Something went wrong. Try again.
Monorepo for Tangled tangled.org
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584package oauth
import ( "bytes" "context" "encoding/json" "errors" "fmt" "io" "log/slog" "net/http" "strings" "time"
comatproto "github.com/bluesky-social/indigo/api/atproto" "github.com/bluesky-social/indigo/atproto/auth/oauth" "github.com/bluesky-social/indigo/atproto/syntax" lexutil "github.com/bluesky-social/indigo/lex/util" xrpc "github.com/bluesky-social/indigo/xrpc" "github.com/go-chi/chi/v5" "github.com/posthog/posthog-go" "tangled.org/core/api/tangled" "tangled.org/core/appview/db" "tangled.org/core/appview/knotcompat" "tangled.org/core/appview/models" "tangled.org/core/consts" "tangled.org/core/idresolver" "tangled.org/core/tid" "tangled.org/core/xrpc/serviceauth")
const knotAdminTimeout = 30 * time.Second
func (o *OAuth) Router() http.Handler { r := chi.NewRouter()
r.Get("/oauth/client-metadata.json", o.clientMetadata) r.Get("/oauth/jwks.json", o.jwks) r.Get("/oauth/callback", o.callback) return r}
func (o *OAuth) clientMetadata(w http.ResponseWriter, r *http.Request) { doc := o.ClientApp.Config.ClientMetadata() doc.JWKSURI = &o.JwksUri doc.ClientName = &o.ClientName doc.ClientURI = &o.ClientUri doc.Scope = doc.Scope + " identity:handle"
w.Header().Set("Content-Type", "application/json") if err := json.NewEncoder(w).Encode(doc); err != nil { http.Error(w, err.Error(), http.StatusInternalServerError) return }}
func (o *OAuth) jwks(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "application/json") body := o.ClientApp.Config.PublicJWKS() if err := json.NewEncoder(w).Encode(body); err != nil { http.Error(w, err.Error(), http.StatusInternalServerError) return }}
func (o *OAuth) callback(w http.ResponseWriter, r *http.Request) { ctx := r.Context() l := o.Logger.With("query", r.URL.Query())
redirectURL := o.GetAuthReturn(r) _ = o.ClearAuthReturn(w, r)
sessData, err := o.ClientApp.ProcessCallback(ctx, r.URL.Query()) if err != nil { var callbackErr *oauth.AuthRequestCallbackError if errors.As(err, &callbackErr) { l.Debug("callback error", "err", callbackErr) http.Redirect(w, r, fmt.Sprintf("/login?error=%s", callbackErr.ErrorCode), http.StatusFound) return } l.Error("failed to process callback", "err", err) http.Redirect(w, r, "/login?error=oauth", http.StatusFound) return }
if err := o.SaveSession(w, r, sessData); err != nil { l.Error("failed to save session", "data", sessData, "err", err) errorCode := "session" if errors.Is(err, ErrMaxAccountsReached) { errorCode = "max_accounts" } http.Redirect(w, r, fmt.Sprintf("/login?error=%s", errorCode), http.StatusFound) return }
o.Logger.Debug("session saved successfully")
did := sessData.AccountDID.String()
// default to true, so users don't have to onboard again isTangledUser, err := db.IsTangledUser(o.Db, did) if err != nil { isTangledUser = true }
isNewUser := !isTangledUser if isNewUser { if ob, _ := db.GetOnboarding(o.Db, did); ob == nil { if err := db.UpsertOnboarding(o.Db, &models.Onboarding{ Did: did, Step: models.OnboardingStepProfile, Status: models.OnboardingInProgress, }); err != nil { o.Logger.Error("failed to seed onboarding record", "did", did, "err", err) } } }
o.ensureProfileRecord(sessData.AccountDID, sessData.SessionID)
go o.addToDefaultKnot(sessData.AccountDID, sessData.SessionID) go o.autoClaimTnglShDomain(sessData.AccountDID.String())
if !o.Config.Core.Dev { err = o.Posthog.Enqueue(posthog.Capture{ DistinctId: sessData.AccountDID.String(), Event: "signin", }) if err != nil { o.Logger.Error("failed to enqueue posthog event", "err", err) } }
if redirectURL == "" { redirectURL = "/" }
if o.isAccountDeactivated(sessData) { redirectURL = "/settings/profile" } else if isNewUser { redirectURL = "/welcome" }
http.Redirect(w, r, redirectURL, http.StatusFound)}
func (o *OAuth) isAccountDeactivated(sessData *oauth.ClientSessionData) bool { pdsClient := &xrpc.Client{ Host: sessData.HostURL, Client: &http.Client{Timeout: 5 * time.Second}, }
_, err := comatproto.RepoDescribeRepo( context.Background(), pdsClient, sessData.AccountDID.String(), ) if err == nil { return false }
var xrpcErr *xrpc.Error var xrpcBody *xrpc.XRPCError return errors.As(err, &xrpcErr) && errors.As(xrpcErr.Wrapped, &xrpcBody) && xrpcBody.ErrStr == "RepoDeactivated"}
