oproxy: implemented authorize

pkg/atproto/resolution.go pkg/oproxy/resolution.go

···
-package atproto
+package oproxy
 
 import (
 	"context"

pkg/oproxy/handlers.go

···
 	"fmt"
 	"net/http"
 	"net/url"
-	"time"
 
 	"github.com/labstack/echo/v4"
 	"go.opentelemetry.io/otel"
···
 }
 
 func (o *OProxy) HandleOAuthPAR(c echo.Context) error {
+	ctx, span := otel.Tracer("server").Start(c.Request().Context(), "HandleOAuthPAR")
+	defer span.End()
 	c.Response().Header().Set("Access-Control-Allow-Origin", "*")
 	var par PAR
 	if err := json.NewDecoder(c.Request().Body).Decode(&par); err != nil {
···
 		return echo.NewHTTPError(http.StatusUnauthorized, "DPoP header is required")
 	}
 
-	resp, err := o.NewPAR(c.Request().Context(), &par, dpopHeader)
+	resp, err := o.NewPAR(ctx, &par, dpopHeader)
 	if err != nil {
 		return echo.NewHTTPError(http.StatusBadRequest, err.Error())
 	}
···
 }
 
 func (o *OProxy) HandleOAuthAuthorize(c echo.Context) error {
-	w.Header().Set("Access-Control-Allow-Origin", "*")
-	query := r.URL.Query()
-	parID := query.Get("request_uri")
-	if parID == "" {
-		apierrors.WriteHTTPBadRequest(w, "request_uri is required", nil)
-		return
-	}
-	par, err := a.Model.GetPAR(parID)
-	if err != nil {
-		apierrors.WriteHTTPInternalServerError(w, "could not get par", err)
-		return
-	}
-	if par == nil {
-		apierrors.WriteHTTPBadRequest(w, "par not found", nil)
-		return
-	}
-	if par.ExpiresAt.Before(time.Now()) {
-		apierrors.WriteHTTPBadRequest(w, "par expired", nil)
-		return
+	ctx, span := otel.Tracer("server").Start(c.Request().Context(), "HandleOAuthAuthorize")
+	defer span.End()
+	c.Response().Header().Set("Access-Control-Allow-Origin", "*")
+	requestURI := c.QueryParam("request_uri")
+	if requestURI == "" {
+		return echo.NewHTTPError(http.StatusBadRequest, "request_uri is required")
 	}
-	if par.LoginHint == "" {
-		apierrors.WriteHTTPBadRequest(w, "login hint is required", nil)
-		return
+	clientID := c.QueryParam("client_id")
+	if clientID == "" {
+		return echo.NewHTTPError(http.StatusBadRequest, "client_id is required")
 	}
-	redirectURL, err := atproto.Login(ctx, a.CLI, par, a.Model)
+	redirectURL, err := o.Authorize(ctx, clientID, requestURI)
 	if err != nil {
-		apierrors.WriteHTTPInternalServerError(w, "could not login", err)
-		return
+		return err
 	}
-	http.Redirect(w, r, redirectURL, http.StatusTemporaryRedirect)
-
+	return c.Redirect(http.StatusTemporaryRedirect, redirectURL)
 }
 
 func (o *OProxy) HandleOAuthReturn(c echo.Context) error {
-	ctx, span := otel.Tracer("server").Start(ctx, "HandlePlaceStreamAccountOauthReturn")
+	ctx, span := otel.Tracer("server").Start(c.Request().Context(), "HandleOAuthReturn")
 	defer span.End()
-	code := r.URL.Query().Get("code")
-	iss := r.URL.Query().Get("iss")
-	state := r.URL.Query().Get("state")
+	code := c.QueryParam("code")
+	iss := c.QueryParam("iss")
+	state := c.QueryParam("state")
 	upstreamSession, err := atproto.HandleOauthReturn(ctx, a.CLI, code, iss, state, a.Model)
 	if err != nil {
 		apierrors.WriteHTTPInternalServerError(w, "could not handle oauth return", err)

pkg/oproxy/helpers.go

···
 
 import (
 	"fmt"
+	"strings"
 
