mirror of
https://github.com/nikdoof/pocket-id.git
synced 2025-12-14 23:32:18 +00:00
initial commit
This commit is contained in:
Elias Schneider
415
backend/internal/handler/oidc.go
Normal file
415
backend/internal/handler/oidc.go
Normal file
@@ -0,0 +1,415 @@
|
||||
package handler
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"github.com/gin-gonic/gin"
|
||||
"golang-rest-api-template/internal/common"
|
||||
"golang-rest-api-template/internal/common/middleware"
|
||||
"golang-rest-api-template/internal/model"
|
||||
"golang-rest-api-template/internal/utils"
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
"gorm.io/gorm"
|
||||
"net/http"
|
||||
"os"
|
||||
"time"
|
||||
)
|
||||
|
||||
func RegisterOIDCRoutes(group *gin.RouterGroup) {
|
||||
group.POST("/oidc/authorize", middleware.JWTAuth(false), authorizeHandler)
|
||||
group.POST("/oidc/authorize/new-client", middleware.JWTAuth(false), authorizeNewClientHandler)
|
||||
group.POST("/oidc/token", createIDTokenHandler)
|
||||
|
||||
group.GET("/oidc/clients", middleware.JWTAuth(true), listClientsHandler)
|
||||
group.POST("/oidc/clients", middleware.JWTAuth(true), createClientHandler)
|
||||
group.GET("/oidc/clients/:id", getClientHandler)
|
||||
group.PUT("/oidc/clients/:id", middleware.JWTAuth(true), updateClientHandler)
|
||||
group.DELETE("/oidc/clients/:id", middleware.JWTAuth(true), deleteClientHandler)
|
||||
|
||||
group.POST("/oidc/clients/:id/secret", middleware.JWTAuth(true), createClientSecretHandler)
|
||||
|
||||
group.GET("/oidc/clients/:id/logo", getClientLogoHandler)
|
||||
group.DELETE("/oidc/clients/:id/logo", deleteClientLogoHandler)
|
||||
group.POST("/oidc/clients/:id/logo", middleware.JWTAuth(true), middleware.LimitFileSize(2<<20), updateClientLogoHandler)
|
||||
}
|
||||
|
||||
type AuthorizeRequest struct {
|
||||
ClientID string `json:"clientID" binding:"required"`
|
||||
Scope string `json:"scope" binding:"required"`
|
||||
Nonce string `json:"nonce"`
|
||||
}
|
||||
|
||||
func authorizeHandler(c *gin.Context) {
|
||||
var parsedBody AuthorizeRequest
|
||||
if err := c.ShouldBindJSON(&parsedBody); err != nil {
|
||||
utils.HandlerError(c, http.StatusBadRequest, "invalid request body")
|
||||
return
|
||||
}
|
||||
|
||||
var userAuthorizedOIDCClient model.UserAuthorizedOidcClient
|
||||
common.DB.First(&userAuthorizedOIDCClient, "client_id = ? AND user_id = ?", parsedBody.ClientID, c.GetString("userID"))
|
||||
|
||||
// If the record isn't found or the scope is different return an error
|
||||
// The client will have to call the authorizeNewClientHandler
|
||||
if userAuthorizedOIDCClient.Scope != parsedBody.Scope {
|
||||
utils.HandlerError(c, http.StatusForbidden, "missing authorization")
|
||||
return
|
||||
}
|
||||
|
||||
authorizationCode, err := createAuthorizationCode(parsedBody.ClientID, c.GetString("userID"), parsedBody.Scope, parsedBody.Nonce)
|
||||
if err != nil {
|
||||
utils.UnknownHandlerError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
c.JSON(http.StatusOK, gin.H{"code": authorizationCode})
|
||||
}
|
||||
|
||||
// authorizeNewClientHandler authorizes a new client for the user
|
||||
// a new client is a new client when the user has not authorized the client before
|
||||
func authorizeNewClientHandler(c *gin.Context) {
|
||||
var parsedBody model.AuthorizeNewClientDto
|
||||
if err := c.ShouldBindJSON(&parsedBody); err != nil {
|
||||
utils.HandlerError(c, http.StatusBadRequest, "invalid request body")
|
||||
return
|
||||
}
|
||||
|
||||
userAuthorizedClient := model.UserAuthorizedOidcClient{
|
||||
UserID: c.GetString("userID"),
|
||||
ClientID: parsedBody.ClientID,
|
||||
Scope: parsedBody.Scope,
|
||||
}
|
||||