type onboardAction int
const ( onboardViaAdminAPI onboardAction = iota onboardViaRecord onboardBlockedMissingSecret onboardBlockedSecretSet)
type defaultKnotState struct { native bool adminSecretSet bool}
func onboardActionFor(s defaultKnotState) onboardAction { switch { case s.native && s.adminSecretSet: return onboardViaAdminAPI case s.native: return onboardBlockedMissingSecret case s.adminSecretSet: return onboardBlockedSecretSet default: return onboardViaRecord }}
func (o *OAuth) addToDefaultKnot(did syntax.DID, sessionId string) { l := o.Logger.With("subject", did)
ctx := context.Background()
if o.Acl.IsKnotMember(ctx, o.Config.Knot.Default, did.String()) { l.Warn("already a member of the default knot") return }
native := knotcompat.KnotHasCapability(ctx, o.Config.Knot.Default, o.Config.Core.Dev, consts.CapKnotACL)
switch onboardActionFor(defaultKnotState{native: native, adminSecretSet: o.Config.Knot.AdminSecret != ""}) { case onboardViaAdminAPI: if err := o.addMemberViaKnotAdmin(ctx, o.Config.Knot.Default, did); err != nil { l.Error("failed to add to default knot via admin api", "err", err) return } err := o.acceptDefaultKnotMembership(ctx, did, sessionId) o.Acl.InvalidateMembers(o.Config.Knot.Default) if err != nil { l.Error("failed to accept default knot invite", "err", err) return } l.Debug("successfully added to default knot via admin api")
case onboardBlockedMissingSecret: l.Error("cannot add to default knot: knot admin secret not configured")
case onboardBlockedSecretSet: l.Warn("default knot probe failed, skipping legacy fallback because an admin secret is configured")
case onboardViaRecord: l.Debug("adding to default knot") session, err := o.getAppPasswordSession() if err != nil { l.Error("failed to create session", "err", err) return }
record := tangled.KnotMember{ LexiconTypeID: tangled.KnotMemberNSID, Subject: did.String(), Domain: o.Config.Knot.Default, CreatedAt: time.Now().Format(time.RFC3339), }
if err := session.putRecord(record, tangled.KnotMemberNSID); err != nil { l.Error("failed to add to default knot", "err", err) return }
if err := o.Enforcer.AddKnotMember(o.Config.Knot.Default, did.String()); err != nil { l.Error("failed to set up enforcer rules", "err", err) return }
l.Debug("successfully added to default knot") }}
func (o *OAuth) acceptDefaultKnotMembership(ctx context.Context, did syntax.DID, sessionId string) error { rkey, err := serviceauth.RkeyForService(o.Config.Knot.Default) if err != nil { return fmt.Errorf("failed to derive the default knot's acceptance record key: %w", err) } session, err := o.resumeSession(ctx, did, sessionId) if err != nil { return fmt.Errorf("failed to resume session: %w", err) } acceptance, err := ensureAcceptanceRecord(ctx, session.APIClient(), did, rkey) if err != nil { return err } client, err := o.SessionServiceClient(ctx, did, sessionId, WithService(o.Config.Knot.Default), WithLxm(tangled.KnotAcceptMembershipNSID), WithDev(o.Config.Core.Dev), WithTimeout(knotAdminTimeout)) if err != nil { return fmt.Errorf("failed to build knot service client: %w", err) } return tangled.KnotAcceptMembership(ctx, client, &tangled.KnotAcceptMembership_Input{Acceptance: acceptance})}
func ensureAcceptanceRecord(ctx context.Context, client lexutil.LexClient, did syntax.DID, rkey serviceauth.ServiceRkey) (string, error) { if held, err := comatproto.RepoGetRecord(ctx, client, "", tangled.KnotMemberAcceptanceNSID, did.String(), rkey.String()); err == nil && held != nil { return held.Uri, nil } acceptance := &tangled.KnotMemberAcceptance{LexiconTypeID: tangled.KnotMemberAcceptanceNSID, CreatedAt: time.Now().Format(time.RFC3339)} written, err := comatproto.RepoPutRecord(ctx, client, &comatproto.RepoPutRecord_Input{Collection: tangled.KnotMemberAcceptanceNSID, Repo: did.String(), Rkey: rkey.String(), Record: &lexutil.LexiconTypeDecoder{Val: acceptance}}) if err != nil { return "", fmt.Errorf("failed to write acceptance record: %w", err) } return written.Uri, nil}
func (o *OAuth) addMemberViaKnotAdmin(ctx context.Context, knotHost string, subject syntax.DID) error { ctx, cancel := context.WithTimeout(ctx, knotAdminTimeout) defer cancel()
scheme := "https://" if o.Config.Core.Dev { scheme = "http://" } endpoint := fmt.Sprintf("%s%s/admin/addMember", scheme, knotHost)
