Something went wrong. Try again.
A community based topic aggregation platform built on atproto
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532package testkit
import ( "bytes" "context" "encoding/json" "errors" "fmt" "io" "net/http" "net/http/cookiejar" "net/url" "regexp" "slices" "strconv" "strings" "time")
// Headless OAuth web sign-in.//// WHY THIS EXISTS//// RequireAuth accepts one credential: a sealed token naming a row in the// AppView's OAuth session store, and the only thing that issues one is// /oauth/callback at the end of a real authorization-code flow. T2 may not// write to the AppView's database, so it has no other way to get a session// than to do what a browser does: start at /oauth/login, sign in and consent at// the PDS' authorization server, and hand the resulting code to the callback.// SignIn is that browser, minus the browser.//// WHAT IT DEPENDS ON//// The PDS side is not an XRPC API. It is the JSON API behind the sign-in page of// @atproto/oauth-provider (the ~api/sign-in and ~api/consent endpoints), which// is an implementation detail of the provider's UI, pinned here by the PDS image// in docker-compose.ci.yml (last verified against pds:0.4.5027). Its checks are// what shape the requests below: the authorize page must be loaded as a// top-level navigation to bind a device, and the API calls must look// same-origin (Origin, Referer and Sec-Fetch-* headers) and carry the// double-submit CSRF token the page set. A PDS upgrade that changes that UI// breaks this helper, and the fix belongs here.//// WHAT IT NEVER DOES//// It follows no redirect on its own: each hop is a step whose answer is checked,// so a failure names the step instead of surfacing as a confusing final page.// Its errors start with that step and carry the HTTP status, the provider's// error code and description, a redirect's path but never its query, and// transport errors. Secrecy is enforced by value at one point, where SignInE// returns: every secret the flow handled — the password, the ephemeral token,// the request_uri, the authorization code and state, and every cookie value// either side set, the sealed session included — is scrubbed from the message.
// oauthProviderAPIPrefix is where @atproto/oauth-provider mounts its UI's API.const oauthProviderAPIPrefix = "/@atproto/oauth-provider/~api"
// signInTimeout bounds SignIn as a whole. The flow is five requests against// local services, or six when a dev-mode AppView first canonicalizes the login// host; a minute is ample on a loaded CI machine and still fails a hung PDS well// inside the go test timeout.const signInTimeout = 60 * time.Second
// maxProviderDescription caps how much of a provider's error_description an// error repeats.const maxProviderDescription = 200
// redactedSecret stands in for a secret wherever an error would have quoted it.const redactedSecret = "[redacted]"
// oauthErrorCode matches what an OAuth error code looks like, a first filter on// what reaches a test log. It is a shape check only: secrecy comes from// scrubbing.var oauthErrorCode = regexp.MustCompile(`^[A-Za-z0-9_.-]{1,64}$`)
// signInFlow is the state of one sign-in: the two sides' cookies, the// addresses each later step must reuse, and the secrets handled so far.type signInFlow struct { appView *AppView // appViewOrigin is where the flow's AppView requests go. It starts as the // client's base URL and moves if /oauth/login canonicalizes the host, // because the binding cookie it sets is host-only. appViewOrigin string // appViewHTTP keeps a fresh cookie jar for the AppView side, so the // host-only, /oauth-scoped binding cookie reaches the callback exactly as // a browser would send it. appViewHTTP *http.Client
pdsHTTP *http.Client // pdsCookies is a name→value map rather than a cookiejar: the provider // marks csrf-token Secure, and net/http/cookiejar will not send a Secure // cookie over the plain-http address the stack's PDS listens on. pdsCookies map[string]string authorizeURL string issuer string
// secrets holds every secret value the flow has handled, raw and // query-escaped, for scrubbing out of errors. secrets []string}
// SignIn runs the real OAuth web login for account against this AppView and// returns the sealed session token, usable with As. Fatal on failure.func (a *AppView) SignIn(t TestingT, account *Account) string { t.Helper() ctx, cancel := context.WithTimeout(context.Background(), signInTimeout) defer cancel() token, err := a.SignInE(ctx, account.Handle, account.Password) if err != nil { t.Fatalf("testkit: signing %s in through the AppView's OAuth web flow: %v", account.Handle, err) } return token}
