mirror of
https://github.com/trezor/trezor-suite.git
synced 2026-03-06 07:25:20 +01:00
29 lines
2.1 KiB
Markdown
29 lines
2.1 KiB
Markdown
# @trezor/auth-server
|
|
|
|
Authorization endpoints for saving labels in Google Drive via OAuth 2.0.
|
|
|
|
Google requires `client_secret` specific for an app to grant long term access to a user via a `refresh_token`. This is a [recommended](https://developers.google.com/identity/protocols/oauth2/native-app) OAuth flow for desktop apps. Exposing `client_secret` could potentially enable attackers impersonating the app to gain access to the user's labels. Therefore, Google authentication server is accessed via our backend which stores the `client_secret`. Unlike the [Dropbox](https://developers.dropbox.com/oauth-guide) OAuth implementation, it is not possible to substitute the secret with PKCE.
|
|
|
|
## Development
|
|
|
|
Start by generating your own testing credentials for Suite Desktop.<br />
|
|
Please note that instructions regarding Google Cloud configuration may not be up to date.
|
|
|
|
1. Open [Google Cloud Platform > Credentials](https://console.cloud.google.com/apis/credentials) and create a new "OAuth 2.0 Client ID" credential.
|
|
1. If you are not in a "Project" already, you'll have to create one and assign it to an "Organization".<br />
|
|
⚠️ You may have to use a personal Google profile, if your corporate account has insufficient rights to create/edit organizations!
|
|
1. Select "Desktop app" and set any name.
|
|
1. Navigate through "OAuth consent screen" to ["Audience"](https://console.cloud.google.com/auth/audience) and add yourself and/or any other emails as "Test users".<br />
|
|
_Not to be mistaken with Service Accounts, those are unrelated._
|
|
|
|
Continue in Trezor Suite:
|
|
|
|
1. Replace `client_secret` in [index.ts](./src/index.ts) and `CLIENT_ID` in [@trezor/suite](../suite/src/actions/suite/constants/metadataProviderConstants.ts) with generated credentials.
|
|
1. Set OAuth API in Suite debug settings to `http://localhost:3005` or override the `authServerUrl` [here](../suite/src/services/google.ts).
|
|
1. Install dependencies via `yarn workspace @trezor/auth-server install`.
|
|
1. Run the server locally via `yarn workspace @trezor/auth-server dev`.
|
|
|
|
## Build
|
|
|
|
`yarn workspace @trezor/auth-server build`
|