feat: add snapchat provider (#2071)

hf · ymiedviediev · web-flow · commit fca8ea4a701e · 2025-07-02T15:27:01.000+02:00
Adds support for the Snapchat OAuth provider. This is not going to be configurable for generic Supabase projects at this time. Like #1998 but with some fixes. --------- Co-authored-by: Yurii <ymiedviediev@snapchat.com>
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -227,6 +227,7 @@ To see the current settings, make a request to `https://localhost:9999/settings`
     "gitlab": false,
     "google": false,
     "facebook": false,
+    "snapchat": false,
     "spotify": false,
     "slack": false,
     "slack_oidc": false,
diff --git a/README.md b/README.md
@@ -430,7 +430,7 @@ The default group to assign all new users to.
 
 ### External Authentication Providers
 
-We support `apple`, `azure`, `bitbucket`, `discord`, `facebook`, `figma`, `github`, `gitlab`, `google`, `keycloak`, `linkedin`, `notion`, `spotify`, `slack`, `twitch`, `twitter` and `workos` for external authentication.
+We support `apple`, `azure`, `bitbucket`, `discord`, `facebook`, `figma`, `github`, `gitlab`, `google`, `keycloak`, `linkedin`, `notion`, `snapchat`, `spotify`, `slack`, `twitch`, `twitter` and `workos` for external authentication.
 
 Use the names as the keys underneath `external` to configure each separately.
 
@@ -746,6 +746,7 @@ Returns the publicly available settings for this auth instance.
     "linkedin": true,
     "notion": true,
     "slack": true,
+    "snapchat":  true,
     "spotify": true,
     "twitch": true,
     "twitter": true,
@@ -1212,7 +1213,7 @@ Get access_token from external oauth provider
 query params:
 
 ```
-provider=apple | azure | bitbucket | discord | facebook | figma | github | gitlab | google | keycloak | linkedin | notion | slack | spotify | twitch | twitter | workos
+provider=apple | azure | bitbucket | discord | facebook | figma | github | gitlab | google | keycloak | linkedin | notion | slack | snapchat | spotify | twitch | twitter | workos
 
 scopes=<optional additional scopes depending on the provider (email and name are requested by default)>
 ```
diff --git a/hack/test.env b/hack/test.env
@@ -76,6 +76,10 @@ GOTRUE_EXTERNAL_NOTION_ENABLED=true
 GOTRUE_EXTERNAL_NOTION_CLIENT_ID=testclientid
 GOTRUE_EXTERNAL_NOTION_SECRET=testsecret
 GOTRUE_EXTERNAL_NOTION_REDIRECT_URI=https://identity.services.netlify.com/callback
+GOTRUE_EXTERNAL_SNAPCHAT_ENABLED=true
+GOTRUE_EXTERNAL_SNAPCHAT_CLIENT_ID=testclientid
+GOTRUE_EXTERNAL_SNAPCHAT_SECRET=testsecret
+GOTRUE_EXTERNAL_SNAPCHAT_REDIRECT_URI=https://identity.services.netlify.com/callback
 GOTRUE_EXTERNAL_SPOTIFY_ENABLED=true
 GOTRUE_EXTERNAL_SPOTIFY_CLIENT_ID=testclientid
 GOTRUE_EXTERNAL_SPOTIFY_SECRET=testsecret
diff --git a/internal/api/external.go b/internal/api/external.go
@@ -584,6 +584,8 @@ func (a *API) Provider(ctx context.Context, name string, scopes string) (provide
 		return provider.NewLinkedinOIDCProvider(config.External.LinkedinOIDC, scopes)
 	case "notion":
 		return provider.NewNotionProvider(config.External.Notion)
+	case "snapchat":
+		return provider.NewSnapchatProvider(config.External.Snapchat, scopes)
 	case "spotify":
 		return provider.NewSpotifyProvider(config.External.Spotify, scopes)
 	case "slack":
diff --git a/internal/api/external_snapchat_test.go b/internal/api/external_snapchat_test.go
@@ -0,0 +1,141 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+