// SignInE is the error-returning form of SignIn. Its error is scrubbed of every// secret the flow handled; errors.Is still recognizes the context's deadline or// cancellation through it.func (a *AppView) SignInE(ctx context.Context, handle, password string) (string, error) { flow, err := a.newSignInFlow() if err != nil { return "", err } flow.remember(password) token, err := flow.run(ctx, handle, password) if err != nil { return "", flow.scrub(err) } return token, nil}
func (a *AppView) newSignInFlow() (*signInFlow, error) { jar, err := cookiejar.New(nil) if err != nil { return nil, fmt.Errorf("sign-in: creating cookie jar: %w", err) } transport := a.HTTP.Transport if transport == nil { transport = http.DefaultTransport } guarded := locationGuard{next: transport} noRedirects := func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse } return &signInFlow{ appView: a, appViewOrigin: a.BaseURL, appViewHTTP: &http.Client{Transport: guarded, Timeout: a.HTTP.Timeout, Jar: jar, CheckRedirect: noRedirects}, pdsHTTP: &http.Client{Transport: guarded, Timeout: a.HTTP.Timeout, CheckRedirect: noRedirects}, pdsCookies: map[string]string{}, }, nil}
// run is the flow itself. Its errors are not yet scrubbed; SignInE does that.func (f *signInFlow) run(ctx context.Context, handle, password string) (string, error) { authorizeURL, err := f.startLogin(ctx, handle) if err != nil { return "", err } if err := f.loadAuthorizePage(ctx, authorizeURL); err != nil { return "", err }
var signIn struct { Account struct { DID string `json:"did"` } `json:"account"` EphemeralToken string `json:"ephemeralToken"` } err = f.callProviderAPI(ctx, "sign-in", map[string]any{ "locale": "en", "username": handle, "password": password, "remember": false, }, "", &signIn) if err != nil { return "", err } f.remember(signIn.EphemeralToken) if signIn.Account.DID == "" || signIn.EphemeralToken == "" { return "", errors.New("pds sign-in: response carried no account.did or no ephemeralToken") }
// Consent answers with the URL the provider would send the browser to. It // carries exactly the parameters the AppView's callback receives, so it is // read, never fetched. var consent struct { URL string `json:"url"` } if err := f.callProviderAPI(ctx, "consent", map[string]any{"did": signIn.Account.DID}, signIn.EphemeralToken, &consent); err != nil { return "", err } authorization, err := url.Parse(consent.URL) if err != nil || consent.URL == "" { return "", errors.New("pds consent: response carried no parseable redirect url") } query := authorization.Query() f.remember(query.Get("code"), query.Get("state")) if code := query.Get("error"); code != "" { return "", fmt.Errorf("pds consent: authorization refused with %s", sanitizeOAuthError(code)) } callback := url.Values{} for _, name := range []string{"code", "state", "iss"} { if query.Get(name) == "" { return "", fmt.Errorf("pds consent: redirect url carried no %s", name) } callback.Set(name, query.Get(name)) }
return f.completeCallback(ctx, callback)}
// startLogin requests /oauth/login and returns the PDS authorize URL it// redirects to. A dev-mode AppView reached under a host other than the one in// its configured public URL first redirects to /oauth/login on the public URL's// host; that one hop is taken.func (f *signInFlow) startLogin(ctx context.Context, handle string) (string, error) { target := f.appViewOrigin + "/oauth/login?" + url.Values{"handle": {handle}}.Encode() for hop := 0; hop < 2; hop++ { resp, err := f.appViewRequest(ctx, "appview login", target) if err != nil { return "", err } location, err := redirectLocation("appview login", resp) if err != nil { return "", err } switch location.Path { case "/oauth/authorize": return location.String(), nil case "/oauth/login": f.appViewOrigin = location.Scheme + "://" + location.Host target = location.String() case "/login": return "", fmt.Errorf("appview login: redirected to the login page with %s", sanitizeOAuthError(location.Query().Get("error"))) default: return "", fmt.Errorf("appview login: redirected to unexpected path %q", location.Path) } } return "", errors.New("appview login: redirected to /oauth/login more than once")}
// loadAuthorizePage loads the PDS authorize page as a top-level navigation,// which binds the pending authorization request to a new device session.func (f *signInFlow) loadAuthorizePage(ctx context.Context, authorizeURL string) error { parsed, err := url.Parse(authorizeURL) if err != nil { return errors.New("pds authorize: redirect location is not a URL") } f.remember(parsed.Query().Get("request_uri")) f.authorizeURL = authorizeURL f.issuer = parsed.Scheme + "://" + parsed.Host
