Oauth/token (#7)
* add host and protocol options * some fiddling * tidying up and comments * tick off /oauth/token * tidying a bit * tidying * go mod tidy * allow attaching middleware to server * add middleware * more user friendly * add comments * comments * store account + app * tidying * lots of restructuring * lint + tidy
This commit is contained in:
Tobi Smethurst
GitHub
@ -1,3 +0,0 @@
|
||||
# oauth
|
||||
|
||||
This package provides uses the [GoToSocial oauth2](https://github.com/gotosocial/oauth2) module (forked from [go-oauth2](https://github.com/go-oauth2/oauth2)) to provide [oauth2](https://www.oauth.com/) server functionality to the GoToSocial APIs.
|
||||
@ -1,446 +0,0 @@
|
||||
/*
|
||||
GoToSocial
|
||||
Copyright (C) 2021 GoToSocial Authors admin@gotosocial.org
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU Affero General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU Affero General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU Affero General Public License
|
||||
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
package oauth
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/url"
|
||||
|
||||
"github.com/gin-contrib/sessions"
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/go-pg/pg/v10"
|
||||
"github.com/google/uuid"
|
||||
"github.com/gotosocial/gotosocial/internal/api"
|
||||
"github.com/gotosocial/gotosocial/internal/gtsmodel"
|
||||
"github.com/gotosocial/gotosocial/pkg/mastotypes"
|
||||
"github.com/gotosocial/oauth2/v4"
|
||||
"github.com/gotosocial/oauth2/v4/errors"
|
||||
"github.com/gotosocial/oauth2/v4/manage"
|
||||
"github.com/gotosocial/oauth2/v4/server"
|
||||
"github.com/sirupsen/logrus"
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
)
|
||||
|
||||
type API struct {
|
||||
manager *manage.Manager
|
||||
server *server.Server
|
||||
conn *pg.DB
|
||||
log *logrus.Logger
|
||||
}
|
||||
|
||||
type login struct {
|
||||
Email string `form:"username"`
|
||||
Password string `form:"password"`
|
||||
}
|
||||
|
||||
type code struct {
|
||||
Code string `form:"code"`
|
||||
}
|
||||
|
||||
func New(ts oauth2.TokenStore, cs oauth2.ClientStore, conn *pg.DB, log *logrus.Logger) *API {
|
||||
manager := manage.NewDefaultManager()
|
||||
manager.MapTokenStorage(ts)
|
||||
manager.MapClientStorage(cs)
|
||||
manager.SetAuthorizeCodeTokenCfg(manage.DefaultAuthorizeCodeTokenCfg)
|
||||
sc := &server.Config{
|
||||
TokenType: "Bearer",
|
||||
// Must follow the spec.
|
||||
AllowGetAccessRequest: false,
|
||||
// Support only the non-implicit flow.
|
||||
AllowedResponseTypes: []oauth2.ResponseType{oauth2.Code},
|
||||
// Allow:
|
||||
// - Authorization Code (for first & third parties)
|
||||
// - Refreshing Tokens
|
||||
//
|
||||
// Deny:
|
||||
// - Resource owner secrets (password grant)
|
||||
// - Client secrets
|
||||
AllowedGrantTypes: []oauth2.GrantType{
|
||||
oauth2.AuthorizationCode,
|
||||
oauth2.Refreshing,
|
||||
},
|
||||
AllowedCodeChallengeMethods: []oauth2.CodeChallengeMethod{
|
||||
oauth2.CodeChallengePlain,
|
||||
},
|
||||
}
|
||||
|
||||
srv := server.NewServer(sc, manager)
|
||||
srv.SetInternalErrorHandler(func(err error) *errors.Response {
|
||||
log.Errorf("internal oauth error: %s", err)
|
||||
return nil
|
||||
})
|
||||
|
||||
srv.SetResponseErrorHandler(func(re *errors.Response) {
|
||||
log.Errorf("internal response error: %s", re.Error)
|
||||
})
|
||||
|
||||
api := &API{
|
||||
manager: manager,
|
||||
server: srv,
|
||||
conn: conn,
|
||||
log: log,
|
||||
}
|
||||
|
||||
api.server.SetUserAuthorizationHandler(api.UserAuthorizationHandler)
|
||||
api.server.SetClientInfoHandler(server.ClientFormHandler)
|
||||
return api
|
||||
}
|
||||
|
||||
func (a *API) AddRoutes(s api.Server) error {
|
||||
s.AttachHandler(http.MethodPost, "/api/v1/apps", a.AppsPOSTHandler)
|
||||
|
||||
s.AttachHandler(http.MethodGet, "/auth/sign_in", a.SignInGETHandler)
|
||||
s.AttachHandler(http.MethodPost, "/auth/sign_in", a.SignInPOSTHandler)
|
||||
|
||||
s.AttachHandler(http.MethodPost, "/oauth/token", a.TokenPOSTHandler)
|
||||
|
||||
s.AttachHandler(http.MethodGet, "/oauth/authorize", a.AuthorizeGETHandler)
|
||||
s.AttachHandler(http.MethodPost, "/oauth/authorize", a.AuthorizePOSTHandler)
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func incorrectPassword() (string, error) {
|
||||
return "", errors.New("password/email combination was incorrect")
|
||||
}
|
||||
|
||||
/*
|
||||
MAIN HANDLERS -- serve these through a server/router
|
||||
*/
|
||||
|
||||
// AppsPOSTHandler should be served at https://example.org/api/v1/apps
|
||||
// It is equivalent to: https://docs.joinmastodon.org/methods/apps/
|
||||
func (a *API) AppsPOSTHandler(c *gin.Context) {
|
||||
l := a.log.WithField("func", "AppsPOSTHandler")
|
||||
l.Trace("entering AppsPOSTHandler")
|
||||
|
||||
form := &mastotypes.ApplicationPOSTRequest{}
|
||||
if err := c.ShouldBind(form); err != nil {
|
||||
c.JSON(http.StatusUnprocessableEntity, gin.H{"error": err.Error()})
|
||||
return
|
||||
}
|
||||
|
||||
// permitted length for most fields
|
||||
permittedLength := 64
|
||||
// redirect can be a bit bigger because we probably need to encode data in the redirect uri
|
||||
permittedRedirect := 256
|
||||
|
||||
// check lengths of fields before proceeding so the user can't spam huge entries into the database