+	jwt "github.com/golang-jwt/jwt/v5"
+)
+
+const (
+	snapchatUser = `{"data":{"me":{"externalId":"snapchatTestId","displayName":"Snapchat Test","bitmoji":{"avatar":"https://example.com/bitmoji"}}}}`
+)
+
+func (ts *ExternalTestSuite) TestSignupExternalSnapchat() {
+	req := httptest.NewRequest(http.MethodGet, "https://localhost/authorize?provider=snapchat", nil)
+	w := httptest.NewRecorder()
+	ts.API.handler.ServeHTTP(w, req)
+	ts.Require().Equal(http.StatusFound, w.Code)
+	u, err := url.Parse(w.Header().Get("Location"))
+	ts.Require().NoError(err, "redirect url parse failed")
+	q := u.Query()
+	ts.Equal(ts.Config.External.Snapchat.RedirectURI, q.Get("redirect_uri"))
+	ts.Equal(ts.Config.External.Snapchat.ClientID, []string{q.Get("client_id")})
+	ts.Equal("code", q.Get("response_type"))
+	ts.Equal("https://auth.snapchat.com/oauth2/api/user.external_id https://auth.snapchat.com/oauth2/api/user.display_name https://auth.snapchat.com/oauth2/api/user.bitmoji.avatar", q.Get("scope"))
+
+	claims := ExternalProviderClaims{}
+	p := jwt.NewParser(jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Name}))
+	_, err = p.ParseWithClaims(q.Get("state"), &claims, func(token *jwt.Token) (interface{}, error) {
+		return []byte(ts.Config.JWT.Secret), nil
+	})
+	ts.Require().NoError(err)
+
+	ts.Equal("snapchat", claims.Provider)
+	ts.Equal(ts.Config.SiteURL, claims.SiteURL)
+}
+
+func SnapchatTestSignupSetup(ts *ExternalTestSuite, tokenCount *int, userCount *int, code string, user string) *httptest.Server {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/accounts/oauth2/token":
+			*tokenCount++
+			ts.Equal(code, r.FormValue("code"))
+			ts.Equal("authorization_code", r.FormValue("grant_type"))
+			ts.Equal(ts.Config.External.Snapchat.RedirectURI, r.FormValue("redirect_uri"))
+
+			w.Header().Add("Content-Type", "application/json")
+			fmt.Fprint(w, `{"access_token":"snapchat_token","expires_in":3600}`)
+		case "/v1/me":
+			*userCount++
+			w.Header().Add("Content-Type", "application/json")
+			fmt.Fprint(w, user)
+		default:
+			w.WriteHeader(500)
+			ts.Fail("unknown snapchat oauth call %s", r.URL.Path)
+		}
+	}))
+
+	ts.Config.External.Snapchat.URL = server.URL
+
+	return server
+}
+
+func (ts *ExternalTestSuite) TestSignupExternalSnapchat_AuthorizationCode() {
+	ts.Config.DisableSignup = false
+	tokenCount, userCount := 0, 0
+	code := "authcode"
+	server := SnapchatTestSignupSetup(ts, &tokenCount, &userCount, code, snapchatUser)
+	defer server.Close()
+
+	u := performAuthorization(ts, "snapchat", code, "")
+
+	assertAuthorizationSuccess(ts, u, tokenCount, userCount, "snapchattestid@snapchat.id", "Snapchat Test", "snapchatTestId", "https://example.com/bitmoji")
+}
+
+func (ts *ExternalTestSuite) TestSignupExternalSnapchatDisableSignupErrorWhenNoUser() {
+	ts.Config.DisableSignup = true
+
+	tokenCount, userCount := 0, 0
+	code := "authcode"
+	server := SnapchatTestSignupSetup(ts, &tokenCount, &userCount, code, snapchatUser)
+	defer server.Close()
+
+	u := performAuthorization(ts, "snapchat", code, "")
+
+	assertAuthorizationFailure(ts, u, "Signups not allowed for this instance", "access_denied", "")
+}
+
+func (ts *ExternalTestSuite) TestSignupExternalSnapchatDisableSignupSuccessWithExistingUser() {
+	ts.Config.DisableSignup = true
+
+	ts.createUser("snapchatTestId", "snapchattestid@snapchat.id", "Snapchat Test", "https://example.com/bitmoji", "")
+
