How to disable OAuth account creation for certain routes

[KonnorRogers]

Basically, there's a common pattern with OAuth where if you're on a "Login" page and you hit "Login via GitHub" , but you haven't previously created an account via GitHub , it will automatically create the account for you.

I don't want that behavior. I want the user to have to explicitly go to /create-account and click "Sign up via GitHub"

is there a good way to get this behavior? I feel like I'm missing something obvious.

basically, when on "/login", don't create accounts, only check for existing.

is there an easy way to do this? I'm using Rodauth-Rails as well.

[janko]

I just pushed a new omniauth_create_account? configuration option that controls whether the account will be auto-created if missing. When generating the OmniAuth login link, you can pass a query parameter that will identify the action, for example:

button_to "Login via GitHub", rodauth.omniauth_request_path(:github, action: "login"),
  method: :post, data: { turbo: false }

Then control automatic account creation based on that query parameter:

omniauth_create_account? { omniauth_params["action"] != "login" }

I will make a new release with this feature, just want to properly document it first, possibly with a similar example.

[KonnorRogers]

Perfect!! Thank you! Also, rodauth-rails is great! Thank you so much for making the library!

[janko]

Just released version 0.5.0 with this configuration method 🚀

Glad you like rodauth-rails, please feel free to drop any feedback or criticism along the way 😉

[KonnorRogers]

@janko I do have some feedback!

(not sure this is the place)

but I noticed that setting t.timestamps causes the following error:

class CreateAccountIdentities < ActiveRecord::Migration[7.2]
  def change
    create_table :account_identities do |t|
      t.references :account, foreign_key: { on_delete: :cascade }
      t.string :provider, null: false
      t.string :uid, null: false
      t.index [:provider, :uid], unique: true
      t.timestamps # => This here blows up everything
    end
  end
end

Is there a way to maintain timestamps? I want to know when identities were created / updated

I also noticed you cannot extend Account::Identity the same way you can extend Account. Is this by design?

Something like:

module Account
  class Identity < ApplicationRecord
    has_many :tokens
  end
end

[janko]

Is there a way to maintain timestamps? I want to know when identities were created / updated

Yeah, the timestamps won't maintain themselves, because Rodauth doesn't go through Active Record models for persistence. You need to add this to your Rodauth configuration:

omniauth_identity_insert_hash { super().merge(created_at: Time.now) }
omniauth_identity_update_hash { { updated_at: Time.now } }

I also noticed you cannot extend Account::Identity the same way you can extend Account. Is this by design?

It probably doesn't work due to how Zeitwerk autoloading works. The include Rodauth::Rails.model line in your Account model defines the Account::Identity class, so since the constant is already defined, Zeitwerk has no reason to go and load account/identity.rb. This would probably work when eager loaded.

You can work around this by moving the definition to account.rb:

class Account < ApplicationRecord
  include Rodauth::Rails.model
  # ...

  class Identity < ApplicationRecord
    has_many :tokens
  end
end