diff options
Diffstat (limited to 'backend/auth')
| -rw-r--r-- | backend/auth/dpop.go | 83 | ||||
| -rw-r--r-- | backend/auth/oauth.go | 194 |
2 files changed, 277 insertions, 0 deletions
diff --git a/backend/auth/dpop.go b/backend/auth/dpop.go new file mode 100644 index 0000000..2a8f6ed --- /dev/null +++ b/backend/auth/dpop.go @@ -0,0 +1,83 @@ +package auth + +import ( + "crypto" + "crypto/ecdsa" + "crypto/elliptic" + "crypto/rand" + "encoding/base64" + "time" + + "github.com/golang-jwt/jwt/v5" +) + +type DPoPKeyPair struct { + PrivateKey *ecdsa.PrivateKey + PublicKey *ecdsa.PublicKey + JWK map[string]string +} + +func GenerateDPoPKeyPair() (*DPoPKeyPair, error) { + privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) + if err != nil { + return nil, err + } + + jwk := map[string]string{ + "kty": "EC", + "crv": "P-256", + "x": base64.RawURLEncoding.EncodeToString(privateKey.PublicKey.X.Bytes()), + "y": base64.RawURLEncoding.EncodeToString(privateKey.PublicKey.Y.Bytes()), + } + + return &DPoPKeyPair{ + PrivateKey: privateKey, + PublicKey: &privateKey.PublicKey, + JWK: jwk, + }, nil +} + +func (kp *DPoPKeyPair) GenerateDPoPProof(method, url, nonce string) (string, error) { + // generate unique ID for this proof + jti, err := GenerateRandomToken() + if err != nil { + return "", err + } + + // create JWT header with JWK + header := map[string]interface{}{ + "typ": "dpop+jwt", + "alg": "ES256", + "jwk": kp.JWK, + } + + // create JWT claims + claims := jwt.MapClaims{ + "jti": jti, + "htm": method, // HTTP method (GET, POST, etc) + "htu": url, // HTTP URL (the endpoint you're calling) + "iat": time.Now().Unix(), + } + + // add nonce if provided + if nonce != "" { + claims["nonce"] = nonce + } + + // create token with custom header + token := jwt.NewWithClaims(&jwt.SigningMethodECDSA{ + Name: "ES256", + Hash: crypto.SHA256, + KeySize: 32, + CurveBits: 256, + }, claims) + token.Header = header + + // sign with private key + tokenString, err := token.SignedString(kp.PrivateKey) + if err != nil { + return "", err + } + + return tokenString, nil +} diff --git a/backend/auth/oauth.go b/backend/auth/oauth.go new file mode 100644 index 0000000..012f339 --- /dev/null +++ b/backend/auth/oauth.go @@ -0,0 +1,194 @@ +package auth + +import ( + "crypto/rand" + "crypto/sha256" + "encoding/base64" + "encoding/json" + "fmt" + "io" + "net/http" + "net/url" + "strings" +) + +type OAuthConfig struct { + ClientID string + RedirectURI string + Scopes []string +} + +type OAuthState struct { + State string + CodeVerifier string + DID string + PDS string + AccessToken string + RefreshToken string + KeyPair *DPoPKeyPair +} + +type OAuthMetadata struct { + Issuer string `json:"issuer"` + AuthorizationEndpoint string `json:"authorization_endpoint"` + TokenEndpoint string `json:"token_endpoint"` + Scopes []string `json:"scopes_supported"` +} + +type TokenResponse struct { + AccessToken string `json:"access_token"` + RefreshToken string `json:"refresh_token"` + TokenType string `json:"token_type"` + ExpiresIn int `json:"expires_in"` +} + +func GenerateRandomToken() (string, error) { + b := make([]byte, 32) + _, err := rand.Read(b) + if err != nil { + return "", err + } + return base64.RawURLEncoding.EncodeToString(b), nil +} + +func GenerateCodeChallenge(verifier string) string { + h := sha256.Sum256([]byte(verifier)) + return base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(h[:]) +} + +func FetchOAuthMetadata(pdsURL string) (*OAuthMetadata, error) { + // first get the resource metadata to find the auth server + resourceURL := fmt.Sprintf("%s/.well-known/oauth-protected-resource", pdsURL) + fmt.Printf("Fetching