2021-07-21 23:04:00 +00:00
|
|
|
package usecase
|
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
2022-02-01 18:38:08 +00:00
|
|
|
"errors"
|
2022-01-13 20:50:40 +00:00
|
|
|
"fmt"
|
2021-07-21 23:04:00 +00:00
|
|
|
|
2021-10-13 21:53:31 +00:00
|
|
|
"github.com/lestrrat-go/jwx/jwa"
|
|
|
|
"github.com/lestrrat-go/jwx/jwt"
|
2021-09-29 20:35:39 +00:00
|
|
|
|
2022-01-04 17:31:33 +00:00
|
|
|
"source.toby3d.me/website/indieauth/internal/domain"
|
2022-02-25 15:34:20 +00:00
|
|
|
"source.toby3d.me/website/indieauth/internal/profile"
|
2022-01-13 20:50:40 +00:00
|
|
|
"source.toby3d.me/website/indieauth/internal/session"
|
2022-01-04 17:31:33 +00:00
|
|
|
"source.toby3d.me/website/indieauth/internal/token"
|
2021-07-21 23:04:00 +00:00
|
|
|
)
|
|
|
|
|
2022-02-25 15:34:20 +00:00
|
|
|
type (
|
|
|
|
Config struct {
|
|
|
|
Config *domain.Config
|
|
|
|
Profiles profile.Repository
|
|
|
|
Sessions session.Repository
|
|
|
|
Tokens token.Repository
|
|
|
|
}
|
2021-07-21 23:04:00 +00:00
|
|
|
|
2022-02-25 15:34:20 +00:00
|
|
|
tokenUseCase struct {
|
|
|
|
config *domain.Config
|
|
|
|
profiles profile.Repository
|
|
|
|
sessions session.Repository
|
|
|
|
tokens token.Repository
|
|
|
|
}
|
|
|
|
)
|
|
|
|
|
|
|
|
func NewTokenUseCase(config Config) token.UseCase {
|
2022-01-13 20:50:40 +00:00
|
|
|
jwt.RegisterCustomField("scope", make(domain.Scopes, 0))
|
2021-11-14 21:17:25 +00:00
|
|
|
|
2021-07-21 23:04:00 +00:00
|
|
|
return &tokenUseCase{
|
2022-02-25 15:34:20 +00:00
|
|
|
config: config.Config,
|
|
|
|
profiles: config.Profiles,
|
|
|
|
sessions: config.Sessions,
|
|
|
|
tokens: config.Tokens,
|
2021-07-21 23:04:00 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-02-25 15:34:20 +00:00
|
|
|
func (uc *tokenUseCase) Exchange(ctx context.Context, opts token.ExchangeOptions) (*domain.Token, *domain.Profile,
|
2022-01-29 20:43:53 +00:00
|
|
|
error) {
|
2022-02-25 15:34:20 +00:00
|
|
|
session, err := uc.sessions.GetAndDelete(ctx, opts.Code)
|
2021-11-14 21:17:25 +00:00
|
|
|
if err != nil {
|
2022-01-29 20:43:53 +00:00
|
|
|
return nil, nil, fmt.Errorf("cannot get session from store: %w", err)
|
2021-11-14 21:17:25 +00:00
|
|
|
}
|
|
|
|
|
2022-01-13 20:50:40 +00:00
|
|
|
if opts.ClientID.String() != session.ClientID.String() {
|
2022-01-29 20:43:53 +00:00
|
|
|
return nil, nil, token.ErrMismatchClientID
|
2022-01-13 20:50:40 +00:00
|
|
|
}
|
2021-11-14 21:17:25 +00:00
|
|
|
|
2022-01-13 20:50:40 +00:00
|
|
|
if opts.RedirectURI.String() != session.RedirectURI.String() {
|
2022-01-29 20:43:53 +00:00
|
|
|
return nil, nil, token.ErrMismatchRedirectURI
|
2022-01-13 20:50:40 +00:00
|
|
|
}
|
|
|
|
|
2022-02-02 21:13:46 +00:00
|
|
|
if session.CodeChallenge != "" && session.CodeChallengeMethod != domain.CodeChallengeMethodUndefined &&
|
2022-01-13 20:50:40 +00:00
|
|
|
!session.CodeChallengeMethod.Validate(session.CodeChallenge, opts.CodeVerifier) {
|
2022-01-29 20:43:53 +00:00
|
|
|
return nil, nil, token.ErrMismatchPKCE
|
|
|
|
}
|
|
|
|
|
|
|
|
// NOTE(toby3d): If the authorization code was issued with no scope, the
|
|
|
|
// token endpoint MUST NOT issue an access token, as empty scopes are
|
2022-02-01 18:38:08 +00:00
|
|
|
// invalid (RFC 6749 section 3.3).
