diff options
Diffstat (limited to 'internal/oauth')
| -rw-r--r-- | internal/oauth/README.md | 3 | ||||
| -rw-r--r-- | internal/oauth/oauth.go | 446 | ||||
| -rw-r--r-- | internal/oauth/oauth_test.go | 133 | ||||
| -rw-r--r-- | internal/oauth/pgclientstore.go | 81 | ||||
| -rw-r--r-- | internal/oauth/pgclientstore_test.go | 103 | ||||
| -rw-r--r-- | internal/oauth/pgtokenstore.go | 257 |
6 files changed, 0 insertions, 1023 deletions
diff --git a/internal/oauth/README.md b/internal/oauth/README.md deleted file mode 100644 index 50a9e1274..000000000 --- a/internal/oauth/README.md +++ /dev/null @@ -1,3 +0,0 @@ -# oauth - -This package provides uses the [GoToSocial oauth2](https://github.com/gotosocial/oauth2) module (forked from [go-oauth2](https://github.com/go-oauth2/oauth2)) to provide [oauth2](https://www.oauth.com/) server functionality to the GoToSocial APIs. diff --git a/internal/oauth/oauth.go b/internal/oauth/oauth.go deleted file mode 100644 index 49e04a905..000000000 --- a/internal/oauth/oauth.go +++ /dev/null @@ -1,446 +0,0 @@ -/* - GoToSocial - Copyright (C) 2021 GoToSocial Authors admin@gotosocial.org - - This program is free software: you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published by - the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program. If not, see <http://www.gnu.org/licenses/>. -*/ - -package oauth - -import ( - "fmt" - "net/http" - "net/url" - - "github.com/gin-contrib/sessions" - "github.com/gin-gonic/gin" - "github.com/go-pg/pg/v10" - "github.com/google/uuid" - "github.com/gotosocial/gotosocial/internal/api" - "github.com/gotosocial/gotosocial/internal/gtsmodel" - "github.com/gotosocial/gotosocial/pkg/mastotypes" - "github.com/gotosocial/oauth2/v4" - "github.com/gotosocial/oauth2/v4/errors" - "github.com/gotosocial/oauth2/v4/manage" - "github.com/gotosocial/oauth2/v4/server" - "github.com/sirupsen/logrus" - "golang.org/x/crypto/bcrypt" -) - -type API struct { - manager *manage.Manager - server *server.Server - conn *pg.DB - log *logrus.Logger -} - -type login struct { - Email string `form:"username"` - Password string `form:"password"` -} - -type code struct { - Code string `form:"code"` -} - -func New(ts oauth2.TokenStore, cs oauth2.ClientStore, conn *pg.DB, log *logrus.Logger) *API { - manager := manage.NewDefaultManager() - manager.MapTokenStorage(ts) - manager.MapClientStorage(cs) - manager.SetAuthorizeCodeTokenCfg(manage.DefaultAuthorizeCodeTokenCfg) - sc := &server.Config{ - TokenType: "Bearer", - // Must follow the spec. - AllowGetAccessRequest: false, - // Support only the non-implicit flow. - AllowedResponseTypes: []oauth2.ResponseType{oauth2.Code}, - // Allow: - // - Authorization Code (for first & third parties) - // - Refreshing Tokens - // - // Deny: - // - Resource owner secrets (password grant) - // - Client secrets - AllowedGrantTypes: []oauth2.GrantType{ - oauth2.AuthorizationCode, - oauth2.Refreshing, - }, - AllowedCodeChallengeMethods: []oauth2.CodeChallengeMethod{ - oauth2.CodeChallengePlain, - }, - } - - srv := server.NewServer(sc, manager) - srv.SetInternalErrorHandler(func(err error) *errors.Response { - log.Errorf("internal oauth error: %s", err) - return nil - }) - - srv.SetResponseErrorHandler(func(re *errors.Response) { - log.Errorf("internal response error: %s", re.Error) - }) - - api := &API{ - manager: manager, - server: srv, - conn: conn, - log: log, - } - - api.server.SetUserAuthorizationHandler(api.UserAuthorizationHandler) - api.server.SetClientInfoHandler(server.ClientFormHandler) - return api -} - -func (a *API) AddRoutes(s api.Server) error { - s.AttachHandler(http.MethodPost, "/api/v1/apps", a.AppsPOSTHandler) - - s.AttachHandler(http.MethodGet, "/auth/sign_in", a.SignInGETHandler) - s.AttachHandler(http.MethodPost, "/auth/sign_in", a.SignInPOSTHandler) - - s.AttachHandler(http.MethodPost, "/oauth/token", a.TokenPOSTHandler) - - s.AttachHandler(http.MethodGet, "/oauth/authorize", a.AuthorizeGETHandler) - s.AttachHandler(http.MethodPost, "/oauth/authorize", a.AuthorizePOSTHandler) - - return nil -} - -func incorrectPassword() (string, error) { - return "", errors.New("password/email combination was incorrect") -} - -/* - MAIN HANDLERS -- serve these through a server/router -*/ - -// AppsPOSTHandler should be served at https://example.org/api/v1/apps -// It is equivalent to: https://docs.joinmastodon.org/methods/apps/ -func (a *API) AppsPOSTHandler(c *gin.Context) { - l := a.log.WithField("func", "AppsPOSTHandler") - l.Trace("entering AppsPOSTHandler") - - form := &mastotypes.ApplicationPOSTRequest{} - if err := c.ShouldBind(form); err != nil { - c.JSON(http.StatusUnprocessableEntity, gin.H{"error": err.Error()}) - return - } - - // permitted length for most fields - permittedLength := 64 - // redirect can be a bit bigger because we probably need to encode data in the redirect uri - permittedRedirect := 256 - - // check lengths of fields before proceeding so the user can't spam huge entries into the database - if len(form.ClientName) > permittedLength { - c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("client_name must be less than %d bytes", permittedLength)}) - return - } - if len(form.Website) > permittedLength { - c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("website must be less than %d bytes", permittedLength)}) - return - } - if len(form.RedirectURIs) > permittedRedirect { - c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("redirect_uris must be less than %d bytes", permittedRedirect)}) - return - } - if len(form.Scopes) > permittedLength { - c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("scopes must be less than %d bytes", permittedLength)}) - return - } - - // set default 'read' for scopes if it's not set - var scopes string - if form.Scopes == "" { - scopes = "read" - } else { - scopes = form.Scopes - } - - // generate new IDs for this application and its associated client - clientID := uuid.NewString() - clientSecret := uuid.NewString() - vapidKey := uuid.NewString() - - // generate the application to put in the database - app := >smodel.Application{ - Name: form.ClientName, - Website: form.Website, - RedirectURI: form.RedirectURIs, - ClientID: clientID, - ClientSecret: clientSecret, - Scopes: scopes, - VapidKey: vapidKey, - } - - // chuck it in the db - if _, err := a.conn.Model(app).Insert(); err != nil { - c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) - return - } - - // now we need to model an oauth client from the application that the oauth library can use - oc := &oauthClient{ - ID: clientID, - Secret: clientSecret, - Domain: form.RedirectURIs, - UserID: "", // This client isn't yet associated with a specific user, it's just an app client right now - } - - // chuck it in the db - if _, err := a.conn.Model(oc).Insert(); err != nil { - c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) - return - } - - // done, return the new app information per the spec here: https://docs.joinmastodon.org/methods/apps/ - c.JSON(http.StatusOK, app) -} - -// SignInGETHandler should be served at https://example.org/auth/sign_in. -// The idea is to present a sign in page to the user, where they can enter their username and password. -// The form will then POST to the sign in page, which will be handled by SignInPOSTHandler -func (a *API) SignInGETHandler(c *gin.Context) { - a.log.WithField("func", "SignInGETHandler").Trace("serving sign in html") - c.HTML(http.StatusOK, "sign-in.tmpl", gin.H{}) -} - -// SignInPOSTHandler should be served at https://example.org/auth/sign_in. -// The idea is to present a sign in page to the user, where they can enter their username and password. -// The handler will then redirect to the auth handler served at /auth -func (a *API) SignInPOSTHandler(c *gin.Context) { - l := a.log.WithField("func", "SignInPOSTHandler") - s := sessions.Default(c) - form := &login{} - if err := c.ShouldBind(form); err != nil { - c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()}) - return - } - l.Tracef("parsed form: %+v", form) - - userid, err := a.ValidatePassword(form.Email, form.Password) - if err != nil { - c.String(http.StatusForbidden, err.Error()) - return - } - - s.Set("username", userid) - if err := s.Save(); err != nil { - c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) - return - } - - l.Trace("redirecting to auth page") - c.Redirect(http.StatusFound, "/oauth/authorize") -} - -// TokenPOSTHandler should be served as a POST at https://example.org/oauth/token -// The idea here is to serve an oauth access token to a user, which can be used for authorizing against non-public APIs. -// See https://docs.joinmastodon.org/methods/apps/oauth/#obtain-a-token -func (a *API) TokenPOSTHandler(c *gin.Context) { - l := a.log.WithField("func", "TokenHandler") - l.Trace("entered token handler, will now go to server.HandleTokenRequest") - if err := a.server.HandleTokenRequest(c.Writer, c.Request); err != nil { - c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) - } -} - -// AuthorizeGETHandler should be served as GET at https://example.org/oauth/authorize -// The idea here is to present an oauth authorize page to the user, with a button -// that they have to click to accept. See here: https://docs.joinmastodon.org/methods/apps/oauth/#authorize-a-user -func (a *API) AuthorizeGETHandler(c *gin.Context) { - l := a.log.WithField("func", "AuthorizeGETHandler") - s := sessions.Default(c) - - // Username will be set in the session by AuthorizePOSTHandler if the caller has already gone through the authentication flow - // If it's not set, then we don't know yet who the user is, so we need to redirect them to the sign in page. - v := s.Get("username") - if username, ok := v.(string); !ok || username == "" { - l.Trace("username was empty, parsing form then redirecting to sign in page") - - // first make sure they've filled out the authorize form with the required values - form := &mastotypes.OAuthAuthorize{} - if err := c.ShouldBind(form); err != nil { - c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()}) - return - } - l.Tracef("parsed form: %+v", form) - - // these fields are *required* so check 'em - if form.ResponseType == "" || form.ClientID == "" || form.RedirectURI == "" { - c.JSON(http.StatusBadRequest, gin.H{"error": "missing one of: response_type, client_id or redirect_uri"}) - return - } - - // save these values from the form so we can use them elsewhere in the session - s.Set("force_login", form.ForceLogin) - s.Set("response_type", form.ResponseType) - s.Set("client_id", form.ClientID) - s.Set("redirect_uri", form.RedirectURI) - s.Set("scope", form.Scope) - if err := s.Save(); err != nil { - c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) - return - } - - // send them to the sign in page so we can tell who they are - c.Redirect(http.StatusFound, "/auth/sign_in") - return - } - - // Check if we have a code already. If we do, it means the user used urn:ietf:wg:oauth:2.0:oob as their redirect URI - // and were sent here, which means they just want the code displayed so they can use it out of band. - code := &code{} - if err := c.Bind(code); err != nil { - c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) - return - } - - // the authorize template will either: - // 1. Display the code to the user if they're already authorized and were redirected here because they selected urn:ietf:wg:oauth:2.0:oob. - // 2. Display a form where they can get some information about the app that's trying to authorize, and approve it, which will then go to AuthorizePOSTHandler - l.Trace("serving authorize html") - c.HTML(http.StatusOK, "authorize.tmpl", gin.H{ - "code": code.Code, - }) -} - -// AuthorizePOSTHandler should be served as POST at https://example.org/oauth/authorize -// The idea here is to present an oauth authorize page to the user, with a button -// that they have to click to accept. See here: https://docs.joinmastodon.org/methods/apps/oauth/#authorize-a-user -func (a *API) AuthorizePOSTHandler(c *gin.Context) { - l := a.log.WithField("func", "AuthorizePOSTHandler") - s := sessions.Default(c) - - v := s.Get("username") - if username, ok := v.(string); !ok || username == "" { - c.JSON(http.StatusUnauthorized, gin.H{"error": "you are not signed in"}) - } - - values := url.Values{} - - if v, ok := s.Get("force_login").(string); !ok { - c.JSON(http.StatusBadRequest, gin.H{"error": "session missing force_login"}) - return - } else { - values.Add("force_login", v) - } - - if v, ok := s.Get("response_type").(string); !ok { - c.JSON(http.StatusBadRequest, gin.H{"error": "session missing response_type"}) - return - } else { - values.Add("response_type", v) - } - - if v, ok := s.Get("client_id").(string); !ok { - c.JSON(http.StatusBadRequest, gin.H{"error": "session missing client_id"}) - return - } else { - values.Add("client_id", v) - } - - if v, ok := s.Get("redirect_uri").(string); !ok { - c.JSON(http.StatusBadRequest, gin.H{"error": "session missing redirect_uri"}) - return - } else { - // todo: explain this little hack - if v == "urn:ietf:wg:oauth:2.0:oob" { - v = "http://localhost:8080/oauth/authorize" - } - values.Add("redirect_uri", v) - } - - if v, ok := s.Get("scope").(string); !ok { - c.JSON(http.StatusBadRequest, gin.H{"error": "session missing scope"}) - return - } else { - values.Add("scope", v) - } - - if v, ok := s.Get("username").