Add OpenID Connect authentication

[apilat]

Partially addresses #61 and #515 by adding support for OpenID Connect and generally a more flexible approach to authenticating with the server. Sister PR for server available as actualbudget/actual-server#219

The flow of the bootstrap/login process is

• client sends /bootstrap request which now accepts an additional parameter openid: {issuer, client_id, client_secret, server_hostname}.
• client can request GET /login-methods to receive a list of supported login methods (currently password or openid)
• client sends POST /login-openid with return_url parameter (pointing back to the frontend), server returns redirect_url leading to the openid issuer, client redirects
• user authenticates with openid provider, which redirects to /login-openid/cb on server
• server verifies openid authentication, then redirects to /login/openid-cb on client, passing the token
• client saves token and registers sign in

Some of the changes in the code and not backwards compatible (most importantly server SQL schema and /account/bootstrap behavior). I'm not sure what the project's approach to such changes is - it might be possible to add in special cases to allow a client to connect to an older server. However, this might not be necessary if users are expected to self-host instances and upgrade the server and client in tandem. A more pressing issue is database schema migration - I couldn't find any precedent for how this is done in the server so I would appreciate the maintainer's view on the best approach to do this.

For a user that doesn't use OpenID, this PR slightly changes the bootstrap behavior for passwords as well. Namely, after setting up the password in /bootstrap, the user isn't instantly granted access but instead redirected to /login. This is quite an important change for OpenID as otherwise the user has no way of knowing whether the OpenID configuration works at all. In the case of password authentication, misconfiguration is less likely but nevertheless double-checking the user remembers the password doesn't seem too inconvenient to me.

I am not very familiar with React, so let me know if I have broken any coding conventions. Likewise with web design, I welcome improvements to the presentation of the login/bootstrap screens.

[netlify[bot]]

✅ Deploy Preview for actualbudget ready!

Name	Link
🔨 Latest commit	28c323e4cf64cc6cb343996708b91a8f2e443656
🔍 Latest deploy log	https://app.netlify.com/sites/actualbudget/deploys/649b2cbf3e1c4a0008f483b9
😎 Deploy Preview	https://deploy-preview-1164--actualbudget.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[MatissJanis]

👋 Sorry for the slow review. Overall this looks very exciting!

Some issues:

• [ ] can you add a vertical separator between the regular login option and the "advanced" login? Currently it seems like the openid button is part of the usual registration flow, but it is actually different and hence should be more easily indistinguishable as such

• [ ] can you replace the "actual is super fast..." text with set-up instructions for openid? Think: if I'm a new user and don't know what openid is - how can we explain easily what it is, why use it and how to set it up (maybe link to docs set-up guide?)

• [ ] can you make the buttons side-by-side: left side - "back" (with an arrow) - and right side - ok (primary button)?

• [ ] if the form is not filled and you press "ok" the next page will break and there is no way to return back

• [ ] "change password" link is visible in the app even though I had set up openId

How can I fully test the openid solution? Do I need to set-up a local server? Maybe there's an easier way to use a 3rd party service (for testing purposes)? Could you provide a bit more information so I could test the end-to-end flow?

[carkom]

If you don't have an openid server then https://oauth.tools/ is a good resource for testing.

[MatissJanis]

👋 This PR seems to have gone stale with many conflicts. If you resume working on it - please open a new PR and we'll happily work with you to get this merged ASAP.

[MissakaI]

This seems as a welcoming change for actual. Quick question, How can a user with existing budget files move to a new instance with this openid configuration.

Also @apilat I would love to contribute to this as well.

[k8ieone]

I'd love to see this implemented, this is currently the one missing feature that keeps me from hosting Actual. Is there any way a non-developer like me could help?

[RefineryX]

Would also LOVE to see this implemented!!