forked from tangled.org/core
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546package oauth
import ( "bytes" "context" "encoding/json" "fmt" "log" "net/http" "net/url" "slices" "strings" "time"
"github.com/go-chi/chi/v5" "github.com/gorilla/sessions" "github.com/lestrrat-go/jwx/v2/jwk" "github.com/posthog/posthog-go" "tangled.sh/icyphox.sh/atproto-oauth/helpers" tangled "tangled.sh/tangled.sh/core/api/tangled" sessioncache "tangled.sh/tangled.sh/core/appview/cache/session" "tangled.sh/tangled.sh/core/appview/config" "tangled.sh/tangled.sh/core/appview/db" "tangled.sh/tangled.sh/core/appview/middleware" "tangled.sh/tangled.sh/core/appview/oauth" "tangled.sh/tangled.sh/core/appview/oauth/client" "tangled.sh/tangled.sh/core/appview/pages" "tangled.sh/tangled.sh/core/idresolver" "tangled.sh/tangled.sh/core/rbac" "tangled.sh/tangled.sh/core/tid")
const ( oauthScope = "atproto transition:generic")
type OAuthHandler struct { config *config.Config pages *pages.Pages idResolver *idresolver.Resolver sess *sessioncache.SessionStore db *db.DB store *sessions.CookieStore oauth *oauth.OAuth enforcer *rbac.Enforcer posthog posthog.Client}
func New( config *config.Config, pages *pages.Pages, idResolver *idresolver.Resolver, db *db.DB, sess *sessioncache.SessionStore, store *sessions.CookieStore, oauth *oauth.OAuth, enforcer *rbac.Enforcer, posthog posthog.Client,) *OAuthHandler { return &OAuthHandler{ config: config, pages: pages, idResolver: idResolver, db: db, sess: sess, store: store, oauth: oauth, enforcer: enforcer, posthog: posthog, }}
func (o *OAuthHandler) Router() http.Handler { r := chi.NewRouter()
r.Get("/login", o.login) r.Post("/login", o.login)
r.With(middleware.AuthMiddleware(o.oauth)).Post("/logout", o.logout)
r.Get("/oauth/client-metadata.json", o.clientMetadata) r.Get("/oauth/jwks.json", o.jwks) r.Get("/oauth/callback", o.callback) return r}
func (o *OAuthHandler) clientMetadata(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "application/json") w.WriteHeader(http.StatusOK) json.NewEncoder(w).Encode(o.oauth.ClientMetadata())}
func (o *OAuthHandler) jwks(w http.ResponseWriter, r *http.Request) { jwks := o.config.OAuth.Jwks pubKey, err := pubKeyFromJwk(jwks) if err != nil { log.Printf("error parsing public key: %v", err) http.Error(w, err.Error(), http.StatusInternalServerError) return }
response := helpers.CreateJwksResponseObject(pubKey)
w.Header().Set("Content-Type", "application/json") w.WriteHeader(http.StatusOK) json.NewEncoder(w).Encode(response)}
func (o *OAuthHandler) login(w http.ResponseWriter, r *http.Request) { switch r.Method { case http.MethodGet: returnURL := r.URL.Query().Get("return_url") o.pages.Login(w, pages.LoginParams{ ReturnUrl: returnURL, }) case http.MethodPost: handle := r.FormValue("handle")
// when users copy their handle from bsky.app, it tends to have these characters around it: // // @nelind.dk: // \u202a ensures that the handle is always rendered left to right and // \u202c reverts that so the rest of the page renders however it should handle = strings.TrimPrefix(handle, "\u202a") handle = strings.TrimSuffix(handle, "\u202c")
// `@` is harmless handle = strings.TrimPrefix(handle, "@")
// basic handle validation if !strings.Contains(handle, ".") { log.Println("invalid handle format", "raw", handle) o.pages.Notice(w, "login-msg", fmt.Sprintf("\"%s\" is an invalid handle. Did you mean %s.bsky.social?", handle, handle)) return }
resolved, err := o.idResolver.ResolveIdent(r.Context(), handle) if err != nil { log.Println("failed to resolve handle:", err) o.pages.Notice(w, "login-msg", fmt.Sprintf("\"%s\" is an invalid handle.", handle)) return } self := o.oauth.ClientMetadata() oauthClient, err := client.NewClient( self.ClientID, o.config.OAuth.Jwks, self.RedirectURIs[0], )
if err != nil { log.Println("failed to create oauth client:", err) o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") return }
authServer, err := oauthClient.ResolvePdsAuthServer(r.Context(), resolved.PDSEndpoint()) if err != nil { log.Println("failed to resolve auth server:", err) o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") return }
authMeta, err := oauthClient.FetchAuthServerMetadata(r.Context(), authServer) if err != nil { log.Println("failed to fetch auth server metadata:", err) o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") return }
dpopKey, err := helpers.GenerateKey(nil) if err != nil { log.Println("failed to generate dpop key:", err) o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") return }
dpopKeyJson, err := json.Marshal(dpopKey) if err != nil { log.Println("failed to marshal dpop key:", err) o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") return }