 	"github.com/google/uuid"
 )
···
 	}
 	return fmt.Sprintf("%s-%s", prefix, uu.String())
 }
+
+var urnPrefix = "urn:ietf:params:oauth:request_uri:"
+
+func makeURN(jkt string) string {
+	uu, err := uuid.NewV7()
+	if err != nil {
+		panic(err)
+	}
+	return fmt.Sprintf("%s%s_%s", urnPrefix, jkt, uu.String())
+}
+
+// urn --> jkt, uu
+func parseURN(urn string) (string, string, error) {
+	if !strings.HasPrefix(urn, urnPrefix) {
+		return "", "", fmt.Errorf("invalid URN: %s", urn)
+	}
+	parts := strings.Split(urn[len(urnPrefix):], "_")
+	if len(parts) != 2 {
+		return "", "", fmt.Errorf("invalid URN: %s", urn)
+	}
+	return parts[0], parts[1], nil
+}

pkg/oproxy/oauth_downstream.go

···
 
 	// proof is valid, get public key to use as primary key of oauth session
 	jkt := proof.PublicKey()
-	uu, err := uuid.NewV7()
-	if err != nil {
-		panic(err)
-	}
 
-	urn := fmt.Sprintf("urn:ietf:params:oauth:request_uri:%s", uu.String())
+	urn := makeURN(jkt)
 
 	err = o.createOAuthSession(jkt, &OAuthSession{
 		DownstreamDPoPJKT:       jkt,

pkg/oproxy/oauth_session.go

···
 
 import (
 	"time"
-
-	"gorm.io/gorm"
 )
 
 // OAuthSession stores authentication data needed during the OAuth flow
 type OAuthSession struct {
-	DID string `gorm:"column:repo_did;index"`
+	DID    string `gorm:"column:repo_did;index"`
+	PDSUrl string `gorm:"column:pds_url;index"`
 
 	// Upstream fields
 	UpstreamState            string    `gorm:"column:upstream_state;index"`
 	UpstreamAuthServerIssuer string    `gorm:"column:upstream_auth_server_issuer"`
 	UpstreamPKCEVerifier     string    `gorm:"column:upstream_pkce_verifier"`
 	UpstreamDPoPNonce        string    `gorm:"column:upstream_dpop_nonce"`
-	UpstreamDPoPPrivateJWK   []byte    `gorm:"column:upstream_dpop_private_jwk;type:text"`
+	UpstreamDPoPPrivateJWK   string    `gorm:"column:upstream_dpop_private_jwk;type:text"`
 	UpstreamAccessToken      string    `gorm:"column:upstream_access_token"`
 	UpstreamAccessTokenExp   time.Time `gorm:"column:upstream_access_token_exp"`
 	UpstreamRefreshToken     string    `gorm:"column:upstream_refresh_token"`
 
 	// Downstream fields
-	DownstreamDPoPNonce         string `gorm:"column:downstream_dpop_nonce"`
-	DownstreamDPoPJKT           string `gorm:"column:downstream_dpop_jkt;primaryKey"`
-	DownstreamAccessToken       string `gorm:"column:downstream_access_token;index"`
-	DownstreamRefreshToken      string `gorm:"column:downstream_refresh_token;index"`
-	DownstreamAuthorizationCode string `gorm:"column:downstream_authorization_code;index"`
-	DownstreamState             string `gorm:"column:downstream_state"`
-	DownstreamScope             string `gorm:"column:downstream_scope"`
-	DownstreamCodeChallenge     string `gorm:"column:downstream_code_challenge"`
-	DownstreamPARRequestURI     string `gorm:"column:downstream_par_request_uri"`
+	DownstreamDPoPNonce         string     `gorm:"column:downstream_dpop_nonce"`
+	DownstreamDPoPJKT           string     `gorm:"column:downstream_dpop_jkt;primaryKey"`
+	DownstreamAccessToken       string     `gorm:"column:downstream_access_token;index"`
+	DownstreamRefreshToken      string     `gorm:"column:downstream_refresh_token;index"`
+	DownstreamAuthorizationCode string     `gorm:"column:downstream_authorization_code;index"`
+	DownstreamState             string     `gorm:"column:downstream_state"`
+	DownstreamScope             string     `gorm:"column:downstream_scope"`
+	DownstreamCodeChallenge     string     `gorm:"column:downstream_code_challenge"`
+	DownstreamPARRequestURI     string     `gorm:"column:downstream_par_request_uri"`
+	DownstreamPARUsedAt         *time.Time `gorm:"column:downstream_par_used_at"`
 