req, err := http.NewRequestWithContext(ctx, http.MethodGet, authorizeURL, nil) if err != nil { return errors.New("pds authorize: building request failed") } req.Header.Set("Accept", "text/html") req.Header.Set("Sec-Fetch-Mode", "navigate") req.Header.Set("Sec-Fetch-Dest", "document") req.Header.Set("Sec-Fetch-Site", "cross-site") resp, err := send(f.pdsHTTP, req, "pds authorize") if err != nil { return err } defer drainAndClose(resp) // Absorb before the status check: a refusal's cookies must be remembered // before its body can echo them into the error. f.absorbPDSCookies(resp) if resp.StatusCode != http.StatusOK { return fmt.Errorf("pds authorize: HTTP %d%s", resp.StatusCode, f.providerErrorSuffix(resp)) } // The provider's CSRF check is double-submit: the header must equal the // cookie the page set, so a page that set none is a failure here. var missing []string for _, name := range []string{"dev-id", "ses-id", "csrf-token"} { if f.pdsCookies[name] == "" { missing = append(missing, name) } } if len(missing) > 0 { return fmt.Errorf("pds authorize: page set no %s cookie", strings.Join(missing, ", ")) } return nil}
// callProviderAPI POSTs in to the provider UI's endpoint, as the sign-in page's// own script would, and decodes a 200 answer into out.func (f *signInFlow) callProviderAPI(ctx context.Context, endpoint string, in any, bearer string, out any) error { step := "pds " + endpoint body, err := json.Marshal(in) if err != nil { return fmt.Errorf("%s: encoding request failed", step) } req, err := http.NewRequestWithContext(ctx, http.MethodPost, f.issuer+oauthProviderAPIPrefix+"/"+endpoint, bytes.NewReader(body)) if err != nil { return fmt.Errorf("%s: building request failed", step) } req.Header.Set("Content-Type", "application/json") req.Header.Set("Accept", "application/json") req.Header.Set("Origin", f.issuer) req.Header.Set("Referer", f.authorizeURL) req.Header.Set("Sec-Fetch-Mode", "same-origin") req.Header.Set("Sec-Fetch-Site", "same-origin") req.Header.Set("Sec-Fetch-Dest", "empty") req.Header.Set("X-CSRF-Token", f.pdsCookies["csrf-token"]) if bearer != "" { req.Header.Set("Authorization", "Bearer "+bearer) } for name, value := range f.pdsCookies { req.AddCookie(&http.Cookie{Name: name, Value: value}) } resp, err := send(f.pdsHTTP, req, step) if err != nil { return err } defer drainAndClose(resp) // Sign-in rotates ses-id; consent must present the rotated one. Absorb // before the status check so a refusal's cookies are remembered before its // body can echo them into the error. f.absorbPDSCookies(resp) if resp.StatusCode != http.StatusOK { return fmt.Errorf("%s: HTTP %d%s", step, resp.StatusCode, f.providerErrorSuffix(resp)) } // maxErrorBody bounds this success body too; the provider's answers are small. if err := json.NewDecoder(io.LimitReader(resp.Body, maxErrorBody)).Decode(out); err != nil { return fmt.Errorf("%s: response (Content-Type %q) is not the expected JSON: %w", step, resp.Header.Get("Content-Type"), err) } return nil}
// completeCallback hands the authorization response to the AppView's callback// and returns the sealed session it set. A callback that answers without// setting coves_session failed, whatever its status says.func (f *signInFlow) completeCallback(ctx context.Context, params url.Values) (string, error) { resp, err := f.appViewRequest(ctx, "appview callback", f.appViewOrigin+"/oauth/callback?"+params.Encode()) if err != nil { return "", err } for _, cookie := range resp.Cookies() { if cookie.Name == "coves_session" && cookie.Value != "" && cookie.MaxAge >= 0 { return cookie.Value, nil } } if location, err := resp.Location(); err == nil && location.Path == "/login" { return "", fmt.Errorf("appview callback: HTTP %d, redirected to the login page with %s", resp.StatusCode, sanitizeOAuthError(location.Query().Get("error"))) } return "", fmt.Errorf("appview callback: HTTP %d without setting coves_session", resp.StatusCode)}
// appViewRequest GETs target with the flow's AppView cookie jar and the// client's headers, which is how the client IP reaches the AppView: login and// callback share a rate limiter keyed on it. The body is drained and closed;// callers read only the status, Location and cookies.func (f *signInFlow) appViewRequest(ctx context.Context, step, target string) (*http.Response, error) { req, err := http.NewRequestWithContext(ctx, http.MethodGet, target, nil) if err != nil { return nil, fmt.Errorf("%s: building request failed", step) } for name, values := range f.appView.Headers { for _, value := range values { req.Header.Add(name, value) } } resp, err := send(f.appViewHTTP, req, step) if err != nil { return nil, err } drainAndClose(resp) for _, cookie := range resp.Cookies() { f.remember(cookie.Value) } if resp.StatusCode == http.StatusTooManyRequests { return nil, fmt.Errorf("%s: HTTP 429, rate limited by the AppView's OAuth login limiter "+ "(10 per minute per client IP; each sign-in spends two or three)", step) } return resp, nil}
func (f *signInFlow) absorbPDSCookies(resp *http.Response) { for _, cookie := range resp.Cookies() { f.remember(cookie.Value) if cookie.MaxAge < 0 || cookie.Value == "" { delete(f.pdsCookies, cookie.Name) continue } f.pdsCookies[cookie.Name] = cookie.Value }}
