[CORL-761] stream-side account tab for sso (#2834)

* move download comments to my comments tab

* only show download comments if available

* move ignored users management to same tab as notifications, rename to preferences

* fix query and ts defs

* add url to jwt

* make account tab go to external url if provided

* ensure url is an optional jwt field

* update tabs for stream profile

* update classnames for tabs

* fix tests

src/core/server/app/middleware/passport/strategies/verifiers/sso.ts

@@ -41,6 +41,7 @@ export interface SSOUserProfile {
   username: string;
   badges?: string[];
   role?: GQLUSER_ROLE;
+  url?: string;
 }
 
 export interface SSOToken {
@@ -64,8 +65,9 @@ export const SSOUserProfileSchema = Joi.object()
     username: Joi.string().required(),
     badges: Joi.array().items(Joi.string()),
     role: Joi.string().only(Object.values(GQLUSER_ROLE)),
+    url: Joi.string().uri(),
   })
-  .optionalKeys(["badges", "role"]);
+  .optionalKeys(["badges", "role", "url"]);
 
 export const SSOTokenSchema = Joi.object()
   .keys({
@@ -91,7 +93,7 @@ export async function findOrCreateSSOUser(
   const {
     jti,
     exp,
-    user: { id, email, username, badges, role },
+    user: { id, email, username, badges, role, url },
     iat,
   } = decodedToken;
 
@@ -109,6 +111,7 @@ export async function findOrCreateSSOUser(
     type: "sso",
     id,
   });
+
   if (!user) {
     if (!integration.allowRegistration) {
       // Registration is disabled, so we can't create the user user here.
@@ -131,6 +134,7 @@ export async function findOrCreateSSOUser(
         id,
         username,
         role: role || GQLUSER_ROLE.COMMENTER,
+        ssoURL: url,
         badges,
         email,
         emailVerified: true,

src/core/server/graph/schema/schema.graphql

@@ -2098,6 +2098,11 @@ type User {
       roles: [ADMIN, MODERATOR]
       permit: [SUSPENDED, BANNED, PENDING_DELETION]
     )
+
+  """
+  ssoURL is the url for managing sso account
+  """
+  ssoURL: String
 }
 
 """

src/core/server/models/user/helpers.ts

@@ -30,11 +30,12 @@ export function getSSOProfile(user: Pick<User, "profiles">) {
 
 export function needsSSOUpdate(
   token: SSOUserProfile,
-  user: Pick<User, "email" | "username" | "badges" | "role">
+  user: Pick<User, "email" | "username" | "badges" | "role" | "ssoURL">
 ) {
   return (
     user.email !== token.email ||
     user.username !== token.username ||
+    (user.ssoURL && user.ssoURL !== token.url) ||
     (token.role && user.role !== token.role) ||
     !isEqual(user.badges, token.badges)
   );

src/core/server/models/user/user.ts

@@ -392,6 +392,11 @@ export interface User extends TenantResource {
    */
   badges?: string[];
 
+  /**
+   * ssoURL is the url where a user can manage their sso account
+   */
+  ssoURL?: string;
+
   /**
    * emailVerificationID is used to store state regarding the verification state
    * of an email address to prevent replay attacks.
@@ -485,6 +490,7 @@ export interface FindOrCreateUserInput {
   avatar?: string;
   email?: string;
   badges?: string[];
+  ssoURL?: string;
   emailVerified?: boolean;
   role: GQLUSER_ROLE;
   profile: Profile;