Automatic login (#1900)

* Automatic login

* update debug message with correct port

* fix passing forward token

.env

@@ -10,6 +10,8 @@ OPENAI_BASE_URL=https://router.huggingface.co/v1
 OPENAI_API_KEY=#your provider API key (works for HF router, OpenAI, LM Studio, etc.). 
 # When set to true, user token will be used for inference calls
 USE_USER_TOKEN=false
+# Automatically redirect to oauth login page if user is not logged in, when set to "true"
+AUTOMATIC_LOGIN=false
 
 ### MongoDB ###
 MONGODB_URL=#your mongodb URL here, use chat-ui-db image if you don't want to set this

src/hooks.server.ts

@@ -2,7 +2,12 @@ import { config, ready } from "$lib/server/config";
 import type { Handle, HandleServerError, ServerInit, HandleFetch } from "@sveltejs/kit";
 import { collections } from "$lib/server/database";
 import { base } from "$app/paths";
-import { authenticateRequest, refreshSessionCookie, requiresUser } from "$lib/server/auth";
+import {
+	authenticateRequest,
+	refreshSessionCookie,
+	requiresUser,
+	triggerOauthFlow,
+} from "$lib/server/auth";
 import { ERROR_MESSAGES } from "$lib/stores/errors";
 import { addWeeks } from "date-fns";
 import { checkAndRunMigrations } from "$lib/migrations/migrations";
@@ -126,8 +131,17 @@ export const handle: Handle = async ({ event, resolve }) => {
 		{ type: "svelte", value: event.cookies }
 	);
 
-	event.locals.user = auth.user || undefined;
 	event.locals.sessionId = auth.sessionId;
+
+	if (
+		!auth.user &&
+		config.AUTOMATIC_LOGIN === "true" &&
+		!event.url.pathname.startsWith(`${base}/login`)
+	) {
+		return await triggerOauthFlow({ request: event.request, url: event.url, locals: event.locals });
+	}
+
+	event.locals.user = auth.user || undefined;
 	event.locals.token = auth.token;
 
 	event.locals.isAdmin =

src/lib/server/adminToken.ts

@@ -37,9 +37,11 @@ class AdminTokenManager {
 		// if admin token is set, don't display it
 		if (!this.enabled || config.ADMIN_TOKEN) return;
 
-		let port = process.argv.includes("--port")
-			? parseInt(process.argv[process.argv.indexOf("--port") + 1])
-			: undefined;
+		let port = process.env.PORT
+			? parseInt(process.env.PORT)
+			: process.argv.includes("--port")
+				? parseInt(process.argv[process.argv.indexOf("--port") + 1])
+				: undefined;
 
 		if (!port) {
 			const mode = process.argv.find((arg) => arg === "preview" || arg === "dev");

src/lib/server/auth.ts

@@ -10,7 +10,7 @@ import { config } from "$lib/server/config";
 import { sha256 } from "$lib/utils/sha256";
 import { z } from "zod";
 import { dev } from "$app/environment";
-import type { Cookies } from "@sveltejs/kit";
+import { redirect, type Cookies } from "@sveltejs/kit";
 import { collections } from "$lib/server/database";
 import JSON5 from "json5";
 import { logger } from "$lib/server/logger";
@@ -19,6 +19,7 @@ import type { Cookie } from "elysia";
 import { adminTokenManager } from "./adminToken";
 import type { User } from "$lib/types/User";
 import type { Session } from "$lib/types/Session";
+import { base } from "$app/paths";
 
 export interface OIDCSettings {
 	redirectURI: string;
@@ -359,3 +360,32 @@ export async function authenticateRequest(
 
