external_controller.rb

# BigBlueButton open source conferencing system - http://www.bigbluebutton.org/.
#
# Copyright (c) 2022 BigBlueButton Inc. and by respective authors (see below).
#
# This program is free software; you can redistribute it and/or modify it under the
# terms of the GNU Lesser General Public License as published by the Free Software
# Foundation; either version 3.0 of the License, or (at your option) any later
# version.
#
# Greenlight is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
# PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public License along
# with Greenlight; if not, see <http://www.gnu.org/licenses/>.

# frozen_string_literal: true

class ExternalController < ApplicationController
  include ClientRoutable

  skip_before_action :verify_authenticity_token

  # GET 'auth/:provider/callback'
  # Creates the user using the information received through the external auth method
  def create_user
    provider = current_provider

    credentials = request.env['omniauth.auth']

    user_info = build_user_info(credentials)

    user = User.find_by(external_id: credentials['uid'], provider:)
    new_user = user.blank?

    registration_method = SettingGetter.new(setting_name: 'RegistrationMethod', provider: current_provider).call

    # Check if they have a valid token only if a new sign up
    if new_user && registration_method == SiteSetting::REGISTRATION_METHODS[:invite] && !valid_invite_token(email: user_info[:email])
      return redirect_to root_path(error: Rails.configuration.custom_error_msgs[:invite_token_invalid])
    end

    # Create the user if they dont exist
    if new_user
      user = UserCreator.new(user_params: user_info, provider: current_provider, role: default_role).call
      user.save!
      create_default_room(user)
    end

    if SettingGetter.new(setting_name: 'ResyncOnLogin', provider:).call
      user.assign_attributes(user_info.except(:language)) # Don't reset the user's language
      user.save! if user.changed?
    end

    # Set to pending if registration method is approval
    if registration_method == SiteSetting::REGISTRATION_METHODS[:approval]
      user.pending! if new_user
      return redirect_to pending_path if user.pending?
    end

    user.generate_session_token!
    session[:session_token] = user.session_token

    # TODO: - Ahmad: deal with errors

    redirect_location = cookies.delete(:location)

    return redirect_to redirect_location, allow_other_host: false if redirect_location&.match?('\/rooms\/\w{3}-\w{3}-\w{3}(-\w{3})?\/join\z')

    redirect_to root_path