(string); !ok { - c.JSON(http.StatusBadRequest, gin.H{"error": "session missing username"}) - return - } else { - values.Add("username", v) - } - - c.Request.Form = values - l.Tracef("values on request set to %+v", c.Request.Form) - - if err := s.Save(); err != nil { - c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) - return - } - - if err := a.server.HandleAuthorizeRequest(c.Writer, c.Request); err != nil { - c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()}) - } -} - -/* - SUB-HANDLERS -- don't serve these directly, they should be attached to the oauth2 server -*/ - -// PasswordAuthorizationHandler takes a username (in this case, we use an email address) -// and a password. The goal is to authenticate the password against the one for that email -// address stored in the database. If OK, we return the userid (a uuid) for that user, -// so that it can be used in further Oauth flows to generate a token/retreieve an oauth client from the db. -func (a *API) ValidatePassword(email string, password string) (userid string, err error) { - l := a.log.WithField("func", "PasswordAuthorizationHandler") - - // make sure an email/password was provided and bail if not - if email == "" || password == "" { - l.Debug("email or password was not provided") - return incorrectPassword() - } - - // first we select the user from the database based on email address, bail if no user found for that email - gtsUser := >smodel.User{} - if err := a.conn.Model(gtsUser).Where("email = ?", email).Select(); err != nil { - l.Debugf("user %s was not retrievable from db during oauth authorization attempt: %s", email, err) - return incorrectPassword() - } - - // make sure a password is actually set and bail if not - if gtsUser.EncryptedPassword == "" { - l.Warnf("encrypted password for user %s was empty for some reason", gtsUser.Email) - return incorrectPassword() - } - - // compare the provided password with the encrypted one from the db, bail if they don't match - if err := bcrypt.CompareHashAndPassword([]byte(gtsUser.EncryptedPassword), []byte(password)); err != nil { - l.Debugf("password hash didn't match for user %s during login attempt: %s", gtsUser.Email, err) - return incorrectPassword() - } - - // If we've made it this far the email/password is correct, so we can just return the id of the user. - userid = gtsUser.ID - l.Tracef("returning (%s, %s)", userid, err) - return -} - -// UserAuthorizationHandler gets the user's ID from the 'username' field of the request form, -// or redirects to the /auth/sign_in page, if this key is not present. -func (a *API) UserAuthorizationHandler(w http.ResponseWriter, r *http.Request) (userID string, err error) { - l := a.log.WithField("func", "UserAuthorizationHandler") - userID = r.FormValue("username") - if userID == "" { - l.Trace("username was empty, redirecting to sign in page") - http.Redirect(w, r, "/auth/sign_in", http.StatusFound) - return "", nil - } - l.Tracef("returning (%s, %s)", userID, err) - return userID, err -} diff --git a/internal/oauth/oauth_test.go b/internal/oauth/oauth_test.go deleted file mode 100644 index 6c3a17c14..000000000 --- a/internal/oauth/oauth_test.go +++ /dev/null @@ -1,133 +0,0 @@ -package oauth - -import ( - "context" - "fmt" - "testing" - "time" - - "github.com/go-pg/pg/v10" - "github.com/go-pg/pg/v10/orm" - "github.com/gotosocial/gotosocial/internal/api" - "github.com/gotosocial/gotosocial/internal/config" - "github.com/gotosocial/gotosocial/internal/gtsmodel" - "github.com/gotosocial/oauth2/v4" - "github.com/sirupsen/logrus" - "github.com/stretchr/testify/suite" - "golang.org/x/crypto/bcrypt" -) - -type OauthTestSuite struct { - suite.Suite - tokenStore oauth2.TokenStore - clientStore oauth2.ClientStore - conn *pg.DB - testAccount *gtsmodel.Account - testUser *gtsmodel.User - testClient *oauthClient - config *config.Config -} - -const () - -// SetupSuite sets some variables on the suite that we can use as consts (more or less) throughout -func (suite *OauthTestSuite) SetupSuite() { - encryptedPassword, err := bcrypt.GenerateFromPassword([]byte("test-password"), bcrypt.DefaultCost) - if err != nil { - logrus.Panicf("error encrypting user pass: %s", err) - } - - suite.testAccount = >smodel.Account{} - suite.testUser = >smodel.User{ - EncryptedPassword: string(encryptedPassword), - Email: "user@localhost", - AccountID: "some-account-id-it-doesn't-matter-really-since-this-user-doesn't-actually-have-an-account!", - } - suite.testClient = &oauthClient{ - ID: "a-known-client-id", - Secret: "some-secret", - Domain: "http://localhost:8080", - } - - // because go tests are run within the test package directory, we need to fiddle with the templateconfig - // basedir in a way that we wouldn't normally have to do when running the binary, in order to make - // the templates actually load - c := config.Empty() - c.TemplateConfig.BaseDir = "../../web/template/" - suite.config = c -} - -// SetupTest creates a postgres connection and creates the oauth_clients table before each test -func (suite *OauthTestSuite) SetupTest() { - suite.conn = pg.Connect(&pg.Options{}) - if err := suite.conn.Ping(context.Background()); err != nil { - logrus.Panicf("db connection error: %s", err) - } - - models := []interface{}{ - &oauthClient{}, - &oauthToken{}, - >smodel.User{}, - >smodel.Account{}, - >smodel.Application{}, - } - - for _, m := range models { - if err := suite.conn.Model(m).CreateTable(&orm.CreateTableOptions{ - IfNotExists: true, - }); err != nil { - logrus.Panicf("db connection error: %s", err) - } - } - - suite.tokenStore = NewPGTokenStore(context.Background(), suite.conn, logrus.New()) - suite.clientStore = NewPGClientStore(suite.conn) - - if _, err := suite.conn.Model(suite.testUser).Insert(); err != nil { - logrus.Panicf("could not insert test user into db: %s", err) - } - - if _, err := suite.conn.Model(suite.testClient).Insert(); err != nil { - logrus.Panicf("could not insert test client into db: %s", err) - } - -} - -// TearDownTest drops the oauth_clients table and closes the pg connection after each test -func (suite *OauthTestSuite) TearDownTest() { - models := []interface{}{ - &oauthClient{}, - &oauthToken{}, - >smodel.User{}, - >smodel.Account{}, - >smodel.Application{}, - } - for _, m := range models { - if err := suite.conn.Model(m).DropTable(&orm.DropTableOptions{}); err != nil { - logrus.Panicf("drop table error: %s", err) - } - } - if err := suite.conn.Close(); err != nil { - logrus.Panicf("error closing db connection: %s", err) - } - suite.conn = nil -} - -func (suite *OauthTestSuite) TestAPIInitialize() { - log := logrus.New() - log.SetLevel(logrus.TraceLevel) - - r := api.New(suite.config, log) - api := New(suite.tokenStore, suite.clientStore, suite.conn, log) - if err := api.AddRoutes(r); err != nil { - suite.FailNow(fmt.Sprintf("error initializing api: %s", err)) - } - go r.Start() - time.Sleep(30 * time.Second) - // http://localhost:8080/oauth/authorize?client_id=a-known-client-id&response_type=code&redirect_uri=https://example.org - // http://localhost:8080/oauth/authorize?client_id=a-known-client-id&response_type=code&redirect_uri=urn:ietf:wg:oauth:2.0:oob -} - -func TestOauthTestSuite(t *testing.T) { - suite.Run(t, new(OauthTestSuite)) -} diff --git a/internal/oauth/pgclientstore.go b/internal/oauth/pgclientstore.go deleted file mode 100644 index 1df46fedb..000000000 --- a/internal/oauth/pgclientstore.go +++ /dev/null @@ -1,81 +0,0 @@ -/* - GoToSocial - Copyright (C) 2021 GoToSocial Authors admin@gotosocial.org - - This program is free software: you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published by - the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program. If not, see <http://www.gnu.org/licenses/>. -*/ - -package oauth - -import ( - "context" - "fmt" - - "github.com/go-pg/pg/v10" - "github.com/gotosocial/oauth2/v4" - "github.com/gotosocial/oauth2/v4/models" -) - -type pgClientStore struct { - conn *pg.DB -} - -func NewPGClientStore(conn *pg.DB) oauth2.ClientStore { - pts := &pgClientStore{ - conn: conn, - } - return pts -} - -func (pcs *pgClientStore) GetByID(ctx context.Context, clientID string) (oauth2.ClientInfo, error) { - poc := &oauthClient{ - ID: clientID, - } - if err := pcs.conn.WithContext(ctx).Model(poc).Where("id = ?", poc.ID).Select(); err != nil { - return nil, fmt.Errorf("error in clientstore getbyid searching for client %s: %s", clientID, err) - } - return models.New(poc.ID, poc.Secret, poc.Domain, poc.UserID), nil -} - -func (pcs *pgClientStore) Set(ctx context.Context, id string, cli oauth2.ClientInfo) error { - poc := &oauthClient{ - ID: cli.GetID(), - Secret: cli.GetSecret(), - Domain: cli.GetDomain(), - UserID: cli.GetUserID(), - } - _, err := pcs.conn.WithContext(ctx).Model(poc).OnConflict("(id) DO UPDATE").Insert() - if err != nil { - return fmt.Errorf("error in clientstore set: %s", err) - } - return nil -} - -func (pcs *pgClientStore) Delete(ctx