Create vs Login when using Google oauth for access

Question

I am currently trying to setup my server to allow users to login with google oauth 2.0.

I am using passport and passport-google-oauth.

Normal set up is something like:

var GoogleStrategy = require('passport-google-oauth').OAuth2Strategy;

passport.use(new GoogleStrategy({
    clientID: GOOGLE_CLIENT_ID,
    clientSecret: GOOGLE_CLIENT_SECRET,
    callbackURL: "http://127.0.0.1:3000/auth/google/callback"
  },
  function(accessToken, refreshToken, profile, done) {
    User.findOrCreate({ googleId: profile.id }, function (err, user) {
      return done(err, user);
    });
  }
));

However what I really want is to still control access to my server after accounts are approved.

Meaning a user would first 'create' and account using google, then be able to signin once there account is approved.

I would really like there to be a signup route and login route:

app.get('/auth/google/signup',
  passport.authenticate('google', { scope: ['profile', 'email'] }));

app.get('/auth/google',
  passport.authenticate('google', { scope: 'https://www.googleapis.com/auth/plus.login' }));

app.get('/auth/google/callback', 
  passport.authenticate('google', { failureRedirect: '/login' }),
  function(req, res) {
    // Successful authentication, redirect home.
    res.redirect('/');
  });

My problem is that when I get to the GoogleStrategy setup I don't really know which route they initially hit. IE if they hit the login route but had not created an account I do not want to create an account I want to warn them that they did not yet create an account. Had they hit the signup route and already had an account I would not want to create another account I would just tell them they already have an account.

Is there anyway in the GoogleStrategy that I can tell which route the user initially hit on my server?

Answer 1

In your user model create the "approved" field, with default False (Boolean)

And you can check this field on the GoogleStrategy to restrict the access.

If you want to apply this on all Strategies you can filter on the serialization method in passport.

Hope it helps.

Answer 2

You can pass a 'state' query parameter in your initial request that will be round-tripped back to your callback.

Documented here: https://developers.google.com/identity/protocols/OAuth2WebServer

state Any string Provides any state that might be useful to your application upon receipt of the response. The Google Authorization Server roundtrips this parameter, so your application receives the same value it sent. To mitigate against cross-site request forgery (CSRF), it is strongly recommended to include an anti-forgery token in the state, and confirm it in the response. See OpenID Connect for an example of how to do this.