Feature/oauth2 login

harvest-finance/backend/package.json

@@ -70,7 +70,10 @@
     "exceljs": "^4.4.0",
     "fast-csv": "^5.0.5",
     "graphql": "^16.14.0",
+    "joi": "^18.2.3",
     "passport": "^0.7.0",
+    "passport-github2": "^0.1.12",
+    "passport-google-oauth20": "^2.0.0",
     "passport-jwt": "^4.0.1",
     "pdfkit": "^0.18.0",
     "pg": "^8.18.0",
@@ -100,6 +103,8 @@
     "@types/express": "^5.0.0",
     "@types/jest": "^30.0.0",
     "@types/node": "^22.10.7",
+    "@types/passport-github2": "^1.2.9",
+    "@types/passport-google-oauth20": "^2.0.17",
     "@types/passport-jwt": "^4.0.1",
     "@types/pino": "^7.0.4",
     "@types/pino-http": "^5.8.4",
@@ -137,4 +142,4 @@
     "coverageDirectory": "../coverage",
     "testEnvironment": "node"
   }
-}
+}

harvest-finance/backend/src/app.module.ts

@@ -54,6 +54,7 @@ import {
   SorobanEvent,
   Transaction,
   User,
+  UserOAuthLink,
   Vault,
   VaultDeposit,
   Verification,
@@ -109,6 +110,7 @@ import { WebhooksModule } from './webhooks/webhooks.module';
         database: configService.get<string>('DB_NAME'),
         entities: [
           User,
+          UserOAuthLink,
           Order,
           Transaction,
           Verification,

harvest-finance/backend/src/auth/auth.controller.ts

@@ -6,7 +6,9 @@ import {
   Req,
   HttpCode,
   HttpStatus,
+  Get,
 } from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
 import type { Request } from 'express';
 import {
   ApiTags,
@@ -173,7 +175,7 @@ export class AuthController {
    @UseGuards(JwtAuthGuard)
    @HttpCode(HttpStatus.OK)
    @ApiBearerAuth()
-   @ApiOperation({ summary: 'Logout user', description: 'Invalidates the user's refresh token, effectively logging them out. Requires a valid JWT access token in the Authorization header.' })
+   @ApiOperation({ summary: 'Logout user', description: 'Invalidates the user\'s refresh token, effectively logging them out. Requires a valid JWT access token in the Authorization header.' })
    @ApiResponse({
      status: 200,
      description: 'Logged out successfully',
@@ -349,4 +351,56 @@ export class AuthController {
       },
     };
   }
+
+  /**
+   * Redirect to Google OAuth provider
+   */
+  @Get('google')
+  @UseGuards(AuthGuard('google'))
+  @ApiOperation({ summary: 'Login via Google', description: 'Redirects to Google login consent screen.' })
+  async googleAuth(@Req() req) {
+    // Handled by passport guard
+  }
+
+  /**
+   * Google OAuth callback handler
+   */
+  @Get('google/callback')
+  @UseGuards(AuthGuard('google'))
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: 'Google Auth callback', description: 'Handles redirect callback from Google, registers/links account, and issues JWT tokens.' })
+  @ApiResponse({
+    status: 200,
+    description: 'Successfully authenticated',
+    type: AuthResponseDto,
+  })
+  async googleAuthRedirect(@Req() req): Promise<AuthResponseDto> {
+    return this.authService.loginWithOAuth(req.user);
+  }
+
+  /**
+   * Redirect to GitHub OAuth provider
+   */
+  @Get('github')
+  @UseGuards(AuthGuard('github'))
+  @ApiOperation({ summary: 'Login via GitHub', description: 'Redirects to GitHub login screen.' })
+  async githubAuth(@Req() req) {
+    // Handled by passport guard
+  }
+
+  /**
+   * GitHub OAuth callback handler
+   */
+  @Get('github/callback')
+  @UseGuards(AuthGuard('github'))
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: 'GitHub Auth callback', description: 'Handles redirect callback from GitHub, registers/links account, and issues JWT tokens.' })
+  @ApiResponse({
+    status: 200,
+    description: 'Successfully authenticated',
+    type: AuthResponseDto,
+  })
+  async githubAuthRedirect(@Req() req): Promise<AuthResponseDto> {
+    return this.authService.loginWithOAuth(req.user);
+  }
 }