 	RevokedAt *time.Time `gorm:"column:revoked_at"`
 	CreatedAt time.Time
 	UpdatedAt time.Time
-	DeletedAt gorm.DeletedAt `gorm:"index"`
 }
 
+// for gorm. this is prettier than "o_auth_sessions"
 func (o *OAuthSession) TableName() string {
 	return "oauth_sessions"
+}
+
+type OAuthSessionStatus string
+
+const (
+	// PAR has been created, but not yet used
+	OAuthSessionStatePARCreated OAuthSessionStatus = "par-created"
+	// PAR has been used, but maybe upstream will fail for some reason
+	OAuthSessionStatePARUsed OAuthSessionStatus = "par-used"
+	// PAR has been used, we're waiting to hear back from upstream
+	OAuthSessionStateUpstream OAuthSessionStatus = "upstream"
+	// Upstream came back, we've issued the user a code but it hasn't been used yet
+	OAuthSessionStateDownstream OAuthSessionStatus = "downstream"
+	// Code has been used, everything is good
+	OAuthSessionStateReady OAuthSessionStatus = "ready"
+	// For any reason we're done. Revoked or expired
+	OAuthSessionStateRejected OAuthSessionStatus = "rejected"
+)
+
+func (o *OAuthSession) Status() OAuthSessionStatus {
+	if o.RevokedAt != nil {
+		return OAuthSessionStateRejected
+	}
+	if o.UpstreamAccessTokenExp.Before(time.Now()) {
+		return OAuthSessionStateRejected
+	}
+	if o.DownstreamAccessToken != "" {
+		return OAuthSessionStateReady
+	}
+	if o.DownstreamAuthorizationCode != "" {
+		return OAuthSessionStateDownstream
+	}
+	if o.UpstreamDPoPPrivateJWK != "" {
+		return OAuthSessionStateUpstream
+	}
+	if o.DownstreamPARUsedAt != nil {
+		return OAuthSessionStatePARUsed
+	}
+	if o.DownstreamPARRequestURI != "" {
+		return OAuthSessionStatePARCreated
+	}
+	// todo: this should never happen, log a warning? panic?
+	return OAuthSessionStateRejected
 }
 
 // func (m *DBModel) CreateOAuthSession(session *OAuthSession) error {

pkg/oproxy/oauth_upstream.go

···
 	"context"
 	"encoding/json"
 	"fmt"
+	"net/http"
 	"net/url"
 	"time"
 
···
 	"github.com/bluesky-social/indigo/xrpc"
 	oauth "github.com/haileyok/atproto-oauth-golang"
 	"github.com/haileyok/atproto-oauth-golang/helpers"
+	"github.com/labstack/echo/v4"
 	"github.com/lestrrat-go/jwx/v2/jwk"
 	"stream.place/streamplace/pkg/config"
-	"stream.place/streamplace/pkg/log"
 	"stream.place/streamplace/pkg/model"
 )
 
