Implementation of 0Auth calendar sync with MongoDB Realm
Budget: $10 – $20 NZD
We’re implementing a calendar syncing solution for Mobiscroll and MongoDB we’ve got it working where it’s pulling the data
however, As of right now, the Oauth Authentication system is flawed. The current flow is as follows:
The user makes a request to the HTTPS endpoint defined in the realm cloud console (/authorizer)
The endpoint makes an OAuth request to the Google servers to obtain the access code (this displays the google sign-in page to the user for them to allow access to their Google account)
The Google server redirects back to the same HTTPS endpoint with the access code to request an access and refreshes token
At this point, the initial realm user details passed through the first request are no longer existent, as we cannot control the data passed back through googles redirect URI
Mongo stores the access token in the database with no associated user
What we require is:
The user makes a request to the HTTPS endpoint (or a function)
The endpoint makes a request to the server to obtain the access code, and a pop up is displayed to the user to enter their google details
The access code is transmitted to the HTTPS endpoint with the Realm users details
The endpoint requests tokens from google and stores them in the database along with the Realm users ID
This comes with a few speed bumps:
An app CANNOT use the ionic built in browser, as this exposes certain security risks and is not allowed by apple or google
The same endpoint CANNOT be used for both the access code and the token request, as the realm user data is lost in the process.
Either the access code must be obtained within the app itself, or the realm user data must persist between obtaining the access code and making the token request
The calendar events fetching works as intended, but is not perfect
A realm function requests the access token from the database, or a new one using the refresh token if it has expired
Using that token, it makes a request to the google calendar API to access the users events from their primary calendar
It then overwrites any existing google tasks, and replaces them with the updated list
however, As of right now, the Oauth Authentication system is flawed. The current flow is as follows:
The user makes a request to the HTTPS endpoint defined in the realm cloud console (/authorizer)
The endpoint makes an OAuth request to the Google servers to obtain the access code (this displays the google sign-in page to the user for them to allow access to their Google account)
The Google server redirects back to the same HTTPS endpoint with the access code to request an access and refreshes token
At this point, the initial realm user details passed through the first request are no longer existent, as we cannot control the data passed back through googles redirect URI
Mongo stores the access token in the database with no associated user
What we require is:
The user makes a request to the HTTPS endpoint (or a function)
The endpoint makes a request to the server to obtain the access code, and a pop up is displayed to the user to enter their google details
The access code is transmitted to the HTTPS endpoint with the Realm users details
The endpoint requests tokens from google and stores them in the database along with the Realm users ID
This comes with a few speed bumps:
An app CANNOT use the ionic built in browser, as this exposes certain security risks and is not allowed by apple or google
The same endpoint CANNOT be used for both the access code and the token request, as the realm user data is lost in the process.
Either the access code must be obtained within the app itself, or the realm user data must persist between obtaining the access code and making the token request
The calendar events fetching works as intended, but is not perfect
A realm function requests the access token from the database, or a new one using the refresh token if it has expired
Using that token, it makes a request to the google calendar API to access the users events from their primary calendar
It then overwrites any existing google tasks, and replaces them with the updated list