use axum::{extract::State, http::HeaderMap, response::IntoResponse, Json};
use chrono::{Duration, Utc};
use std::sync::Arc;
use crate::callback::{AuthCallback, AuthCallbackPayload};
use crate::errors::AppError;
use crate::handlers::auth::{
call_authenticated_callback_with_timeout, call_registered_callback_with_timeout,
};
use crate::models::{AuthMethod, AuthResponse, GoogleAuthRequest};
use crate::repositories::normalize_email;
use crate::repositories::{
generate_api_key, ApiKeyEntity, AuditEventType, MembershipEntity, SessionEntity,
TransactionalOps, UserEntity,
};
use crate::services::EmailService;
use crate::utils::{
build_json_response_with_cookies, compute_post_login, extract_client_ip_with_fallback,
get_default_org_context, hash_refresh_token, resolve_org_assignment,
user_entity_to_auth_user, PeerIp,
};
use crate::AppState;
pub async fn google_auth<C: AuthCallback, E: EmailService>(
State(state): State<Arc<AppState<C, E>>>,
headers: HeaderMap,
PeerIp(peer_ip): PeerIp,
Json(req): Json<GoogleAuthRequest>,
) -> Result<impl IntoResponse, AppError> {
let enabled = state
.settings_service
.get_bool("auth_google_enabled")
.await
.ok()
.flatten()
.unwrap_or(state.config.google.enabled);
if !enabled {
return Err(AppError::NotFound("Google auth disabled".into()));
}
let client_id = state
.settings_service
.get("auth_google_client_id")
.await
.ok()
.flatten()
.filter(|s| !s.is_empty())
.or_else(|| state.config.google.client_id.clone())
.ok_or_else(|| AppError::Config("Google client ID not configured".into()))?;
state.sanctions_service.check_country_from_request(&headers).await?;
let claims = match (&req.id_token, &req.access_token) {
(Some(id_token), _) => {
state
.google_service
.verify_id_token(id_token, &client_id)
.await?
}
(_, Some(access_token)) => {
state
.google_service
.verify_access_token(access_token)
.await?
}
_ => return Err(AppError::Validation("Either idToken or accessToken is required".into())),
};
let email = claims
.email
.ok_or(AppError::Validation("Email not provided by Google".into()))?;
let normalized_email = normalize_email(&email);
let existing_user = state.user_repo.find_by_google_id(&claims.sub).await?;
let (user, is_new_user, api_key) = if let Some(user) = existing_user {
(user, false, None)
} else if let Some(mut existing) = state.user_repo.find_by_email(&normalized_email).await? {
let now = Utc::now();
existing.google_id = Some(claims.sub);
existing.updated_at = now;
existing.last_login_at = Some(now);
if !existing.auth_methods.contains(&AuthMethod::Google) {
existing.auth_methods.push(AuthMethod::Google);
}
if existing.name.is_none() {
existing.name = claims.name;
}
if existing.picture.is_none() {
existing.picture = claims.picture;
}
let user = state.user_repo.update(existing).await?;
(user, false, None)
} else {
let now = Utc::now();
let mut user = UserEntity {
id: uuid::Uuid::new_v4(),
email: Some(normalized_email),
email_verified: true, password_hash: None,
name: claims.name,
username: None,
picture: claims.picture,
wallet_address: None,
google_id: Some(claims.sub),
apple_id: None,
stripe_customer_id: None,
auth_methods: vec![AuthMethod::Google],
is_system_admin: false,
created_at: now,
updated_at: now,
last_login_at: Some(now),
welcome_completed_at: None,
referral_code: crate::repositories::generate_referral_code(),
referred_by: None,
payout_wallet_address: None,
kyc_status: "none".to_string(),
kyc_verified_at: None,
kyc_expires_at: None,
accreditation_status: "none".to_string(),
accreditation_verified_at: None,
accreditation_expires_at: None,
};
let referrals_enabled = state
.settings_service
.get_bool("feature_referrals_enabled")
.await
.ok()
.flatten()
.unwrap_or(false);
if referrals_enabled {
if let Some(ref code) = req.referral {
