feat: complete link/unlink flow for social accts

Signed-off-by: miguel456 <me@nogueira.codes>

app/Http/Controllers/Auth/DiscordController.php

@@ -26,8 +26,10 @@ use App\Http\Controllers\Controller;
 use App\User;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Str;
 use Laravel\Socialite\Facades\Socialite;
+use Laravel\Socialite\Two\InvalidStateException;
 
 class DiscordController extends Controller
 {
@@ -41,7 +43,20 @@ class DiscordController extends Controller
 
     public function discordCallback() {
 
-        $discordUser = Socialite::driver('discord')->user();
+
+        try {
+
+            $discordUser = Socialite::driver('discord')->user();
+
+        } catch (InvalidStateException $stateException) {
+            Log::warning('Invalid state for social authentication: ', [
+                'message' => $stateException->getMessage(),
+                'ua' => request()->userAgent(),
+                'ip' => request()->ip()
+            ]);
+            return redirect(route('discordRedirect'));
+        }
+
         $appUser = User::where('email', $discordUser->getEmail())->first();
 
         if ($appUser) {

app/Http/Controllers/UserController.php

@@ -45,8 +45,11 @@ use App\Traits\HandlesAccountDeletion;
 use App\Traits\ReceivesAccountTokens;
 use App\User;
 use Google2FA;
+use Illuminate\Contracts\Foundation\Application;
 use Illuminate\Http\Client\RequestException;
+use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
+use Illuminate\Routing\Redirector;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Log;
@@ -248,6 +251,32 @@ class UserController extends Controller
     }
 
 
+    /**
+     * Sets a new password for the user.
+     *
+     * @param SetNewPasswordRequest $request
+     * @return Application|RedirectResponse|Redirector
+     */
+    public function setPassword(SetNewPasswordRequest $request) {
+
+        if (!Auth::user()->hasPassword()) {
+
+            Auth::user()->password = Hash::make($request->newpass);
+            Auth::user()->save();
+
+            Auth::logout();
+            $request->session()->invalidate();
+            $request->session()->regenerateToken();
+
+            return redirect(route('login'));
+        }
+
+        return redirect()
+            ->back()
+            ->with('error', __('Your account already has a password.'));
+    }
+
+
     /**
      * Sets a user's password and removes their discord information from storage
      *
@@ -255,35 +284,34 @@ class UserController extends Controller
      * @param SetNewPasswordRequest $request
      * @return \Illuminate\Contracts\Foundation\Application|\Illuminate\Http\RedirectResponse|\Illuminate\Routing\Redirector
      */
-    public function setUnlinkPassword(SetNewPasswordRequest $request, DiscordService $discordService)
+    public function unlinkDiscordAccount(Request $request, DiscordService $discordService)
     {
-        Auth::user()->password = Hash::make($request->newpass);
-        Auth::user()->save();
+        if ($request->user()->hasPassword()) {
+            try {
+                $discordService->revokeAccountTokens(Auth::user());
+                Log::warning('Revoking social account tokens, user initiated', [
+                    'user' => Auth::user()->email
+                ]);
+            } catch (RequestException $requestException) {
 
-        try {
-            $discordService->revokeAccountTokens(Auth::user());
-            Log::warning('Revoking social account tokens, user initiated', [
-                'user' => Auth::user()->email
-            ]);
-        } catch (RequestException $requestException) {
+                if ($requestException->getCode() == 401) {
+                    return redirect(route('discordRedirect'));
+                }
 
-            if ($requestException->getCode() == 401) {
-                return redirect(route('discordRedirect'));
+                Log::error('Error while trying to revoke Discord credentials', [$requestException->getMessage()]);
+                return redirect()
+                    ->back()
+                    ->with('error', __('An unknown error ocurred. Please try again later.'));
             }
 
-            Log::error('Error while trying to revoke Discord credentials', [$requestException->getMessage()]);
-            return redirect()
-                ->back()
-                ->with('error', __('An unknown error ocurred. Please try again later.'));
+            $request->session()->flash('success', __('Discord account unlinked successfully. Link it again by re-authorizing the app with the same account in the login screen, or through your account settings.'));
+            return redirect()->back();
         }
 
+        return redirect()
+            ->back()
+            ->with('error', __('Please set a password for your account first before trying to unlink Discord.'));
 
-        Auth::logout();
-        $request->session()->invalidate();
-        $request->session()->regenerateToken();
-
-        $request->session()->flash('success', 'Discord account unlinked! You may now login with your Discord email and brand new password.');
-        return redirect(route('login'));
     }
 
 

app/Http/Requests/SetNewPasswordRequest.php

@@ -28,7 +28,7 @@ class SetNewPasswordRequest extends FormRequest
     public function rules()
     {
         return [
-            'newpass' => 'required|string|min:10|confirmed'
+            'newpass' => 'required|string|min:10|confirmed',
         ];
     }
 }