Browse Source
* [feature] Refactor tokens, allow multiple app redirect_uris * move + tweak handlers a bit * return error for unset oauth2.ClientStore funcs * wrap UpdateToken with cache * panic handling * cheeky little time optimization * unlock on errorpull/3845/head
tobi
1 year ago
committed by
GitHub
77 changed files with 963 additions and 594 deletions
@ -0,0 +1,200 @@
|
||||
// GoToSocial
|
||||
// Copyright (C) GoToSocial Authors admin@gotosocial.org
|
||||
// SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
//
|
||||
// This program is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU Affero General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// This program is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU Affero General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU Affero General Public License
|
||||
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
package migrations |
||||
|
||||
import ( |
||||
"context" |
||||
|
||||
oldmodel "github.com/superseriousbusiness/gotosocial/internal/db/bundb/migrations/20211113114307_init" |
||||
newmodel "github.com/superseriousbusiness/gotosocial/internal/db/bundb/migrations/20250224105654_token_app_client_refactor" |
||||
"github.com/superseriousbusiness/gotosocial/internal/id" |
||||
"github.com/uptrace/bun" |
||||
) |
||||
|
||||
func init() { |
||||
up := func(ctx context.Context, db *bun.DB) error { |
||||
return db.RunInTx(ctx, nil, func(ctx context.Context, tx bun.Tx) error { |
||||
|
||||
// Drop unused clients table.
|
||||
if _, err := tx. |
||||
NewDropTable(). |
||||
Table("clients"). |
||||
IfExists(). |
||||
Exec(ctx); err != nil { |
||||
return err |
||||
} |
||||
|
||||
// Select all old model
|
||||
// applications into memory.
|
||||
oldApps := []*oldmodel.Application{} |
||||
if err := tx. |
||||
NewSelect(). |
||||
Model(&oldApps). |
||||
Scan(ctx); err != nil { |
||||
return err |
||||
} |
||||
|
||||
// Drop the old applications table.
|
||||
if _, err := tx. |
||||
NewDropTable(). |
||||
Table("applications"). |
||||
IfExists(). |
||||
Exec(ctx); err != nil { |
||||
return err |
||||
} |
||||
|
||||
// Create the new applications table.
|
||||
if _, err := tx. |
||||
NewCreateTable(). |
||||
Model((*newmodel.Application)(nil)). |
||||
IfNotExists(). |
||||
Exec(ctx); err != nil { |
||||
return err |
||||
} |
||||
|
||||
// Add indexes to new applications table.
|
||||
if _, err := tx. |
||||
NewCreateIndex(). |
||||
Table("applications"). |
||||
Index("applications_client_id_idx"). |
||||
Column("client_id"). |
||||
IfNotExists(). |
||||
Exec(ctx); err != nil { |
||||
return err |
||||
} |
||||
|
||||
if _, err := tx. |
||||
NewCreateIndex(). |
||||
Table("applications"). |
||||
Index("applications_managed_by_user_id_idx"). |
||||
Column("managed_by_user_id"). |
||||
IfNotExists(). |
||||
Exec(ctx); err != nil { |
||||
return err |
||||
} |
||||
|
||||
if len(oldApps) != 0 { |
||||
// Convert all the old model applications into new ones.
|
||||
newApps := make([]*newmodel.Application, 0, len(oldApps)) |
||||
for _, oldApp := range oldApps { |
||||
newApps = append(newApps, &newmodel.Application{ |
||||
ID: id.NewULIDFromTime(oldApp.CreatedAt), |
||||
Name: oldApp.Name, |
||||
Website: oldApp.Website, |
||||
RedirectURIs: []string{oldApp.RedirectURI}, |
||||
ClientID: oldApp.ClientID, |
||||
ClientSecret: oldApp.ClientSecret, |
||||
Scopes: oldApp.Scopes, |
||||
}) |
||||
} |
||||
|
||||
// Whack all the new apps in
|
||||
// there. Lads lads lads lads!
|
||||
if _, err := tx. |
||||
NewInsert(). |
||||
Model(&newApps). |
||||
Exec(ctx); err != nil { |
||||
return err |
||||
} |
||||
} |
||||
|
||||
// Select all the old model
|
||||
// tokens into memory.