-func Login(ctx context.Context, cli *config.CLI, downstreamPAR *model.PAR, mod model.Model) (string, error) {
-	meta := GetUpstreamMetadata("longos.iameli.link", "web", "")
+// downstream --> upstream transition; attempt to send user to the upstream auth server
+func (o *OProxy) Authorize(ctx context.Context, requestURI, clientID string) (string, error) {
+	downstreamMeta := o.GetDownstreamMetadata()
+	if downstreamMeta.ClientID != clientID {
+		return "", echo.NewHTTPError(http.StatusBadRequest, "client ID mismatch")
+	}
+
+	jkt, _, err := parseURN(requestURI)
+	if err != nil {
+		return "", echo.NewHTTPError(http.StatusBadRequest, err.Error())
+	}
+
+	session, err := o.loadOAuthSession(jkt)
+	if err != nil {
+		return "", echo.NewHTTPError(http.StatusBadRequest, err.Error())
+	}
+
+	if session == nil {
+		return "", echo.NewHTTPError(http.StatusBadRequest, "no session found")
+	}
+
+	if session.Status() != OAuthSessionStatePARCreated {
+		return "", echo.NewHTTPError(http.StatusBadRequest, "session is not in par-created state")
+	}
+
+	if session.DownstreamPARRequestURI != requestURI {
+		return "", echo.NewHTTPError(http.StatusBadRequest, "request URI mismatch")
+	}
+
+	now := time.Now()
+	session.DownstreamPARUsedAt = &now
+	err = o.updateOAuthSession(jkt, session)
+	if err != nil {
+		return "", echo.NewHTTPError(http.StatusInternalServerError, fmt.Sprintf("failed to update OAuth session: %s", err))
+	}
+
+	upstreamMeta := o.GetUpstreamMetadata()
 	oclient, err := oauth.NewClient(oauth.ClientArgs{
-		ClientJwk:   cli.JWK,
-		ClientId:    meta.ClientID,
-		RedirectUri: meta.RedirectURIs[0],
+		ClientJwk:   o.jwk,
+		ClientId:    upstreamMeta.ClientID,
+		RedirectUri: upstreamMeta.RedirectURIs[0],
 	})
-	log.Log(ctx, "OAuth client information", "clientId", meta.ClientID, "redirectUri", meta.RedirectURIs[0])
 	if err != nil {
-		return "", fmt.Errorf("failed to create OAuth client: %w", err)
+		return "", echo.NewHTTPError(http.StatusInternalServerError, fmt.Sprintf("failed to create OAuth client: %s", err))
 	}
 
-	// If you already have a did or a URL, you can skip this step
-	did, err := resolveHandle(ctx, downstreamPAR.LoginHint) // returns did:plc:abc123 or did:web:test.com
-	if err != nil {
-		return "", fmt.Errorf("failed to resolve handle '%s': %w", downstreamPAR.LoginHint, err)
-	}
+	// did, err := resolveHandle(ctx, session.DID)
+	// if err != nil {
+	// 	return "", echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("failed to resolve handle '%s': %s", session.DID, err))
+	// }
 
-	// If you already have a URL, you can skip this step
-	service, err := resolveService(ctx, did) // returns https://pds.haileyok.com
+	service, err := resolveService(ctx, session.DID)
 	if err != nil {
-		return "", fmt.Errorf("failed to resolve service for DID '%s': %w", did, err)
+		return "", echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("failed to resolve service for DID '%s': %s", session.DID, err))
 	}
 
 	authserver, err := oclient.ResolvePdsAuthServer(ctx, service)
 	if err != nil {
-		return "", fmt.Errorf("failed to resolve PDS auth server for service '%s': %w", service, err)
+		return "", echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("failed to resolve PDS auth server for service '%s': %s", service, err))
 	}
 
 	authmeta, err := oclient.FetchAuthServerMetadata(ctx, authserver)
 	if err != nil {
-		return "", fmt.Errorf("failed to fetch auth server metadata from '%s': %w", authserver, err)
+		return "", echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("failed to fetch auth server metadata from '%s': %s", authserver, err))
 	}
 
 	k, err := helpers.GenerateKey(nil)
 	if err != nil {
-		return "", fmt.Errorf("failed to generate DPoP key: %w", err)
+		return "", echo.NewHTTPError(http.StatusInternalServerError, fmt.Sprintf("failed to generate DPoP key: %s", err))
 	}
 
