Use user.FullName in Oauth2 id_token response (#6071)

Cherry-pick of [gitea#32542](https://github.com/go-gitea/gitea/pull/32542).

This makes /login/oauth/authorize behave the same way as the /login/oauth/userinfo endpoint. Previously, `name` property of the returned OIDCToken used to depend on the UI.DefaultShowFullName setting (I don't think this is desired behavior). Even worse, the `userinfo` endpoint can return basically the same data, but the `name` value there always returned `FullName`, even if it's empty (no fallback to `Name`).

A few notes:

I'm not sure what branch to target with this PR, please correct me if I'm chose the wrong one.

The deleted lines in the tests are duplicates, there's a copy of the whole thing just below, the only difference being the `Name` field (used to test the dependency on the UI.DefaultShowFullName setting)

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
- [ ] in their respective `*_test.go` for unit tests.
- [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
- [ ] in `web_src/js/*.test.js` if it can be unit tested.
- [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [ ] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6071
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Baltazár Radics <baltazar.radics@gmail.com>
Co-committed-by: Baltazár Radics <baltazar.radics@gmail.com>

authored by

Baltazár Radics

Baltazár Radics and committed by

Earl Warren 2 years ago 0734596e 6b9168c1

+11 -29

2 changed files

expand all

routers

web

auth

oauth.go

oauth_test.go

+2 -2

routers/web/auth/oauth.go

··· 231 231 Nonce: grant.Nonce, 232 232 } 233 233 if grant.ScopeContains("profile") { 234 - idToken.Name = user.GetDisplayName() 234 + idToken.Name = user.DisplayName() 235 235 idToken.PreferredUsername = user.Name 236 236 idToken.Profile = user.HTMLURL() 237 237 idToken.Picture = user.AvatarLink(ctx) ··· 305 305 306 306 response := &userInfoResponse{ 307 307 Sub: fmt.Sprint(ctx.Doer.ID), 308 - Name: ctx.Doer.FullName, 308 + Name: ctx.Doer.DisplayName(), 309 309 Username: ctx.Doer.Name, 310 310 Email: ctx.Doer.Email, 311 311 Picture: ctx.Doer.AvatarLink(ctx),

+9 -27

routers/web/auth/oauth_test.go

··· 10 10 "code.gitea.io/gitea/models/db" 11 11 "code.gitea.io/gitea/models/unittest" 12 12 user_model "code.gitea.io/gitea/models/user" 13 - "code.gitea.io/gitea/modules/setting" 13 + "code.gitea.io/gitea/modules/timeutil" 14 14 "code.gitea.io/gitea/services/auth/source/oauth2" 15 15 16 16 "github.com/golang-jwt/jwt/v5" ··· 67 67 68 68 // Scopes: openid profile email 69 69 oidcToken = createAndParseToken(t, grants[0]) 70 - assert.Equal(t, user.Name, oidcToken.Name) 71 - assert.Equal(t, user.Name, oidcToken.PreferredUsername) 72 - assert.Equal(t, user.HTMLURL(), oidcToken.Profile) 73 - assert.Equal(t, user.AvatarLink(db.DefaultContext), oidcToken.Picture) 74 - assert.Equal(t, user.Website, oidcToken.Website) 75 - assert.Equal(t, user.UpdatedUnix, oidcToken.UpdatedAt) 76 - assert.Equal(t, user.Email, oidcToken.Email) 77 - assert.Equal(t, user.IsActive, oidcToken.EmailVerified) 78 - 79 - // set DefaultShowFullName to true 80 - oldDefaultShowFullName := setting.UI.DefaultShowFullName 81 - setting.UI.DefaultShowFullName = true 82 - defer func() { 83 - setting.UI.DefaultShowFullName = oldDefaultShowFullName 84 - }() 85 - 86 - // Scopes: openid profile email 87 - oidcToken = createAndParseToken(t, grants[0]) 88 - assert.Equal(t, user.FullName, oidcToken.Name) 89 - assert.Equal(t, user.Name, oidcToken.PreferredUsername) 90 - assert.Equal(t, user.HTMLURL(), oidcToken.Profile) 91 - assert.Equal(t, user.AvatarLink(db.DefaultContext), oidcToken.Picture) 92 - assert.Equal(t, user.Website, oidcToken.Website) 93 - assert.Equal(t, user.UpdatedUnix, oidcToken.UpdatedAt) 94 - assert.Equal(t, user.Email, oidcToken.Email) 95 - assert.Equal(t, user.IsActive, oidcToken.EmailVerified) 70 + assert.Equal(t, "User Five", oidcToken.Name) 71 + assert.Equal(t, "user5", oidcToken.PreferredUsername) 72 + assert.Equal(t, "https://try.gitea.io/user5", oidcToken.Profile) 73 + assert.Equal(t, "https://try.gitea.io/assets/img/avatar_default.png", oidcToken.Picture) 74 + assert.Equal(t, "", oidcToken.Website) 75 + assert.Equal(t, timeutil.TimeStamp(0), oidcToken.UpdatedAt) 76 + assert.Equal(t, "user5@example.com", oidcToken.Email) 77 + assert.True(t, oidcToken.EmailVerified) 96 78 } 97 79 98 80 func TestEncodeCodeChallenge(t *testing.T) {

Configure Feed

Configure Feed