|
||||
if len(form.ClientName) > permittedLength {
|
||||
c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("client_name must be less than %d bytes", permittedLength)})
|
||||
return
|
||||
}
|
||||
if len(form.Website) > permittedLength {
|
||||
c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("website must be less than %d bytes", permittedLength)})
|
||||
return
|
||||
}
|
||||
if len(form.RedirectURIs) > permittedRedirect {
|
||||
c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("redirect_uris must be less than %d bytes", permittedRedirect)})
|
||||
return
|
||||
}
|
||||
if len(form.Scopes) > permittedLength {
|
||||
c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("scopes must be less than %d bytes", permittedLength)})
|
||||
return
|
||||
}
|
||||
|
||||
// set default 'read' for scopes if it's not set
|
||||
var scopes string
|
||||
if form.Scopes == "" {
|
||||
scopes = "read"
|
||||
} else {
|
||||
scopes = form.Scopes
|
||||
}
|
||||
|
||||
// generate new IDs for this application and its associated client
|
||||
clientID := uuid.NewString()
|
||||
clientSecret := uuid.NewString()
|
||||
vapidKey := uuid.NewString()
|
||||
|
||||
// generate the application to put in the database
|
||||
app := >smodel.Application{
|
||||
Name: form.ClientName,
|
||||
Website: form.Website,
|
||||
RedirectURI: form.RedirectURIs,
|
||||
ClientID: clientID,
|
||||
ClientSecret: clientSecret,
|
||||
Scopes: scopes,
|
||||
VapidKey: vapidKey,
|
||||
}
|
||||
|
||||
// chuck it in the db
|
||||
if _, err := a.conn.Model(app).Insert(); err != nil {
|
||||
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
||||
return
|
||||
}
|
||||
|
||||
// now we need to model an oauth client from the application that the oauth library can use
|
||||
oc := &oauthClient{
|
||||
ID: clientID,
|
||||
Secret: clientSecret,
|
||||
Domain: form.RedirectURIs,
|
||||
UserID: "", // This client isn't yet associated with a specific user, it's just an app client right now
|
||||
}
|
||||
|
||||
// chuck it in the db
|
||||
if _, err := a.conn.Model(oc).Insert(); err != nil {
|
||||
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
||||
return
|
||||
}
|
||||
|
||||
// done, return the new app information per the spec here: https://docs.joinmastodon.org/methods/apps/
|
||||
c.JSON(http.StatusOK, app)
|
||||
}
|
||||
|
||||
// SignInGETHandler should be served at https://example.org/auth/sign_in.
|
||||
// The idea is to present a sign in page to the user, where they can enter their username and password.
|
||||
// The form will then POST to the sign in page, which will be handled by SignInPOSTHandler
|
||||
func (a *API) SignInGETHandler(c *gin.Context) {
|
||||
a.log.WithField("func", "SignInGETHandler").Trace("serving sign in html")
|
||||
c.HTML(http.StatusOK, "sign-in.tmpl", gin.H{})
|
||||
}
|
||||
|
||||
// SignInPOSTHandler should be served at https://example.org/auth/sign_in.
|
||||
// The idea is to present a sign in page to the user, where they can enter their username and password.
|
||||
// The handler will then redirect to the auth handler served at /auth
|
||||
func (a *API) SignInPOSTHandler(c *gin.Context) {
|
||||
l := a.log.WithField("func", "SignInPOSTHandler")
|
||||
s := sessions.Default(c)
|
||||
form := &login{}
|
||||
if err := c.ShouldBind(form); err != nil {
|
||||
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||
return
|
||||
}
|
||||
l.Tracef("parsed form: %+v", form)
|
||||
|
||||
userid, err := a.ValidatePassword(form.Email, form.Password)
|
||||
if err != nil {
|
||||
c.String(http.StatusForbidden, err.Error())
|
||||
return
|
||||
}
|
||||
|
||||
s.Set("username", userid)
|
||||
if err := s.Save(); err != nil {
|
||||
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
||||
return
|
||||
}
|
||||
|
||||
l.Trace("redirecting to auth page")
|
||||
c.Redirect(http.StatusFound, "/oauth/authorize")
|
||||
}
|
||||
|
||||
// TokenPOSTHandler should be served as a POST at https://example.org/oauth/token
|
||||
// The idea here is to serve an oauth access token to a user, which can be used for authorizing against non-public APIs.
|
||||
// See https://docs.joinmastodon.org/methods/apps/oauth/#obtain-a-token
|
||||
func (a *API) TokenPOSTHandler(c *gin.Context) {
|
||||
l := a.log.WithField("func", "TokenHandler")
|
||||
l.Trace("entered token handler, will now go to server.HandleTokenRequest")
|
||||
if err := a.server.HandleTokenRequest(c.Writer, c.Request); err != nil {
|
||||
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
||||
}
|
||||
}
|
||||
|
||||
// AuthorizeGETHandler should be served as GET at https://example.org/oauth/authorize
|
||||
// The idea here is to present an oauth authorize page to the user, with a button
|
||||
// that they have to click to accept. See here: https://docs.joinmastodon.org/methods/apps/oauth/#authorize-a-user
|
||||
func (a *API) AuthorizeGETHandler(c *gin.Context) {
|
||||
l := a.log.WithField("func", "AuthorizeGETHandler")
|
||||
s := sessions.Default(c)
|
||||
|
||||
// Username will be set in the session by AuthorizePOSTHandler if the caller has already gone through the authentication flow
|
||||
// If it's not set, then we don't know yet who the user is, so we need to redirect them to the sign in page.