|
||||
oldTokens := []*oldmodel.Token{} |
||||
if err := tx. |
||||
NewSelect(). |
||||
Model(&oldTokens). |
||||
Scan(ctx); err != nil { |
||||
return err |
||||
} |
||||
|
||||
// Drop the old token table.
|
||||
if _, err := tx. |
||||
NewDropTable(). |
||||
Table("tokens"). |
||||
IfExists(). |
||||
Exec(ctx); err != nil { |
||||
return err |
||||
} |
||||
|
||||
// Create the new token table.
|
||||
if _, err := tx. |
||||
NewCreateTable(). |
||||
Model((*newmodel.Token)(nil)). |
||||
IfNotExists(). |
||||
Exec(ctx); err != nil { |
||||
return err |
||||
} |
||||
|
||||
// Add access index to new token table.
|
||||
if _, err := tx. |
||||
NewCreateIndex(). |
||||
Table("tokens"). |
||||
Index("tokens_access_idx"). |
||||
Column("access"). |
||||
IfNotExists(). |
||||
Exec(ctx); err != nil { |
||||
return err |
||||
} |
||||
|
||||
if len(oldTokens) != 0 { |
||||
// Convert all the old model tokens into new ones.
|
||||
newTokens := make([]*newmodel.Token, 0, len(oldTokens)) |
||||
for _, oldToken := range oldTokens { |
||||
newTokens = append(newTokens, &newmodel.Token{ |
||||
ID: id.NewULIDFromTime(oldToken.CreatedAt), |
||||
ClientID: oldToken.ClientID, |
||||
UserID: oldToken.UserID, |
||||
RedirectURI: oldToken.RedirectURI, |
||||
Scope: oldToken.Scope, |
||||
Code: oldToken.Code, |
||||
CodeChallenge: oldToken.CodeChallenge, |
||||
CodeChallengeMethod: oldToken.CodeChallengeMethod, |
||||
CodeCreateAt: oldToken.CodeCreateAt, |
||||
CodeExpiresAt: oldToken.CodeExpiresAt, |
||||
Access: oldToken.Access, |
||||
AccessCreateAt: oldToken.AccessCreateAt, |
||||
AccessExpiresAt: oldToken.AccessExpiresAt, |
||||
Refresh: oldToken.Refresh, |
||||
RefreshCreateAt: oldToken.RefreshCreateAt, |
||||
RefreshExpiresAt: oldToken.RefreshExpiresAt, |
||||
}) |
||||
} |
||||
|
||||
// Whack all the new tokens in
|
||||
// there. Lads lads lads lads!
|
||||
if _, err := tx. |
||||
NewInsert(). |
||||
Model(&newTokens). |
||||
Exec(ctx); err != nil { |
||||
return err |
||||
} |
||||
} |
||||
|
||||
return nil |
||||
}) |
||||
} |
||||
|
||||
down := func(ctx context.Context, db *bun.DB) error { |
||||
return nil |
||||
} |
||||
|
||||
if err := Migrations.Register(up, down); err != nil { |
||||
panic(err) |
||||
} |
||||
} |
||||
@ -0,0 +1,42 @@
|
||||
// GoToSocial
|
||||
// Copyright (C) GoToSocial Authors admin@gotosocial.org
|
||||
// SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
//
|
||||
// This program is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU Affero General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// This program is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU Affero General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU Affero General Public License
|
||||
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
package gtsmodel |
||||
|
||||
import "time" |
||||
|
||||
// Token is a translation of the gotosocial token
|
||||
// with the ExpiresIn fields replaced with ExpiresAt.