|
2022-01-29 20:43:53 +00:00
|
|
|
if session.Scope.IsEmpty() {
|
|
|
|
return nil, nil, token.ErrEmptyScope
|
2022-01-13 20:50:40 +00:00
|
|
|
}
|
2021-11-14 21:17:25 +00:00
|
|
|
|
2022-02-17 21:47:13 +00:00
|
|
|
if !session.Scope.Has(domain.ScopeProfile) {
|
|
|
|
session.Profile = nil
|
|
|
|
} else if !session.Scope.Has(domain.ScopeEmail) {
|
|
|
|
session.Profile.Email = nil
|
|
|
|
}
|
|
|
|
|
2022-02-01 17:27:48 +00:00
|
|
|
tkn, err := domain.NewToken(domain.NewTokenOptions{
|
2022-02-25 15:34:20 +00:00
|
|
|
Expiration: uc.config.JWT.Expiry,
|
2022-01-13 20:50:40 +00:00
|
|
|
Issuer: session.ClientID,
|
2022-02-17 21:47:13 +00:00
|
|
|
Subject: session.Me,
|
2022-01-13 20:50:40 +00:00
|
|
|
Scope: session.Scope,
|
2022-02-25 15:34:20 +00:00
|
|
|
Secret: []byte(uc.config.JWT.Secret),
|
|
|
|
Algorithm: uc.config.JWT.Algorithm,
|
|
|
|
NonceLength: uc.config.JWT.NonceLength,
|
2022-01-13 20:50:40 +00:00
|
|
|
})
|
2021-11-14 21:17:25 +00:00
|
|
|
if err != nil {
|
2022-01-29 20:43:53 +00:00
|
|
|
return nil, nil, fmt.Errorf("cannot generate a new access token: %w", err)
|
2021-11-14 21:17:25 +00:00
|
|
|
}
|
|
|
|
|
2022-02-17 21:47:13 +00:00
|
|
|
return tkn, session.Profile, nil
|
2021-11-14 21:17:25 +00:00
|
|
|
}
|
|
|
|
|
2022-02-25 15:34:20 +00:00
|
|
|
func (uc *tokenUseCase) Verify(ctx context.Context, accessToken string) (*domain.Token, *domain.Profile, error) {
|
|
|
|
find, err := uc.tokens.Get(ctx, accessToken)
|
2022-02-01 18:38:08 +00:00
|
|
|
if err != nil && !errors.Is(err, token.ErrNotExist) {
|
2022-02-25 15:34:20 +00:00
|
|
|
return nil, nil, fmt.Errorf("cannot check token in store: %w", err)
|
2021-09-23 18:27:59 +00:00
|
|
|
}
|
|
|
|
|
2021-10-17 22:51:10 +00:00
|
|
|
if find != nil {
|
2022-02-25 15:34:20 +00:00
|
|
|
return nil, nil, token.ErrRevoke
|
2021-10-13 21:53:31 +00:00
|
|
|
}
|
|
|
|
|
2022-02-25 15:34:20 +00:00
|
|
|
tkn, err := jwt.ParseString(accessToken, jwt.WithVerify(jwa.SignatureAlgorithm(uc.config.JWT.Algorithm),
|
|
|
|
[]byte(uc.config.JWT.Secret)))
|
2021-10-13 21:53:31 +00:00
|
|
|
if err != nil {
|
2022-02-25 15:34:20 +00:00
|
|
|
return nil, nil, fmt.Errorf("cannot parse JWT token: %w", err)
|
