feat: implement basic oidc functionality

frontend/src/pages/authorize-page.tsx

@@ -1,6 +1,6 @@
 import { useUserContext } from "@/context/user-context";
-import { useQuery } from "@tanstack/react-query";
-import { Navigate } from "react-router";
+import { useMutation, useQuery } from "@tanstack/react-query";
+import { Navigate, useNavigate } from "react-router";
 import { useLocation } from "react-router";
 import {
   Card,
@@ -11,6 +11,8 @@ import {
 } from "@/components/ui/card";
 import { getOidcClientInfoScehma } from "@/schemas/oidc-schemas";
 import { Button } from "@/components/ui/button";
+import axios from "axios";
+import { toast } from "sonner";
 
 type AuthorizePageProps = {
   scope: string;
@@ -25,6 +27,7 @@ const optionalAuthorizeProps = ["state"];
 export const AuthorizePage = () => {
   const { isLoggedIn } = useUserContext();
   const { search } = useLocation();
+  const navigate = useNavigate();
 
   const searchParams = new URLSearchParams(search);
 
@@ -46,12 +49,38 @@ export const AuthorizePage = () => {
     },
   });
 
+  const authorizeMutation = useMutation({
+    mutationFn: () => {
+      return axios.post("/api/oidc/authorize", {
+        scope: props.scope,
+        response_type: props.responseType,
+        client_id: props.clientId,
+        redirect_uri: props.redirectUri,
+        state: props.state,
+      });
+    },
+    mutationKey: ["authorize", props.clientId],
+    onSuccess: (data) => {
+      toast.info("Authorized", {
+        description: "You will be soon redirected to your application",
+      });
+      window.location.replace(
+        `${data.data.redirect_uri}?code=${encodeURIComponent(data.data.code)}&state=${encodeURIComponent(data.data.state)}`,
+      );
+    },
+    onError: (error) => {
+      window.location.replace(
+        `/error?error=${encodeURIComponent(error.message)}`,
+      );
+    },
+  });
+
   if (!isLoggedIn) {
     // TODO: Pass the params to the login page, so user can login -> authorize
     return <Navigate to="/login" replace />;
   }
 
-  for (const key in Object.keys(props)) {
+  Object.keys(props).forEach((key) => {
     if (
       !props[key as keyof AuthorizePageProps] &&
       !optionalAuthorizeProps.includes(key)
@@ -59,7 +88,7 @@ export const AuthorizePage = () => {
       // TODO: Add reason for error
       return <Navigate to="/error" replace />;
     }
-  }
+  });
 
   if (getClientInfo.isLoading) {
     return (
@@ -91,8 +120,19 @@ export const AuthorizePage = () => {
         </CardDescription>
       </CardHeader>
       <CardFooter className="flex flex-col items-stretch gap-2">
-        <Button>Authorize</Button>
-        <Button variant="outline">Cancel</Button>
+        <Button
+          onClick={() => authorizeMutation.mutate()}
+          loading={authorizeMutation.isPending}
+        >
+          Authorize
+        </Button>
+        <Button
+          onClick={() => navigate("/")}
+          disabled={authorizeMutation.isPending}
+          variant="outline"
+        >
+          Cancel
+        </Button>
       </CardFooter>
     </Card>
   );

internal/assets/migrations/000005_oidc_session.down.sql

@@ -0,0 +1,3 @@
+DROP TABLE IF EXISTS "oidc_tokens";
+DROP TABLE IF EXISTS "oidc_userinfo";
+DROP TABLE IF EXISTS "oidc_codes";

internal/assets/migrations/000005_oidc_session.up.sql

@@ -0,0 +1,25 @@
+CREATE TABLE IF NOT EXISTS "oidc_codes" (
+    "sub" TEXT NOT NULL UNIQUE,
+    "code" TEXT NOT NULL PRIMARY KEY UNIQUE,
+    "scope" TEXT NOT NULL,
+    "redirect_uri" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "expires_at" INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS "oidc_tokens" (
+    "sub" TEXT NOT NULL UNIQUE,
+    "access_token" TEXT NOT NULL PRIMARY KEY UNIQUE,
+    "scope" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "expires_at" INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS "oidc_userinfo" (
+    "sub" TEXT NOT NULL UNIQUE PRIMARY KEY,
+    "name" TEXT NOT NULL,
+    "preferred_username" TEXT NOT NULL,
+    "email" TEXT NOT NULL,
+    "groups" TEXT NOT NULL,
+    "updated_at" INTEGER NOT NULL
+);

internal/bootstrap/app_bootstrap.go

@@ -176,7 +176,7 @@ func (app *BootstrapApp) Setup() error {
 	app.context.configuredProviders = configuredProviders
 