body, err := json.Marshal(tangled.KnotAddMember_Input{Subject: subject.String()}) if err != nil { return err }
req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body)) if err != nil { return err } req.Header.Set("Content-Type", "application/json") req.SetBasicAuth("admin", o.Config.Knot.AdminSecret)
resp, err := http.DefaultClient.Do(req) if err != nil { return err } defer resp.Body.Close()
if resp.StatusCode != http.StatusOK { msg, _ := io.ReadAll(resp.Body) return fmt.Errorf("knot admin addMember returned status %d: %s", resp.StatusCode, bytes.TrimSpace(msg)) }
return nil}
// create a AppPasswordSession using apppasswordstype AppPasswordSession struct { AccessJwt string `json:"accessJwt"` RefreshJwt string `json:"refreshJwt"` PdsEndpoint string Did string Logger *slog.Logger ExpiresAt time.Time}
func CreateAppPasswordSession(res *idresolver.Resolver, appPassword, did string, logger *slog.Logger) (*AppPasswordSession, error) { if appPassword == "" { return nil, fmt.Errorf("no app password configured") }
resolved, err := res.ResolveIdent(context.Background(), did) if err != nil { return nil, fmt.Errorf("failed to resolve tangled.sh DID %s: %v", did, err) }
pdsEndpoint := resolved.PDSEndpoint() if pdsEndpoint == "" { return nil, fmt.Errorf("no PDS endpoint found for tangled.sh DID %s", did) }
sessionPayload := map[string]string{ "identifier": did, "password": appPassword, } sessionBytes, err := json.Marshal(sessionPayload) if err != nil { return nil, fmt.Errorf("failed to marshal session payload: %v", err) }
sessionURL := pdsEndpoint + "/xrpc/com.atproto.server.createSession" sessionReq, err := http.NewRequestWithContext(context.Background(), "POST", sessionURL, bytes.NewBuffer(sessionBytes)) if err != nil { return nil, fmt.Errorf("failed to create session request: %v", err) } sessionReq.Header.Set("Content-Type", "application/json")
logger.Debug("creating app password session", "url", sessionURL, "headers", sessionReq.Header)
client := &http.Client{Timeout: 30 * time.Second} sessionResp, err := client.Do(sessionReq) if err != nil { return nil, fmt.Errorf("failed to create session: %v", err) } defer sessionResp.Body.Close()
if sessionResp.StatusCode != http.StatusOK { return nil, fmt.Errorf("failed to create session: HTTP %d", sessionResp.StatusCode) }
var session AppPasswordSession if err := json.NewDecoder(sessionResp.Body).Decode(&session); err != nil { return nil, fmt.Errorf("failed to decode session response: %v", err) }
session.PdsEndpoint = pdsEndpoint session.Did = did session.Logger = logger session.ExpiresAt = time.Now().Add(115 * time.Minute)
return &session, nil}
func (s *AppPasswordSession) RefreshSession() error { refreshURL := s.PdsEndpoint + "/xrpc/com.atproto.server.refreshSession" req, err := http.NewRequestWithContext(context.Background(), "POST", refreshURL, nil) if err != nil { return fmt.Errorf("failed to create refresh request: %w", err) }
req.Header.Set("Authorization", "Bearer "+s.RefreshJwt)
s.Logger.Debug("refreshing app password session", "url", refreshURL)
client := &http.Client{Timeout: 30 * time.Second} resp, err := client.Do(req) if err != nil { return fmt.Errorf("failed to refresh session: %w", err) } defer resp.Body.Close()
if resp.StatusCode != http.StatusOK { var errorResponse map[string]any if err := json.NewDecoder(resp.Body).Decode(&errorResponse); err != nil { return fmt.Errorf("failed to refresh session: HTTP %d (failed to decode error response: %w)", resp.StatusCode, err) } errorBytes, _ := json.Marshal(errorResponse) return fmt.Errorf("failed to refresh session: HTTP %d, response: %s", resp.StatusCode, string(errorBytes)) }
var refreshResponse struct { AccessJwt string `json:"accessJwt"` RefreshJwt string `json:"refreshJwt"` } if err := json.NewDecoder(resp.Body).Decode(&refreshResponse); err != nil { return fmt.Errorf("failed to decode refresh response: %w", err) }
s.AccessJwt = refreshResponse.AccessJwt s.RefreshJwt = refreshResponse.RefreshJwt // Set new expiry time with 5 minute buffer s.ExpiresAt = time.Now().Add(115 * time.Minute)
s.Logger.Debug("successfully refreshed app password session") return nil}
func (s *AppPasswordSession) IsValid() bool { return time.Now().Before(s.ExpiresAt)}
