Support accepting oAuth2 access_tokens over the headless API

[Rjevski]

Auth providers who provide mobile/frontend SDKs sometimes give you a client-side API that returns an access_token, essentially skipping the normal oAuth2-based "code" redirect flow. The headless API currently doesn't support this.

For a client of mine that's only using Google I have implemented it by replacing the original provider with a subclass that also accepts the access_token parameter in the verify_token method, but I feel like it might be a good candidate to discuss a way to do this generically across all providers?

For reference, this is the current way I'm doing it:

from allauth.socialaccount.adapter import get_adapter
from allauth.socialaccount.providers.base import ProviderException
from allauth.socialaccount.providers.google.provider import (
    GoogleProvider as OriginalGoogleProvider,
)
from allauth.socialaccount.providers.oauth2.client import OAuth2Error
from django.core.exceptions import PermissionDenied
from django.http import HttpRequest
from requests import RequestException


class GoogleProvider(OriginalGoogleProvider):
    """
    Google provider subclass with extra support for "access_token"
    in the `verify_token` function.
    """

    def _verify_access_token(self, access_token: str):
        """
        Given an oAuth2 `access_token` obtained out-of-band,
        for example via a mobile SDK, verifies it.

        This effectively skips the "exchange code for access_token" part,
        but is otherwise a normal Allauth oAuth2 flow.
        """

        # lifted from OAuth2CallbackView
        oauth2_adapter = self.oauth2_adapter_class(self.request)
        app = self.app

        fake_code_response = {"access_token": access_token}

        token = oauth2_adapter.parse_token(fake_code_response)

        if app.pk:
            token.app = app

        login = oauth2_adapter.complete_login(
            self.request, app, token, response=fake_code_response
        )
        login.token = token

        return login

    def verify_token(self, request: HttpRequest, token: dict):
        """
        Override `verify_token` to also handle `access_token`s passed here.

        We prioritize `access_token` over `id_token`, if both are provided.

        TODO: raise a discussion on Allauth's Github about supporting oAuth2
         access_tokens on the headless API globally across all providers?
        """

        access_token = token.get("access_token")
        id_token = token.get("id_token")

        if access_token:
            try:
                return self._verify_access_token(access_token)
            except (
                PermissionDenied,
                OAuth2Error,
                RequestException,
                ProviderException,
            ) as e:
                raise get_adapter().validation_error("invalid_token") from e
        elif id_token:
            return super().verify_token(request, token)
        else:
            raise get_adapter().validation_error("invalid_token")


provider_classes = [GoogleProvider]

I'd love for you to come up with a clean way of implementing this across all providers, but in the meantime if you're open to the above code I'm more than happy to submit a PR to include this in the existing Google provider at the very least.

[pennersr]

When using an access token for authentication purposes, you need to take special care and double check that the access token really originated from your app. Otherwise, it becomes possible for some evil partty to harvest access tokens on an unrelated site and use those to login into yours.

Have a look at the Facebook provider. It supports both id_token and access_token for signing in, and there inspect_token() is called to ensure that the token originates from a safe source.

Unfortunately, this is custom logic, to be implemented per provider. Would be happy to receive a pull request, provided a similar check is done.