 	// Setup router
-	router, err := app.setupRouter()
+	router, err := app.setupRouter(queries)
 
 	if err != nil {
 		return fmt.Errorf("failed to setup routes: %w", err)

internal/bootstrap/router_bootstrap.go

@@ -7,13 +7,14 @@ import (
 	"github.com/steveiliop56/tinyauth/internal/config"
 	"github.com/steveiliop56/tinyauth/internal/controller"
 	"github.com/steveiliop56/tinyauth/internal/middleware"
+	"github.com/steveiliop56/tinyauth/internal/repository"
 
 	"github.com/gin-gonic/gin"
 )
 
 var DEV_MODES = []string{"main", "test", "development"}
 
-func (app *BootstrapApp) setupRouter() (*gin.Engine, error) {
+func (app *BootstrapApp) setupRouter(queries *repository.Queries) (*gin.Engine, error) {
 	if !slices.Contains(DEV_MODES, config.Version) {
 		gin.SetMode(gin.ReleaseMode)
 	}
@@ -88,7 +89,8 @@ func (app *BootstrapApp) setupRouter() (*gin.Engine, error) {
 
 	oidcController := controller.NewOIDCController(controller.OIDCControllerConfig{
 		Clients: app.context.oidcClients,
-	}, apiRouter)
+		AppURL:  app.config.AppURL,
+	}, apiRouter, queries)
 
 	oidcController.SetupRoutes()
 

internal/controller/oidc_controller.go

@@ -1,30 +1,71 @@
 package controller
 
 import (
+	"fmt"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
 	"github.com/gin-gonic/gin"
+	"github.com/google/go-querystring/query"
 	"github.com/steveiliop56/tinyauth/internal/config"
+	"github.com/steveiliop56/tinyauth/internal/repository"
+	"github.com/steveiliop56/tinyauth/internal/utils"
 	"github.com/steveiliop56/tinyauth/internal/utils/tlog"
 )
 
+var (
+	SupportedResponseTypes = []string{"code"}
+	SupportedScopes        = []string{"openid", "profile", "email", "groups"}
+	SupportedGrantTypes    = []string{"authorization_code"}
+)
+
 type OIDCControllerConfig struct {
 	Clients []config.OIDCClientConfig
+	AppURL  string
 }
 
 type OIDCController struct {
-	clients []config.OIDCClientConfig
+	config  OIDCControllerConfig
 	router  *gin.RouterGroup
+	queries *repository.Queries
 }
 
-func NewOIDCController(config OIDCControllerConfig, router *gin.RouterGroup) *OIDCController {
+type AuthorizeRequest struct {
+	Scope        string `json:"scope" binding:"required"`
+	ResponseType string `json:"response_type" binding:"required"`
+	ClientID     string `json:"client_id" binding:"required"`
+	RedirectURI  string `json:"redirect_uri" binding:"required"`
+	State        string `json:"state" binding:"required"`
+}
+
+type TokenRequest struct {
+	GrantType   string `form:"grant_type" binding:"required"`
+	Code        string `form:"code" binding:"required"`
+	RedirectURI string `form:"redirect_uri" binding:"required"`
+}
+
+type CallbackError struct {
+	Error            string `url:"error"`
+	ErrorDescription string `url:"error_description"`
+	State            string `url:"state"`
+}
+
+func NewOIDCController(config OIDCControllerConfig, router *gin.RouterGroup, queries *repository.Queries) *OIDCController {
 	return &OIDCController{
-		clients: config.Clients,
+		config:  config,
 		router:  router,
+		queries: queries,
 	}
 }
 
 func (controller *OIDCController) SetupRoutes() {
 	oidcGroup := controller.router.Group("/oidc")
 	oidcGroup.GET("/clients/:id", controller.GetClientInfo)
+	oidcGroup.POST("/authorize", controller.Authorize)
+	oidcGroup.POST("/token", controller.Token)
+	oidcGroup.GET("/userinfo", controller.Userinfo)
 }
 
 type ClientRequest struct {
@@ -47,7 +88,7 @@ func (controller *OIDCController) GetClientInfo(c *gin.Context) {
 	var client *config.OIDCClientConfig
 