func (s *AppPasswordSession) putRecord(record any, collection string) error { if !s.IsValid() { s.Logger.Debug("access token expired, refreshing session") if err := s.RefreshSession(); err != nil { return fmt.Errorf("failed to refresh session: %w", err) } s.Logger.Debug("session refreshed") }
recordBytes, err := json.Marshal(record) if err != nil { return fmt.Errorf("failed to marshal knot member record: %w", err) }
payload := map[string]any{ "repo": s.Did, "collection": collection, "rkey": tid.TID(), "record": json.RawMessage(recordBytes), }
payloadBytes, err := json.Marshal(payload) if err != nil { return fmt.Errorf("failed to marshal request payload: %w", err) }
url := s.PdsEndpoint + "/xrpc/com.atproto.repo.putRecord" req, err := http.NewRequestWithContext(context.Background(), "POST", url, bytes.NewBuffer(payloadBytes)) if err != nil { return fmt.Errorf("failed to create HTTP request: %w", err) }
req.Header.Set("Content-Type", "application/json") req.Header.Set("Authorization", "Bearer "+s.AccessJwt)
s.Logger.Debug("putting record", "url", url, "collection", collection)
client := &http.Client{Timeout: 30 * time.Second} resp, err := client.Do(req) if err != nil { return fmt.Errorf("failed to add user to default service: %w", err) } defer resp.Body.Close()
if resp.StatusCode != http.StatusOK { var errorResponse map[string]any if err := json.NewDecoder(resp.Body).Decode(&errorResponse); err != nil { return fmt.Errorf("failed to add user to default service: HTTP %d (failed to decode error response: %w)", resp.StatusCode, err) } return fmt.Errorf("failed to add user to default service: HTTP %d, response: %v", resp.StatusCode, errorResponse) }
return nil}
// autoClaimTnglShDomain checks if the user has a .tngl.sh handle and, if so,// ensures their corresponding sites domain is claimed. This is idempotent —// ClaimDomain is a no-op if the claim already exists.func (o *OAuth) autoClaimTnglShDomain(did string) { l := o.Logger.With("did", did)
pdsDomain := strings.TrimPrefix(o.Config.Pds.Host, "https://") pdsDomain = strings.TrimPrefix(pdsDomain, "http://")
resolved, err := o.IdResolver.ResolveIdent(context.Background(), did) if err != nil { l.Error("autoClaimTnglShDomain: failed to resolve ident", "err", err) return }
handle := resolved.Handle.String() if !strings.HasSuffix(handle, "."+pdsDomain) { return }
if err := db.ClaimDomain(o.Db, did, handle); err != nil { l.Warn("autoClaimTnglShDomain: failed to claim domain", "domain", handle, "err", err) } else { l.Info("autoClaimTnglShDomain: claimed domain", "domain", handle) }}
// ensureProfileRecord writes an empty profile record to the user's PDS if they// don't already have one, serves as a marker record for tangled uers//// also helps inform onboarding statefunc (o *OAuth) ensureProfileRecord(did syntax.DID, sessionId string) { ctx := context.Background() l := o.Logger.With("did", did)
didStr := did.String() if profile, err := db.GetProfile(o.Db, didStr); err != nil { l.Error("ensureProfileRecord: failed to read profile from db", "err", err) return } else if profile != nil { // already has a profile record, leave it untouched return }
session, err := o.resumeSession(ctx, did, sessionId) if err != nil { l.Error("ensureProfileRecord: failed to resume session", "err", err) return } client := session.APIClient()
_, err = comatproto.RepoPutRecord(ctx, client, &comatproto.RepoPutRecord_Input{ Collection: tangled.ActorProfileNSID, Repo: didStr, Rkey: "self", Record: &lexutil.LexiconTypeDecoder{ Val: &tangled.ActorProfile{}, }, }) if err != nil { l.Error("ensureProfileRecord: failed to write profile record", "err", err) return }
// mirror to the local db so the appview reflects the record immediately if err := db.UpsertProfile(o.Db, &models.Profile{Did: didStr}); err != nil { l.Error("ensureProfileRecord: failed to upsert profile in db", "err", err) }
l.Info("ensureProfileRecord: created empty profile record")}
// getAppPasswordSession returns a cached AppPasswordSession, creating one if needed.func (o *OAuth) getAppPasswordSession() (*AppPasswordSession, error) { o.appPasswordSessionMu.Lock() defer o.appPasswordSessionMu.Unlock()
if o.appPasswordSession != nil { return o.appPasswordSession, nil }
session, err := CreateAppPasswordSession(o.IdResolver, o.Config.Core.AppPassword, consts.TangledDid, o.Logger) if err != nil { return nil, err }
o.appPasswordSession = session return session, nil}