|
||||
type Token struct { |
||||
ID string `bun:"type:CHAR(26),pk,nullzero,notnull,unique"` // id of this item in the database
|
||||
LastUsed time.Time `bun:"type:timestamptz,nullzero"` // approximate time when this token was last used
|
||||
ClientID string `bun:"type:CHAR(26),nullzero,notnull"` // ID of the client who owns this token
|
||||
UserID string `bun:"type:CHAR(26),nullzero"` // ID of the user who owns this token
|
||||
RedirectURI string `bun:",nullzero,notnull"` // Oauth redirect URI for this token
|
||||
Scope string `bun:",nullzero,notnull,default:'read'"` // Oauth scope
|
||||
Code string `bun:",pk,nullzero,notnull,default:''"` // Code, if present
|
||||
CodeChallenge string `bun:",nullzero"` // Code challenge, if code present
|
||||
CodeChallengeMethod string `bun:",nullzero"` // Code challenge method, if code present
|
||||
CodeCreateAt time.Time `bun:"type:timestamptz,nullzero"` // Code created time, if code present
|
||||
CodeExpiresAt time.Time `bun:"type:timestamptz,nullzero"` // Code expires at -- null means the code never expires
|
||||
Access string `bun:",pk,nullzero,notnull,default:''"` // User level access token, if present
|
||||
AccessCreateAt time.Time `bun:"type:timestamptz,nullzero"` // User level access token created time, if access present
|
||||
AccessExpiresAt time.Time `bun:"type:timestamptz,nullzero"` // User level access token expires at -- null means the token never expires
|
||||
Refresh string `bun:",pk,nullzero,notnull,default:''"` // Refresh token, if present
|
||||
RefreshCreateAt time.Time `bun:"type:timestamptz,nullzero"` // Refresh created at, if refresh present
|
||||
RefreshExpiresAt time.Time `bun:"type:timestamptz,nullzero"` // Refresh expires at -- null means the refresh token never expires
|
||||
} |
||||
@ -1,30 +0,0 @@
|
||||
// GoToSocial
|
||||
// Copyright (C) GoToSocial Authors admin@gotosocial.org
|
||||
// SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
//
|
||||
// This program is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU Affero General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// This program is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU Affero General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU Affero General Public License
|
||||
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
package gtsmodel |
||||
|
||||
import "time" |
||||
|
||||
// Client is a wrapper for OAuth client details.
|
||||
type Client struct { |
||||
ID string `bun:"type:CHAR(26),pk,nullzero,notnull,unique"` // id of this item in the database
|
||||
CreatedAt time.Time `bun:"type:timestamptz,nullzero,notnull,default:current_timestamp"` // when was item created
|
||||
UpdatedAt time.Time `bun:"type:timestamptz,nullzero,notnull,default:current_timestamp"` // when was item last updated
|
||||
Secret string `bun:",nullzero,notnull"` // secret generated when client was created
|
||||
Domain string `bun:",nullzero,notnull"` // domain requested for client
|
||||
UserID string `bun:"type:CHAR(26),nullzero"` // id of the user that this client acts on behalf of
|
||||
} |
||||
@ -0,0 +1,153 @@
|
||||
// GoToSocial
|
||||
// Copyright (C) GoToSocial Authors admin@gotosocial.org
|
||||
// SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
//
|
||||
// This program is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU Affero General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// This program is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU Affero General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU Affero General Public License
|
||||
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
package handlers |
||||
|
||||
import ( |
||||
"context" |
||||
"errors" |
||||
"net/http" |
||||
"net/url" |
||||
"slices" |
||||
"strings" |
||||
|
||||
"codeberg.org/superseriousbusiness/oauth2/v4" |
||||
oautherr "codeberg.org/superseriousbusiness/oauth2/v4/errors" |
||||
"codeberg.org/superseriousbusiness/oauth2/v4/manage" |
||||
"codeberg.org/superseriousbusiness/oauth2/v4/server" |
||||
apiutil "github.com/superseriousbusiness/gotosocial/internal/api/util" |
||||
"github.com/superseriousbusiness/gotosocial/internal/db" |
||||
"github.com/superseriousbusiness/gotosocial/internal/gtscontext" |
||||
"github.com/superseriousbusiness/gotosocial/internal/gtserror" |
||||
"github.com/superseriousbusiness/gotosocial/internal/log" |
||||
"github.com/superseriousbusiness/gotosocial/internal/state" |
||||
) |
||||
|
||||
// GetClientScopeHandler returns a handler for testing scope on a TokenGenerateRequest.