 	// Inefficient yeah, but it will be good until we have thousands of clients
-	for _, clientCfg := range controller.clients {
+	for _, clientCfg := range controller.config.Clients {
 		if clientCfg.ClientID == req.ClientID {
 			client = &clientCfg
 			break
@@ -69,3 +110,392 @@ func (controller *OIDCController) GetClientInfo(c *gin.Context) {
 		"name":   &client.Name,
 	})
 }
+
+func (controller *OIDCController) Authorize(c *gin.Context) {
+	// Check if we are logged in
+	userContext, err := utils.GetContext(c)
+
+	if err != nil {
+		tlog.App.Error().Err(err).Msg("Failed to get user context")
+		c.JSON(401, gin.H{
+			"status":  401,
+			"message": "Unauthorized",
+		})
+		return
+	}
+
+	// OIDC stuff
+	var req AuthorizeRequest
+
+	err = c.BindJSON(&req)
+	if err != nil {
+		tlog.App.Error().Err(err).Msg("Failed to bind JSON")
+		c.JSON(400, gin.H{
+			"status":  400,
+			"message": "Bad Request",
+		})
+		return
+	}
+
+	// TODO: All these errors should redirect to the error page with an explanation
+
+	// Validate client ID
+	var client *config.OIDCClientConfig
+
+	for _, clientCfg := range controller.config.Clients {
+		if clientCfg.ClientID == req.ClientID {
+			client = &clientCfg
+			break
+		}
+	}
+
+	if client == nil {
+		tlog.App.Warn().Str("client_id", req.ClientID).Msg("Client not found")
+		c.JSON(404, gin.H{
+			"status":  404,
+			"message": "Client not found",
+		})
+		return
+	}
+
+	// Validate redirect URI
+	if !slices.Contains(client.TrustedRedirectURLs, req.RedirectURI) {
+		tlog.App.Warn().Str("redirect_uri", req.RedirectURI).Msg("Redirect URI not trusted")
+		c.JSON(400, gin.H{
+			"status":  400,
+			"message": "Bad Request",
+		})
+		return
+	}
+
+	// Validate scopes
+	reqScopes := strings.Split(req.Scope, " ")
+	keptScopes := make([]string, 0)
+
+	if len(reqScopes) == 0 || strings.TrimSpace(req.Scope) == "" {
+		queries, err := query.Values(CallbackError{
+			Error:            "invalid_request",
+			ErrorDescription: "Missing scope parameter",
+			State:            req.State,
+		})
+
+		if err != nil {
+			tlog.App.Error().Err(err).Msg("Failed to build query")
+			c.Redirect(302, fmt.Sprintf("%s/error", controller.config.AppURL))
+			return
+		}
+
+		c.Redirect(302, fmt.Sprintf("%s/callback?%s", req.RedirectURI, queries.Encode()))
+		return
+	}
+
+	for _, scope := range reqScopes {
+		if slices.Contains(SupportedScopes, scope) {
+			keptScopes = append(keptScopes, scope)
+			continue
+		}
+		tlog.App.Warn().Str("scope", scope).Msg("Scope not supported, ignoring")
+	}
+
+	// Generate a code and a sub
+	code, err := utils.GetRandomString(32)
+
+	if err != nil {
+		tlog.App.Error().Err(err).Msg("Failed to generate random string")
+		c.Redirect(302, fmt.Sprintf("%s/error", controller.config.AppURL))
+		return
+	}
+
+	sub, err := utils.GetRandomInt(10)
+
+	if err != nil {
+		tlog.App.Error().Err(err).Msg("Failed to generate random integer")
+		c.Redirect(302, fmt.Sprintf("%s/error", controller.config.AppURL))
+		return
+	}
+
+	expiresAt := time.Now().Add(time.Minute * time.Duration(10)).Unix()
+
+	// Insert the code into the database
+	_, err = controller.queries.CreateOidcCode(c, repository.CreateOidcCodeParams{
+		Code:        code,
+		Sub:         strconv.Itoa(int(sub)),
+		Scope:       strings.Join(keptScopes, ","),
+		RedirectURI: req.RedirectURI,
+		ClientID:    client.ClientID,
+		ExpiresAt:   expiresAt,
+	})
+
+	if err != nil {
+		tlog.App.Error().Err(err).Msg("Failed to insert code into database")
+		c.Redirect(302, fmt.Sprintf("%s/error", controller.config.AppURL))
+		return
+	}
+
+	// We also need a snapshot of the user that authorized this
+	userInfoParams := repository.CreateOidcUserInfoParams{
+		Sub:               strconv.Itoa(int(sub)),
+		Name:              userContext.Name,
+		Email:             userContext.Email,
+		PreferredUsername: userContext.Username,
+		UpdatedAt:         time.Now().Unix(),
+	}
+
+	if userContext.Provider == "ldap" {
+		userInfoParams.Groups = userContext.LdapGroups
+	}
+
+	if userContext.OAuth && len(userContext.OAuthGroups) > 0 {
+		userInfoParams.Groups = userContext.OAuthGroups
+	}
+
+	_, err = controller.queries.CreateOidcUserInfo(c, userInfoParams)
+
+	if err != nil {
+		tlog.App.Error().Err(err).Msg("Failed to insert user info into database")
+		c.Redirect(302, fmt.Sprintf("%s/error", controller.config.AppURL))
+		return
+	}
+
+	// Return code and done
+	c.JSON(200, gin.H{
+		"status":       200,
+		"message":      "Authorized",
+		"code":         code,
+		"state":        req.State,
+		"redirect_uri": req.RedirectURI,
+	})
+}
+
+func (controller *OIDCController) Token(c *gin.Context) {
+	// Get basic auth
+	clientId, clientSecret, ok := c.Request.BasicAuth()
+
+	if !ok {
+		tlog.App.Error().Msg("Missing token verifier")
+		c.JSON(400, gin.H{
+			"error": "invalid_request",
+		})
+		return
+	}
+
+	// Ensure client exists
+	var client *config.OIDCClientConfig
+
+	for _, clientCfg := range controller.config.Clients {
+		if clientCfg.ClientID == clientId {
+			client = &clientCfg
