changed google-auth strategy and removed session use

backend/src/index.ts

@@ -3,9 +3,7 @@ dotenv.config();
 import express from 'express';
 import helmet from 'helmet';
 import cors from 'cors';
-import session from 'express-session';
 import * as Sentry from '@sentry/node';
-import MongoStore from 'connect-mongo';
 import { DatabaseService } from './services';
 import { setUpHealthEndpoint } from './services/health';
 import { initSmtp } from './services/smtp';
@@ -114,15 +112,6 @@ const main = async () => {
     );
 
     app.use(requestIp.mw());
-    app.use(session({
-        secret: await getSessionSecret(),
-        resave: false, // don't save session if unmodified
-        saveUninitialized: false, // don't create session until something stored
-        store: MongoStore.create({
-            mongoUrl: mongoURL,
-            dbName: 'sessions',
-        })
-    }));
 
     if ((await getNodeEnv()) === 'production') {
         // enable app-wide rate-limiting + helmet security

backend/src/routes/v1/oauth.ts

@@ -9,6 +9,7 @@ router.get(
     authLimiter,
     passport.authenticate('google', {
       scope: ['profile', 'email'],
+      session: false,
     }),
   )
   

backend/src/routes/v3/auth.ts

@@ -10,7 +10,7 @@ router.post(
     '/login1',
     authLimiter,
     body('email').isString().trim(),
-    body('providerAuthToken').isString().trim(),
+    body('providerAuthToken').isString().trim().optional({nullable: true}),
     body('clientPublicKey').isString().trim().notEmpty(),
     validateRequest,
     authController.login1
@@ -20,7 +20,7 @@ router.post(
     '/login2',
     authLimiter,
     body('email').isString().trim(),
-    body('providerAuthToken').isString().trim(),
+    body('providerAuthToken').isString().trim().optional({nullable: true}),
     body('clientProof').isString().trim().notEmpty(),
     validateRequest,
     authController.login2

backend/src/utils/auth.ts

@@ -16,7 +16,7 @@ import {
 } from '../config';
 
 // eslint-disable-next-line @typescript-eslint/no-var-requires
-const GoogleStrategy = require('passport-google-oidc');
+const GoogleStrategy = require('passport-google-oauth20').Strategy;
 
 // TODO: find a more optimal folder structure to store these types of functions
 
@@ -69,7 +69,14 @@ const initializePassport = async () => {
         clientID: googleClientId,
         clientSecret: googleClientSecret,
         callbackURL: '/api/v1/oauth/callback/google',
-      }, async (req: express.Request, issuer: any, profile: any, cb: any) => {
+        scope: ['profile', ' email'],
+      }, async (
+          req: express.Request,
+          accessToken: string,
+          refreshToken: string,
+          profile: any,
+          cb: any
+        ) => {
         const email = profile.emails[0].value;
         let user = await User.findOne({
           authProvider: AuthProvider.GOOGLE,