parResp, err := oauthClient.SendParAuthRequest(r.Context(), authServer, authMeta, handle, oauthScope, dpopKey) if err != nil { log.Println("failed to send par auth request:", err) o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") return }
err = o.sess.SaveRequest(r.Context(), sessioncache.OAuthRequest{ Did: resolved.DID.String(), PdsUrl: resolved.PDSEndpoint(), Handle: handle, AuthserverIss: authMeta.Issuer, PkceVerifier: parResp.PkceVerifier, DpopAuthserverNonce: parResp.DpopAuthserverNonce, DpopPrivateJwk: string(dpopKeyJson), State: parResp.State, ReturnUrl: r.FormValue("return_url"), }) if err != nil { log.Println("failed to save oauth request:", err) o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") return }
u, _ := url.Parse(authMeta.AuthorizationEndpoint) query := url.Values{} query.Add("client_id", self.ClientID) query.Add("request_uri", parResp.RequestUri) u.RawQuery = query.Encode() o.pages.HxRedirect(w, u.String()) }}
func (o *OAuthHandler) callback(w http.ResponseWriter, r *http.Request) { state := r.FormValue("state")
oauthRequest, err := o.sess.GetRequestByState(r.Context(), state) if err != nil { log.Println("failed to get oauth request:", err) o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") return }
defer func() { err := o.sess.DeleteRequestByState(r.Context(), state) if err != nil { log.Println("failed to delete oauth request for state:", state, err) } }()
error := r.FormValue("error") errorDescription := r.FormValue("error_description") if error != "" || errorDescription != "" { log.Printf("error: %s, %s", error, errorDescription) o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") return }
code := r.FormValue("code") if code == "" { log.Println("missing code for state: ", state) o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") return }
iss := r.FormValue("iss") if iss == "" { log.Println("missing iss for state: ", state) o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") return }
if iss != oauthRequest.AuthserverIss { log.Println("mismatched iss:", iss, "!=", oauthRequest.AuthserverIss, "for state:", state) o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") return }
self := o.oauth.ClientMetadata()
oauthClient, err := client.NewClient( self.ClientID, o.config.OAuth.Jwks, self.RedirectURIs[0], )
if err != nil { log.Println("failed to create oauth client:", err) o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") return }
jwk, err := helpers.ParseJWKFromBytes([]byte(oauthRequest.DpopPrivateJwk)) if err != nil { log.Println("failed to parse jwk:", err) o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") return }
tokenResp, err := oauthClient.InitialTokenRequest( r.Context(), code, oauthRequest.AuthserverIss, oauthRequest.PkceVerifier, oauthRequest.DpopAuthserverNonce, jwk, ) if err != nil { log.Println("failed to get token:", err) o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") return }
if tokenResp.Scope != oauthScope { log.Println("scope doesn't match:", tokenResp.Scope) o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") return }
err = o.oauth.SaveSession(w, r, *oauthRequest, tokenResp) if err != nil { log.Println("failed to save session:", err) o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") return }
log.Println("session saved successfully") go o.addToDefaultKnot(oauthRequest.Did) go o.addToDefaultSpindle(oauthRequest.Did)
if !o.config.Core.Dev { err = o.posthog.Enqueue(posthog.Capture{ DistinctId: oauthRequest.Did, Event: "signin", }) if err != nil { log.Println("failed to enqueue posthog event:", err) } }
returnUrl := oauthRequest.ReturnUrl if returnUrl == "" { returnUrl = "/" }
http.Redirect(w, r, returnUrl, http.StatusFound)}
func (o *OAuthHandler) logout(w http.ResponseWriter, r *http.Request) { err := o.oauth.ClearSession(r, w) if err != nil { log.Println("failed to clear session:", err) http.Redirect(w, r, "/", http.StatusFound) return }
log.Println("session cleared successfully") o.pages.HxRedirect(w, "/login")}
func pubKeyFromJwk(jwks string) (jwk.Key, error) { k, err := helpers.ParseJWKFromBytes([]byte(jwks)) if err != nil { return nil, err } pubKey, err := k.PublicKey() if err != nil { return nil, err } return pubKey, nil}
var ( tangledDid = "did:plc:wshs7t2adsemcrrd4snkeqli" icyDid = "did:plc:hwevmowznbiukdf6uk5dwrrq"
defaultSpindle = "spindle.tangled.sh" defaultKnot = "knot1.tangled.sh")
func (o *OAuthHandler) addToDefaultSpindle(did string) { // use the tangled.sh app password to get an accessJwt // and create an sh.tangled.spindle.member record with that spindleMembers, err := db.GetSpindleMembers( o.db, db.FilterEq("instance", "spindle.tangled.sh"), db.FilterEq("subject", did), ) if err != nil { log.Printf("failed to get spindle members for did %s: %v", did, err) return }
