feat(auth): link credentials users with OIDC

packages/auth/test/adapter.spec.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "vitest";
 
-import { users } from "@homarr/db/schema";
+import { eq } from "@homarr/db";
+import { accounts, apiKeys, groupMembers, groups, users } from "@homarr/db/schema";
 import { createDb } from "@homarr/db/test";
 
 import { createAdapter } from "../adapter";
@@ -64,4 +65,91 @@ describe("createAdapter should create drizzle adapter", () => {
     // Assert
     await expect(actAsync()).rejects.toThrow("Unable to get user by email for unknown provider");
   });
+
+  test("getUserByEmail should return a credentials user for oidc when credentials linking is enabled", async () => {
+    const db = createDb();
+    const adapter = createAdapter(db, "oidc", true);
+    const email = "test@example.com";
+    await db.insert(users).values({ id: "credentials-user", name: "test", email, provider: "credentials" });
+
+    const user = await adapter.getUserByEmail?.(email);
+
+    expect(user?.id).toBe("credentials-user");
+  });
+
+  test("getUserByEmail should not return credentials users for non-oidc providers", async () => {
+    const db = createDb();
+    const adapter = createAdapter(db, "ldap", true);
+    const email = "test@example.com";
+    await db.insert(users).values({ id: "credentials-user", name: "test", email, provider: "credentials" });
+
+    const user = await adapter.getUserByEmail?.(email);
+
+    expect(user).toBeNull();
+  });
+
+  test("getUserByEmail should prefer an existing oidc user over a credentials user", async () => {
+    const db = createDb();
+    const adapter = createAdapter(db, "oidc", true);
+    const email = "test@example.com";
+    await db.insert(users).values([
+      { id: "credentials-user", name: "credentials", email, provider: "credentials" },
+      { id: "oidc-user", name: "oidc", email, provider: "oidc" },
+    ]);
+
+    const user = await adapter.getUserByEmail?.(email);
+
+    expect(user?.id).toBe("oidc-user");
+  });
+
+  test("linkAccount should preserve the credentials user and their data", async () => {
+    const db = createDb();
+    const adapter = createAdapter(db, "oidc", true);
+    const email = "test@example.com";
+    await db.insert(users).values({
+      id: "credentials-user",
+      name: "test",
+      email,
+      password: "hashed-password",
+      provider: "credentials",
+      colorScheme: "light",
+      completedBoardTour: true,
+    });
+    await db.insert(groups).values({ id: "group", name: "Test group", position: 1 });
+    await db.insert(groupMembers).values({ groupId: "group", userId: "credentials-user" });
+    await db.insert(apiKeys).values({ id: "api-key", apiKey: "secret", userId: "credentials-user" });
+
+    const user = await adapter.getUserByEmail?.(email);
+    if (!user) throw new Error("Expected credentials user to be found for OIDC linking");
+    await adapter.linkAccount?.({
+      userId: user.id,
+      type: "oidc",
+      provider: "oidc",
+      providerAccountId: "oidc-subject",
+    });
+
+    const linkedUser = await db.query.users.findFirst({ where: eq(users.id, "credentials-user") });
+    const account = await db.query.accounts.findFirst({ where: eq(accounts.providerAccountId, "oidc-subject") });
+    const membership = await db.query.groupMembers.findFirst({
+      where: eq(groupMembers.userId, "credentials-user"),
+    });
+    const apiKey = await db.query.apiKeys.findFirst({ where: eq(apiKeys.userId, "credentials-user") });
+    const userByAccount = await adapter.getUserByAccount?.({
+      provider: "oidc",
+      providerAccountId: "oidc-subject",
+    });
+    const allUsers = await db.query.users.findMany();
+    expect(linkedUser).toMatchObject({
+      id: "credentials-user",
+      password: "hashed-password",
+      provider: "credentials",
+      colorScheme: "light",
+      completedBoardTour: true,
+    });
+    expect(account?.userId).toBe("credentials-user");
+    expect(membership?.groupId).toBe("group");
+    expect(apiKey?.id).toBe("api-key");
+    expect(userByAccount?.id).toBe("credentials-user");
+    expect(allUsers).toHaveLength(1);
+  });
 });

packages/auth/test/events.spec.ts

@@ -135,7 +135,7 @@ describe("createSignInEventHandler should create signInEventHandler", () => {
     test("should add missing group membership", async () => {
       // Arrange
       const db = createDb();
-      await createUserAsync(db);
+      await createUserAsync(db, "oidc");
       await createGroupAsync(db);
       const eventHandler = createSignInEventHandler(db);
 