+			break
+		}
+	}
+
+	if client == nil {
+		tlog.App.Warn().Str("client_id", clientId).Msg("Client not found")
+		c.JSON(400, gin.H{
+			"error": "invalid_request",
+		})
+		return
+	}
+
+	if client.ClientSecret != clientSecret {
+		tlog.App.Warn().Str("client_id", clientId).Msg("Invalid client secret")
+		c.JSON(400, gin.H{
+			"error": "invalid_client",
+		})
+		return
+	}
+
+	// Get token
+	var req TokenRequest
+
+	err := c.Bind(&req)
+	if err != nil {
+		tlog.App.Error().Err(err).Msg("Failed to bind token request")
+		c.JSON(400, gin.H{
+			"error": "invalid_request",
+		})
+		return
+	}
+
+	// Validate grant type
+	if !slices.Contains(SupportedGrantTypes, req.GrantType) {
+		tlog.App.Warn().Str("grant_type", req.GrantType).Msg("Unsupported grant type")
+		c.JSON(400, gin.H{
+			"error": "unsupported_grant_type",
+		})
+		return
+	}
+
+	// Find pending code entry
+	entry, err := controller.queries.GetOidcCode(c, req.Code)
+
+	if err != nil {
+		tlog.App.Error().Err(err).Msg("Failed to find code in database")
+		c.JSON(400, gin.H{
+			"error": "invalid_request",
+		})
+		return
+	}
+
+	// Ensure redirect URIs match
+	if entry.RedirectURI != req.RedirectURI {
+		tlog.App.Warn().Str("redirect_uri", req.RedirectURI).Msg("Redirect URI mismatch")
+		c.JSON(400, gin.H{
+			"error": "invalid_request",
+		})
+		return
+	}
+
+	// Generate access token
+	genToken, err := utils.GetRandomString(29)
+
+	if err != nil {
+		tlog.App.Error().Err(err).Msg("Failed to generate access token")
+		c.JSON(400, gin.H{
+			"error": "invalid_request",
+		})
+		return
+	}
+
+	// Add tinyauth prefix
+	token := fmt.Sprintf("ta-%s", genToken)
+
+	// TODO: either add a refresh token or customize token expiry
+	expiresAt := time.Now().Add(time.Duration(3600) * time.Second).Unix()
+
+	// Create token entry
+	_, err = controller.queries.CreateOidcToken(c, repository.CreateOidcTokenParams{
+		Sub:         entry.Sub,
+		AccessToken: token,
+		Scope:       entry.Scope,
+		ClientID:    client.ClientID,
+		ExpiresAt:   expiresAt,
+	})
+
+	if err != nil {
+		tlog.App.Error().Err(err).Msg("Failed to create token in database")
+		c.JSON(400, gin.H{
+			"error": "invalid_request",
+		})
+		return
+	}
+
+	// Delete code entry
+	err = controller.queries.DeleteOidcCode(c, entry.Code)
+
+	if err != nil {
+		tlog.App.Error().Err(err).Msg("Failed to delete code in database")
+		c.JSON(400, gin.H{
+			"error": "invalid_request",
+		})
+		return
+	}
+
+	// Respond with token
+	c.JSON(200, gin.H{
+		"access_token": token,
+		"token_type":   "bearer",
+		"expires_in":   3600,
+	})
+}
+
+func (controller *OIDCController) Userinfo(c *gin.Context) {
+	// Get bearer
+	authorizationHeader := c.GetHeader("Authorization")
+
+	tokenType, token, ok := strings.Cut(authorizationHeader, " ")
+
+	if !ok {
+		tlog.App.Warn().Msg("OIDC userinfo accessed without authorization header")
+		c.JSON(401, gin.H{
+			"error": "invalid_request",
+		})
+		return
+	}
+
+	if strings.ToLower(tokenType) != "bearer" {
+		tlog.App.Warn().Msg("OIDC userinfo accessed with invalid token type")
+		c.JSON(401, gin.H{
+			"error": "invalid_request",
+		})
+		return
+	}
+
+	// Get token entry
+	entry, err := controller.queries.GetOidcToken(c, token)
+
+	if err != nil {
+		tlog.App.Err(err).Msg("Failed to get token entry")
+		c.JSON(401, gin.H{
+			"error": "invalid_request",
+		})
+		return
+	}
+
+	// Get scopes
+	scopes := strings.Split(entry.Scope, ",")
+
+	// Check if token is expired
+	if time.Now().Unix() > entry.ExpiresAt {
+		tlog.App.Warn().Msg("OIDC userinfo accessed with expired token")
+
+		err = controller.queries.DeleteOidcToken(c, entry.AccessToken)
+		if err != nil {
+			tlog.App.Err(err).Msg("Failed to delete expired token")
+		}
+
+		err = controller.queries.DeleteOidcUserInfo(c, entry.Sub)
+		if err != nil {
+			tlog.App.Err(err).Msg("Failed to delete oidc user info")
+		}
+
+		c.JSON(401, gin.H{
+			"error": "invalid_request",
+		})
+		return
+	}
+
+	// Get user info
+	user, err := controller.queries.GetOidcUserInfo(c, entry.Sub)
+
+	if err != nil {
+		tlog.App.Err(err).Msg("Failed to get user entry")
+		c.JSON(401, gin.H{
+			"error": "invalid_request",
+		})
+		return
+	}
+
+	// If we don't have the openid scope, return an error
+	if !slices.Contains(scopes, "openid") {
+		tlog.App.Warn().Msg("OIDC userinfo accessed without openid scope")
+		c.JSON(401, gin.H{
+			"error": "invalid_request",
+		})
+		return
+	}
+
+	// Let's build the response
+	res := map[string]any{
+		"sub":        user.Sub,
+		"updated_at": user.UpdatedAt,
+	}
+
+	// If we have the profile scope, add the profile stuff
+	if slices.Contains(scopes, "profile") {
+		res["name"] = user.Name
+		res["preferred_username"] = user.PreferredUsername
+	}
+
+	// If we have the email scope, add the email stuff
+	if slices.Contains(scopes, "email") {
+		res["email"] = user.Email
+	}
+
+	// If we have the groups scope, add the groups stuff
+	if slices.Contains(scopes, "groups") {
+		res["groups"] = user.Groups
+	}
+
+	c.JSON(200, res)
+}