if len(spindleMembers) != 0 { log.Printf("did %s is already a member of the default spindle", did) return }
log.Printf("adding %s to default spindle", did) session, err := o.createAppPasswordSession(o.config.Core.AppPassword, tangledDid) if err != nil { log.Printf("failed to create session: %s", err) return }
record := tangled.SpindleMember{ LexiconTypeID: "sh.tangled.spindle.member", Subject: did, Instance: defaultSpindle, CreatedAt: time.Now().Format(time.RFC3339), }
if err := session.putRecord(record, tangled.SpindleMemberNSID); err != nil { log.Printf("failed to add member to default spindle: %s", err) return }
log.Printf("successfully added %s to default spindle", did)}
func (o *OAuthHandler) addToDefaultKnot(did string) { // use the tangled.sh app password to get an accessJwt // and create an sh.tangled.spindle.member record with that
allKnots, err := o.enforcer.GetKnotsForUser(did) if err != nil { log.Printf("failed to get knot members for did %s: %v", did, err) return }
if slices.Contains(allKnots, defaultKnot) { log.Printf("did %s is already a member of the default knot", did) return }
log.Printf("adding %s to default knot", did) session, err := o.createAppPasswordSession(o.config.Core.TmpAltAppPassword, icyDid) if err != nil { log.Printf("failed to create session: %s", err) return }
record := tangled.KnotMember{ LexiconTypeID: "sh.tangled.knot.member", Subject: did, Domain: defaultKnot, CreatedAt: time.Now().Format(time.RFC3339), }
if err := session.putRecord(record, tangled.KnotMemberNSID); err != nil { log.Printf("failed to add member to default knot: %s", err) return }
if err := o.enforcer.AddKnotMember(defaultKnot, did); err != nil { log.Printf("failed to set up enforcer rules: %s", err) return }
log.Printf("successfully added %s to default Knot", did)}
// create a session using apppasswordstype session struct { AccessJwt string `json:"accessJwt"` PdsEndpoint string Did string}
func (o *OAuthHandler) createAppPasswordSession(appPassword, did string) (*session, error) { if appPassword == "" { return nil, fmt.Errorf("no app password configured, skipping member addition") }
resolved, err := o.idResolver.ResolveIdent(context.Background(), did) if err != nil { return nil, fmt.Errorf("failed to resolve tangled.sh DID %s: %v", did, err) }
pdsEndpoint := resolved.PDSEndpoint() if pdsEndpoint == "" { return nil, fmt.Errorf("no PDS endpoint found for tangled.sh DID %s", did) }
sessionPayload := map[string]string{ "identifier": did, "password": appPassword, } sessionBytes, err := json.Marshal(sessionPayload) if err != nil { return nil, fmt.Errorf("failed to marshal session payload: %v", err) }
sessionURL := pdsEndpoint + "/xrpc/com.atproto.server.createSession" sessionReq, err := http.NewRequestWithContext(context.Background(), "POST", sessionURL, bytes.NewBuffer(sessionBytes)) if err != nil { return nil, fmt.Errorf("failed to create session request: %v", err) } sessionReq.Header.Set("Content-Type", "application/json")
client := &http.Client{Timeout: 30 * time.Second} sessionResp, err := client.Do(sessionReq) if err != nil { return nil, fmt.Errorf("failed to create session: %v", err) } defer sessionResp.Body.Close()
if sessionResp.StatusCode != http.StatusOK { return nil, fmt.Errorf("failed to create session: HTTP %d", sessionResp.StatusCode) }
var session session if err := json.NewDecoder(sessionResp.Body).Decode(&session); err != nil { return nil, fmt.Errorf("failed to decode session response: %v", err) }
session.PdsEndpoint = pdsEndpoint session.Did = did
return &session, nil}
func (s *session) putRecord(record any, collection string) error { recordBytes, err := json.Marshal(record) if err != nil { return fmt.Errorf("failed to marshal knot member record: %w", err) }
payload := map[string]any{ "repo": s.Did, "collection": collection, "rkey": tid.TID(), "record": json.RawMessage(recordBytes), }
payloadBytes, err := json.Marshal(payload) if err != nil { return fmt.Errorf("failed to marshal request payload: %w", err) }
url := s.PdsEndpoint + "/xrpc/com.atproto.repo.putRecord" req, err := http.NewRequestWithContext(context.Background(), "POST", url, bytes.NewBuffer(payloadBytes)) if err != nil { return fmt.Errorf("failed to create HTTP request: %w", err) }
req.Header.Set("Content-Type", "application/json") req.Header.Set("Authorization", "Bearer "+s.AccessJwt)
client := &http.Client{Timeout: 30 * time.Second} resp, err := client.Do(req) if err != nil { return fmt.Errorf("failed to add user to default service: %w", err) } defer resp.Body.Close()
if resp.StatusCode != http.StatusOK { return fmt.Errorf("failed to add user to default service: HTTP %d", resp.StatusCode) }
return nil}