mirror of
https://github.com/steveiliop56/tinyauth.git
synced 2026-04-21 04:58:15 +00:00
Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 dependabot[bot]
|
bd7c80bd4a |
@@ -19,7 +19,7 @@ jobs:
|
|||||||
REPO: ${{ github.event.repository.name }}
|
REPO: ${{ github.event.repository.name }}
|
||||||
|
|
||||||
- name: Create release
|
- name: Create release
|
||||||
uses: softprops/action-gh-release@v3
|
uses: softprops/action-gh-release@v2
|
||||||
with:
|
with:
|
||||||
prerelease: true
|
prerelease: true
|
||||||
tag_name: nightly
|
tag_name: nightly
|
||||||
@@ -459,7 +459,7 @@ jobs:
|
|||||||
merge-multiple: true
|
merge-multiple: true
|
||||||
|
|
||||||
- name: Release
|
- name: Release
|
||||||
uses: softprops/action-gh-release@v3
|
uses: softprops/action-gh-release@v2
|
||||||
with:
|
with:
|
||||||
files: binaries/*
|
files: binaries/*
|
||||||
tag_name: nightly
|
tag_name: nightly
|
||||||
|
|||||||
@@ -426,6 +426,6 @@ jobs:
|
|||||||
merge-multiple: true
|
merge-multiple: true
|
||||||
|
|
||||||
- name: Release
|
- name: Release
|
||||||
uses: softprops/action-gh-release@v3
|
uses: softprops/action-gh-release@v2
|
||||||
with:
|
with:
|
||||||
files: binaries/*
|
files: binaries/*
|
||||||
|
|||||||
@@ -9,10 +9,6 @@
|
|||||||
<link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
|
<link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
|
||||||
<meta name="apple-mobile-web-app-title" content="Tinyauth" />
|
<meta name="apple-mobile-web-app-title" content="Tinyauth" />
|
||||||
<meta name="robots" content="nofollow, noindex" />
|
<meta name="robots" content="nofollow, noindex" />
|
||||||
<meta
|
|
||||||
name="description"
|
|
||||||
content="The tiniest authentication and authorization server you have ever seen."
|
|
||||||
/>
|
|
||||||
<link rel="manifest" href="/site.webmanifest" />
|
<link rel="manifest" href="/site.webmanifest" />
|
||||||
<title>Tinyauth</title>
|
<title>Tinyauth</title>
|
||||||
</head>
|
</head>
|
||||||
|
|||||||
@@ -21,7 +21,7 @@ export const LanguageSelector = () => {
|
|||||||
|
|
||||||
return (
|
return (
|
||||||
<Select onValueChange={handleSelect} value={language}>
|
<Select onValueChange={handleSelect} value={language}>
|
||||||
<SelectTrigger aria-label="Select language">
|
<SelectTrigger>
|
||||||
<SelectValue placeholder="Select language" />
|
<SelectValue placeholder="Select language" />
|
||||||
</SelectTrigger>
|
</SelectTrigger>
|
||||||
<SelectContent>
|
<SelectContent>
|
||||||
|
|||||||
@@ -11,33 +11,6 @@ export const oidcParamsSchema = z.object({
|
|||||||
code_challenge_method: z.string().optional(),
|
code_challenge_method: z.string().optional(),
|
||||||
});
|
});
|
||||||
|
|
||||||
function b64urlDecode(s: string): string {
|
|
||||||
const base64 = s.replace(/-/g, "+").replace(/_/g, "/");
|
|
||||||
return atob(base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), "="));
|
|
||||||
}
|
|
||||||
|
|
||||||
function decodeRequestObject(jwt: string): Record<string, string> {
|
|
||||||
try {
|
|
||||||
// Must have exactly 3 parts: header, payload, signature
|
|
||||||
const parts = jwt.split(".");
|
|
||||||
if (parts.length !== 3) return {};
|
|
||||||
|
|
||||||
// Header must specify "alg": "none" and signature must be empty string
|
|
||||||
const header = JSON.parse(b64urlDecode(parts[0]));
|
|
||||||
if (!header || typeof header !== "object" || header.alg !== "none" || parts[2] !== "") return {};
|
|
||||||
|
|
||||||
const payload = JSON.parse(b64urlDecode(parts[1]));
|
|
||||||
if (!payload || typeof payload !== "object" || Array.isArray(payload)) return {};
|
|
||||||
const result: Record<string, string> = {};
|
|
||||||
for (const [k, v] of Object.entries(payload)) {
|
|
||||||
if (typeof v === "string") result[k] = v;
|
|
||||||
}
|
|
||||||
return result;
|
|
||||||