internal/middleware/context_middleware.go

@@ -2,6 +2,7 @@ package middleware
 
 import (
 	"fmt"
+	"slices"
 	"strings"
 	"time"
 
@@ -13,6 +14,8 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
+var OIDCIgnorePaths = []string{"/api/oidc/token", "/api/oidc/userinfo"}
+
 type ContextMiddlewareConfig struct {
 	CookieDomain string
 }
@@ -37,6 +40,13 @@ func (m *ContextMiddleware) Init() error {
 
 func (m *ContextMiddleware) Middleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
+		// There is no point in trying to get credentials if it's an OIDC endpoint
+		path := c.Request.URL.Path
+		if slices.Contains(OIDCIgnorePaths, path) {
+			c.Next()
+			return
+		}
+
 		cookie, err := m.auth.GetSessionCookie(c)
 
 		if err != nil {

internal/repository/models.go

@@ -4,6 +4,32 @@
 
 package repository
 
+type OidcCode struct {
+	Sub         string
+	Code        string
+	Scope       string
+	RedirectURI string
+	ClientID    string
+	ExpiresAt   int64
+}
+
+type OidcToken struct {
+	Sub         string
+	AccessToken string
+	Scope       string
+	ClientID    string
+	ExpiresAt   int64
+}
+
+type OidcUserinfo struct {
+	Sub               string
+	Name              string
+	PreferredUsername string
+	Email             string
+	Groups            string
+	UpdatedAt         int64
+}
+
 type Session struct {
 	UUID        string
 	Username    string