|
||||
func GetClientScopeHandler(ctx context.Context, state *state.State) server.ClientScopeHandler { |
||||
return func(tgr *oauth2.TokenGenerateRequest) (allowed bool, err error) { |
||||
application, err := state.DB.GetApplicationByClientID( |
||||
gtscontext.SetBarebones(ctx), |
||||
tgr.ClientID, |
||||
) |
||||
if err != nil && !errors.Is(err, db.ErrNoEntries) { |
||||
log.Errorf(ctx, "database error getting application: %v", err) |
||||
return false, err |
||||
} |
||||
|
||||
if application == nil { |
||||
err := gtserror.Newf("no application found with client id %s", tgr.ClientID) |
||||
return false, err |
||||
} |
||||
|
||||
// Normalize scope.
|
||||
if strings.TrimSpace(tgr.Scope) == "" { |
||||
tgr.Scope = "read" |
||||
} |
||||
|
||||
// Make sure requested scopes are all
|
||||
// within scopes permitted by application.
|
||||
hasScopes := strings.Split(application.Scopes, " ") |
||||
wantsScopes := strings.Split(tgr.Scope, " ") |
||||
for _, wantsScope := range wantsScopes { |
||||
thisOK := slices.ContainsFunc( |
||||
hasScopes, |
||||
func(hasScope string) bool { |
||||
has := apiutil.Scope(hasScope) |
||||
wants := apiutil.Scope(wantsScope) |
||||
return has.Permits(wants) |
||||
}, |
||||
) |
||||
|
||||
if !thisOK { |
||||
// Requested unpermitted
|
||||
// scope for this app.
|
||||
return false, nil |
||||
} |
||||
} |
||||
|
||||
// All OK.
|
||||
return true, nil |
||||
} |
||||
} |
||||
|
||||
func GetValidateURIHandler(ctx context.Context) manage.ValidateURIHandler { |
||||
return func(hasRedirects string, wantsRedirect string) error { |
||||
// Normalize the wantsRedirect URI
|
||||
// string by parsing + reserializing.
|
||||
wantsRedirectURI, err := url.Parse(wantsRedirect) |
||||
if err != nil { |
||||
return err |
||||
} |
||||
wantsRedirect = wantsRedirectURI.String() |
||||
|
||||
// Redirect URIs are given to us as
|
||||
// a list of URIs, newline-separated.
|
||||
//
|
||||
// They're already normalized on input so
|
||||
// we don't need to parse + reserialize them.
|
||||
//
|
||||
// Ensure that one of them matches.
|
||||
if slices.ContainsFunc( |
||||
strings.Split(hasRedirects, "\n"), |
||||
func(hasRedirect string) bool { |
||||
// Want an exact match.
|
||||
// See: https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uri-validation/
|
||||
return wantsRedirect == hasRedirect |
||||
}, |
||||
) { |
||||
return nil |
||||
} |
||||
|
||||
return oautherr.ErrInvalidRedirectURI |
||||
} |
||||
} |
||||
|
||||
func GetAuthorizeScopeHandler() server.AuthorizeScopeHandler { |
||||
return func(_ http.ResponseWriter, r *http.Request) (string, error) { |
||||
// Use provided scope or
|
||||
// fall back to default "read".
|
||||
scope := r.FormValue("scope") |
||||
if strings.TrimSpace(scope) == "" { |
||||
scope = "read" |
||||
} |
||||
return scope, nil |
||||
} |
||||
} |
||||
|
||||
func GetInternalErrorHandler(ctx context.Context) server.InternalErrorHandler { |
||||
return func(err error) *oautherr.Response { |
||||
log.Errorf(ctx, "internal oauth error: %v", err) |
||||
return nil |
||||
} |
||||
} |
||||
|
||||
func GetResponseErrorHandler(ctx context.Context) server.ResponseErrorHandler { |
||||
return func(re *oautherr.Response) { |
||||
log.Errorf(ctx, "internal response error: %v", re.Error) |
||||
} |
||||
} |
||||
|
||||
func GetUserAuthorizationHandler() server.UserAuthorizationHandler { |
||||
return func(w http.ResponseWriter, r *http.Request) (string, error) { |
||||
userID := r.FormValue("userid") |
||||
if userID == "" { |
||||
return "", errors.New("userid was empty") |
||||
} |
||||
return userID, nil |
||||
} |
||||
} |
||||
Loading…
Reference in new issue