Django HRM ×
Rocket.Chat SSO

OAUTH2_PROVIDER = {
    "SCOPES": {
        "read":  "Read scope",
        "write": "Write scope",
    },
    "ACCESS_TOKEN_EXPIRE_SECONDS":  36000,
    "REFRESH_TOKEN_EXPIRE_SECONDS": 86400,
    "ROTATE_REFRESH_TOKEN":         True,

    # ← CRITICAL: disable PKCE for Rocket.Chat compatibility
    "PKCE_REQUIRED": False,

    # Allow http for local development
    "ALLOWED_REDIRECT_URI_SCHEMES": ["https", "http"],
}

from django.urls import path, include

urlpatterns = [
    path("admin/", admin.site.urls),

    # OAuth2 built-in endpoints — MUST be before your api urls
    path("o/", include("oauth2_provider.urls",
         namespace="oauth2_provider")),  # ← gives /o/token/ /o/authorize/ etc

    # Your custom endpoints
    path("api/v2/", include("apps.account.urls")),
]

from oauth2_provider.views import ProtectedResourceView
from django.http import JsonResponse

class UserInfoView(ProtectedResourceView):
    """
    Rocket.Chat calls this with: Authorization: Bearer <token>
    Returns user data to create/update Rocket.Chat user profile.
    """
    def get(self, request, *args, **kwargs):
        user = request.user
        return JsonResponse({
            "sub":      str(user.pk),       # required — unique user ID
            "email":   user.email,         # required — for matching accounts
            "name":    user.get_full_name()
                       or user.username,  # display name in Rocket.Chat
            "username": user.username,     # Rocket.Chat username
        })

from django.urls import path
from .views import UserInfoView

urlpatterns = [
    # ... your other urls
    path("o/userinfo/", UserInfoView.as_view(), name="userinfo"),
]

// Build the authorize URL and redirect user
function loginWithHRM() {
  const params = new URLSearchParams({
    response_type: "code",
    client_id:     "KEf3f5N4JiTg9fuyRU96zcX882ZSR2Cwihbmbkfv",
    redirect_uri:  "https://your_company_site.com/_oauth/hrm",
    scope:         "read write",
    state:         generateState(),  // random string for CSRF protection
  });

  window.location.href =
    `https://api.your_company_site.com/o/authorize/?${params}`;
}

function generateState() {
  return Math.random().toString(36).substring(2, 15);
}

// On your redirect_uri page, extract the code
const params = new URLSearchParams(window.location.search);
const code  = params.get("code");
const state = params.get("state");

// Exchange code for token via your backend
const response = await fetch("/api/v2/account/oauth/callback/", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ code, state }),
});

const { access_token } = await response.json();
localStorage.setItem("token", access_token);
window.location.href = "/dashboard";

import requests
from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework.permissions import AllowAny

class OAuthCallbackView(APIView):
    permission_classes = [AllowAny]

    def post(self, request):
        code = request.data.get("code")

        # Exchange code for token
        token_response = requests.post(
            "https://api.your_company_site.com/o/token/",
            data={
                "grant_type":    "authorization_code",
                "code":          code,
                "redirect_uri":  "https://your-frontend.com/callback",
                "client_id":     "KEf3f5N4JiTg9fuyRU96zcX882ZSR2Cwihbmbkfv",
                "client_secret": "your_plain_secret",
            }
        )
        return Response(token_response.json())