err := common.DB.Create(&userAuthorizedClient).Error
|
||||
|
||||
if err != nil && errors.Is(err, gorm.ErrDuplicatedKey) {
|
||||
err = common.DB.Model(&userAuthorizedClient).Update("scope", parsedBody.Scope).Error
|
||||
}
|
||||
|
||||
if err != nil {
|
||||
utils.UnknownHandlerError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
authorizationCode, err := createAuthorizationCode(parsedBody.ClientID, c.GetString("userID"), parsedBody.Scope, parsedBody.Nonce)
|
||||
if err != nil {
|
||||
utils.UnknownHandlerError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
c.JSON(http.StatusOK, gin.H{"code": authorizationCode})
|
||||
|
||||
}
|
||||
|
||||
func createIDTokenHandler(c *gin.Context) {
|
||||
var body model.OidcIdTokenDto
|
||||
|
||||
if err := c.ShouldBind(&body); err != nil {
|
||||
utils.HandlerError(c, http.StatusBadRequest, "invalid request body")
|
||||
return
|
||||
}
|
||||
|
||||
// Currently only authorization_code grant type is supported
|
||||
if body.GrantType != "authorization_code" {
|
||||
utils.HandlerError(c, http.StatusBadRequest, "grant type not supported")
|
||||
return
|
||||
}
|
||||
|
||||
clientID := body.ClientID
|
||||
clientSecret := body.ClientSecret
|
||||
|
||||
// Client id and secret can also be passed over the Authorization header
|
||||
if clientID == "" || clientSecret == "" {
|
||||
var ok bool
|
||||
clientID, clientSecret, ok = c.Request.BasicAuth()
|
||||
if !ok {
|
||||
utils.HandlerError(c, http.StatusBadRequest, "Client id and secret not provided")
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
// Get the client
|
||||
var client model.OidcClient
|
||||
err := common.DB.First(&client, "id = ?", clientID, clientSecret).Error
|
||||
if err != nil {
|
||||
utils.HandlerError(c, http.StatusBadRequest, "OIDC OIDC client not found")
|
||||
return
|
||||
}
|
||||
|
||||
// Check if client secret is correct
|
||||
err = bcrypt.CompareHashAndPassword([]byte(client.Secret), []byte(clientSecret))
|
||||
if err != nil {
|
||||
utils.HandlerError(c, http.StatusBadRequest, "invalid client secret")
|
||||
return
|
||||
}
|
||||
|
||||
var authorizationCodeMetaData model.OidcAuthorizationCode
|
||||
err = common.DB.Preload("User").First(&authorizationCodeMetaData, "code = ?", body.Code).Error
|
||||
if err != nil {
|
||||
utils.HandlerError(c, http.StatusBadRequest, "invalid authorization code")
|
||||
return
|
||||
}
|
||||
|
||||
// Check if the client id matches the client id in the authorization code and if the code has expired
|
||||
if authorizationCodeMetaData.ClientID != clientID && authorizationCodeMetaData.ExpiresAt.Before(time.Now()) {
|
||||
utils.HandlerError(c, http.StatusBadRequest, "invalid authorization code")
|
||||
return
|
||||
}
|
||||
|
||||
idToken, e := common.GenerateIDToken(authorizationCodeMetaData.User, clientID, authorizationCodeMetaData.Scope, authorizationCodeMetaData.Nonce)
|
||||
if e != nil {
|
||||
utils.UnknownHandlerError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
// Delete the authorization code after it has been used
|
||||
common.DB.Delete(&authorizationCodeMetaData)
|
||||
|
||||
c.JSON(http.StatusOK, gin.H{"id_token": idToken})
|
||||
}
|
||||
|
||||
func getClientHandler(c *gin.Context) {
|
||||
clientId := c.Param("id")
|
||||
|
||||
var client model.OidcClient
|
||||
err := common.DB.First(&client, "id = ?", clientId).Error
|
||||
if err != nil {
|
||||
utils.HandlerError(c, http.StatusNotFound, "OIDC client not found")
|
||||
return
|
||||
}
|
||||
|
||||
c.JSON(http.StatusOK, client)
|
||||
}
|
||||
|
||||
func listClientsHandler(c *gin.Context) {
|
||||
var clients []model.OidcClient
|
||||
searchTerm := c.Query("search")
|
||||
|
||||
query := common.DB.Model(&model.OidcClient{})
