Merge branch 'pr/4014' into devel

Fixes #4014.

History.md

@@ -23,6 +23,12 @@
 * Preserve the value of `_` in `meteor shell`.  #4010
 
 
+## Meteor Accounts
+
+* Add `Accounts.oauth.deregisterService` method, and ensure that users can only
+  log in with currently registered services.  #4014
+
+
 ## v1.1, 2015-??
 
 ### Windows Support

packages/accounts-oauth/oauth_common.js

@@ -19,6 +19,17 @@ Accounts.oauth.registerService = function (name) {
   }
 };
 
+// Removes a previously registered service.
+// This will disable logging in with this service, and serviceNames() will not
+// contain it.
+// It's worth noting that already logged in users will remain logged in unless
+// you manually expire their sessions.
+Accounts.oauth.deregisterService = function (name) {
+  if (!_.has(services, name))
+    throw new Error("Service not found: " + name);
+  delete services[name];
+};
+
 Accounts.oauth.serviceNames = function () {
   return _.keys(services);
 };

packages/accounts-oauth/oauth_server.js

@@ -41,6 +41,17 @@ Accounts.registerLoginHandler(function (options) {
     // We tried to login, but there was a fatal error. Report it back
     // to the user.
     throw result;
-  else
+  else {
+    if (!_.contains(Accounts.oauth.serviceNames(), result.serviceName)) {
+      // serviceName was not found in the registered services list.
+      // This could happen because the service never registered itself or
+      // deregisterService was called on it.
+      return { type: "oauth",
+               error: new Meteor.Error(
+                 Accounts.LoginCancelledError.numericError,
+                 "No registered oauth service found for: " + result.serviceName) };
+
+    }
     return Accounts.updateOrCreateUserFromExternalService(result.serviceName, result.serviceData, result.options);
+  }
 });