|
||||
v := s.Get("username")
|
||||
if username, ok := v.(string); !ok || username == "" {
|
||||
l.Trace("username was empty, parsing form then redirecting to sign in page")
|
||||
|
||||
// first make sure they've filled out the authorize form with the required values
|
||||
form := &mastotypes.OAuthAuthorize{}
|
||||
if err := c.ShouldBind(form); err != nil {
|
||||
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||
return
|
||||
}
|
||||
l.Tracef("parsed form: %+v", form)
|
||||
|
||||
// these fields are *required* so check 'em
|
||||
if form.ResponseType == "" || form.ClientID == "" || form.RedirectURI == "" {
|
||||
c.JSON(http.StatusBadRequest, gin.H{"error": "missing one of: response_type, client_id or redirect_uri"})
|
||||
return
|
||||
}
|
||||
|
||||
// save these values from the form so we can use them elsewhere in the session
|
||||
s.Set("force_login", form.ForceLogin)
|
||||
s.Set("response_type", form.ResponseType)
|
||||
s.Set("client_id", form.ClientID)
|
||||
s.Set("redirect_uri", form.RedirectURI)
|
||||
s.Set("scope", form.Scope)
|
||||
if err := s.Save(); err != nil {
|
||||
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
||||
return
|
||||
}
|
||||
|
||||
// send them to the sign in page so we can tell who they are
|
||||
c.Redirect(http.StatusFound, "/auth/sign_in")
|
||||
return
|
||||
}
|
||||
|
||||
// Check if we have a code already. If we do, it means the user used urn:ietf:wg:oauth:2.0:oob as their redirect URI
|
||||
// and were sent here, which means they just want the code displayed so they can use it out of band.
|
||||
code := &code{}
|
||||
if err := c.Bind(code); err != nil {
|
||||
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
||||
return
|
||||
}
|
||||
|
||||
// the authorize template will either:
|
||||
// 1. Display the code to the user if they're already authorized and were redirected here because they selected urn:ietf:wg:oauth:2.0:oob.
|
||||
// 2. Display a form where they can get some information about the app that's trying to authorize, and approve it, which will then go to AuthorizePOSTHandler
|
||||
l.Trace("serving authorize html")
|
||||
c.HTML(http.StatusOK, "authorize.tmpl", gin.H{
|
||||
"code": code.Code,
|
||||
})
|
||||
}
|
||||
|
||||
// AuthorizePOSTHandler should be served as POST at https://example.org/oauth/authorize
|
||||
// The idea here is to present an oauth authorize page to the user, with a button
|
||||
// that they have to click to accept. See here: https://docs.joinmastodon.org/methods/apps/oauth/#authorize-a-user
|
||||
func (a *API) AuthorizePOSTHandler(c *gin.Context) {
|
||||
l := a.log.WithField("func", "AuthorizePOSTHandler")
|
||||
s := sessions.Default(c)
|
||||
|
||||
v := s.Get("username")
|
||||
if username, ok := v.(string); !ok || username == "" {
|
||||
c.JSON(http.StatusUnauthorized, gin.H{"error": "you are not signed in"})
|
||||
}
|
||||
|
||||
values := url.Values{}
|
||||
|
||||
if v, ok := s.Get("force_login").(string); !ok {
|
||||
c.JSON(http.StatusBadRequest, gin.H{"error": "session missing force_login"})
|
||||
return
|
||||
} else {
|
||||
values.Add("force_login", v)
|
||||
}
|
||||
|
||||
if v, ok := s.Get("response_type").(string); !ok {
|
||||
c.JSON(http.StatusBadRequest, gin.H{"error": "session missing response_type"})
|
||||
return
|
||||
} else {
|
||||
values.Add("response_type", v)
|
||||
}
|
||||
|
||||
if v, ok := s.Get("client_id").(string); !ok {
|
||||
c.JSON(http.StatusBadRequest, gin.H{"error": "session missing client_id"})
|
||||
return
|
||||
} else {
|
||||
values.Add("client_id", v)
|
||||
}
|
||||
|
||||
if v, ok := s.Get("redirect_uri").(string); !ok {
|
||||
c.JSON(http.StatusBadRequest, gin.H{"error": "session missing redirect_uri"})
|
||||
return
|
||||
} else {
|
||||
// todo: explain this little hack
|
||||
if v == "urn:ietf:wg:oauth:2.0:oob" {
|
||||
v = "http://localhost:8080/oauth/authorize"
|
||||
}
|
||||
values.Add("redirect_uri", v)
|
||||
}
|
||||
|
||||
if v, ok := s.Get("scope").(string); !ok {
|
||||
c.JSON(http.StatusBadRequest, gin.H{"error": "session missing scope"})
|
||||
return
|
||||
} else {
|
||||
values.Add("scope", v)
|
||||
}
|
||||
|
||||
if v, ok := s.Get("username").(string); !ok {
|
||||
c.JSON(http.StatusBadRequest, gin.H{"error": "session missing username"})
|
||||
return
|
||||
} else {
|
||||
values.Add("username", v)
|
||||
}
|
||||
|
||||
c.Request.Form = values
|
||||
l.Tracef("values on request set to %+v", c.Request.Form)
|
||||
|
||||
if err := s.Save(); err != nil {
|
||||
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
||||
return
|
||||
}
|
||||
|
||||
if err := a.server.HandleAuthorizeRequest(c.Writer, c.Request); err != nil {
|
||||
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
SUB-HANDLERS -- don't serve these directly, they should be attached to the oauth2 server
|
||||
*/
|
||||
|
||||
// PasswordAuthorizationHandler takes a username (in this case, we use an email address)
|
||||
// and a password. The goal is to authenticate the password against the one for that email
|
||||
// address stored in the database. If OK, we return the userid (a uuid) for that user,
|
||||
// so that it can be used in further Oauth flows to generate a token/retreieve an oauth client from the db.
