/tree/auth - Senary

indieauth.go

package auth

import (
	"encoding/base64"
	"encoding/json"
	"fmt"
	"net/http"
	"senary/common"
	"sync"
	"time"

	"go.hacdias.com/indielib/indieauth"
)

const (
	oauthCookieName      string = "indieauth-cookie"
	senaryAuthCookieName string = "senaryauth-cookie"
)

type AuthClient struct {
	iac            *indieauth.Client
	config         *common.Config
	sessionMapLock sync.Mutex
	sessions       map[string]common.AuthInfo
}

func NewAuthClient(config *common.Config) *AuthClient {
	iac := indieauth.NewClient(config.ClientID, config.CallbackURI, nil)
	return &AuthClient{config: config, iac: iac, sessions: make(map[string]common.AuthInfo)}
}

func (c *AuthClient) GetAuthInfo(config *common.Config, r *http.Request) common.AuthInfo {
	cookie, err := r.Cookie(senaryAuthCookieName)
	user := common.AuthInfo{Name: "guest", Domain: config.ClientID, IsMaintainer: false}
	if cookie != nil && err == nil {
		c.sessionMapLock.Lock()
		if auth, exists := c.sessions[cookie.Value]; exists {
			user.Name = auth.Name
			user.Domain = auth.Domain
			user.IsMaintainer = config.IsMaintainer(auth.Domain)
			fmt.Printf("%v %v\n", user.IsMaintainer, auth.Domain)
		}
		c.sessionMapLock.Unlock()
	}
	return user
}

// loginHandler handles the login process after submitting the domain via the
// index page.
func (c *AuthClient) LoginHandler(w http.ResponseWriter, r *http.Request) {
	err := r.ParseForm()
	if err != nil {
		http.Error(w, err.Error(), http.StatusBadRequest)
		return
	}

	profileURL := r.FormValue("profile")
	if profileURL == "" {
		http.Error(w, "empty profile", http.StatusBadRequest)
		return
	}

	// After retrieving the profile URL from the login form, canonicalize it,
	// and check if it is valid.
	profileURL = indieauth.CanonicalizeURL(profileURL)
	if err := indieauth.IsValidProfileURL(profileURL); err != nil {
		http.Error(w, err.Error(), http.StatusBadRequest)
		return
	}

	// Generates the redirect request to the target profile so that the user can
	// authorize the request. We also ask for the "profile" and "email" scope so
	// that we can get more information about the user.
	authInfo, redirect, err := c.iac.Authenticate(r.Context(), profileURL, "profile email")
	if err != nil {
		http.Error(w, err.Error(), http.StatusBadRequest)
		return
	}

	// We store the authInfo in a cookie. This information will be later needed
	// to validate the callback request from the authentication server.
	err = c.storeAuthInfo(w, r, authInfo)
	if err != nil {
		http.Error(w, err.Error(), http.StatusBadRequest)
		return
	}

	// Redirect to the authentication server so that the user can authorize it.
	http.Redirect(w, r, redirect, http.StatusSeeOther)
}

// callbackHandler handles the callback from the authentication server.
func (c *AuthClient) CallbackHandler(w http.ResponseWriter, r *http.Request) {
	// Retrieve the authentication info from the cookie.
	authInfo, err := c.getAuthInfo(w, r)
	if err != nil {
		http.Error(w, err.Error(), http.StatusBadRequest)
		return
	}

	// Validate the callback using authInfo and the current request.
	code, err := c.iac.ValidateCallback(authInfo, r)
	if err != nil {
		http.Error(w, err.Error(), http.StatusBadRequest)
		return
	}

	// We now fetch the profile of the user so we know more about the user.
	// Depending on the authentication server, this information might be more
	// or less complete. However, ".Me" must always be present.
	profile, err := c.iac.FetchProfile(r.Context(), authInfo, code)
	if err != nil {
		http.Error(w, err.Error(), http.StatusBadRequest)
		return
	}

	// Validate the ".Me" - please note that loopback (localhost) is invalid.
	if err := indieauth.IsValidProfileURL(profile.Me); err != nil {
		http.Error(w, fmt.Sprintf("invalid 'me': %s", err), http.StatusBadRequest)
		return
	}

	// The user is now logged in to your application. We simply display a simple
	// page with the profile information. However, in your application, you likely
	// want to create a session cookie (or something similar) to know that the user
	// is logged in.
	w.Header().Set("Content-Type", "text/html; charset=utf-8")

	sessionID, err := common.RandomIdent(64)
	if err != nil {
		http.Error(w, fmt.Sprintf("invalid 'me': %s", err), http.StatusBadRequest)
		return
	}
	c.sessionMapLock.Lock()
	c.sessions[sessionID] = common.AuthInfo{Name: profile.Profile.Name, Domain: profile.Me}
	c.sessionMapLock.Unlock()

	http.SetCookie(w, &http.Cookie{
		Name:     senaryAuthCookieName,
		Value:    sessionID,
		Expires:  time.Now().Add(time.Hour * 24 * 10),
		Secure:   r.URL.Scheme == "https",
		HttpOnly: true,
		Path:     "/",
		SameSite: http.SameSiteLaxMode,
	})

	_ = c.config.Templates.ExecuteTemplate(w, "auth.success.tpl.html", c.sessions[sessionID])
}

// storeAuthInfo stores [indieauth.AuthInfo] into a cookie. This information is
// required to then validate the request once the callback is received. Note that
// this is just an example. You could use other methods, such as encoding with JWT
// tokens, a database, you name it.
func (c *AuthClient) storeAuthInfo(w http.ResponseWriter, r *http.Request, i *indieauth.AuthInfo) error {
	data, err := json.Marshal(i)
	if err != nil {
		return err
	}

	http.SetCookie(w, &http.Cookie{
		Name:     oauthCookieName,
		Value:    base64.StdEncoding.EncodeToString(data),
		Expires:  time.Now().Add(time.Minute * 10),
		Secure:   r.URL.Scheme == "https",
		HttpOnly: true,
		Path:     "/",
		SameSite: http.SameSiteLaxMode,
	})

	return nil
}

// getAuthInfo gets the [indieauth.AuthInfo] stored into a cookie.
func (c *AuthClient) getAuthInfo(w http.ResponseWriter, r *http.Request) (*indieauth.AuthInfo, error) {
	cookie, err := r.Cookie(oauthCookieName)
	if err != nil {
		return nil, err
	}

	value, err := base64.StdEncoding.DecodeString(cookie.Value)
	if err != nil {
		return nil, err
	}

	var i *indieauth.AuthInfo
	err = json.Unmarshal([]byte(value), &i)
	if err != nil {
		return nil, err
	}

	// Delete cookie.
	http.SetCookie(w, &http.Cookie{
		Name:     oauthCookieName,
		MaxAge:   -1,
		Secure:   r.URL.Scheme == "https",
		Path:     "/",
		HttpOnly: true,
	})

	return i, nil
}