internal/repository/oidc_queries.sql.go

@@ -0,0 +1,224 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.30.0
+// source: oidc_queries.sql
+
+package repository
+
+import (
+	"context"
+)
+
+const createOidcCode = `-- name: CreateOidcCode :one
+INSERT INTO "oidc_codes" (
+    "sub",
+    "code",
+    "scope",
+    "redirect_uri",
+    "client_id",
+    "expires_at"
+) VALUES (
+    ?, ?, ?, ?, ?, ?
+)
+RETURNING sub, code, scope, redirect_uri, client_id, expires_at
+`
+
+type CreateOidcCodeParams struct {
+	Sub         string
+	Code        string
+	Scope       string
+	RedirectURI string
+	ClientID    string
+	ExpiresAt   int64
+}
+
+func (q *Queries) CreateOidcCode(ctx context.Context, arg CreateOidcCodeParams) (OidcCode, error) {
+	row := q.db.QueryRowContext(ctx, createOidcCode,
+		arg.Sub,
+		arg.Code,
+		arg.Scope,
+		arg.RedirectURI,
+		arg.ClientID,
+		arg.ExpiresAt,
+	)
+	var i OidcCode
+	err := row.Scan(
+		&i.Sub,
+		&i.Code,
+		&i.Scope,
+		&i.RedirectURI,
+		&i.ClientID,
+		&i.ExpiresAt,
+	)
+	return i, err
+}
+
+const createOidcToken = `-- name: CreateOidcToken :one
+INSERT INTO "oidc_tokens" (
+    "sub",
+    "access_token",
+    "scope",
+    "client_id",
+    "expires_at"
+) VALUES (
+    ?, ?, ?, ?, ?
+)
+RETURNING sub, access_token, scope, client_id, expires_at
+`
+
+type CreateOidcTokenParams struct {
+	Sub         string
+	AccessToken string
+	Scope       string
+	ClientID    string
+	ExpiresAt   int64
+}
+
+func (q *Queries) CreateOidcToken(ctx context.Context, arg CreateOidcTokenParams) (OidcToken, error) {
+	row := q.db.QueryRowContext(ctx, createOidcToken,
+		arg.Sub,
+		arg.AccessToken,
+		arg.Scope,
+		arg.ClientID,
+		arg.ExpiresAt,
+	)
+	var i OidcToken
+	err := row.Scan(
+		&i.Sub,
+		&i.AccessToken,
+		&i.Scope,
+		&i.ClientID,
+		&i.ExpiresAt,
+	)
+	return i, err
+}
+
+const createOidcUserInfo = `-- name: CreateOidcUserInfo :one
+INSERT INTO "oidc_userinfo" (
+    "sub",
+    "name",
+    "preferred_username",
+    "email",
+    "groups",
+    "updated_at"
+) VALUES (
+    ?, ?, ?, ?, ?, ?
+)
+RETURNING sub, name, preferred_username, email, "groups", updated_at
+`
+
+type CreateOidcUserInfoParams struct {
+	Sub               string
+	Name              string
+	PreferredUsername string
+	Email             string
+	Groups            string
+	UpdatedAt         int64
+}
+
+func (q *Queries) CreateOidcUserInfo(ctx context.Context, arg CreateOidcUserInfoParams) (OidcUserinfo, error) {
+	row := q.db.QueryRowContext(ctx, createOidcUserInfo,
+		arg.Sub,
+		arg.Name,
+		arg.PreferredUsername,
+		arg.Email,
+		arg.Groups,
+		arg.UpdatedAt,
+	)
+	var i OidcUserinfo
+	err := row.Scan(
+		&i.Sub,
+		&i.Name,
+		&i.PreferredUsername,
+		&i.Email,
+		&i.Groups,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const deleteOidcCode = `-- name: DeleteOidcCode :exec
+DELETE FROM "oidc_codes"
+WHERE "code" = ?
+`
+
+func (q *Queries) DeleteOidcCode(ctx context.Context, code string) error {
+	_, err := q.db.ExecContext(ctx, deleteOidcCode, code)
+	return err
+}
+
+const deleteOidcToken = `-- name: DeleteOidcToken :exec
+DELETE FROM "oidc_tokens"
+WHERE "access_token" = ?
+`
+
+func (q *Queries) DeleteOidcToken(ctx context.Context, accessToken string) error {
+	_, err := q.db.ExecContext(ctx, deleteOidcToken, accessToken)
+	return err
+}
+
+const deleteOidcUserInfo = `-- name: DeleteOidcUserInfo :exec
+DELETE FROM "oidc_userinfo"
+WHERE "sub" = ?
+`
+
+func (q *Queries) DeleteOidcUserInfo(ctx context.Context, sub string) error {
+	_, err := q.db.ExecContext(ctx, deleteOidcUserInfo, sub)
+	return err
+}
+
+const getOidcCode = `-- name: GetOidcCode :one
+SELECT sub, code, scope, redirect_uri, client_id, expires_at FROM "oidc_codes"
+WHERE "code" = ?
+`
+
+func (q *Queries) GetOidcCode(ctx context.Context, code string) (OidcCode, error) {
+	row := q.db.QueryRowContext(ctx, getOidcCode, code)
+	var i OidcCode
+	err := row.Scan(
+		&i.Sub,
+		&i.Code,
+		&i.Scope,
+		&i.RedirectURI,
+		&i.ClientID,
+		&i.ExpiresAt,
+	)
+	return i, err
+}
+
+const getOidcToken = `-- name: GetOidcToken :one
+SELECT sub, access_token, scope, client_id, expires_at FROM "oidc_tokens"
+WHERE "access_token" = ?
+`
+
+func (q *Queries) GetOidcToken(ctx context.Context, accessToken string) (OidcToken, error) {
+	row := q.db.QueryRowContext(ctx, getOidcToken, accessToken)
+	var i OidcToken
+	err := row.Scan(
+		&i.Sub,
+		&i.AccessToken,
+		&i.Scope,
+		&i.ClientID,
+		&i.ExpiresAt,
+	)
+	return i, err
+}
+
+const getOidcUserInfo = `-- name: GetOidcUserInfo :one
+SELECT sub, name, preferred_username, email, "groups", updated_at FROM "oidc_userinfo"
+WHERE "sub" = ?
+`
+
+func (q *Queries) GetOidcUserInfo(ctx context.Context, sub string) (OidcUserinfo, error) {
+	row := q.db.QueryRowContext(ctx, getOidcUserInfo, sub)
+	var i OidcUserinfo
+	err := row.Scan(
+		&i.Sub,
+		&i.Name,
+		&i.PreferredUsername,
+		&i.Email,
+		&i.Groups,
+		&i.UpdatedAt,
+	)
+	return i, err
+}