|
||||
func (a *API) ValidatePassword(email string, password string) (userid string, err error) {
|
||||
l := a.log.WithField("func", "PasswordAuthorizationHandler")
|
||||
|
||||
// make sure an email/password was provided and bail if not
|
||||
if email == "" || password == "" {
|
||||
l.Debug("email or password was not provided")
|
||||
return incorrectPassword()
|
||||
}
|
||||
|
||||
// first we select the user from the database based on email address, bail if no user found for that email
|
||||
gtsUser := >smodel.User{}
|
||||
if err := a.conn.Model(gtsUser).Where("email = ?", email).Select(); err != nil {
|
||||
l.Debugf("user %s was not retrievable from db during oauth authorization attempt: %s", email, err)
|
||||
return incorrectPassword()
|
||||
}
|
||||
|
||||
// make sure a password is actually set and bail if not
|
||||
if gtsUser.EncryptedPassword == "" {
|
||||
l.Warnf("encrypted password for user %s was empty for some reason", gtsUser.Email)
|
||||
return incorrectPassword()
|
||||
}
|
||||
|
||||
// compare the provided password with the encrypted one from the db, bail if they don't match
|
||||
if err := bcrypt.CompareHashAndPassword([]byte(gtsUser.EncryptedPassword), []byte(password)); err != nil {
|
||||
l.Debugf("password hash didn't match for user %s during login attempt: %s", gtsUser.Email, err)
|
||||
return incorrectPassword()
|
||||
}
|
||||
|
||||
// If we've made it this far the email/password is correct, so we can just return the id of the user.
|
||||
userid = gtsUser.ID
|
||||
l.Tracef("returning (%s, %s)", userid, err)
|
||||
return
|
||||
}
|
||||
|
||||
// UserAuthorizationHandler gets the user's ID from the 'username' field of the request form,
|
||||
// or redirects to the /auth/sign_in page, if this key is not present.
|
||||
func (a *API) UserAuthorizationHandler(w http.ResponseWriter, r *http.Request) (userID string, err error) {
|
||||
l := a.log.WithField("func", "UserAuthorizationHandler")
|
||||
userID = r.FormValue("username")
|
||||
if userID == "" {
|
||||
l.Trace("username was empty, redirecting to sign in page")
|
||||
http.Redirect(w, r, "/auth/sign_in", http.StatusFound)
|
||||
return "", nil
|
||||
}
|
||||
l.Tracef("returning (%s, %s)", userID, err)
|
||||
return userID, err
|
||||
}
|
||||
@ -1,133 +0,0 @@
|
||||
package oauth
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/go-pg/pg/v10"
|
||||
"github.com/go-pg/pg/v10/orm"
|
||||
"github.com/gotosocial/gotosocial/internal/api"
|
||||
"github.com/gotosocial/gotosocial/internal/config"
|
||||
"github.com/gotosocial/gotosocial/internal/gtsmodel"
|
||||
"github.com/gotosocial/oauth2/v4"
|
||||
"github.com/sirupsen/logrus"
|
||||
"github.com/stretchr/testify/suite"
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
)
|
||||
|
||||
type OauthTestSuite struct {
|
||||
suite.Suite
|
||||
tokenStore oauth2.TokenStore
|
||||
clientStore oauth2.ClientStore
|
||||
conn *pg.DB
|
||||
testAccount *gtsmodel.Account
|
||||
testUser *gtsmodel.User
|
||||
testClient *oauthClient
|
||||
config *config.Config
|
||||
}
|
||||
|
||||
const ()
|
||||
|
||||
// SetupSuite sets some variables on the suite that we can use as consts (more or less) throughout
|
||||
func (suite *OauthTestSuite) SetupSuite() {
|
||||
encryptedPassword, err := bcrypt.GenerateFromPassword([]byte("test-password"), bcrypt.DefaultCost)
|
||||
if err != nil {
|
||||
logrus.Panicf("error encrypting user pass: %s", err)
|
||||
}
|
||||
|
||||
suite.testAccount = >smodel.Account{}
|
||||
suite.testUser = >smodel.User{
|
||||
EncryptedPassword: string(encryptedPassword),
|
||||
Email: "user@localhost",
|
||||
AccountID: "some-account-id-it-doesn't-matter-really-since-this-user-doesn't-actually-have-an-account!",
|
||||
}
|
||||
suite.testClient = &oauthClient{
|
||||
ID: "a-known-client-id",
|
||||
Secret: "some-secret",
|
||||
Domain: "http://localhost:8080",
|
||||
}
|
||||
|
||||
// because go tests are run within the test package directory, we need to fiddle with the templateconfig
|
||||
// basedir in a way that we wouldn't normally have to do when running the binary, in order to make
|
||||
// the templates actually load
|
||||
c := config.Empty()
|
||||
c.TemplateConfig.BaseDir = "../../web/template/"
|
||||
suite.config = c
|
||||
}
|
||||
|
||||
// SetupTest creates a postgres connection and creates the oauth_clients table before each test
|
||||
func (suite *OauthTestSuite) SetupTest() {
|
||||
suite.conn = pg.Connect(&pg.Options{})
|
||||
if err := suite.conn.Ping(context.Background()); err != nil {
|
||||
logrus.Panicf("db connection error: %s", err)
|
||||
}
|
||||
|
||||
models := []interface{}{
|
||||
&oauthClient{},
|
||||
