website/server/src/auth/providers/registry.js

// ── Provider registry ──────────────────────────────────────────────────────
//
// Turns stored auth_providers rows into live provider instances, and owns the
// "which providers are usable" health logic. The authentication layer talks to
// the registry, never to a specific provider class, so adding a provider is just
// a new entry in KINDS.
//
// Built-ins (google, discord) always "exist" as defaults even before an admin
// creates a row, so the admin UI can render their config form. A provider is only
// shown to end users (login page) when it is enabled AND its config validates.

const GoogleProvider = require('./google.provider')
const DiscordProvider = require('./discord.provider')
const GenericOidcProvider = require('./genericOidc.provider')
const SteamProvider = require('./steam.provider')
const authProviders = require('../../model/authProviders/authProviders.model')

// kind → provider class.
const KINDS = {
  google: GoogleProvider,
  discord: DiscordProvider,
  oidc: GenericOidcProvider,
  oauth2: GenericOidcProvider,
  steam: SteamProvider,
}

// Built-in providers and their fixed display metadata. Endpoints are in the
// provider classes; only enabled/clientId/secret are admin-configurable.
const BUILTINS = [
  { id: 'google', kind: 'google', name: 'Google', priority: 1 },
  { id: 'discord', kind: 'discord', name: 'Discord', priority: 2 },
  // OpenID 2.0, not OAuth2 (STEAM_SIGNIN.md §3): no client id, and the "secret"
  // is the Steam Web API key it cannot be enabled without (D394).
  { id: 'steam', kind: 'steam', name: 'Steam', priority: 3 },
]

const BUILTIN_IDS = new Set(BUILTINS.map((b) => b.id))

function isBuiltin(id) {
  return BUILTIN_IDS.has(id)
}

// Providers whose callback is OpenID 2.0 (`openid.*` fields) rather than an OAuth2
// `code`. Steam is the only one, and only as the built-in: a custom provider can
// only be oidc/oauth2, so the kind is known from the id before any row is read.
function isOpenId(id) {
  return id === 'steam'
}

// Providers that never sign anybody up, whatever player_registration says (D395).
function neverProvisions(kind) {
  return kind === 'steam'
}

// Instantiate a provider from a config row (secret already decrypted by the
// model as `client_secret`). Returns null for an unknown kind.
function instantiate(row) {
  const Klass = KINDS[row.kind]
  if (!Klass) return null
  return new Klass({
    id: row.id,
    kind: row.kind,
    name: row.name,
    enabled: row.enabled,
    clientId: row.client_id,
    clientSecret: row.client_secret, // present only via getWithSecret
    authorizeUrl: row.authorize_url,
    tokenUrl: row.token_url,
    userinfoUrl: row.userinfo_url,
    scopes: row.scopes,
    priority: row.priority,
  })
}

// Load a ready-to-use provider instance (secret decrypted) by id, or null.
async function load(id) {
  const row = await authProviders.getWithSecret(id)
  if (!row) return null
  return instantiate(row)
}

// Validate a config row's completeness. Built-ins need client_id + a secret;
// custom (oidc/oauth2) also need the three endpoint URLs. Returns { valid, missing }.
function validateConfig(row) {
  const missing = []
  if (row.kind === 'steam') {
    // No client id; the Web API key is the one thing it needs (D394).
    if (!row.client_secret_enc && !row.client_secret) missing.push('api_key')
    return { valid: missing.length === 0, missing }
  }
  if (!row.client_id) missing.push('client_id')
  // A stored secret shows up as client_secret_enc on plain rows, or client_secret
  // on decrypted rows — accept either as "has a secret".
  if (!row.client_secret_enc && !row.client_secret) missing.push('client_secret')
  if (row.kind === 'oidc' || row.kind === 'oauth2') {
    if (!row.authorize_url) missing.push('authorize_url')
    if (!row.token_url) missing.push('token_url')
    if (!row.userinfo_url) missing.push('userinfo_url')
  }
  return { valid: missing.length === 0, missing }
}

// All configured rows merged with built-in defaults (so google/discord always
// appear for the admin UI even with no row yet). Each entry carries health.
async function listConfigured() {
  const rows = await authProviders.list()
  const byId = new Map(rows.map((r) => [r.id, r]))
  const out = []
  // Built-ins first, in their fixed order.
  for (const b of BUILTINS) {
    const row = byId.get(b.id) || {
      id: b.id, kind: b.kind, name: b.name, enabled: 0,
      client_id: null, client_secret_enc: null, priority: b.priority,
    }
    byId.delete(b.id)
    out.push({ ...row, builtin: true, health: validateConfig(row) })
  }
  // Then any custom providers.
  for (const row of byId.values()) {
    out.push({ ...row, builtin: false, health: validateConfig(row) })
  }
  return out
}

// Providers that should appear to end users: enabled AND valid. Shaped for the
// public discovery endpoint and sorted by priority.
async function listEnabledValid() {
  const configured = await listConfigured()
  return configured
    .filter((p) => p.enabled && validateConfig(p).valid)
    .sort((a, b) => (a.priority ?? 100) - (b.priority ?? 100))
    .map((p) => ({
      id: p.id,
      name: p.name,
      icon: p.kind, // 'google' | 'discord' | 'steam' | 'oidc' | 'oauth2'
      loginUrl: `/api/v1/auth/sso/${p.id}/start`,
      priority: p.priority ?? 100,
    }))
}

module.exports = {
  KINDS,
  BUILTINS,
  isBuiltin,
  isOpenId,
  neverProvisions,
  instantiate,
  load,
  validateConfig,
  listConfigured,
  listEnabledValid,
}