 	return { user: undefined, sessionId, secretSessionId, isAdmin: false };
 }
+
+export async function triggerOauthFlow({
+	request,
+	url,
+	locals,
+}: {
+	request: Request;
+	url: URL;
+	locals: App.Locals;
+}): Promise<Response> {
+	const referer = request.headers.get("referer");
+	let redirectURI = `${(referer ? new URL(referer) : url).origin}${base}/login/callback`;
+
+	// TODO: Handle errors if provider is not responding
+
+	if (url.searchParams.has("callback")) {
+		const callback = url.searchParams.get("callback") || redirectURI;
+		if (config.ALTERNATIVE_REDIRECT_URLS.includes(callback)) {
+			redirectURI = callback;
+		}
+	}
+
+	const authorizationUrl = await getOIDCAuthorizationUrl(
+		{ redirectURI },
+		{ sessionId: locals.sessionId }
+	);
+
+	throw redirect(302, authorizationUrl);
+}

src/lib/server/endpoints/openai/endpointOai.ts

@@ -106,7 +106,14 @@ export async function endpointOai(
 	const imageProcessor = makeImageProcessor(multimodal.image);
 
 	if (completion === "completions") {
-		return async ({ messages, preprompt, continueMessage, generateSettings, conversationId }) => {
+		return async ({
+			messages,
+			preprompt,
+			continueMessage,
+			generateSettings,
+			conversationId,
+			locals,
+		}) => {
 			const prompt = await buildPrompt({
 				messages,
 				continueMessage,
@@ -132,13 +139,21 @@ export async function endpointOai(
 				headers: {
 					"ChatUI-Conversation-ID": conversationId?.toString() ?? "",
 					"X-use-cache": "false",
+					...(locals?.token ? { Authorization: `Bearer ${locals.token}` } : {}),
 				},
 			});
 
 			return openAICompletionToTextGenerationStream(openAICompletion);
 		};
 	} else if (completion === "chat_completions") {
-		return async ({ messages, preprompt, generateSettings, conversationId, isMultimodal }) => {
+		return async ({
+			messages,
+			preprompt,
+			generateSettings,
+			conversationId,
+			isMultimodal,
+			locals,
+		}) => {
 			// Format messages for the chat API, handling multimodal content if supported
 			let messagesOpenAI: OpenAI.Chat.Completions.ChatCompletionMessageParam[] =
 				await prepareMessages(messages, imageProcessor, isMultimodal ?? model.multimodal);
@@ -186,6 +201,7 @@ export async function endpointOai(
 						headers: {
 							"ChatUI-Conversation-ID": conversationId?.toString() ?? "",
 							"X-use-cache": "false",
+							...(locals?.token ? { Authorization: `Bearer ${locals.token}` } : {}),
 						},
 					}
 				);
@@ -198,6 +214,7 @@ export async function endpointOai(
 						headers: {
 							"ChatUI-Conversation-ID": conversationId?.toString() ?? "",
 							"X-use-cache": "false",
+							...(locals?.token ? { Authorization: `Bearer ${locals.token}` } : {}),
 						},
 					}
 				);

src/routes/login/+server.ts

@@ -1,29 +1,5 @@
-import { getOIDCAuthorizationUrl } from "$lib/server/auth";
-import { base } from "$app/paths";
-import { config } from "$lib/server/config";
+import { triggerOauthFlow } from "$lib/server/auth";
 
 export async function GET({ request, url, locals }) {
-	const referer = request.headers.get("referer");
-	let redirectURI = `${(referer ? new URL(referer) : url).origin}${base}/login/callback`;
-
-	// TODO: Handle errors if provider is not responding
-
-	if (url.searchParams.has("callback")) {
-		const callback = url.searchParams.get("callback") || redirectURI;
-		if (config.ALTERNATIVE_REDIRECT_URLS.includes(callback)) {
-			redirectURI = callback;
-		}
-	}
-
-	const authorizationUrl = await getOIDCAuthorizationUrl(
-		{ redirectURI },
-		{ sessionId: locals.sessionId }
-	);
-
-	return new Response(null, {
-		status: 302,
-		headers: {
-			Location: authorizationUrl,
-		},
-	});
+	return await triggerOauthFlow({ request, url, locals });
 }