internal/repository/session_queries.sql.go

@@ -1,7 +1,7 @@
 // Code generated by sqlc. DO NOT EDIT.
 // versions:
 //   sqlc v1.30.0
-// source: queries.sql
+// source: session_queries.sql
 
 package repository
 
@@ -10,7 +10,7 @@ import (
 )
 
 const createSession = `-- name: CreateSession :one
-INSERT INTO sessions (
+INSERT INTO "sessions" (
     "uuid",
     "username",
     "email",

internal/utils/security_utils.go

@@ -1,8 +1,11 @@
 package utils
 
 import (
+	"crypto/rand"
 	"encoding/base64"
 	"errors"
+	"math"
+	"math/big"
 	"net"
 	"regexp"
 	"strings"
@@ -105,3 +108,28 @@ func GenerateUUID(str string) string {
 	uuid := uuid.NewSHA1(uuid.NameSpaceURL, []byte(str))
 	return uuid.String()
 }
+
+// These could definitely be improved A LOT but at least they are cryptographically secure
+func GetRandomString(length int) (string, error) {
+	if length < 1 {
+		return "", errors.New("length must be greater than 0")
+	}
+	b := make([]byte, length)
+	_, err := rand.Read(b)
+	if err != nil {
+		return "", err
+	}
+	state := base64.RawURLEncoding.EncodeToString(b)
+	return state[:length], nil
+}
+
+func GetRandomInt(length int) (int64, error) {
+	if length < 1 {
+		return 0, errors.New("length must be greater than 0")
+	}
+	a, err := rand.Int(rand.Reader, big.NewInt(int64(math.Pow(10, float64(length)))))
+	if err != nil {
+		return 0, err
+	}
+	return a.Int64(), nil
+}

internal/utils/security_utils_test.go

@@ -2,6 +2,7 @@ package utils_test
 
 import (
 	"os"
+	"strconv"
 	"testing"
 