+	tokenCount, userCount := 0, 0
+	code := "authcode"
+	server := SnapchatTestSignupSetup(ts, &tokenCount, &userCount, code, snapchatUser)
+	defer server.Close()
+
+	u := performAuthorization(ts, "snapchat", code, "")
+
+	assertAuthorizationSuccess(ts, u, tokenCount, userCount, "snapchattestid@snapchat.id", "Snapchat Test", "snapchatTestId", "https://example.com/bitmoji")
+}
+
+func (ts *ExternalTestSuite) TestInviteTokenExternalSnapchatSuccessWhenMatchingToken() {
+	// name and avatar should be populated from Snapchat API
+	// Use the same email that the provider will generate - converted to lowercase
+	ts.createUser("snapchatTestId", "snapchattestid@snapchat.id", "", "", "invite_token")
+
+	tokenCount, userCount := 0, 0
+	code := "authcode"
+	server := SnapchatTestSignupSetup(ts, &tokenCount, &userCount, code, snapchatUser)
+	defer server.Close()
+
+	u := performAuthorization(ts, "snapchat", code, "invite_token")
+
+	assertAuthorizationSuccess(ts, u, tokenCount, userCount, "snapchattestid@snapchat.id", "Snapchat Test", "snapchatTestId", "https://example.com/bitmoji")
+}
+
+func (ts *ExternalTestSuite) TestInviteTokenExternalSnapchatErrorWhenNoMatchingToken() {
+	tokenCount, userCount := 0, 0
+	code := "authcode"
+	server := SnapchatTestSignupSetup(ts, &tokenCount, &userCount, code, snapchatUser)
+	defer server.Close()
+
+	w := performAuthorizationRequest(ts, "snapchat", "invite_token")
+	ts.Require().Equal(http.StatusNotFound, w.Code)
+}
+
+func (ts *ExternalTestSuite) TestInviteTokenExternalSnapchatErrorWhenWrongToken() {
+	ts.createUser("snapchatTestId", "", "", "", "invite_token")
+
+	tokenCount, userCount := 0, 0
+	code := "authcode"
+	server := SnapchatTestSignupSetup(ts, &tokenCount, &userCount, code, snapchatUser)
+	defer server.Close()
+
+	w := performAuthorizationRequest(ts, "snapchat", "wrong_token")
+	ts.Require().Equal(http.StatusNotFound, w.Code)
+}
diff --git a/internal/api/provider/snapchat.go b/internal/api/provider/snapchat.go
@@ -0,0 +1,117 @@
+package provider
+
+import (
+	"context"
+	"net/url"
+	"strings"
+
+	"github.com/supabase/auth/internal/conf"
+	"golang.org/x/oauth2"
+)
+
+const IssuerSnapchat = "https://accounts.snapchat.com"
+
+const (
+	defaultSnapchatAuthBase  = "accounts.snapchat.com"
+	defaultSnapchatTokenBase = "accounts.snapchat.com"
+	defaultSnapchatAPIBase   = "kit.snapchat.com"
+)
+
+type snapchatProvider struct {
+	*oauth2.Config
+	ProfileURL string
+}
+
+type snapchatUser struct {
+	Data struct {
+		Me struct {
+			ExternalID  string `json:"externalId"`
+			DisplayName string `json:"displayName"`
+			Bitmoji     struct {
+				Avatar string `json:"avatar"`
+			} `json:"bitmoji"`
+		} `json:"me"`
+	} `json:"data"`
+}
+
+// NewSnapchatProvider creates a Snapchat account provider.
+func NewSnapchatProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error) {
+	if err := ext.ValidateOAuth(); err != nil {
+		return nil, err
+	}
+
+	authHost := chooseHost(ext.URL, defaultSnapchatAuthBase)
+	tokenHost := chooseHost(ext.URL, defaultSnapchatTokenBase)
+	profileURL := chooseHost(ext.URL, defaultSnapchatAPIBase) + "/v1/me"
+
+	oauthScopes := []string{
+		"https://auth.snapchat.com/oauth2/api/user.external_id",
+		"https://auth.snapchat.com/oauth2/api/user.display_name",
+		"https://auth.snapchat.com/oauth2/api/user.bitmoji.avatar",
+	}
+
+	if scopes != "" {
+		oauthScopes = append(oauthScopes, strings.Split(scopes, ",")...)
