138 lines
3.0 KiB
Go
138 lines
3.0 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"log"
|
|
"net/http"
|
|
"net/url"
|
|
"slices"
|
|
"time"
|
|
|
|
"github.com/coreos/go-oidc/v3/oidc"
|
|
"golang.org/x/oauth2"
|
|
"tomatentum.net/outfit-voting-abi26/internal/util"
|
|
)
|
|
|
|
var (
|
|
provider *oidc.Provider
|
|
verifier *oidc.IDTokenVerifier
|
|
config oauth2.Config
|
|
ctx context.Context
|
|
authCookie string = "outfit-voting-abi26-auth"
|
|
)
|
|
|
|
func IssuerBaseURL() string {
|
|
urlstring := provider.Endpoint().AuthURL
|
|
|
|
url, err := url.Parse(urlstring)
|
|
if err != nil {
|
|
return ""
|
|
}
|
|
url.Path = "/"
|
|
return url.String()
|
|
}
|
|
|
|
func InitProvider(issuer, id, secret, redirect string) error {
|
|
ctx = context.Background()
|
|
var err error
|
|
provider, err = oidc.NewProvider(ctx, issuer)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
verifier = provider.Verifier(&oidc.Config{
|
|
ClientID: id,
|
|
})
|
|
|
|
config = oauth2.Config{
|
|
ClientID: id,
|
|
ClientSecret: secret,
|
|
Endpoint: provider.Endpoint(),
|
|
RedirectURL: redirect,
|
|
Scopes: []string{oidc.ScopeOpenID, "profile", "email"},
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func GetToken(code string) (*oidc.IDToken, error) {
|
|
token, err := config.Exchange(ctx, code)
|
|
|
|
if err != nil {
|
|
return &oidc.IDToken{}, err
|
|
}
|
|
|
|
rawToken, ok := token.Extra("id_token").(string)
|
|
|
|
if !ok {
|
|
return &oidc.IDToken{}, errors.New("id_token missing")
|
|
}
|
|
|
|
return verifier.Verify(ctx, rawToken)
|
|
}
|
|
|
|
func Redirect(w http.ResponseWriter, r *http.Request) {
|
|
state, nonce := setCookies(w, r)
|
|
AddRedirect(state, r.RequestURI)
|
|
|
|
url := config.AuthCodeURL(state, oidc.Nonce(nonce))
|
|
http.Redirect(w, r, url, http.StatusFound)
|
|
}
|
|
|
|
func CheckState(r *http.Request) error {
|
|
cookie, err := r.Cookie("state")
|
|
if err != nil {
|
|
return errors.Join(err, errors.New("State not found"))
|
|
}
|
|
log.Printf("DEBUG: statecookie: %s, statequery: %s\n", cookie.Value, r.URL.Query().Get("state"))
|
|
if r.URL.Query().Get("state") != cookie.Value {
|
|
return errors.New("State did not match")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func CheckNonce(r *http.Request, idtoken *oidc.IDToken) error {
|
|
cookie, err := r.Cookie("nonce")
|
|
if err != nil {
|
|
return errors.Join(err, errors.New("Nonce not found"))
|
|
}
|
|
if idtoken.Nonce != cookie.Value {
|
|
return errors.New("Nonce did not match")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func CheckAudience(idtoken *oidc.IDToken) error {
|
|
if !slices.Contains(idtoken.Audience, config.ClientID) {
|
|
return errors.New("Audience does not match")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func setCookies(w http.ResponseWriter, r *http.Request) (state, nonce string) {
|
|
state, err := util.RandString(16)
|
|
if err != nil {
|
|
http.Error(w, "Internal error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
nonce, err = util.RandString(16)
|
|
if err != nil {
|
|
http.Error(w, "Internal error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
setCallbackCookie(w, r, "state", state)
|
|
setCallbackCookie(w, r, "nonce", nonce)
|
|
|
|
return state, nonce
|
|
}
|
|
|
|
func setCallbackCookie(w http.ResponseWriter, r *http.Request, name, value string) {
|
|
c := &http.Cookie{
|
|
Name: name,
|
|
Value: value,
|
|
MaxAge: int(time.Hour.Seconds()),
|
|
Secure: r.TLS != nil,
|
|
HttpOnly: true,
|
|
}
|
|
http.SetCookie(w, c)
|
|
}
|