context.Context, id string) error { - poc := &oauthClient{ - ID: id, - } - _, err := pcs.conn.WithContext(ctx).Model(poc).Where("id = ?", poc.ID).Delete() - if err != nil { - return fmt.Errorf("error in clientstore delete: %s", err) - } - return nil -} - -type oauthClient struct { - ID string - Secret string - Domain string - UserID string -} diff --git a/internal/oauth/pgclientstore_test.go b/internal/oauth/pgclientstore_test.go deleted file mode 100644 index eb011fe01..000000000 --- a/internal/oauth/pgclientstore_test.go +++ /dev/null @@ -1,103 +0,0 @@ -package oauth - -import ( - "context" - "testing" - - "github.com/go-pg/pg/v10" - "github.com/go-pg/pg/v10/orm" - "github.com/gotosocial/oauth2/v4/models" - "github.com/sirupsen/logrus" - "github.com/stretchr/testify/suite" -) - -type PgClientStoreTestSuite struct { - suite.Suite - conn *pg.DB - testClientID string - testClientSecret string - testClientDomain string - testClientUserID string -} - -const () - -// SetupSuite sets some variables on the suite that we can use as consts (more or less) throughout -func (suite *PgClientStoreTestSuite) SetupSuite() { - suite.testClientID = "test-client-id" - suite.testClientSecret = "test-client-secret" - suite.testClientDomain = "https://example.org" - suite.testClientUserID = "test-client-user-id" -} - -// SetupTest creates a postgres connection and creates the oauth_clients table before each test -func (suite *PgClientStoreTestSuite) SetupTest() { - suite.conn = pg.Connect(&pg.Options{}) - if err := suite.conn.Ping(context.Background()); err != nil { - logrus.Panicf("db connection error: %s", err) - } - if err := suite.conn.Model(&oauthClient{}).CreateTable(&orm.CreateTableOptions{ - IfNotExists: true, - }); err != nil { - logrus.Panicf("db connection error: %s", err) - } -} - -// TearDownTest drops the oauth_clients table and closes the pg connection after each test -func (suite *PgClientStoreTestSuite) TearDownTest() { - if err := suite.conn.Model(&oauthClient{}).DropTable(&orm.DropTableOptions{}); err != nil { - logrus.Panicf("drop table error: %s", err) - } - if err := suite.conn.Close(); err != nil { - logrus.Panicf("error closing db connection: %s", err) - } - suite.conn = nil -} - -func (suite *PgClientStoreTestSuite) TestClientStoreSetAndGet() { - // set a new client in the store - cs := NewPGClientStore(suite.conn) - if err := cs.Set(context.Background(), suite.testClientID, models.New(suite.testClientID, suite.testClientSecret, suite.testClientDomain, suite.testClientUserID)); err != nil { - suite.FailNow(err.Error()) - } - - // fetch that client from the store - client, err := cs.GetByID(context.Background(), suite.testClientID) - if err != nil { - suite.FailNow(err.Error()) - } - - // check that the values are the same - suite.NotNil(client) - suite.EqualValues(models.New(suite.testClientID, suite.testClientSecret, suite.testClientDomain, suite.testClientUserID), client) -} - -func (suite *PgClientStoreTestSuite) TestClientSetAndDelete() { - // set a new client in the store - cs := NewPGClientStore(suite.conn) - if err := cs.Set(context.Background(), suite.testClientID, models.New(suite.testClientID, suite.testClientSecret, suite.testClientDomain, suite.testClientUserID)); err != nil { - suite.FailNow(err.Error()) - } - - // fetch the client from the store - client, err := cs.GetByID(context.Background(), suite.testClientID) - if err != nil { - suite.FailNow(err.Error()) - } - - // check that the values are the same - suite.NotNil(client) - suite.EqualValues(models.New(suite.testClientID, suite.testClientSecret, suite.testClientDomain, suite.testClientUserID), client) - if err := cs.Delete(context.Background(), suite.testClientID); err != nil { - suite.FailNow(err.Error()) - } - - // try to get the deleted client; we should get an error - deletedClient, err := cs.GetByID(context.Background(), suite.testClientID) - suite.Assert().Nil(deletedClient) - suite.Assert().NotNil(err) -} - -func TestPgClientStoreTestSuite(t *testing.T) { - suite.Run(t, new(PgClientStoreTestSuite)) -} diff --git a/internal/oauth/pgtokenstore.go b/internal/oauth/pgtokenstore.go deleted file mode 100644 index 0271afafb..000000000 --- a/internal/oauth/pgtokenstore.go +++ /dev/null @@ -1,257 +0,0 @@ -/* - GoToSocial - Copyright (C) 2021 GoToSocial Authors admin@gotosocial.org - - This program is free software: you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published by - the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program. If not, see <http://www.gnu.org/licenses/>. -*/ - -package oauth - -import ( - "context" - "errors" - "fmt" - "time" - - "github.com/go-pg/pg/v10" - "github.com/gotosocial/oauth2/v4" - "github.com/gotosocial/oauth2/v4/models" - "github.com/sirupsen/logrus" -) - -// pgTokenStore is an implementation of oauth2.TokenStore, which uses Postgres as a storage backend. -type pgTokenStore struct { - oauth2.TokenStore - conn *pg.DB - log *logrus.Logger -} - -// NewPGTokenStore returns a token store, using postgres, that satisfies the oauth2.TokenStore interface. -// -// In order to allow tokens to 'expire' (not really a thing in Postgres world), it will also set off a -// goroutine that iterates through the tokens in the DB once per minute and deletes any that have expired. -func NewPGTokenStore(ctx context.Context, conn *pg.DB, log *logrus.Logger) oauth2.TokenStore { - pts := &pgTokenStore{ - conn: conn, - log: log, - } - - // set the token store to clean out expired tokens once per minute, or return if we're done - go func(ctx context.Context, pts *pgTokenStore, log *logrus.Logger) { - cleanloop: - for { - select { - case <-ctx.Done(): - log.Info("breaking cleanloop") - break cleanloop - case <-time.After(1 * time.Minute): - log.Debug("sweeping out old oauth entries broom broom") - if err := pts.sweep(); err != nil { - log.Errorf("error while sweeping oauth entries: %s", err) - } - } - } - }(ctx, pts, log) - return pts -} - -// sweep clears out old tokens that have expired; it should be run on a loop about once per minute or so. -func (pts *pgTokenStore) sweep() error { - // select *all* tokens from the db - // todo: if this becomes expensive (ie., there are fucking LOADS of tokens) then figure out a better way. - var tokens []oauthToken - if err := pts.conn.Model(&tokens).Select(); err != nil { - return err - } - - // iterate through and remove expired tokens - now := time.Now() - for _, pgt := range tokens { - // The zero value of a time.Time is 00:00 january 1 1970, which will always be before now. So: - // we only want to check if a token expired before now if the expiry time is *not zero*; - // ie., if it's been explicity set. - if !pgt.CodeExpiresAt.IsZero() && pgt.CodeExpiresAt.Before(now) || !pgt.RefreshExpiresAt.IsZero() && pgt.RefreshExpiresAt.Before(now) || !pgt.AccessExpiresAt.IsZero() && pgt.AccessExpiresAt.Before(now) { - if _, err := pts.conn.Model(&pgt).Delete(); err != nil { - return err - } - } - } - - return nil -} - -// Create creates and store the new token information. -// For the original implementation, see https://github.com/gotosocial/oauth2/blob/master/store/token.go#L34 -func (pts *pgTokenStore) Create(ctx context.Context, info oauth2.TokenInfo) error { - t, ok := info.(*models.Token) - if !ok { - return errors.New("info param was not a models.Token") - } - _, err := pts.conn.WithContext(ctx).Model(oauthTokenToPGToken(t)).Insert() - if err != nil { - return fmt.Errorf("error in tokenstore create: %s", err) - } - return nil -} - -// RemoveByCode deletes a token from the DB based on the Code field -func (pts *pgTokenStore) RemoveByCode(ctx context.Context, code string) error { - _, err := pts.conn.Model(&oauthToken{}).Where("code = ?", code).Delete() - if err != nil { - return fmt.Errorf("error in tokenstore removebycode: %s", err) - } - return nil -} - -// RemoveByAccess deletes a token from the DB based on the Access field -func (pts *pgTokenStore) RemoveByAccess(ctx context.Context, access string) error { - _, err := pts.conn.Model(&oauthToken{}).Where("access = ?", access).Delete() - if err != nil { - return fmt.Errorf("error in tokenstore removebyaccess: %s", err) - } - return nil -} - -// RemoveByRefresh deletes a token from the DB based on the Refresh field -func (pts *pgTokenStore) RemoveByRefresh(ctx context.Context, refresh string) error { - _, err := pts.conn.Model(&oauthToken{}).Where("refresh = ?", refresh).Delete() - if err != nil { - return fmt.Errorf("error in tokenstore removebyrefresh: %s", err) - } - return nil -} - -// GetByCode selects a token from the DB based on the Code field -func (pts *pgTokenStore) GetByCode(ctx context.Context, code string) (oauth2.TokenInfo, error) { - pgt := &oauthToken{} - if err := pts.conn.Model(pgt).Where("code = ?", code).Select(); err != nil { - return nil, fmt.Errorf("error in tokenstore getbycode: %s", err) - } - return pgTokenToOauthToken(pgt), nil -} - -// GetByAccess selects a token from the DB based on the Access field -func (pts *pgTokenStore) GetByAccess(ctx context.Context, access string) (oauth2.TokenInfo, error) { - pgt := &oauthToken{} - if err := pts.conn.Model(pgt).Where("access = ?", access).Select(); err != nil { - return nil, fmt.Errorf("error in tokenstore getbyaccess: %s", err) - } - return pgTokenToOauthToken(pgt), nil -} - -// GetByRefresh selects a token from the DB based on the Refresh field -func (pts *pgTokenStore) GetByRefresh(ctx context.Context, refresh string) (oauth2.TokenInfo, error) { - pgt := &oauthToken{} - if err := pts.conn.Model(pgt).Where("refresh = ?", refresh).Select(); err != nil { - return nil, fmt.Errorf("error in tokenstore getbyrefresh: %s", err) - } - return pgTokenToOauthToken(pgt), nil -} - -/* - The following models are basically helpers for the postgres token store implementation, they should only be used internally. -*/ - -// oauthToken is a translation of the gotosocial token with the ExpiresIn fields replaced with ExpiresAt. -// -// Explanation for this: gotosocial assumes an in-memory or file database of some kind, where a time-to-live parameter (TTL) can be defined, -// and tokens with expired TTLs are automatically removed. Since Postgres doesn't have that feature, it's easier to set an expiry time and -// then periodically sweep out tokens when that time has passed. -// -// Note that this struct does *not* satisfy the token interface shown here: https://github.com/gotosocial/oauth2/blob/master/model.go#L22 -// and implemented here: https://github.com/gotosocial/oauth2/blob/master/models/token.go. -// As such, manual translation is always required between oauthToken and the gotosocial *model.Token. The helper functions oauthTokenToPGToken -// and pgTokenToOauthToken can be used for that. -type oauthToken struct { - ClientID string - UserID string - RedirectURI string - Scope string - Code string `pg:"default:'',pk"` - CodeChallenge string - CodeChallengeMethod string - CodeCreateAt time.Time `pg:"type:timestamp"` - CodeExpiresAt time.Time `pg:"type:timestamp"` - Access string `pg:"default:'',pk"` - AccessCreateAt time.Time `pg:"type:timestamp"` - AccessExpiresAt time.Time `pg:"type:timestamp"` - Refresh string `pg:"default:'',pk"` - RefreshCreateAt time.Time `pg:"type:timestamp"` - RefreshExpiresAt time.Time `pg:"type:timestamp"` -} - -// oauthTokenToPGToken is a lil util function that takes a gotosocial token and gives back a token for inserting into postgres -func oauthTokenToPGToken(tkn *models.Token) *oauthToken { - now := time.Now() - - // For the following, we want to make sure we're not adding a time.Now() to an *empty* ExpiresIn, otherwise that's - // going to cause all sorts of interesting problems. So check first to make sure that the ExpiresIn is not equal - // to the zero value of a time.Duration, which is 0s. If it *is* empty/nil, just leave the ExpiresAt at nil as well. - - var cea time.Time - if tkn.CodeExpiresIn != 0*time.Second { - cea = now.Add(tkn.CodeExpiresIn) - } - - var aea time.Time - if tkn.AccessExpiresIn != 0*time.Second { - aea = now.Add(tkn.AccessExpiresIn) - } - - var rea time.Time - if tkn.RefreshExpiresIn != 0*time.Second { - rea = now.Add(tkn.RefreshExpiresIn) - } - - return &oauthToken{ - ClientID: tkn.ClientID, - UserID: tkn.UserID, - RedirectURI: tkn.RedirectURI, - Scope: tkn.Scope, - Code: tkn.Code, - CodeChallenge: tkn.CodeChallenge, - CodeChallengeMethod: tkn.CodeChallengeMethod, - CodeCreateAt: tkn.CodeCreateAt, - CodeExpiresAt: cea, - Access: tkn.Access, - AccessCreateAt: tkn.AccessCreateAt, - AccessExpiresAt: aea, - Refresh: tkn.Refresh, - RefreshCreateAt: tkn.RefreshCreateAt, - RefreshExpiresAt: rea, - } -} - -// pgTokenToOauthToken is a lil util function that takes a postgres token and gives back a gotosocial token -func pgTokenToOauthToken(pgt *oauthToken) *models.Token { - now := time.Now() - - return &models.Token{ - ClientID: pgt.ClientID, - UserID: pgt.UserID, - RedirectURI: pgt.RedirectURI, - Scope: pgt.Scope, - Code: pgt.Code, - CodeChallenge: pgt.CodeChallenge, - CodeChallengeMethod: pgt.CodeChallengeMethod, - CodeCreateAt: pgt.CodeCreateAt, - CodeExpiresIn: pgt.CodeExpiresAt.Sub(now), - Access: pgt.Access, - AccessCreateAt: pgt.AccessCreateAt, - AccessExpiresIn: pgt.AccessExpiresAt.Sub(now), - Refresh: pgt.Refresh, - RefreshCreateAt: pgt.RefreshCreateAt, - RefreshExpiresIn: pgt.RefreshExpiresAt.Sub(now), - } -} |