match state.user_repo.find_by_referral_code(code).await {
Ok(Some(referrer)) => {
user.referred_by = Some(referrer.id);
}
Ok(None) => {
tracing::debug!(referral_code = %code, "Referral code not found, ignoring");
}
Err(e) => {
tracing::warn!(error = %e, "Failed to look up referral code, ignoring");
}
}
}
}
let org_assignment = resolve_org_assignment(&state, user.id).await?;
let membership = MembershipEntity::new(user.id, org_assignment.org_id, org_assignment.role);
let raw_api_key = generate_api_key();
let api_key_entity = ApiKeyEntity::new(user.id, &raw_api_key, "default");
#[cfg(feature = "postgres")]
let user = if let Some(pool) = state.postgres_pool.as_ref() {
TransactionalOps::create_user_with_membership_and_api_key(
pool, &user, &membership, &api_key_entity,
)
.await?;
user
} else {
let created = state.user_repo.create(user).await?;
state.membership_repo.create(membership).await?;
state.api_key_repo.create(api_key_entity).await?;
created
};
#[cfg(not(feature = "postgres"))]
let user = {
let created = state.user_repo.create(user).await?;
state.membership_repo.create(membership).await?;
state.api_key_repo.create(api_key_entity).await?;
created
};
(user, true, Some(raw_api_key))
};
if is_new_user {
if let Some(referrer_id) = user.referred_by {
if let Err(e) = crate::services::referral_reward_service::issue_signup_reward(
&*state.user_repo,
&*state.credit_repo,
&*state.referral_payout_repo,
&state.settings_service,
&*state.callback,
user.id,
referrer_id,
&state.config.privacy.company_currency,
)
.await
{
tracing::warn!(
user_id = %user.id,
referrer_id = %referrer_id,
error = %e,
"Failed to issue referral signup reward"
);
}
}
}
let memberships = state.membership_repo.find_by_user(user.id).await?;
let token_context = get_default_org_context(&memberships, user.is_system_admin, user.email_verified);
let session_id = uuid::Uuid::new_v4();
let token_pair =
state
.jwt_service
.generate_token_pair_with_context(user.id, session_id, &token_context)?;
let refresh_expiry =
Utc::now() + Duration::seconds(state.jwt_service.refresh_expiry_secs() as i64);
let ip_address =
extract_client_ip_with_fallback(&headers, state.config.server.trust_proxy, peer_ip);
let user_agent = headers
.get(axum::http::header::USER_AGENT)
.and_then(|v| v.to_str().ok())
.map(|s| s.to_string());
let mut session = SessionEntity::new_with_id(
session_id,
user.id,
hash_refresh_token(&token_pair.refresh_token, &state.config.jwt.secret),
refresh_expiry,
ip_address.clone(),
user_agent.clone(),
);
session.last_strong_auth_at = Some(Utc::now());
state.session_repo.create(session).await?;
let auth_user = user_entity_to_auth_user(&user);
let payload = AuthCallbackPayload {
user: auth_user.clone(),
method: AuthMethod::Google,
is_new_user,
session_id: session_id.to_string(),
ip_address,
user_agent,
referral: req.referral.clone(),
};
let callback_data = if is_new_user {
call_registered_callback_with_timeout(&state.callback, &payload).await
} else {
call_authenticated_callback_with_timeout(&state.callback, &payload).await
};
let audit_event = if is_new_user {
AuditEventType::UserRegister
} else {
AuditEventType::UserLogin
};
let _ = state
.audit_service
.log_user_event(audit_event, user.id, Some(&headers))
.await;
let response_tokens = if state.config.cookie.enabled {
None
} else {
Some(token_pair.clone())
};
let response = AuthResponse {
user: auth_user,
tokens: response_tokens,
is_new_user,
callback_data,
api_key,
email_queued: None,
post_login: compute_post_login(&user, &state.settings_service, &*state.totp_repo, &*state.credential_repo, &*state.wallet_material_repo, &*state.storage.pending_wallet_recovery_repo).await,
};
Ok(build_json_response_with_cookies(
&state.config.cookie,
&token_pair,
state.jwt_service.refresh_expiry_secs(),
response,
))
}