diff options
Diffstat (limited to 'backend/auth/oauth.go')
| -rw-r--r-- | backend/auth/oauth.go | 194 |
1 files changed, 194 insertions, 0 deletions
diff --git a/backend/auth/oauth.go b/backend/auth/oauth.go new file mode 100644 index 0000000..012f339 --- /dev/null +++ b/backend/auth/oauth.go @@ -0,0 +1,194 @@ +package auth + +import ( + "crypto/rand" + "crypto/sha256" + "encoding/base64" + "encoding/json" + "fmt" + "io" + "net/http" + "net/url" + "strings" +) + +type OAuthConfig struct { + ClientID string + RedirectURI string + Scopes []string +} + +type OAuthState struct { + State string + CodeVerifier string + DID string + PDS string + AccessToken string + RefreshToken string + KeyPair *DPoPKeyPair +} + +type OAuthMetadata struct { + Issuer string `json:"issuer"` + AuthorizationEndpoint string `json:"authorization_endpoint"` + TokenEndpoint string `json:"token_endpoint"` + Scopes []string `json:"scopes_supported"` +} + +type TokenResponse struct { + AccessToken string `json:"access_token"` + RefreshToken string `json:"refresh_token"` + TokenType string `json:"token_type"` + ExpiresIn int `json:"expires_in"` +} + +func GenerateRandomToken() (string, error) { + b := make([]byte, 32) + _, err := rand.Read(b) + if err != nil { + return "", err + } + return base64.RawURLEncoding.EncodeToString(b), nil +} + +func GenerateCodeChallenge(verifier string) string { + h := sha256.Sum256([]byte(verifier)) + return base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(h[:]) +} + +func FetchOAuthMetadata(pdsURL string) (*OAuthMetadata, error) { + // first get the resource metadata to find the auth server + resourceURL := fmt.Sprintf("%s/.well-known/oauth-protected-resource", pdsURL) + fmt.Printf("Fetching oauth metadata from: %s\n", resourceURL) + resp, err := http.Get(resourceURL) + if err != nil { + return nil, err + } + defer resp.Body.Close() + + var resource struct { + AuthorizationServers []string `json:"authorization_servers"` + } + if err := json.NewDecoder(resp.Body).Decode(&resource); err != nil { + return nil, err + } + + if len(resource.AuthorizationServers) == 0 { + return nil, fmt.Errorf("no authorization servers found") + } + + // now fetch the actual oauth metadata from the auth server + authServer := resource.AuthorizationServers[0] + metadataURL := fmt.Sprintf("%s/.well-known/oauth-authorization-server", authServer) + + resp, err = http.Get(metadataURL) + if err != nil { + return nil, err + } + defer resp.Body.Close() + + var metadata OAuthMetadata + if err := json.NewDecoder(resp.Body).Decode(&metadata); err != nil { + return nil, err + } + + return &metadata, nil +} + +func BuildAuthorizationURL(metadata *OAuthMetadata, config *OAuthConfig, state, codeChallenge string) string { + params := url.Values{ + "response_type": {"code"}, + "client_id": {config.ClientID}, + "redirect_uri": {config.RedirectURI}, + "state": {state}, + "code_challenge": {codeChallenge}, + "code_challenge_method": {"S256"}, + "scope": {"atproto"}, + } + + return metadata.AuthorizationEndpoint + "?" + params.Encode() +} + +func ExchangeCodeForTokens(pdsURL, code, verifier, backendURL string, keypair *DPoPKeyPair) (*TokenResponse, error) { + metadata, err := FetchOAuthMetadata(pdsURL) + if err != nil { + return nil, err + } + + data := url.Values{ + "grant_type": {"authorization_code"}, + "code": {code}, + "redirect_uri": {backendURL + "/api/callback"}, + "code_verifier": {verifier}, + "client_id": {backendURL + "/api/callback"}, + } + + fmt.Printf("Sending verifier: %s\n", verifier) + + dpopProof, err := keypair.GenerateDPoPProof("POST", metadata.TokenEndpoint, "") + if err != nil { + return nil, err + } + + req, err := http.NewRequest("POST", metadata.TokenEndpoint, strings.NewReader(data.Encode())) + if err != nil { + return nil, err + } + + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + req.Header.Set("DPoP", dpopProof) + + resp, err := http.DefaultClient.Do(req) + if err != nil { + return nil, err + } + defer resp.Body.Close() + + // if nonce required, retry with nonce + if resp.StatusCode == 400 { + body, _ := io.ReadAll(resp.Body) + bodyStr := string(body) + + if strings.Contains(bodyStr, "use_dpop_nonce") { + nonce := resp.Header.Get("DPoP-Nonce") + if nonce == "" { + return nil, fmt.Errorf("server requires nonce but didn't provide one") + } + + // generate new DPoP proof with nonce + dpopProof, err = keypair.GenerateDPoPProof("POST", metadata.TokenEndpoint, nonce) + if err != nil { + return nil, err + } + + retryReq, err := http.NewRequest("POST", metadata.TokenEndpoint, strings.NewReader(data.Encode())) + if err != nil { + return nil, err + } + retryReq.Header.Set("Content-Type", "application/x-www-form-urlencoded") + retryReq.Header.Set("DPoP", dpopProof) + + resp, err = http.DefaultClient.Do(retryReq) + if err != nil { + return nil, err + } + defer resp.Body.Close() + } else { + // it's a different 400 error, don't retry + return nil, fmt.Errorf("token exchange failed: 400 - %s", bodyStr) + } + } + + if resp.StatusCode != 200 { + body, _ := io.ReadAll(resp.Body) + fmt.Printf("Token exchange error: %s\n", string(body)) + return nil, fmt.Errorf("token exchange failed: %d - %s", resp.StatusCode, string(body)) + } + + var tokens TokenResponse + if err := json.NewDecoder(resp.Body).Decode(&tokens); err != nil { + return nil, err + } + + return &tokens, nil +} |