|
||||
|
||||
if searchTerm != "" {
|
||||
searchPattern := "%" + searchTerm + "%"
|
||||
query = query.Where("name LIKE ?", searchPattern)
|
||||
}
|
||||
|
||||
pagination, err := utils.Paginate(c, query, &clients)
|
||||
if err != nil {
|
||||
utils.UnknownHandlerError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
c.JSON(http.StatusOK, gin.H{
|
||||
"data": clients,
|
||||
"pagination": pagination,
|
||||
})
|
||||
}
|
||||
|
||||
func createClientHandler(c *gin.Context) {
|
||||
var input model.OidcClientCreateDto
|
||||
if err := c.ShouldBindJSON(&input); err != nil {
|
||||
utils.HandlerError(c, http.StatusBadRequest, "invalid request body")
|
||||
return
|
||||
}
|
||||
|
||||
client := model.OidcClient{
|
||||
Name: input.Name,
|
||||
CallbackURL: input.CallbackURL,
|
||||
CreatedByID: c.GetString("userID"),
|
||||
}
|
||||
|
||||
if err := common.DB.Create(&client).Error; err != nil {
|
||||
utils.UnknownHandlerError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
c.JSON(http.StatusCreated, client)
|
||||
}
|
||||
|
||||
func deleteClientHandler(c *gin.Context) {
|
||||
var client model.OidcClient
|
||||
if err := common.DB.First(&client, "id = ?", c.Param("id")).Error; err != nil {
|
||||
utils.HandlerError(c, http.StatusNotFound, "OIDC OIDC client not found")
|
||||
return
|
||||
}
|
||||
|
||||
if err := common.DB.Delete(&client).Error; err != nil {
|
||||
utils.UnknownHandlerError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
c.Status(http.StatusNoContent)
|
||||
}
|
||||
|
||||
func updateClientHandler(c *gin.Context) {
|
||||
var input model.OidcClientCreateDto
|
||||
if err := c.ShouldBindJSON(&input); err != nil {
|
||||
utils.HandlerError(c, http.StatusBadRequest, "invalid request body")
|
||||
return
|
||||
}
|
||||
|
||||
var client model.OidcClient
|
||||
if err := common.DB.First(&client, "id = ?", c.Param("id")).Error; err != nil {
|
||||
if errors.Is(err, gorm.ErrRecordNotFound) {
|
||||
utils.HandlerError(c, http.StatusNotFound, "OIDC client not found")
|
||||
return
|
||||
}
|
||||
utils.UnknownHandlerError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
client.Name = input.Name
|
||||
client.CallbackURL = input.CallbackURL
|
||||
|
||||
if err := common.DB.Save(&client).Error; err != nil {
|
||||
utils.UnknownHandlerError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
c.JSON(http.StatusNoContent, client)
|
||||
}
|
||||
|
||||
// createClientSecretHandler creates a new secret for the client and revokes the old one
|
||||
func createClientSecretHandler(c *gin.Context) {
|
||||
var client model.OidcClient
|
||||
if err := common.DB.First(&client, "id = ?", c.Param("id")).Error; err != nil {
|
||||
if errors.Is(err, gorm.ErrRecordNotFound) {
|
||||
utils.HandlerError(c, http.StatusNotFound, "OIDC client not found")
|
||||
return
|
||||
}
|
||||
utils.UnknownHandlerError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
clientSecret, err := utils.GenerateRandomAlphanumericString(32)
|
||||
if err != nil {
|
||||
utils.UnknownHandlerError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
hashedSecret, err := bcrypt.GenerateFromPassword([]byte(clientSecret), bcrypt.DefaultCost)
|
||||
if err != nil {
|
||||
utils.UnknownHandlerError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
client.Secret = string(hashedSecret)
|
||||
if err := common.DB.Save(&client).Error; err != nil {
|
||||
utils.UnknownHandlerError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
c.JSON(http.StatusOK, gin.H{"secret": clientSecret})
|
||||
}
|
||||
|
||||
func getClientLogoHandler(c *gin.Context) {
|
||||
var client model.OidcClient
|
||||
if err := common.DB.First(&client, "id = ?", c.Param("id")).Error; err != nil {