&oauthToken{},
|
||||
>smodel.User{},
|
||||
>smodel.Account{},
|
||||
>smodel.Application{},
|
||||
}
|
||||
|
||||
for _, m := range models {
|
||||
if err := suite.conn.Model(m).CreateTable(&orm.CreateTableOptions{
|
||||
IfNotExists: true,
|
||||
}); err != nil {
|
||||
logrus.Panicf("db connection error: %s", err)
|
||||
}
|
||||
}
|
||||
|
||||
suite.tokenStore = NewPGTokenStore(context.Background(), suite.conn, logrus.New())
|
||||
suite.clientStore = NewPGClientStore(suite.conn)
|
||||
|
||||
if _, err := suite.conn.Model(suite.testUser).Insert(); err != nil {
|
||||
logrus.Panicf("could not insert test user into db: %s", err)
|
||||
}
|
||||
|
||||
if _, err := suite.conn.Model(suite.testClient).Insert(); err != nil {
|
||||
logrus.Panicf("could not insert test client into db: %s", err)
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
// TearDownTest drops the oauth_clients table and closes the pg connection after each test
|
||||
func (suite *OauthTestSuite) TearDownTest() {
|
||||
models := []interface{}{
|
||||
&oauthClient{},
|
||||
&oauthToken{},
|
||||
>smodel.User{},
|
||||
>smodel.Account{},
|
||||
>smodel.Application{},
|
||||
}
|
||||
for _, m := range models {
|
||||
if err := suite.conn.Model(m).DropTable(&orm.DropTableOptions{}); err != nil {
|
||||
logrus.Panicf("drop table error: %s", err)
|
||||
}
|
||||
}
|
||||
if err := suite.conn.Close(); err != nil {
|
||||
logrus.Panicf("error closing db connection: %s", err)
|
||||
}
|
||||
suite.conn = nil
|
||||
}
|
||||
|
||||
func (suite *OauthTestSuite) TestAPIInitialize() {
|
||||
log := logrus.New()
|
||||
log.SetLevel(logrus.TraceLevel)
|
||||
|
||||
r := api.New(suite.config, log)
|
||||
api := New(suite.tokenStore, suite.clientStore, suite.conn, log)
|
||||
if err := api.AddRoutes(r); err != nil {
|
||||
suite.FailNow(fmt.Sprintf("error initializing api: %s", err))
|
||||
}
|
||||
go r.Start()
|
||||
time.Sleep(30 * time.Second)
|
||||
// http://localhost:8080/oauth/authorize?client_id=a-known-client-id&response_type=code&redirect_uri=https://example.org
|
||||
// http://localhost:8080/oauth/authorize?client_id=a-known-client-id&response_type=code&redirect_uri=urn:ietf:wg:oauth:2.0:oob
|
||||
}
|
||||
|
||||
func TestOauthTestSuite(t *testing.T) {
|
||||
suite.Run(t, new(OauthTestSuite))
|
||||
}
|
||||
@ -1,81 +0,0 @@
|
||||
/*
|
||||
GoToSocial
|
||||
Copyright (C) 2021 GoToSocial Authors admin@gotosocial.org
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU Affero General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU Affero General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU Affero General Public License
|
||||
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
package oauth
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
|
||||
"github.com/go-pg/pg/v10"
|
||||
"github.com/gotosocial/oauth2/v4"
|
||||
"github.com/gotosocial/oauth2/v4/models"
|
||||
)
|
||||
|
||||
type pgClientStore struct {
|
||||
conn *pg.DB
|
||||
}
|
||||
|
||||
func NewPGClientStore(conn *pg.DB) oauth2.ClientStore {
|
||||
pts := &pgClientStore{
|
||||
conn: conn,
|
||||
}
|
||||
return pts
|
||||
}
|
||||
|
||||
func (pcs *pgClientStore) GetByID(ctx context.Context, clientID string) (oauth2.ClientInfo, error) {
|
||||
poc := &oauthClient{
|
||||
ID: clientID,
|
||||
}
|
||||
if err := pcs.conn.WithContext(ctx).Model(poc).Where("id = ?", poc.ID).Select(); err != nil {
|
||||
return nil, fmt.Errorf("error in clientstore getbyid searching for client %s: %s", clientID, err)
|
||||
}
|
||||
return models.New(poc.ID, poc.Secret, poc.Domain, poc.UserID), nil
|
||||
}
|
||||
|
||||
func (pcs *pgClientStore) Set(ctx context.Context, id string, cli oauth2.ClientInfo) error {
|
||||
poc := &oauthClient{
|
||||
ID: cli.GetID(),
|
||||
Secret: cli.GetSecret(),
|
||||
Domain: cli.GetDomain(),
|
||||
UserID: cli.GetUserID(),
|
||||
}
|
||||
_, err := pcs.conn.WithContext(ctx).Model(poc).OnConflict("(id) DO UPDATE").Insert()
|
||||
if err != nil {
|
||||
return fmt.Errorf("error in clientstore set: %s", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (pcs *pgClientStore) Delete(ctx context.Context, id string) error {
|
||||
poc := &oauthClient{
|
||||
ID: id,
|
||||
}
|
||||
_, err := pcs.conn.WithContext(ctx).Model(poc).Where("id = ?", poc.ID).Delete()
|
||||
if err != nil {
|
||||
return fmt.Errorf("error in clientstore delete: %s", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
type oauthClient struct {
|
||||
ID string
|
||||
Secret string
|
||||
Domain string
|
||||
UserID string
|
||||
}
|
||||
@ -1,103 +0,0 @@
|
||||
package oauth
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
|
||||
"github.com/go-pg/pg/v10"