@@ -155,7 +155,7 @@ describe("createSignInEventHandler should create signInEventHandler", () => {
     test("should remove group membership", async () => {
       // Arrange
       const db = createDb();
-      await createUserAsync(db);
+      await createUserAsync(db, "oidc");
       await createGroupAsync(db);
       await db.insert(groupMembers).values({
         userId: "1",
@@ -179,7 +179,7 @@ describe("createSignInEventHandler should create signInEventHandler", () => {
     test("should not remove group membership for everyone group", async () => {
       // Arrange
       const db = createDb();
-      await createUserAsync(db);
+      await createUserAsync(db, "oidc");
       await createGroupAsync(db, everyoneGroup);
       await db.insert(groupMembers).values({
         userId: "1",
@@ -204,7 +204,7 @@ describe("createSignInEventHandler should create signInEventHandler", () => {
       // Arrange
       mockEnv.AUTH_OIDC_GROUPS_LOCAL_MANAGEMENT = true;
       const db = createDb();
-      await createUserAsync(db);
+      await createUserAsync(db, "oidc");
       await createGroupAsync(db);
       const eventHandler = createSignInEventHandler(db);
 
@@ -229,10 +229,10 @@ describe("createSignInEventHandler should create signInEventHandler", () => {
     ["ldap" as const, { name: "test-new" }, undefined],
     ["oidc" as const, { name: "test" }, { preferred_username: "test-new" }],
     ["oidc" as const, { name: "test" }, { preferred_username: "test@example.com", name: "test-new" }],
-  ])("signInEventHandler should update username for %s provider", async (_provider, user, profile) => {
+  ])("signInEventHandler should update username for %s provider", async (provider, user, profile) => {
     // Arrange
     const db = createDb();
-    await createUserAsync(db);
+    await createUserAsync(db, provider);
     const eventHandler = createSignInEventHandler(db);
 
     // Act
@@ -251,6 +251,32 @@ describe("createSignInEventHandler should create signInEventHandler", () => {
     });
     expect(dbUser?.name).toBe("test-new");
   });
+  test("signInEventHandler should preserve credentials-owned data when the user signs in with linked oidc", async () => {
+    const db = createDb();
+    await createUserAsync(db, "credentials", "local-avatar");
+    await createGroupAsync(db);
+    await db.insert(groupMembers).values({ userId: "1", groupId: "1" });
+    const eventHandler = createSignInEventHandler(db);
+
+    await eventHandler?.({
+      user: { id: "1", name: "test" },
+      profile: {
+        preferred_username: "oidc-name",
+        picture: "oidc-avatar",
+        someRandomGroupsKey: [],
+      },
+      account: null,
+    });
+
+    const dbUser = await db.query.users.findFirst({ where: eq(users.id, "1") });
+    const membership = await db.query.groupMembers.findFirst({ where: eq(groupMembers.userId, "1") });
+    expect(dbUser).toMatchObject({
+      name: "test",
+      image: "local-avatar",
+      provider: "credentials",
+    });
+    expect(membership?.groupId).toBe("1");
+  });
   test("signInEventHandler should set color-scheme cookie", async () => {
     // Arrange
     const db = createDb();
@@ -275,11 +301,17 @@ describe("createSignInEventHandler should create signInEventHandler", () => {
   });
 });
 
-const createUserAsync = async (db: Database) =>
+const createUserAsync = async (
+  db: Database,
+  provider: "credentials" | "ldap" | "oidc" = "credentials",
+  image?: string,
+) =>
   await db.insert(users).values({
     id: "1",
     name: "test",
     colorScheme: "dark",
+    image,
+    provider,
   });
 
 const createGroupAsync = async (db: Database, name = "test") =>