true)
+                    .generate_one()
+                    .map_err(|e| ModelError::Any(e.into()))?;
+                let password_hash =
+                    hash::hash_password(&password).map_err(|e| ModelError::Any(e.into()))?;
+                users::ActiveModel {
+                    email: ActiveValue::set(profile.email.to_string()),
+                    name: ActiveValue::set(profile.name.to_string()),
+                    email_verified_at: ActiveValue::set(Some(Local::now().into())),
+                    password: ActiveValue::set(password_hash),
+                    ..Default::default()
+                }
+                .insert(&txn)
+                .await
+                .map_err(|e| {
+                    tracing::error!(error = %e, "failed to create OAuth2 user");
+                    ModelError::Any(e.into())
+                })?
+            }
+        };
+        txn.commit().await?;
+        Ok(user)
+    }
+
+    /// Required by the trait; mirrors the inherent [`Model::generate_jwt`]
+    /// (inlined to avoid the inherent/trait name clash).
+    fn generate_jwt(&self, secret: &str, expiration: &u64) -> ModelResult<String> {
+        jwt::JWT::new(secret)
+            .generate_token(*expiration, self.pid.to_string(), Map::new())
+            .map_err(ModelError::from)
+    }
+}