oauth metadata from: %s\n", resourceURL) + resp, err := http.Get(resourceURL) + if err != nil { + return nil, err + } + defer resp.Body.Close() + + var resource struct { + AuthorizationServers []string `json:"authorization_servers"` + } + if err := json.NewDecoder(resp.Body).Decode(&resource); err != nil { + return nil, err + } + + if len(resource.AuthorizationServers) == 0 { + return nil, fmt.Errorf("no authorization servers found") + } + + // now fetch the actual oauth metadata from the auth server + authServer := resource.AuthorizationServers[0] + metadataURL := fmt.Sprintf("%s/.well-known/oauth-authorization-server", authServer) + + resp, err = http.Get(metadataURL) + if err != nil { + return nil, err + } + defer resp.Body.Close() + + var metadata OAuthMetadata + if err := json.NewDecoder(resp.Body).Decode(&metadata); err != nil { + return nil, err + } + + return &metadata, nil +} + +func BuildAuthorizationURL(metadata *OAuthMetadata, config *OAuthConfig, state, codeChallenge string) string { + params := url.Values{ + "response_type": {"code"}, + "client_id": {config.ClientID}, + "redirect_uri": {config.RedirectURI}, + "state": {state}, + "code_challenge": {codeChallenge}, + "code_challenge_method": {"S256"}, + "scope": {"atproto"}, + } + + return metadata.AuthorizationEndpoint + "?" + params.Encode() +} + +func ExchangeCodeForTokens(pdsURL, code, verifier, backendURL string, keypair *DPoPKeyPair) (*TokenResponse, error) { + metadata, err := FetchOAuthMetadata(pdsURL) + if err != nil { + return nil, err + } + + data := url.Values{ + "grant_type": {"authorization_code"}, + "code": {code}, + "redirect_uri": {backendURL + "/api/callback"}, + "code_verifier": {verifier}, + "client_id": {backendURL + "/api/callback"}, + } + + fmt.Printf("Sending verifier: %s\n", verifier) + + dpopProof, err := keypair.GenerateDPoPProof("POST", metadata.TokenEndpoint, "") + if err != nil { + return nil, err + } + + req, err := http.NewRequest("POST", metadata.TokenEndpoint, strings.NewReader(data.Encode())) + if err != nil { + return nil, err + } + + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + req.Header.Set("DPoP", dpopProof) + + resp, err := http.DefaultClient.Do(req) + if err != nil { + return nil, err + } + defer resp.Body.Close() + + // if nonce required, retry with nonce + if resp.StatusCode == 400 { + body, _ := io.ReadAll(resp.Body) + bodyStr := string(body) + + if strings.Contains(bodyStr, "use_dpop_nonce") { + nonce := resp.Header.Get("DPoP-Nonce") + if nonce == "" { + return nil, fmt.Errorf("server requires nonce but didn't provide one") + } + + // generate new DPoP proof with nonce + dpopProof, err = keypair.GenerateDPoPProof("POST", metadata.TokenEndpoint, nonce) + if err != nil { + return nil, err + } + + retryReq, err := http.NewRequest("POST", metadata.TokenEndpoint, strings.NewReader(data.Encode())) + if err != nil { + return nil, err + } + retryReq.Header.Set("Content-Type", "application/x-www-form-urlencoded") + retryReq.Header.Set("DPoP", dpopProof) + + resp, err = http.DefaultClient.Do(retryReq) + if err != nil { + return nil, err + } + defer resp.Body.Close() + } else { + // it's a different 400 error, don't retry + return nil, fmt.Errorf("token exchange failed: 400 - %s", bodyStr) + } + } + + if resp.StatusCode != 200 { + body, _ := io.ReadAll(resp.Body) + fmt.Printf("Token exchange error: %s\n", string(body)) + return nil, fmt.Errorf("token exchange failed: %d - %s", resp.StatusCode, string(body)) + } + + var tokens TokenResponse + if err := json.NewDecoder(resp.Body).Decode(&tokens); err != nil { + return nil, err + } + + return &tokens, nil +} |