-	// b, err := json.Marshal(k)
-	// if err != nil {
-	// 	return "", err
-	// }
-
-	parResp, err := oclient.SendParAuthRequest(ctx, authserver, authmeta, downstreamPAR.LoginHint, meta.Scope, k)
+	parResp, err := oclient.SendParAuthRequest(ctx, authserver, authmeta, session.DID, upstreamMeta.Scope, k)
 	if err != nil {
-		return "", fmt.Errorf("failed to send PAR auth request to '%s': %w", authserver, err)
+		return "", echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("failed to send PAR auth request to '%s': %s", authserver, err))
 	}
 
-	log.Log(ctx, "parResp", "parResp", parResp)
-
 	jwkJSON, err := json.Marshal(k)
 	if err != nil {
 		return "", fmt.Errorf("failed to marshal DPoP key to JSON: %w", err)
···
 	if err != nil {
 		return "", fmt.Errorf("failed to parse auth server metadata: %w", err)
 	}
-	u.RawQuery = fmt.Sprintf("client_id=%s&request_uri=%s", url.QueryEscape(meta.ClientID), parResp.RequestUri)
+	u.RawQuery = fmt.Sprintf("client_id=%s&request_uri=%s", url.QueryEscape(upstreamMeta.ClientID), parResp.RequestUri)
 	str := u.String()
 
-	err = mod.CreateOAuthSession(&model.OAuthSession{
-		UpstreamState:            parResp.State,
-		RepoDID:                  did,
-		PDSUrl:                   service,
-		UpstreamAuthServerIssuer: authserver,
-		UpstreamPKCEVerifier:     parResp.PkceVerifier,
-		UpstreamDPoPNonce:        parResp.DpopAuthserverNonce,
-		UpstreamDPoPPrivateJWK:   jwkJSON,
-		DownstreamPARID:          downstreamPAR.ID,
-	})
+	session.DID = session.DID
+	session.PDSUrl = service
+	session.UpstreamState = parResp.State
+	session.UpstreamAuthServerIssuer = authserver
+	session.UpstreamPKCEVerifier = parResp.PkceVerifier
+	session.UpstreamDPoPNonce = parResp.DpopAuthserverNonce
+	session.UpstreamDPoPPrivateJWK = string(jwkJSON)
+
+	err = o.updateOAuthSession(jkt, session)
 	if err != nil {
-		return "", fmt.Errorf("failed to create OAuth session in database: %w", err)
+		return "", echo.NewHTTPError(http.StatusInternalServerError, fmt.Sprintf("failed to update OAuth session: %s", err))
 	}
 
 	return str, nil
 }
 
-func HandleOauthReturn(ctx context.Context, cli *config.CLI, code string, iss string, state string, mod model.Model) (*model.OAuthSession, error) {
+func Return(ctx context.Context, code string, iss string, state string) (*model.OAuthSession, error) {
 	meta := GetUpstreamMetadata("longos.iameli.link", "web", "")
 	oclient, err := oauth.NewClient(oauth.ClientArgs{
 		ClientJwk:   cli.JWK,

pkg/oproxy/oproxy.go

···
 package oproxy
 
-import "github.com/labstack/echo/v4"
+import (
+	"log/slog"
+	"os"
+
+	"github.com/labstack/echo/v4"
+	"github.com/lestrrat-go/jwx/v2/jwk"
+)
 
 type OProxy struct {
 	createOAuthSession func(id string, session *OAuthSession) error
···
 	e                  *echo.Echo
 	host               string
 	scope              string
+	jwk                jwk.Key
+	slog               *slog.Logger
 }
 
 type Config struct {
···
 	LoadOAuthSession   func(id string) (*OAuthSession, error)
 	Host               string
 	Scope              string
+	JWK                jwk.Key
+	Slog               *slog.Logger
 }
 
 func New(conf *Config) *OProxy {
 	e := echo.New()
+	mySlog := conf.Slog
+	if mySlog == nil {
+		mySlog = slog.New(slog.NewTextHandler(os.Stderr, nil))
+	}
 	return &OProxy{
 		createOAuthSession: conf.CreateOAuthSession,
 		updateOAuthSession: conf.UpdateOAuthSession,
···
 		e:                  e,
 		host:               conf.Host,
 		scope:              conf.Scope,
+		jwk:                conf.JWK,
 	}
 }