Feature request: Dynamic override from database

Passing the secret as querystring is not safe, I think maybe it’s better to load the configurations from database.

// First, create a provider
let provider = new Provider({
  provider: 'twitter',
  override: 'myapp',
  config: {
    "key": "...",
    "secret": "...",
    "callback": "/hi"
  }
})
provider.save()

// Then
app.use('/grant', grant({
  "defaults": {
    "protocol": "http",
    "host": "localhost:3000",
    "transport": "session",
    "state": true
  },
  "google": {
    "key": "...",
    "secret": "...",
    "scope": ["openid"],
    "nonce": true,
    "custom_params": {"access_type": "offline"},
    "callback": "/hello"
  },
  "twitter": {
    "key": "...",
    "secret": "...",
    "callback": "/hi"
  }
}, async function(provider, override){
   // Load from database.
  let doc = await Provider.findOne({
    provider,
    override
  })
  return doc.config
}))

• /connect/twitter/myapp will load the config from database.

[simov]

That’s an interesting idea, I’ll have to think about it.

In the meantime you can probably set your dynamic configuration directly on the query object that’s attached to the request argument:

var express = require('express')
var session = require('express-session')
var grant = require('grant-express')


express()
  .use(session({secret: 'grant', saveUninitialized: true, resave: true}))
  .use('/connect/:provider/:override', (req, res, next) => {
    if (
      req.params.provider === 'twitter' &&
      req.params.override === 'foo'
    ) {
      // load from database
      req.query.key = 'KEY'
      req.query.secret = 'SECRET'
    }
    next()
  })
  .use(grant(require('./config.json')))
  .get('/hello', (req, res) => {
    res.end(JSON.stringify(req.query, null, 2))
  })
  .listen(3000)

{
  "defaults": {
    "protocol": "http",
    "host": "localhost:3000"
  },
  "twitter": {
    "callback": "/hello",
    "dynamic": true
  }
}

Then if you navigate to http://localhost:3000/connect/twitter/foo you’ll be able to login using the credentials set in the middleware before Grant.

I have tested it only with Express, but it should work with Koa too.

[simov]

Dynamic input state overrides landed in v4.7.0

The documentation and examples about it are a bit scarce at the moment, but here is the relevant commit in the readme.

In summary now you can use the request/response lifecycle state of your HTTP framework of choice to set dynamic overrides before entering the Grant routes. This dynamic configuration works outside of the dynamic configuration key, meaning you can override anything using the request/response lifecycle state. The dynamic option controls only allowed keys to override over HTTP via GET/POST request.