lavender/server/flow.go

147 lines
4.3 KiB
Go
Raw Normal View History

2023-10-01 21:44:49 +01:00
package server
import (
"context"
2023-10-01 21:44:49 +01:00
_ "embed"
"fmt"
2023-10-09 16:29:10 +01:00
"github.com/1f349/lavender/issuer"
"github.com/1f349/lavender/server/pages"
"github.com/google/uuid"
2023-10-01 21:44:49 +01:00
"github.com/julienschmidt/httprouter"
"golang.org/x/oauth2"
2023-10-01 21:44:49 +01:00
"net/http"
"net/url"
2023-10-04 14:51:38 +01:00
"strings"
2023-10-03 23:20:28 +01:00
"time"
2023-10-01 21:44:49 +01:00
)
2023-10-09 00:04:28 +01:00
var uuidNewStringState = uuid.NewString
var uuidNewStringAti = uuid.NewString
var uuidNewStringRti = uuid.NewString
2023-10-09 16:29:10 +01:00
var testOa2Exchange = func(oa2conf oauth2.Config, ctx context.Context, code string) (*oauth2.Token, error) {
return oa2conf.Exchange(ctx, code)
}
var testOa2UserInfo = func(oidc *issuer.WellKnownOIDC, ctx context.Context, exchange *oauth2.Token) (*http.Response, error) {
client := oidc.OAuth2Config.Client(ctx, exchange)
return client.Get(oidc.UserInfoEndpoint)
}
2023-10-01 21:44:49 +01:00
func (h *HttpServer) flowPopup(rw http.ResponseWriter, req *http.Request, _ httprouter.Params) {
cookie, err := req.Cookie("lavender-login-name")
if err == nil && cookie.Valid() == nil {
pages.RenderPageTemplate(rw, "flow-popup-memory", map[string]any{
2023-11-15 09:21:09 +00:00
"ServiceName": h.conf.Load().ServiceName,
"Origin": req.URL.Query().Get("origin"),
"LoginName": cookie.Value,
})
return
}
2023-10-09 00:04:28 +01:00
pages.RenderPageTemplate(rw, "flow-popup", map[string]any{
2023-11-15 09:21:09 +00:00
"ServiceName": h.conf.Load().ServiceName,
2023-10-04 14:51:38 +01:00
"Origin": req.URL.Query().Get("origin"),
2023-10-01 21:44:49 +01:00
})
}
2023-10-03 23:20:28 +01:00
func (h *HttpServer) flowPopupPost(rw http.ResponseWriter, req *http.Request, _ httprouter.Params) {
if req.PostFormValue("not-you") == "1" {
http.SetCookie(rw, &http.Cookie{
Name: "lavender-login-name",
Value: "",
Path: "/",
MaxAge: -1,
Secure: true,
SameSite: http.SameSiteStrictMode,
})
http.Redirect(rw, req, (&url.URL{
Path: "/popup",
RawQuery: url.Values{
"origin": []string{req.PostFormValue("origin")},
}.Encode(),
}).String(), http.StatusFound)
return
}
loginName := req.PostFormValue("loginname")
2023-11-15 09:21:09 +00:00
login := h.manager.Load().FindServiceFromLogin(loginName)
2023-10-01 21:44:49 +01:00
if login == nil {
http.Error(rw, "No login service defined for this username", http.StatusBadRequest)
return
}
// the @ must exist if the service is defined
n := strings.IndexByte(loginName, '@')
loginUn := loginName[:n]
2023-10-01 21:44:49 +01:00
now := time.Now()
future := now.AddDate(1, 0, 0)
http.SetCookie(rw, &http.Cookie{
Name: "lavender-login-name",
Value: loginName,
Path: "/",
Expires: future,
MaxAge: int(future.Sub(now).Seconds()),
Secure: true,
SameSite: http.SameSiteStrictMode,
})
2023-10-04 14:51:38 +01:00
targetOrigin := req.PostFormValue("origin")
2023-11-15 09:21:09 +00:00
allowedService, found := (*h.services.Load())[targetOrigin]
2023-10-26 11:30:04 +01:00
if !found {
2023-10-04 14:51:38 +01:00
http.Error(rw, "Invalid target origin", http.StatusBadRequest)
2023-10-03 23:20:28 +01:00
return
}
// save state for use later
2023-10-09 00:04:28 +01:00
state := login.Config.Namespace + ":" + uuidNewStringState()
2023-10-03 23:20:28 +01:00
h.flowState.Set(state, flowStateData{
login,
2023-10-26 11:30:04 +01:00
allowedService,
2023-10-03 23:20:28 +01:00
}, time.Now().Add(15*time.Minute))
2023-10-01 21:44:49 +01:00
2023-10-03 23:20:28 +01:00
// generate oauth2 config and redirect to authorize URL
2023-10-04 14:51:38 +01:00
oa2conf := login.OAuth2Config
2023-11-15 09:21:09 +00:00
oa2conf.RedirectURL = h.conf.Load().BaseUrl + "/callback"
nextUrl := oa2conf.AuthCodeURL(state, oauth2.SetAuthURLParam("login_name", loginUn))
http.Redirect(rw, req, nextUrl, http.StatusFound)
2023-10-01 21:44:49 +01:00
}
2023-10-03 23:20:28 +01:00
func (h *HttpServer) flowCallback(rw http.ResponseWriter, req *http.Request, _ httprouter.Params) {
err := req.ParseForm()
if err != nil {
http.Error(rw, "Error parsing form", http.StatusBadRequest)
return
}
2023-10-01 21:44:49 +01:00
2023-10-03 23:20:28 +01:00
q := req.URL.Query()
state := q.Get("state")
n := strings.IndexByte(state, ':')
2023-11-15 09:21:09 +00:00
if n == -1 || !h.manager.Load().CheckNamespace(state[:n]) {
2023-10-09 16:29:10 +01:00
http.Error(rw, "Invalid state namespace", http.StatusBadRequest)
2023-10-03 23:20:28 +01:00
return
}
v, found := h.flowState.Get(state)
if !found {
http.Error(rw, "Invalid state", http.StatusBadRequest)
return
}
oa2conf := v.sso.OAuth2Config
2023-11-15 09:21:09 +00:00
oa2conf.RedirectURL = h.conf.Load().BaseUrl + "/callback"
2023-10-09 16:29:10 +01:00
exchange, err := testOa2Exchange(oa2conf, context.Background(), q.Get("code"))
2023-10-04 14:51:38 +01:00
if err != nil {
fmt.Println("Failed exchange:", err)
2023-10-04 14:51:38 +01:00
http.Error(rw, "Failed to exchange code", http.StatusInternalServerError)
return
}
2023-10-27 09:40:10 +01:00
2023-12-05 18:10:47 +00:00
h.finishTokenGenerateFlow(rw, req, v, exchange, func(accessToken, refreshToken string, v3 map[string]any) {
pages.RenderPageTemplate(rw, "flow-callback", map[string]any{
"ServiceName": h.conf.Load().ServiceName,
"TargetOrigin": v.target.Url.String(),
"TargetMessage": v3,
"AccessToken": accessToken,
"RefreshToken": refreshToken,
})
2023-10-04 14:51:38 +01:00
})
2023-10-01 21:44:49 +01:00
}