|
||||
"github.com/go-pg/pg/v10/orm"
|
||||
"github.com/gotosocial/oauth2/v4/models"
|
||||
"github.com/sirupsen/logrus"
|
||||
"github.com/stretchr/testify/suite"
|
||||
)
|
||||
|
||||
type PgClientStoreTestSuite struct {
|
||||
suite.Suite
|
||||
conn *pg.DB
|
||||
testClientID string
|
||||
testClientSecret string
|
||||
testClientDomain string
|
||||
testClientUserID string
|
||||
}
|
||||
|
||||
const ()
|
||||
|
||||
// SetupSuite sets some variables on the suite that we can use as consts (more or less) throughout
|
||||
func (suite *PgClientStoreTestSuite) SetupSuite() {
|
||||
suite.testClientID = "test-client-id"
|
||||
suite.testClientSecret = "test-client-secret"
|
||||
suite.testClientDomain = "https://example.org"
|
||||
suite.testClientUserID = "test-client-user-id"
|
||||
}
|
||||
|
||||
// SetupTest creates a postgres connection and creates the oauth_clients table before each test
|
||||
func (suite *PgClientStoreTestSuite) SetupTest() {
|
||||
suite.conn = pg.Connect(&pg.Options{})
|
||||
if err := suite.conn.Ping(context.Background()); err != nil {
|
||||
logrus.Panicf("db connection error: %s", err)
|
||||
}
|
||||
if err := suite.conn.Model(&oauthClient{}).CreateTable(&orm.CreateTableOptions{
|
||||
IfNotExists: true,
|
||||
}); err != nil {
|
||||
logrus.Panicf("db connection error: %s", err)
|
||||
}
|
||||
}
|
||||
|
||||
// TearDownTest drops the oauth_clients table and closes the pg connection after each test
|
||||
func (suite *PgClientStoreTestSuite) TearDownTest() {
|
||||
if err := suite.conn.Model(&oauthClient{}).DropTable(&orm.DropTableOptions{}); err != nil {
|
||||
logrus.Panicf("drop table error: %s", err)
|
||||
}
|
||||
if err := suite.conn.Close(); err != nil {
|
||||
logrus.Panicf("error closing db connection: %s", err)
|
||||
}
|
||||
suite.conn = nil
|
||||
}
|
||||
|
||||
func (suite *PgClientStoreTestSuite) TestClientStoreSetAndGet() {
|
||||
// set a new client in the store
|
||||
cs := NewPGClientStore(suite.conn)
|
||||
if err := cs.Set(context.Background(), suite.testClientID, models.New(suite.testClientID, suite.testClientSecret, suite.testClientDomain, suite.testClientUserID)); err != nil {
|
||||
suite.FailNow(err.Error())
|
||||
}
|
||||
|
||||
// fetch that client from the store
|
||||
client, err := cs.GetByID(context.Background(), suite.testClientID)
|
||||
if err != nil {
|
||||
suite.FailNow(err.Error())
|
||||
}
|
||||
|
||||
// check that the values are the same
|
||||
suite.NotNil(client)
|
||||
suite.EqualValues(models.New(suite.testClientID, suite.testClientSecret, suite.testClientDomain, suite.testClientUserID), client)
|
||||
}
|
||||
|
||||
func (suite *PgClientStoreTestSuite) TestClientSetAndDelete() {
|
||||
// set a new client in the store
|
||||
cs := NewPGClientStore(suite.conn)
|
||||
if err := cs.Set(context.Background(), suite.testClientID, models.New(suite.testClientID, suite.testClientSecret, suite.testClientDomain, suite.testClientUserID)); err != nil {
|
||||
suite.FailNow(err.Error())
|
||||
}
|
||||
|
||||
// fetch the client from the store
|
||||
client, err := cs.GetByID(context.Background(), suite.testClientID)
|
||||
if err != nil {
|
||||
suite.FailNow(err.Error())
|
||||
}
|
||||
|
||||
// check that the values are the same
|
||||
suite.NotNil(client)
|
||||
suite.EqualValues(models.New(suite.testClientID, suite.testClientSecret, suite.testClientDomain, suite.testClientUserID), client)
|
||||
if err := cs.Delete(context.Background(), suite.testClientID); err != nil {
|
||||
suite.FailNow(err.Error())
|
||||
}
|
||||
|
||||
// try to get the deleted client; we should get an error
|
||||
deletedClient, err := cs.GetByID(context.Background(), suite.testClientID)
|
||||
suite.Assert().Nil(deletedClient)
|
||||
suite.Assert().NotNil(err)
|
||||
}
|
||||
|
||||
func TestPgClientStoreTestSuite(t *testing.T) {
|
||||
suite.Run(t, new(PgClientStoreTestSuite))
|
||||
}
|
||||
@ -1,257 +0,0 @@
|
||||
/*
|
||||
GoToSocial
|
||||
Copyright (C) 2021 GoToSocial Authors admin@gotosocial.org
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU Affero General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU Affero General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU Affero General Public License
|
||||
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
package oauth
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"time"
|
||||
|
||||
"github.com/go-pg/pg/v10"
|
||||
"github.com/gotosocial/oauth2/v4"
|
||||
"github.com/gotosocial/oauth2/v4/models"
|
||||
"github.com/sirupsen/logrus"
|
||||
)
|
||||
|
||||
// pgTokenStore is an implementation of oauth2.TokenStore, which uses Postgres as a storage backend.
