Enhance Dynamic User Attribute Handling in OIDC Integration (#885)

* Refactor `updateUser` to Support Dynamic `nameClaim` Configuration

* style: run Prettier to fix lint errors

* Validate NAME_CLAIM in OIDConfig schema

* Refactor userData parsing

---------

Co-authored-by: Nathan Sarrazin <[email protected]>
Co-authored-by: ‘XGungo’ <‘[email protected]’>

.env

@@ -29,13 +29,15 @@ OPENID_CONFIG=`{
   "PROVIDER_URL": "",
   "CLIENT_ID": "",
   "CLIENT_SECRET": "",
-  "SCOPES": ""
+  "SCOPES": "",
+  "NAME_CLAIM": ""
 }`
 
 # /!\ legacy openid settings, prefer the config above
 OPENID_CLIENT_ID=
 OPENID_CLIENT_SECRET=
 OPENID_SCOPES="openid profile" # Add "email" for some providers like Google that do not provide preferred_username
+OPENID_NAME_CLAIM="name" # Change to "username" for some providers that do not provide name
 OPENID_PROVIDER_URL=https://huggingface.co # for Google, use https://accounts.google.com
 OPENID_TOLERANCE=
 OPENID_RESOURCE=

src/lib/server/auth.ts

@@ -6,6 +6,7 @@ import {
 	OPENID_CLIENT_SECRET,
 	OPENID_PROVIDER_URL,
 	OPENID_SCOPES,
+	OPENID_NAME_CLAIM,
 	OPENID_TOLERANCE,
 	OPENID_RESOURCE,
 	OPENID_CONFIG,
@@ -32,12 +33,16 @@ const stringWithDefault = (value: string) =>
 		.default(value)
 		.transform((el) => (el ? el : value));
 
-const OIDConfig = z
+export const OIDConfig = z
 	.object({
 		CLIENT_ID: stringWithDefault(OPENID_CLIENT_ID),
 		CLIENT_SECRET: stringWithDefault(OPENID_CLIENT_SECRET),
 		PROVIDER_URL: stringWithDefault(OPENID_PROVIDER_URL),
 		SCOPES: stringWithDefault(OPENID_SCOPES),
+		NAME_CLAIM: stringWithDefault(OPENID_NAME_CLAIM).refine(
+			(el) => !["preferred_username", "email", "picture", "sub"].includes(el),
+			{ message: "nameClaim cannot be one of the restricted keys." }
+		),
 		TOLERANCE: stringWithDefault(OPENID_TOLERANCE),
 		RESOURCE: stringWithDefault(OPENID_RESOURCE),
 	})

src/routes/login/callback/updateUser.ts

@@ -8,6 +8,7 @@ import { error, type Cookies } from "@sveltejs/kit";
 import crypto from "crypto";
 import { sha256 } from "$lib/utils/sha256";
 import { addWeeks } from "date-fns";
+import { OIDConfig } from "$lib/server/auth";
 
 export async function updateUser(params: {
 	userData: UserinfoResponse;
@@ -38,10 +39,24 @@ export async function updateUser(params: {
 			sub: z.string(),
 			email: z.string().email().optional(),
 		})
+		.setKey(OIDConfig.NAME_CLAIM, z.string())
 		.refine((data) => data.preferred_username || data.email, {
 			message: "Either preferred_username or email must be provided by the provider.",
 		})
-		.parse(userData);
+		.transform((data) => ({
+			...data,
+			name: data[OIDConfig.NAME_CLAIM],
+		}))
+		.parse(userData) as {
+		preferred_username?: string;
+		email?: string;
+		picture?: string;
+		sub: string;
+		name: string;
+	} & Record<string, string>;
+
+	// Dynamically access user data based on NAME_CLAIM from environment
+	// This approach allows us to adapt to different OIDC providers flexibly.
 
 	// check if user already exists
 	const existingUser = await collections.users.findOne({ hfUserId });