|
||||
utils.HandlerError(c, http.StatusNotFound, "OIDC client not found")
|
||||
return
|
||||
}
|
||||
|
||||
if client.ImageType == nil {
|
||||
utils.HandlerError(c, http.StatusNotFound, "image not found")
|
||||
return
|
||||
}
|
||||
|
||||
imageType := *client.ImageType
|
||||
|
||||
imagePath := fmt.Sprintf("%s/oidc-client-images/%s.%s", common.EnvConfig.UploadPath, client.ID, imageType)
|
||||
mimeType := utils.GetImageMimeType(imageType)
|
||||
|
||||
c.Header("Content-Type", mimeType)
|
||||
c.File(imagePath)
|
||||
}
|
||||
|
||||
func updateClientLogoHandler(c *gin.Context) {
|
||||
file, err := c.FormFile("file")
|
||||
if err != nil {
|
||||
utils.HandlerError(c, http.StatusBadRequest, "invalid request body")
|
||||
return
|
||||
}
|
||||
|
||||
fileType := utils.GetFileExtension(file.Filename)
|
||||
if mimeType := utils.GetImageMimeType(fileType); mimeType == "" {
|
||||
utils.HandlerError(c, http.StatusBadRequest, "file type not supported")
|
||||
return
|
||||
}
|
||||
|
||||
imagePath := fmt.Sprintf("%s/oidc-client-images/%s.%s", common.EnvConfig.UploadPath, c.Param("id"), fileType)
|
||||
err = c.SaveUploadedFile(file, imagePath)
|
||||
if err != nil {
|
||||
utils.UnknownHandlerError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
var client model.OidcClient
|
||||
if err := common.DB.First(&client, "id = ?", c.Param("id")).Error; err != nil {
|
||||
utils.HandlerError(c, http.StatusNotFound, "OIDC client not found")
|
||||
return
|
||||
}
|
||||
|
||||
// Delete the old image if it has a different file type
|
||||
if client.ImageType != nil && fileType != *client.ImageType {
|
||||
oldImagePath := fmt.Sprintf("%s/oidc-client-images/%s.%s", common.EnvConfig.UploadPath, client.ID, *client.ImageType)
|
||||
if err := os.Remove(oldImagePath); err != nil {
|
||||
utils.UnknownHandlerError(c, err)
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
client.ImageType = &fileType
|
||||
if err := common.DB.Save(&client).Error; err != nil {
|
||||
utils.UnknownHandlerError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
c.Status(http.StatusNoContent)
|
||||
}
|
||||
|
||||
func deleteClientLogoHandler(c *gin.Context) {
|
||||
var client model.OidcClient
|
||||
if err := common.DB.First(&client, "id = ?", c.Param("id")).Error; err != nil {
|
||||
utils.HandlerError(c, http.StatusNotFound, "OIDC client not found")
|
||||
return
|
||||
}
|
||||
|
||||
if client.ImageType == nil {
|
||||
utils.HandlerError(c, http.StatusNotFound, "image not found")
|
||||
return
|
||||
}
|
||||
|
||||
imagePath := fmt.Sprintf("%s/oidc-client-images/%s.%s", common.EnvConfig.UploadPath, client.ID, *client.ImageType)
|
||||
if err := os.Remove(imagePath); err != nil {
|
||||
utils.UnknownHandlerError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
client.ImageType = nil
|
||||
if err := common.DB.Save(&client).Error; err != nil {
|
||||
utils.UnknownHandlerError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
c.Status(http.StatusNoContent)
|
||||
}
|
||||
|
||||
func createAuthorizationCode(clientID string, userID string, scope string, nonce string) (string, error) {
|
||||
randomString, err := utils.GenerateRandomAlphanumericString(32)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
oidcAuthorizationCode := model.OidcAuthorizationCode{
|
||||
ExpiresAt: time.Now().Add(15 * time.Minute),
|
||||
Code: randomString,
|
||||
ClientID: clientID,
|
||||
UserID: userID,
|
||||
Scope: scope,
|
||||
Nonce: nonce,
|
||||
}
|
||||
|
||||
if err := common.DB.Create(&oidcAuthorizationCode).Error; err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
return randomString, nil
|
||||
}
|
||||
Reference in New Issue
Block a user