|
||||
type pgTokenStore struct {
|
||||
oauth2.TokenStore
|
||||
conn *pg.DB
|
||||
log *logrus.Logger
|
||||
}
|
||||
|
||||
// NewPGTokenStore returns a token store, using postgres, that satisfies the oauth2.TokenStore interface.
|
||||
//
|
||||
// In order to allow tokens to 'expire' (not really a thing in Postgres world), it will also set off a
|
||||
// goroutine that iterates through the tokens in the DB once per minute and deletes any that have expired.
|
||||
func NewPGTokenStore(ctx context.Context, conn *pg.DB, log *logrus.Logger) oauth2.TokenStore {
|
||||
pts := &pgTokenStore{
|
||||
conn: conn,
|
||||
log: log,
|
||||
}
|
||||
|
||||
// set the token store to clean out expired tokens once per minute, or return if we're done
|
||||
go func(ctx context.Context, pts *pgTokenStore, log *logrus.Logger) {
|
||||
cleanloop:
|
||||
for {
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
log.Info("breaking cleanloop")
|
||||
break cleanloop
|
||||
case <-time.After(1 * time.Minute):
|
||||
log.Debug("sweeping out old oauth entries broom broom")
|
||||
if err := pts.sweep(); err != nil {
|
||||
log.Errorf("error while sweeping oauth entries: %s", err)
|
||||
}
|
||||
}
|
||||
}
|
||||
}(ctx, pts, log)
|
||||
return pts
|
||||
}
|
||||
|
||||
// sweep clears out old tokens that have expired; it should be run on a loop about once per minute or so.
|
||||
func (pts *pgTokenStore) sweep() error {
|
||||
// select *all* tokens from the db
|
||||
// todo: if this becomes expensive (ie., there are fucking LOADS of tokens) then figure out a better way.
|
||||
var tokens []oauthToken
|
||||
if err := pts.conn.Model(&tokens).Select(); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// iterate through and remove expired tokens
|
||||
now := time.Now()
|
||||
for _, pgt := range tokens {
|
||||
// The zero value of a time.Time is 00:00 january 1 1970, which will always be before now. So:
|
||||
// we only want to check if a token expired before now if the expiry time is *not zero*;
|
||||
// ie., if it's been explicity set.
|
||||
if !pgt.CodeExpiresAt.IsZero() && pgt.CodeExpiresAt.Before(now) || !pgt.RefreshExpiresAt.IsZero() && pgt.RefreshExpiresAt.Before(now) || !pgt.AccessExpiresAt.IsZero() && pgt.AccessExpiresAt.Before(now) {
|
||||
if _, err := pts.conn.Model(&pgt).Delete(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// Create creates and store the new token information.
|
||||
// For the original implementation, see https://github.com/gotosocial/oauth2/blob/master/store/token.go#L34
|
||||
func (pts *pgTokenStore) Create(ctx context.Context, info oauth2.TokenInfo) error {
|
||||
t, ok := info.(*models.Token)
|
||||
if !ok {
|
||||
return errors.New("info param was not a models.Token")
|
||||
}
|
||||
_, err := pts.conn.WithContext(ctx).Model(oauthTokenToPGToken(t)).Insert()
|
||||
if err != nil {
|
||||
return fmt.Errorf("error in tokenstore create: %s", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// RemoveByCode deletes a token from the DB based on the Code field
|
||||
func (pts *pgTokenStore) RemoveByCode(ctx context.Context, code string) error {
|
||||
_, err := pts.conn.Model(&oauthToken{}).Where("code = ?", code).Delete()
|
||||
if err != nil {
|
||||
return fmt.Errorf("error in tokenstore removebycode: %s", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// RemoveByAccess deletes a token from the DB based on the Access field
|
||||
func (pts *pgTokenStore) RemoveByAccess(ctx context.Context, access string) error {
|
||||
_, err := pts.conn.Model(&oauthToken{}).Where("access = ?", access).Delete()
|
||||
if err != nil {
|
||||
return fmt.Errorf("error in tokenstore removebyaccess: %s", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// RemoveByRefresh deletes a token from the DB based on the Refresh field
|
||||
func (pts *pgTokenStore) RemoveByRefresh(ctx context.Context, refresh string) error {
|
||||
_, err := pts.conn.Model(&oauthToken{}).Where("refresh = ?", refresh).Delete()
|
||||
if err != nil {
|
||||
return fmt.Errorf("error in tokenstore removebyrefresh: %s", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// GetByCode selects a token from the DB based on the Code field
|
||||
func (pts *pgTokenStore) GetByCode(ctx context.Context, code string) (oauth2.TokenInfo, error) {
|
||||
pgt := &oauthToken{}
|
||||
if err := pts.conn.Model(pgt).Where("code = ?", code).Select(); err != nil {
|
||||
return nil, fmt.Errorf("error in tokenstore getbycode: %s", err)
|
||||
}
|
||||
return pgTokenToOauthToken(pgt), nil
|
||||
}
|
||||
|
||||
// GetByAccess selects a token from the DB based on the Access field
|
||||
func (pts *pgTokenStore) GetByAccess(ctx context.Context, access string) (oauth2.TokenInfo, error) {
|
||||
pgt := &oauthToken{}
|
||||
if err := pts.conn.Model(pgt).Where("access = ?", access).Select(); err != nil {
|
||||
return nil, fmt.Errorf("error in tokenstore getbyaccess: %s", err)
|
||||
}
|
||||
return pgTokenToOauthToken(pgt), nil
|
||||
}
|
||||
|
||||
// GetByRefresh selects a token from the DB based on the Refresh field
|
||||
func (pts *pgTokenStore) GetByRefresh(ctx context.Context, refresh string) (oauth2.TokenInfo, error) {
|
||||
pgt := &oauthToken{}
|
||||
if err := pts.conn.Model(pgt).Where("refresh = ?", refresh).Select(); err != nil {
|
||||
return nil, fmt.Errorf("error in tokenstore getbyrefresh: %s", err)
|
||||
}
|
||||
return pgTokenToOauthToken(pgt), nil
|
||||
}
|
||||
|
||||
/*
|
||||
The following models are basically helpers for the postgres token store implementation, they should only be used internally.
