Add comprehensive SSO provider support with email confirmation

apps/api/.env.example

@@ -17,6 +17,45 @@ VITNODE_API_URL=http://localhost:8000
 # `{ rpId: "example.com", origins: [...] }` instead. Changing the RP ID later
 # makes every existing passkey unusable.
 
+# === Single sign-on (server-only - never add these to clientEnv) ===
+# Discord, Google and Facebook are registered in `vitnode.api.config.ts`; the
+# others are commented out there until you configure them.
+# See https://vitnode.com/docs/dev/sso for each provider.
+# DISCORD_CLIENT_ID=
+# DISCORD_CLIENT_SECRET=
+# GOOGLE_CLIENT_ID=
+# GOOGLE_CLIENT_SECRET=
+# FACEBOOK_CLIENT_ID=
+# FACEBOOK_CLIENT_SECRET=
+# APPLE_CLIENT_ID=com.example.web
+# APPLE_TEAM_ID=
+# APPLE_KEY_ID=
+# APPLE_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
+# ATLASSIAN_CLIENT_ID=
+# ATLASSIAN_CLIENT_SECRET=
+# GITLAB_CLIENT_ID=
+# GITLAB_CLIENT_SECRET=
+# KICK_CLIENT_ID=
+# KICK_CLIENT_SECRET=
+# LINKEDIN_CLIENT_ID=
+# LINKEDIN_CLIENT_SECRET=
+# MICROSOFT_CLIENT_ID=
+# MICROSOFT_CLIENT_SECRET=
+# PAYPAL_CLIENT_ID=
+# PAYPAL_CLIENT_SECRET=
+# REDDIT_CLIENT_ID=
+# REDDIT_CLIENT_SECRET=
+# REDDIT_USER_AGENT="web:com.example.forum:1.0.0 (by /u/your_username)"
+# SLACK_CLIENT_ID=
+# SLACK_CLIENT_SECRET=
+# SLACK_TEAM_ID=
+# TIKTOK_CLIENT_KEY=
+# TIKTOK_CLIENT_SECRET=
+# TWITCH_CLIENT_ID=
+# TWITCH_CLIENT_SECRET=
+# TWITTER_CLIENT_ID=
+# TWITTER_CLIENT_SECRET=
+
 # === CRON Secret for Internal API Calls ===
 CRON_SECRET=your-secure-cron-secret-key
 

apps/api/migrations/20261024081744_sso_attempts_and_pending/migration.sql

@@ -0,0 +1,33 @@
+CREATE TABLE "core_sso_attempts" (
+	"id" serial PRIMARY KEY,
+	"stateHash" varchar(64) NOT NULL UNIQUE,
+	"bindingHash" varchar(64) NOT NULL,
+	"providerId" varchar(255) NOT NULL,
+	"codeVerifier" varchar(128) NOT NULL,
+	"nonce" varchar(128) NOT NULL,
+	"createdAt" timestamp DEFAULT now() NOT NULL,
+	"expiresAt" timestamp NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "core_sso_attempts" ENABLE ROW LEVEL SECURITY;--> statement-breakpoint
+CREATE TABLE "core_sso_pending" (
+	"id" serial PRIMARY KEY,
+	"tokenHash" varchar(64) NOT NULL UNIQUE,
+	"providerId" varchar(255) NOT NULL,
+	"providerAccountId" varchar(255) NOT NULL,
+	"providerUsername" varchar(255),
+	"profile" jsonb,
+	"email" varchar(255),
+	"confirmHash" varchar(64),
+	"confirmExpiresAt" timestamp,
+	"confirmSends" integer DEFAULT 0 NOT NULL,
+	"confirmSentAt" timestamp,
+	"createdAt" timestamp DEFAULT now() NOT NULL,
+	"expiresAt" timestamp NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "core_sso_pending" ENABLE ROW LEVEL SECURITY;--> statement-breakpoint
+ALTER TABLE "core_users_sso_operations" ADD COLUMN "codeVerifier" varchar(128);--> statement-breakpoint
+ALTER TABLE "core_users_sso_operations" ADD COLUMN "nonce" varchar(128);--> statement-breakpoint
+CREATE INDEX "core_sso_attempts_expires_at_idx" ON "core_sso_attempts" ("expiresAt");--> statement-breakpoint
+CREATE INDEX "core_sso_pending_expires_at_idx" ON "core_sso_pending" ("expiresAt");