 	"github.com/steveiliop56/tinyauth/internal/utils"
@@ -147,3 +148,25 @@ func TestGenerateUUID(t *testing.T) {
 	id3 := utils.GenerateUUID("differentstring")
 	assert.Assert(t, id1 != id3)
 }
+
+func TestGetRandomString(t *testing.T) {
+	// Test with normal length
+	state, err := utils.GetRandomString(16)
+	assert.NilError(t, err)
+	assert.Equal(t, 16, len(state))
+
+	// Test with zero length
+	state, err = utils.GetRandomString(0)
+	assert.Error(t, err, "length must be greater than 0")
+}
+
+func TestGetRandomInt(t *testing.T) {
+	// Test with normal length
+	state, err := utils.GetRandomInt(16)
+	assert.NilError(t, err)
+	assert.Equal(t, 16, len(strconv.Itoa(int(state))))
+
+	// Test with zero length
+	state, err = utils.GetRandomInt(0)
+	assert.Error(t, err, "length must be greater than 0")
+}

sql/oidc_queries.sql

@@ -0,0 +1,61 @@
+-- name: CreateOidcCode :one
+INSERT INTO "oidc_codes" (
+    "sub",
+    "code",
+    "scope",
+    "redirect_uri",
+    "client_id",
+    "expires_at"
+) VALUES (
+    ?, ?, ?, ?, ?, ?
+)
+RETURNING *;
+
+-- name: DeleteOidcCode :exec
+DELETE FROM "oidc_codes"
+WHERE "code" = ?;
+
+-- name: GetOidcCode :one
+SELECT * FROM "oidc_codes"
+WHERE "code" = ?;
+
+-- name: CreateOidcToken :one
+INSERT INTO "oidc_tokens" (
+    "sub",
+    "access_token",
+    "scope",
+    "client_id",
+    "expires_at"
+) VALUES (
+    ?, ?, ?, ?, ?
+)
+RETURNING *;
+
+-- name: DeleteOidcToken :exec
+DELETE FROM "oidc_tokens"
+WHERE "access_token" = ?;
+
+-- name: GetOidcToken :one
+SELECT * FROM "oidc_tokens"
+WHERE "access_token" = ?;
+
+-- name: CreateOidcUserInfo :one
+INSERT INTO "oidc_userinfo" (
+    "sub",
+    "name",
+    "preferred_username",
+    "email",
+    "groups",
+    "updated_at"
+) VALUES (
+    ?, ?, ?, ?, ?, ?
+)
+RETURNING *;
+
+-- name: DeleteOidcUserInfo :exec
+DELETE FROM "oidc_userinfo"
+WHERE "sub" = ?;
+
+-- name: GetOidcUserInfo :one
+SELECT * FROM "oidc_userinfo"
+WHERE "sub" = ?;

sql/oidc_schemas.sql

@@ -0,0 +1,25 @@
+CREATE TABLE IF NOT EXISTS "oidc_codes" (
+    "sub" TEXT NOT NULL UNIQUE,
+    "code" TEXT NOT NULL PRIMARY KEY UNIQUE,
+    "scope" TEXT NOT NULL,
+    "redirect_uri" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "expires_at" INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS "oidc_tokens" (
+    "sub" TEXT NOT NULL UNIQUE,
+    "access_token" TEXT NOT NULL PRIMARY KEY UNIQUE,
+    "scope" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "expires_at" INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS "oidc_userinfo" (
+    "sub" TEXT NOT NULL UNIQUE PRIMARY KEY,
+    "name" TEXT NOT NULL,
+    "preferred_username" TEXT NOT NULL,
+    "email" TEXT NOT NULL,
+    "groups" TEXT NOT NULL,
+    "updated_at" INTEGER NOT NULL
+);

sql/session_queries.sql

@@ -1,5 +1,5 @@
 -- name: CreateSession :one
-INSERT INTO sessions (
+INSERT INTO "sessions" (
     "uuid",
     "username",
     "email",

sqlc.yml

@@ -1,8 +1,8 @@
 version: "2"
 sql:
   - engine: "sqlite"
-    queries: "sql/queries.sql"
-    schema: "sql/schema.sql"
+    queries: "sql/*_queries.sql"
+    schema: "sql/*_schemas.sql"
     gen:
       go:
         package: "repository"
@@ -12,6 +12,7 @@ sql:
           oauth_groups: "OAuthGroups"
           oauth_name: "OAuthName"
           oauth_sub: "OAuthSub"
+          redirect_uri: "RedirectURI"
         overrides:
           - column: "sessions.oauth_groups"
             go_type: "string"