|
||||
*/
|
||||
|
||||
// oauthToken is a translation of the gotosocial token with the ExpiresIn fields replaced with ExpiresAt.
|
||||
//
|
||||
// Explanation for this: gotosocial assumes an in-memory or file database of some kind, where a time-to-live parameter (TTL) can be defined,
|
||||
// and tokens with expired TTLs are automatically removed. Since Postgres doesn't have that feature, it's easier to set an expiry time and
|
||||
// then periodically sweep out tokens when that time has passed.
|
||||
//
|
||||
// Note that this struct does *not* satisfy the token interface shown here: https://github.com/gotosocial/oauth2/blob/master/model.go#L22
|
||||
// and implemented here: https://github.com/gotosocial/oauth2/blob/master/models/token.go.
|
||||
// As such, manual translation is always required between oauthToken and the gotosocial *model.Token. The helper functions oauthTokenToPGToken
|
||||
// and pgTokenToOauthToken can be used for that.
|
||||
type oauthToken struct {
|
||||
ClientID string
|
||||
UserID string
|
||||
RedirectURI string
|
||||
Scope string
|
||||
Code string `pg:"default:'',pk"`
|
||||
CodeChallenge string
|
||||
CodeChallengeMethod string
|
||||
CodeCreateAt time.Time `pg:"type:timestamp"`
|
||||
CodeExpiresAt time.Time `pg:"type:timestamp"`
|
||||
Access string `pg:"default:'',pk"`
|
||||
AccessCreateAt time.Time `pg:"type:timestamp"`
|
||||
AccessExpiresAt time.Time `pg:"type:timestamp"`
|
||||
Refresh string `pg:"default:'',pk"`
|
||||
RefreshCreateAt time.Time `pg:"type:timestamp"`
|
||||
RefreshExpiresAt time.Time `pg:"type:timestamp"`
|
||||
}
|
||||
|
||||
// oauthTokenToPGToken is a lil util function that takes a gotosocial token and gives back a token for inserting into postgres
|
||||
func oauthTokenToPGToken(tkn *models.Token) *oauthToken {
|
||||
now := time.Now()
|
||||
|
||||
// For the following, we want to make sure we're not adding a time.Now() to an *empty* ExpiresIn, otherwise that's
|
||||
// going to cause all sorts of interesting problems. So check first to make sure that the ExpiresIn is not equal
|
||||
// to the zero value of a time.Duration, which is 0s. If it *is* empty/nil, just leave the ExpiresAt at nil as well.
|
||||
|
||||
var cea time.Time
|
||||
if tkn.CodeExpiresIn != 0*time.Second {
|
||||
cea = now.Add(tkn.CodeExpiresIn)
|
||||
}
|
||||
|
||||
var aea time.Time
|
||||
if tkn.AccessExpiresIn != 0*time.Second {
|
||||
aea = now.Add(tkn.AccessExpiresIn)
|
||||
}
|
||||
|
||||
var rea time.Time
|
||||
if tkn.RefreshExpiresIn != 0*time.Second {
|
||||
rea = now.Add(tkn.RefreshExpiresIn)
|
||||
}
|
||||
|
||||
return &oauthToken{
|
||||
ClientID: tkn.ClientID,
|
||||
UserID: tkn.UserID,
|
||||
RedirectURI: tkn.RedirectURI,
|
||||
Scope: tkn.Scope,
|
||||
Code: tkn.Code,
|
||||
CodeChallenge: tkn.CodeChallenge,
|
||||
CodeChallengeMethod: tkn.CodeChallengeMethod,
|
||||
CodeCreateAt: tkn.CodeCreateAt,
|
||||
CodeExpiresAt: cea,
|
||||
Access: tkn.Access,
|
||||
AccessCreateAt: tkn.AccessCreateAt,
|
||||
AccessExpiresAt: aea,
|
||||
Refresh: tkn.Refresh,
|
||||
RefreshCreateAt: tkn.RefreshCreateAt,
|
||||
RefreshExpiresAt: rea,
|
||||
}
|
||||
}
|
||||
|
||||
// pgTokenToOauthToken is a lil util function that takes a postgres token and gives back a gotosocial token
|
||||
func pgTokenToOauthToken(pgt *oauthToken) *models.Token {
|
||||
now := time.Now()
|
||||
|
||||
return &models.Token{
|
||||
ClientID: pgt.ClientID,
|
||||
UserID: pgt.UserID,
|
||||
RedirectURI: pgt.RedirectURI,
|
||||
Scope: pgt.Scope,
|
||||
Code: pgt.Code,
|
||||
CodeChallenge: pgt.CodeChallenge,
|
||||
CodeChallengeMethod: pgt.CodeChallengeMethod,
|
||||
CodeCreateAt: pgt.CodeCreateAt,
|
||||
CodeExpiresIn: pgt.CodeExpiresAt.Sub(now),
|
||||
Access: pgt.Access,
|
||||
AccessCreateAt: pgt.AccessCreateAt,
|
||||
AccessExpiresIn: pgt.AccessExpiresAt.Sub(now),
|
||||
Refresh: pgt.Refresh,
|
||||
RefreshCreateAt: pgt.RefreshCreateAt,
|
||||
RefreshExpiresIn: pgt.RefreshExpiresAt.Sub(now),
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user