// providerErrorSuffix reads an OAuth-style {"error", "error_description"} body// and returns both for an error message. The description is free text that// can echo the request, so it is scrubbed before it is cut to// maxProviderDescription bytes, which keeps a cut from splitting a secret.func (f *signInFlow) providerErrorSuffix(resp *http.Response) string { var envelope struct { Error string `json:"error"` Description string `json:"error_description"` } if err := json.NewDecoder(io.LimitReader(resp.Body, maxErrorBody)).Decode(&envelope); err != nil || envelope.Error == "" { return "" } suffix := " " + sanitizeOAuthError(envelope.Error) if description := f.scrubText(envelope.Description); description != "" { if len(description) > maxProviderDescription { description = strings.ToValidUTF8(description[:maxProviderDescription], "") + "…" } suffix += ": " + description } return suffix}
// remember records secret values the flow has handled, so scrub can remove// them from errors: each raw, query-escaped, and as %q would write it (the// strconv.Quote form without its outer quotes, kept only when quoting changed// the value), so a secret formatted with %q is caught too.func (f *signInFlow) remember(values ...string) { for _, value := range values { if value != "" { f.secrets = append(f.secrets, value, url.QueryEscape(value)) if quoted := strconv.Quote(value); quoted[1:len(quoted)-1] != value { f.secrets = append(f.secrets, quoted[1:len(quoted)-1]) } } }}
// scrubText replaces every remembered form of every secret in text with// redactedSecret.func (f *signInFlow) scrubText(text string) string { secrets := slices.Clone(f.secrets) // Longest first, so a secret that contains another is replaced whole. slices.SortFunc(secrets, func(a, b string) int { return len(b) - len(a) }) for _, secret := range secrets { text = strings.ReplaceAll(text, secret, redactedSecret) } return text}
// scrub is the flow's one secrecy choke point: it returns err's message with// every remembered secret removed, in raw, query-escaped and %q-quoted form.func (f *signInFlow) scrub(err error) error { scrubbed := &signInError{message: f.scrubText(err.Error())} for _, contextErr := range []error{context.DeadlineExceeded, context.Canceled} { if errors.Is(err, contextErr) { scrubbed.contextErr = contextErr break } } return scrubbed}
// signInError is a scrubbed sign-in failure. It unwraps only to the context's// error, so errors.Is still sees a deadline or cancellation while no unscrubbed// message stays reachable through it.type signInError struct { message string contextErr error}
func (e *signInError) Error() string { return e.message }
func (e *signInError) Unwrap() error { return e.contextErr }
// locationGuard drops a Location header that does not parse as a URL// reference. net/http parses Location before CheckRedirect can stop the// redirect and, when that fails, returns an error quoting the raw header,// query and all — text the flow has never seen and so cannot scrub. Without// the header the client returns the response, and redirectLocation reports a// redirect without a usable Location.type locationGuard struct { next http.RoundTripper}
func (g locationGuard) RoundTrip(req *http.Request) (*http.Response, error) { resp, err := g.next.RoundTrip(req) if err != nil { return nil, err } if location := resp.Header.Get("Location"); location != "" { if _, err := req.URL.Parse(location); err != nil { resp.Header.Del("Location") } } return resp, nil}
// send performs req, unwrapping *url.Error: its message quotes the full request// URL, and the callback's query string holds the authorization code.func send(client *http.Client, req *http.Request, step string) (*http.Response, error) { resp, err := client.Do(req) if err != nil { var urlErr *url.Error if errors.As(err, &urlErr) { err = urlErr.Err } return nil, fmt.Errorf("%s: %w", step, err) } return resp, nil}
// redirectLocation requires resp to be a redirect and returns where it points.// The Location itself stays out of the error: its query can carry anything.func redirectLocation(step string, resp *http.Response) (*url.URL, error) { if resp.StatusCode < 300 || resp.StatusCode >= 400 { return nil, fmt.Errorf("%s: HTTP %d, expected a redirect", step, resp.StatusCode) } location, err := resp.Location() if err != nil { return nil, fmt.Errorf("%s: HTTP %d redirect without a usable Location", step, resp.StatusCode) } return location, nil}
// sanitizeOAuthError renders an OAuth error code for a message, or says there// was none worth repeating.func sanitizeOAuthError(code string) string { switch { case code == "": return "no error code" case oauthErrorCode.MatchString(code): return "error " + code default: return "an unrecognized error code" }}
// drainAndClose discards what is left of a body, bounded, so the connection can// be reused, then closes it.func drainAndClose(resp *http.Response) { _, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, maxErrorBody)) _ = resp.Body.Close()}