User Model for OAuth

Welcome to the next step in our journey of implementing OAuth authentication with TypeScript! In our previous lessons, we explored the fundamentals of OAuth and even built a mock Google OAuth flow. These foundational concepts are crucial as we now focus on modifying a user model to accommodate OAuth authentication. This lesson will guide you through the necessary changes to the user model, ensuring it supports OAuth while maintaining security and functionality. Let's dive in! 🚀

Before we modify the user model for OAuth, it's essential to understand its basic structure. In TypeScript, we use Sequelize to define models, which helps manage database interactions efficiently. Here's a simple example of a user model structure:

import { DataTypes, Model } from 'sequelize';
import { sequelize } from './index.js';

export class User extends Model {
  declare id: number;
  declare username: string;
  declare password: string;
}

User.init({
  id: {
    type: DataTypes.INTEGER,
    primaryKey: true,
    autoIncrement: true
  },
  username: DataTypes.STRING,
  password: DataTypes.STRING
}, {
  sequelize,
  modelName: 'User'
});

In this code, we define a User model with fields like id, username, and password. The User.init method initializes the model with data types and constraints, such as making id the primary key and auto-incrementing it. This structure forms the basis for our modifications to support OAuth.

In traditional authentication, users create accounts directly with your application, providing a username and password that your system stores and validates. However, OAuth authentication follows a completely different flow that eliminates the need for local password storage.

Here's how OAuth authentication works:

1. User Initiates Login: The user clicks "Login with Google" (or another provider)
2. Redirect to Provider: Your application redirects the user to Google's authentication server
3. User Authenticates with Provider: The user enters their credentials directly with Google (not your application)
4. Provider Issues Authorization Code: Google verifies the user and sends an authorization code back to your application
5. Exchange Code for Access Token: Your application exchanges this code for an access token
6. Retrieve User Information: Using the access token, your application requests the user's profile information from Google

The key insight is that the user never provides their password to your application. Google handles all password verification on their secure servers. Your application only receives verified user information (like email and name) after Google confirms the user's identity.

This approach offers several advantages:

• Enhanced Security: Your application never stores or handles user passwords
• Reduced Liability: You don't need to implement password security measures
• Better User Experience: Users can leverage their existing accounts without creating new passwords

To accommodate OAuth authentication, we need to modify the user model. The first step is to make the password field optional, as OAuth users authenticate through external providers and don't require a local password.

password: {
  type: DataTypes.STRING,
  allowNull: true // OAuth users don't need passwords
}

By setting allowNull to true, we ensure that the password field is optional, allowing OAuth users to be created without a password.

Next, we introduce new fields to store the user's email and the provider (e.g., google). These fields are crucial for identifying OAuth users and managing their authentication details.

email: {
  type: DataTypes.STRING,
  allowNull: true
},
provider: {
  type: DataTypes.STRING,
  defaultValue: 'local'
}

The email field stores the user's email address, while the provider field indicates the authentication provider. The default value for provider is local, distinguishing between local and OAuth users.

⚠️ IMPORTANT NOTE FOR PRODUCTION

In this course, we use email addresses to identify OAuth users for learning simplicity. Our mock implementation has fixed test users with stable emails, so this approach works fine for educational purposes.

However, in production applications, email-based lookup has critical limitations:

• Emails can change - Users can update their email at the OAuth provider, breaking the link
• Not unique across providers - Same person might use different emails on Google vs GitHub
• Unverified emails - Not all providers verify emails

Production Best Practice: Use the provider's immutable user ID (the sub claim in OpenID Connect) combined with the provider name:

// Production approach - not used in this course
export class User extends Model {
  declare provider: string;
  declare providerUserId: string;  // Never changes
  declare email: string | null;  // Display only
}

User.init({
  provider: {
    type: DataTypes.STRING,
    allowNull: false
  },
  providerUserId: {
    type: DataTypes.STRING,
    allowNull: false
  },
  email: {
    type: DataTypes.STRING,
    allowNull: true
  }
}, {
  sequelize,
  modelName: 'User',
  indexes: [
    {
      unique: true,
      fields: ['provider', 'providerUserId']
    }
  ]
});

This ensures each user has a permanent identity that survives email changes. For this course, we stick with email-based lookup to keep the focus on OAuth flow mechanics.

Understanding data types and default values is crucial for a robust user model. Let's explore these concepts in the context of our OAuth modifications:

• Data Types: We use DataTypes.STRING for fields like username, password, email, and provider. This ensures that these fields store string values, which are appropriate for user information.

• Default Values: The provider field has a default value of local, indicating that users are local by default unless specified otherwise. This helps distinguish between local and OAuth users.

role: {
  type: DataTypes.ENUM('USER', 'ADMIN'),
  defaultValue: 'USER'
}

In this snippet, the role field uses an ENUM data type with a default value of USER, ensuring that users have a defined role upon creation. These data types and default values enhance the functionality and security of our user model.

In this lesson, we explored how to modify a user model to accommodate OAuth authentication. We discussed the basic structure of the user model, explained why OAuth users don't need passwords through the OAuth flow, and implemented changes to support OAuth users. These modifications, including making the password optional and adding fields like email and provider, ensure a flexible and secure user model.

As you move forward, practice exercises will reinforce these concepts, allowing you to apply what you've learned. In the upcoming lessons, we'll continue to build on this foundation, exploring more advanced topics in OAuth implementation. Keep up the great work, and let's continue this exciting journey together! 🎉