From d0ca34c4c4dac687ac9eff53fa3ca2b1d68e8b44 Mon Sep 17 00:00:00 2001 From: tsmethurst Date: Sat, 20 Mar 2021 23:30:19 +0100 Subject: [PATCH] tidying up and comments --- internal/oauth/oauth.go | 58 ++++++++++++++++++++++++++++++----------- 1 file changed, 43 insertions(+), 15 deletions(-) diff --git a/internal/oauth/oauth.go b/internal/oauth/oauth.go index 49e04a9..72a2207 100644 --- a/internal/oauth/oauth.go +++ b/internal/oauth/oauth.go @@ -38,6 +38,14 @@ import ( "golang.org/x/crypto/bcrypt" ) +const ( + outOfBandRedirect = "urn:ietf:wg:oauth:2.0:oob" + appsPath = "/api/v1/apps" + authSignInPath = "/auth/sign_in" + oauthTokenPath = "/oauth/token" + oauthAuthorizePath = "/oauth/authorize" +) + type API struct { manager *manage.Manager server *server.Server @@ -104,15 +112,15 @@ func New(ts oauth2.TokenStore, cs oauth2.ClientStore, conn *pg.DB, log *logrus.L } func (a *API) AddRoutes(s api.Server) error { - s.AttachHandler(http.MethodPost, "/api/v1/apps", a.AppsPOSTHandler) + s.AttachHandler(http.MethodPost, appsPath, a.AppsPOSTHandler) - s.AttachHandler(http.MethodGet, "/auth/sign_in", a.SignInGETHandler) - s.AttachHandler(http.MethodPost, "/auth/sign_in", a.SignInPOSTHandler) + s.AttachHandler(http.MethodGet, authSignInPath, a.SignInGETHandler) + s.AttachHandler(http.MethodPost, authSignInPath, a.SignInPOSTHandler) - s.AttachHandler(http.MethodPost, "/oauth/token", a.TokenPOSTHandler) + s.AttachHandler(http.MethodPost, oauthTokenPath, a.TokenPOSTHandler) - s.AttachHandler(http.MethodGet, "/oauth/authorize", a.AuthorizeGETHandler) - s.AttachHandler(http.MethodPost, "/oauth/authorize", a.AuthorizePOSTHandler) + s.AttachHandler(http.MethodGet, oauthAuthorizePath, a.AuthorizeGETHandler) + s.AttachHandler(http.MethodPost, oauthAuthorizePath, a.AuthorizePOSTHandler) return nil } @@ -242,15 +250,28 @@ func (a *API) SignInPOSTHandler(c *gin.Context) { } l.Trace("redirecting to auth page") - c.Redirect(http.StatusFound, "/oauth/authorize") + c.Redirect(http.StatusFound, oauthAuthorizePath) } // TokenPOSTHandler should be served as a POST at https://example.org/oauth/token // The idea here is to serve an oauth access token to a user, which can be used for authorizing against non-public APIs. // See https://docs.joinmastodon.org/methods/apps/oauth/#obtain-a-token func (a *API) TokenPOSTHandler(c *gin.Context) { - l := a.log.WithField("func", "TokenHandler") - l.Trace("entered token handler, will now go to server.HandleTokenRequest") + l := a.log.WithField("func", "TokenPOSTHandler") + l.Trace("entered TokenPOSTHandler") + + // The commented-out code below doesn't work yet because the oauth2 library can't handle OOB properly! + + // // make sure redirect_uri is actually set first (we don't accept empty) + // if v, ok := c.GetPostForm("redirect_uri"); !ok || v == "" { + // c.JSON(http.StatusBadRequest, gin.H{"error": "session missing redirect_uri"}) + // return + // } else if v == outOfBandRedirect { + // // If redirect_uri is set to out of band, redirect to this endpoint, where we can display the code later + // // This is a bit of a workaround because the oauth library doesn't recognise oob redirect URIs + // c.Request.Form.Set("redirect_uri", fmt.Sprintf("%s://%s%s", a.config.Protocol, a.config.Host, oauthTokenPath)) + // } + if err := a.server.HandleTokenRequest(c.Writer, c.Request); err != nil { c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) } @@ -295,7 +316,7 @@ func (a *API) AuthorizeGETHandler(c *gin.Context) { } // send them to the sign in page so we can tell who they are - c.Redirect(http.StatusFound, "/auth/sign_in") + c.Redirect(http.StatusFound, authSignInPath) return } @@ -355,10 +376,17 @@ func (a *API) AuthorizePOSTHandler(c *gin.Context) { c.JSON(http.StatusBadRequest, gin.H{"error": "session missing redirect_uri"}) return } else { - // todo: explain this little hack - if v == "urn:ietf:wg:oauth:2.0:oob" { - v = "http://localhost:8080/oauth/authorize" - } + // The commented-out code below doesn't work yet because the oauth2 library can't handle OOB properly! + + // if the client requests this particular redirect URI, it means they want to be able to authenticate out of band, + // ie., just have their access_code shown to them so they can do what they want with it later. + // + // But we can't just show the code yet; there's still an authorization flow to go through. + // What we can do is set the redirect uri to the /oauth/authorize page, do the auth + // flow as normal, and then handle showing the code there. See AuthorizeGETHandler. + // if v == outOfBandRedirect { + // v = fmt.Sprintf("%s://%s%s", a.config.Protocol, a.config.Host, oauthAuthorizePath) + // } values.Add("redirect_uri", v) } @@ -438,7 +466,7 @@ func (a *API) UserAuthorizationHandler(w http.ResponseWriter, r *http.Request) ( userID = r.FormValue("username") if userID == "" { l.Trace("username was empty, redirecting to sign in page") - http.Redirect(w, r, "/auth/sign_in", http.StatusFound) + http.Redirect(w, r, authSignInPath, http.StatusFound) return "", nil } l.Tracef("returning (%s, %s)", userID, err)