2021-10-13 21:53:31 +00:00
|
|
|
}
|
|
|
|
|
2022-02-01 17:27:48 +00:00
|
|
|
if err = jwt.Validate(tkn); err != nil {
|
2022-02-25 15:34:20 +00:00
|
|
|
return nil, nil, fmt.Errorf("cannot validate JWT token: %w", err)
|
2021-10-13 21:53:31 +00:00
|
|
|
}
|
|
|
|
|
2022-02-17 21:47:13 +00:00
|
|
|
result := &domain.Token{
|
|
|
|
CreatedAt: tkn.IssuedAt(),
|
|
|
|
Expiry: tkn.Expiration(),
|
|
|
|
ClientID: nil,
|
|
|
|
Me: nil,
|
|
|
|
Scope: nil,
|
|
|
|
AccessToken: accessToken,
|
|
|
|
RefreshToken: "", // TODO(toby3d)
|
|
|
|
}
|
2022-02-01 17:27:48 +00:00
|
|
|
result.ClientID, _ = domain.ParseClientID(tkn.Issuer())
|
|
|
|
result.Me, _ = domain.ParseMe(tkn.Subject())
|
2021-10-13 21:53:31 +00:00
|
|
|
|
2022-02-01 17:27:48 +00:00
|
|
|
if scope, ok := tkn.Get("scope"); ok {
|
2022-01-13 20:50:40 +00:00
|
|
|
result.Scope, _ = scope.(domain.Scopes)
|
2021-10-13 21:53:31 +00:00
|
|
|
}
|
|
|
|
|
2022-02-17 21:47:13 +00:00
|
|
|
if !result.Scope.Has(domain.ScopeProfile) {
|
2022-02-25 15:34:20 +00:00
|
|
|
return result, nil, nil
|
2022-02-17 21:47:13 +00:00
|
|
|
}
|
|
|
|
|
2022-02-25 15:34:20 +00:00
|
|
|
profile, err := uc.profiles.Get(ctx, result.Me)
|
|
|
|
if err != nil {
|
|
|
|
return result, nil, nil
|
2022-02-17 21:47:13 +00:00
|
|
|
}
|
|
|
|
|
2022-02-25 15:34:20 +00:00
|
|
|
if !result.Scope.Has(domain.ScopeEmail) && len(profile.Email) > 0 {
|
|
|
|
profile.Email = nil
|
2022-02-17 21:47:13 +00:00
|
|
|
}
|
|
|
|
|
2022-02-25 15:34:20 +00:00
|
|
|
return result, profile, nil
|
2021-09-20 18:25:08 +00:00
|
|
|
}
|
|
|
|
|
2022-02-25 15:34:20 +00:00
|
|
|
func (uc *tokenUseCase) Revoke(ctx context.Context, accessToken string) error {
|
|
|
|
tkn, _, err := uc.Verify(ctx, accessToken)
|
2021-10-13 21:53:31 +00:00
|
|
|
if err != nil {
|
2022-01-13 20:50:40 +00:00
|
|
|
return fmt.Errorf("cannot verify token: %w", err)
|
2021-10-13 21:53:31 +00:00
|
|
|
}
|
|
|
|
|
2022-02-25 15:34:20 +00:00
|
|
|
if err = uc.tokens.Create(ctx, tkn); err != nil {
|
2022-01-13 20:50:40 +00:00
|
|
|
return fmt.Errorf("cannot save token in database: %w", err)
|
2021-09-23 18:27:59 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
2021-07-21 23:04:00 +00:00
|
|
|
}
|