+	}
+
+	return &snapchatProvider{
+		Config: &oauth2.Config{
+			ClientID:     ext.ClientID[0],
+			ClientSecret: ext.Secret,
+			RedirectURL:  ext.RedirectURI,
+			Endpoint: oauth2.Endpoint{
+				AuthURL:  authHost + "/accounts/oauth2/auth",
+				TokenURL: tokenHost + "/accounts/oauth2/token",
+			},
+			Scopes: oauthScopes,
+		},
+		ProfileURL: profileURL,
+	}, nil
+}
+
+func (p snapchatProvider) GetOAuthToken(code string) (*oauth2.Token, error) {
+	return p.Exchange(context.Background(), code)
+}
+
+func (p snapchatProvider) GetUserData(ctx context.Context, tok *oauth2.Token) (*UserProvidedData, error) {
+	var u snapchatUser
+
+	// Create a URL with the GraphQL query parameter
+	baseURL, err := url.Parse(p.ProfileURL)
+	if err != nil {
+		return nil, err
+	}
+
+	// Add the GraphQL query parameter
+	query := url.Values{}
+	query.Add("query", "{me { externalId displayName bitmoji { avatar id } } }")
+	baseURL.RawQuery = query.Encode()
+
+	if err := makeRequest(ctx, tok, p.Config, baseURL.String(), &u); err != nil {
+		return nil, err
+	}
+
+	data := &UserProvidedData{}
+
+	// Snapchat doesn't provide email by default, additional scopes needed
+	data.Emails = []Email{{
+		Email:    strings.ToLower(u.Data.Me.ExternalID) + "@snapchat.id", // TODO: Create a pseudo-email using the external ID
+		Verified: true,
+		Primary:  true,
+	}}
+
+	data.Metadata = &Claims{
+		Issuer:  IssuerSnapchat,
+		Subject: u.Data.Me.ExternalID,
+		Name:    u.Data.Me.DisplayName,
+		Picture: u.Data.Me.Bitmoji.Avatar,
+
+		// To be deprecated
+		Slug:       u.Data.Me.DisplayName,
+		AvatarURL:  u.Data.Me.Bitmoji.Avatar,
+		FullName:   u.Data.Me.DisplayName,
+		ProviderId: u.Data.Me.ExternalID,
+	}
+
+	return data, nil
+}
diff --git a/internal/api/settings.go b/internal/api/settings.go
@@ -9,6 +9,7 @@ type ProviderSettings struct {
 	Bitbucket      bool `json:"bitbucket"`
 	Discord        bool `json:"discord"`
 	Facebook       bool `json:"facebook"`
+	Snapchat       bool `json:"snapchat"`
 	Figma          bool `json:"figma"`
 	Fly            bool `json:"fly"`
 	GitHub         bool `json:"github"`
@@ -50,6 +51,7 @@ func (a *API) Settings(w http.ResponseWriter, r *http.Request) error {
 			Bitbucket:      config.External.Bitbucket.Enabled,
 			Discord:        config.External.Discord.Enabled,
 			Facebook:       config.External.Facebook.Enabled,
+			Snapchat:       config.External.Snapchat.Enabled,
 			Figma:          config.External.Figma.Enabled,
 			Fly:            config.External.Fly.Enabled,
 			GitHub:         config.External.Github.Enabled,
diff --git a/internal/api/settings_test.go b/internal/api/settings_test.go
@@ -32,6 +32,7 @@ func TestSettings_DefaultProviders(t *testing.T) {
 	require.True(t, p.Bitbucket)
 	require.True(t, p.Discord)
 	require.True(t, p.Facebook)
+	require.True(t, p.Snapchat)
 	require.True(t, p.Notion)
 	require.True(t, p.Spotify)
 	require.True(t, p.Slack)
diff --git a/internal/conf/configuration.go b/internal/conf/configuration.go
@@ -321,6 +321,7 @@ type ProviderConfiguration struct {
 	Bitbucket               OAuthProviderConfiguration     `json:"bitbucket"`
 	Discord                 OAuthProviderConfiguration     `json:"discord"`
 	Facebook                OAuthProviderConfiguration     `json:"facebook"`
+	Snapchat                OAuthProviderConfiguration     `json:"snapchat"`
 	Figma                   OAuthProviderConfiguration     `json:"figma"`
 	Fly                     OAuthProviderConfiguration     `json:"fly"`
 	Github                  OAuthProviderConfiguration     `json:"github"`
diff --git a/internal/reloader/testdata/50_example.env b/internal/reloader/testdata/50_example.env
@@ -84,6 +84,12 @@ GOTRUE_EXTERNAL_FACEBOOK_CLIENT_ID=""
 GOTRUE_EXTERNAL_FACEBOOK_SECRET=""
 GOTRUE_EXTERNAL_FACEBOOK_REDIRECT_URI="https://localhost:9999/callback"
 
+# Snapchat OAuth config
+GOTRUE_EXTERNAL_SNAPCHAT_ENABLED="false"
+GOTRUE_EXTERNAL_SNAPCHAT_CLIENT_ID=""
+GOTRUE_EXTERNAL_SNAPCHAT_SECRET=""
+GOTRUE_EXTERNAL_SNAPCHAT_REDIRECT_URI="https://localhost:9999/callback"
+
 # Figma OAuth config
 GOTRUE_EXTERNAL_FIGMA_ENABLED="false"
 GOTRUE_EXTERNAL_FIGMA_CLIENT_ID=""
