GitHub OAuth Authentication

npx vendure add -p GitHubAuthPlugin

import { AuthenticationStrategy, ExternalAuthenticationService, Injector, RequestContext, User } from '@vendure/core';import { DocumentNode } from 'graphql';import gql from 'graphql-tag';export interface GitHubAuthData {  code: string;  state: string;}export interface GitHubAuthOptions {  clientId: string;  clientSecret: string;}export class GitHubAuthenticationStrategy implements AuthenticationStrategy<GitHubAuthData> {  readonly name = 'github';  private externalAuthenticationService: ExternalAuthenticationService;  constructor(private options: GitHubAuthOptions) {}  init(injector: Injector) {    // Get the service we'll use to create/find customer accounts    this.externalAuthenticationService = injector.get(ExternalAuthenticationService);  }  defineInputType(): DocumentNode {    // Define the GraphQL input type for the authenticate mutation    return gql`      input GitHubAuthInput {        code: String!        state: String!      }    `;  }  async authenticate(ctx: RequestContext, data: GitHubAuthData): Promise<User | false> {    const { code, state } = data;    // Step 1: Exchange the authorization code for an access token    const tokenResponse = await fetch('https://github.com/login/oauth/access_token', {      method: 'POST',      headers: {        'Accept': 'application/json',        'Content-Type': 'application/json',      },      body: JSON.stringify({        client_id: this.options.clientId,        client_secret: this.options.clientSecret,        code,        state,      }),    });    const tokenData = await tokenResponse.json();    if (tokenData.error) {      throw new Error(`GitHub OAuth error: ${tokenData.error_description}`);    }    // Step 2: Use the access token to get user info from GitHub    const userResponse = await fetch('https://api.github.com/user', {      headers: {        'Authorization': `Bearer ${tokenData.access_token}`,        'Accept': 'application/vnd.github.v3+json',      },    });    const user = await userResponse.json();    if (!user.login) {      throw new Error('Unable to retrieve user information from GitHub');    }    // Step 3: Fetch the user's email addresses to determine the primary, verified email.    // This requires the `user:email` OAuth scope. GitHub does NOT guarantee that a user's    // email is verified, so we must read the `verified` flag rather than assume it.    const emailsResponse = await fetch('https://api.github.com/user/emails', {      headers: {        'Authorization': `Bearer ${tokenData.access_token}`,        'Accept': 'application/vnd.github.v3+json',      },    });    const emails = (await emailsResponse.json()) as Array<{      email: string;      primary: boolean;      verified: boolean;    }>;    const primaryEmail = Array.isArray(emails) ? emails.find(e => e.primary) : undefined;    if (!primaryEmail) {      throw new Error('Unable to retrieve a primary email address from GitHub');    }    // Step 4: Check if this GitHub user already has a Vendure account    const existingCustomer = await this.externalAuthenticationService.findCustomerUser(      ctx,      this.name,      user.login, // GitHub username as external identifier    );    if (existingCustomer) {      // User exists, log them in      return existingCustomer;    }    // Step 5: Create a new customer account for first-time GitHub users.    // We pass `verified: primaryEmail.verified` so that this external identity is only    // linked to a pre-existing account (one with the same email) when GitHub has actually    // verified that the user owns the email. Passing `verified: true` unconditionally here    // would risk account takeover — see the security note in the Authentication guide.    const newCustomer = await this.externalAuthenticationService.createCustomerAndUser(ctx, {      strategy: this.name,      externalIdentifier: user.login, // Store GitHub username      verified: primaryEmail.verified,      emailAddress: primaryEmail.email,      firstName: user.name?.split(' ')[0] || user.login,      lastName: user.name?.split(' ').slice(1).join(' ') || '',    });    return newCustomer;  }}