OAuth2 Authentication

// CustomOAuth2UserService.loadUser()
1. Decode JWT and extract claims (email, name, sub)
2. Check if user exists in local database by email
3. If not found, create new AppUser with:
   - email (unique identifier)
   - name (from OAuth2)
   - role (ADMIN if email in APP_ADMIN_EMAILS, else USER)
   - createdAt timestamp
4. If found, perform "role healing" (update role if allow-list changed)
5. Return OAuth2User with ROLE_* authority

spring:
  security:
    oauth2:
      client:
        registration:
          google:
            client-id: ${SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_GOOGLE_CLIENT_ID}
            client-secret: ${SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_GOOGLE_CLIENT_SECRET}
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
            scope:
              - openid          # Request ID token (JWT)
              - profile         # Request name and picture
              - email           # Request email address
        provider:
          google:
            authorization-uri: https://accounts.google.com/o/oauth2/v2/auth
            token-uri: https://oauth2.googleapis.com/token
            user-info-uri: https://www.googleapis.com/oauth2/v3/userinfo

# From Google Cloud Console (OAuth2 credential)
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_GOOGLE_CLIENT_ID=<your-client-id>.apps.googleusercontent.com
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_GOOGLE_CLIENT_SECRET=<your-client-secret>

# Admin emails (comma-separated, case-insensitive)
APP_ADMIN_EMAILS=admin@company.com, supervisor@company.de

# Frontend URL for OAuth2 redirects
APP_FRONTEND_BASE_URL=https://inventory.example.com

@Service
public class CustomOAuth2UserService implements OAuth2UserService<OAuth2UserRequest, OAuth2User> {

    protected OAuth2User loadFromProvider(OAuth2UserRequest request) {
        return new DefaultOAuth2UserService().loadUser(request);
    }
    
    @Override
    public OAuth2User loadUser(OAuth2UserRequest request) {
        // 1. Delegate to default service for upstream provider communication
        OAuth2User oauthUser = loadFromProvider(request);
        
        // 2. Extract email and name
        String email = oauthUser.getAttribute("email");
        String name = oauthUser.getAttribute("name");
        
        // 3. Determine role from APP_ADMIN_EMAILS
        boolean isAdmin = readAdminAllowlist().contains(email.toLowerCase());
        Role desiredRole = isAdmin ? Role.ADMIN : Role.USER;
        
        // 4. Create or find user
        AppUser user = userRepository.findByEmail(email)
            .orElseGet(() -> {
                AppUser u = new AppUser();
                u.setEmail(email);
                u.setName(name);
                u.setRole(desiredRole);
                u.setCreatedAt(LocalDateTime.now());
                return userRepository.save(u);
            });
        
        // 5. Role healing: update if allow-list changed
        if (user.getRole() != desiredRole) {
            user.setRole(desiredRole);
            userRepository.save(user);
        }
        
        // 6. Return OAuth2User with ROLE_* authority
        SimpleGrantedAuthority roleAuth = 
            new SimpleGrantedAuthority("ROLE_" + user.getRole().name());
        
        Map<String, Object> attrs = new HashMap<>(oauthUser.getAttributes());
        attrs.put("appRole", user.getRole().name());
        
        return new DefaultOAuth2User(
            Collections.singletonList(roleAuth),
            attrs,
            "email"  // name attribute for OAuth2User.getName()
        );
    }
}

@Component
public class OAuth2LoginSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {
    
    @Override
    public void onAuthenticationSuccess(HttpServletRequest request,
                                        HttpServletResponse response,
                                        Authentication authentication) {
        // 1. Check if already processed (prevent double-redirect)
        if (request.getAttribute("OAUTH2_SUCCESS_REDIRECT_DONE") != null) {
            return;
        }
        request.setAttribute("OAUTH2_SUCCESS_REDIRECT_DONE", true);
        
        // 2. Extract OAuth2 token and user info
        OAuth2AuthenticationToken token = (OAuth2AuthenticationToken) authentication;
        OAuth2User principal = token.getPrincipal();
        
        String email = principal.getAttribute("email");
        String name = principal.getAttribute("name");
        
        // 3. User already provisioned by CustomOAuth2UserService
        // Create or update AppUser if needed
        AppUser user = userRepository.findByEmail(email)
            .orElseGet(() -> {
                AppUser u = new AppUser();
                u.setEmail(email);
                u.setName(name != null ? name : email);
                return userRepository.save(u);
            });
        
        // 4. Audit log
        log.info("Enterprise OAuth2: User {} authenticated successfully", email);
        
        // 5. Validate return URL and redirect
        String baseUrl = props.getFrontend().getBaseUrl();
        String returnUrl = request.getParameter("return");
        String target = baseUrl + "/auth";
        
        if (returnUrl != null && returnUrl.startsWith(baseUrl)) {
            target = returnUrl;  // Validated redirect
        }
        
        getRedirectStrategy().sendRedirect(request, response, target);
    }
}

@Component
public class CookieOAuth2AuthorizationRequestRepository 
        implements AuthorizationRequestRepository<OAuth2AuthorizationRequest> {
    
    public static final String AUTH_REQUEST_COOKIE_NAME = "OAUTH2_AUTH_REQUEST";
    public static final int COOKIE_MAX_AGE = 180;  // 3 minutes
    
    @Override
    public void saveAuthorizationRequest(OAuth2AuthorizationRequest authRequest,
                                         HttpServletRequest request,
                                         HttpServletResponse response) {
        String json = writeJson(authRequest);
        String encoded = Base64.getUrlEncoder().withoutPadding().encodeToString(json.getBytes());
        
        // Create secure cookie
        Cookie cookie = new Cookie(AUTH_REQUEST_COOKIE_NAME, encoded);
        cookie.setPath("/");
        cookie.setSecure(true);           // HTTPS only
        cookie.setHttpOnly(true);         // No JavaScript access
        cookie.setMaxAge(COOKIE_MAX_AGE); // 3 minutes
        cookie.setSameSite(CookieSameSite.NONE);  // Cross-site
        
        response.addCookie(cookie);
    }
    
    @Override
    public OAuth2AuthorizationRequest loadAuthorizationRequest(HttpServletRequest request) {
        return read(request).orElse(null);
    }
    
    @Override
    public OAuth2AuthorizationRequest removeAuthorizationRequest(HttpServletRequest request,
                                                                  HttpServletResponse response) {
        OAuth2AuthorizationRequest existing = read(request).orElse(null);
        
        // Clear cookie
        Cookie cookie = new Cookie(AUTH_REQUEST_COOKIE_NAME, "");
        cookie.setPath("/");
        cookie.setMaxAge(0);
        
        response.addCookie(cookie);
        return existing;
    }
}

@Bean
public CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration config = new CorsConfiguration();
    config.setAllowedOrigins(Arrays.asList(
        "http://localhost:5173",
        "https://localhost:5173",
        "https://inventory.example.com"
    ));
    config.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"));
    config.setAllowedHeaders(Arrays.asList("*"));
    config.setExposedHeaders(Arrays.asList("Set-Cookie"));
    config.setAllowCredentials(true);      // Allow cookies in CORS
    config.setMaxAge(3600L);
    
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", config);
    return source;
}