} catch {
|
|
||||||
return {};
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
export const useOIDCParams = (
|
export const useOIDCParams = (
|
||||||
params: URLSearchParams,
|
params: URLSearchParams,
|
||||||
): {
|
): {
|
||||||
@@ -47,15 +20,6 @@ export const useOIDCParams = (
|
|||||||
compiled: string;
|
compiled: string;
|
||||||
} => {
|
} => {
|
||||||
const obj = Object.fromEntries(params.entries());
|
const obj = Object.fromEntries(params.entries());
|
||||||
|
|
||||||
// RFC 9101 / OIDC Core 6.1: if `request` param present, decode JWT payload
|
|
||||||
// and merge claims over top-level params (JWT claims take precedence)
|
|
||||||
const requestJwt = params.get("request");
|
|
||||||
if (requestJwt) {
|
|
||||||
const claims = decodeRequestObject(requestJwt);
|
|
||||||
Object.assign(obj, claims);
|
|
||||||
}
|
|
||||||
|
|
||||||
const parsed = oidcParamsSchema.safeParse(obj);
|
const parsed = oidcParamsSchema.safeParse(obj);
|
||||||
|
|
||||||
if (parsed.success) {
|
if (parsed.success) {
|
||||||
|
|||||||
+35
-37
@@ -23,41 +23,39 @@ import { TooltipProvider } from "@/components/ui/tooltip";
|
|||||||
const queryClient = new QueryClient();
|
const queryClient = new QueryClient();
|
||||||
|
|
||||||
createRoot(document.getElementById("root")!).render(
|
createRoot(document.getElementById("root")!).render(
|
||||||
<main>
|
<StrictMode>
|
||||||
<StrictMode>
|
<QueryClientProvider client={queryClient}>
|
||||||
<QueryClientProvider client={queryClient}>
|
<AppContextProvider>
|
||||||
<AppContextProvider>
|
<UserContextProvider>
|
||||||
<UserContextProvider>
|
<TooltipProvider>
|
||||||
<TooltipProvider>
|
<ThemeProvider defaultTheme="system" storageKey="tinyauth-theme">
|
||||||
<ThemeProvider defaultTheme="system" storageKey="tinyauth-theme">
|
<BrowserRouter>
|
||||||
<BrowserRouter>
|
<Routes>
|
||||||
<Routes>
|
<Route element={<Layout />} errorElement={<ErrorPage />}>
|
||||||
<Route element={<Layout />} errorElement={<ErrorPage />}>
|
<Route path="/" element={<App />} />
|
||||||
<Route path="/" element={<App />} />
|
<Route path="/login" element={<LoginPage />} />
|
||||||
<Route path="/login" element={<LoginPage />} />
|
<Route path="/authorize" element={<AuthorizePage />} />
|
||||||
<Route path="/authorize" element={<AuthorizePage />} />
|
<Route path="/logout" element={<LogoutPage />} />
|
||||||
<Route path="/logout" element={<LogoutPage />} />
|
<Route path="/continue" element={<ContinuePage />} />
|
||||||
<Route path="/continue" element={<ContinuePage />} />
|
<Route path="/totp" element={<TotpPage />} />
|
||||||
<Route path="/totp" element={<TotpPage />} />
|
<Route
|
||||||
<Route
|
path="/forgot-password"
|
||||||
path="/forgot-password"
|
element={<ForgotPasswordPage />}
|
||||||
element={<ForgotPasswordPage />}
|
/>
|
||||||
/>
|
<Route
|
||||||
<Route
|
path="/unauthorized"
|
||||||
path="/unauthorized"
|
element={<UnauthorizedPage />}
|
||||||
element={<UnauthorizedPage />}
|
/>
|
||||||
/>
|
<Route path="/error" element={<ErrorPage />} />
|
||||||
<Route path="/error" element={<ErrorPage />} />
|
<Route path="*" element={<NotFoundPage />} />
|
||||||
<Route path="*" element={<NotFoundPage />} />
|
</Route>
|
||||||
</Route>
|
</Routes>
|
||||||
</Routes>
|
</BrowserRouter>
|
||||||
</BrowserRouter>
|
<Toaster />
|
||||||
<Toaster />
|
</ThemeProvider>
|
||||||
</ThemeProvider>
|
</TooltipProvider>
|
||||||
</TooltipProvider>
|
</UserContextProvider>
|
||||||
</UserContextProvider>
|
</AppContextProvider>
|
||||||
</AppContextProvider>
|
</QueryClientProvider>
|
||||||
</QueryClientProvider>
|
</StrictMode>,
|
||||||
</StrictMode>
|
|
||||||
</main>,
|
|
||||||
);
|
);
|
||||||
|
|||||||
@@ -52,11 +52,6 @@ export default defineConfig({
|
|||||||
changeOrigin: true,
|
changeOrigin: true,
|
||||||
rewrite: (path) => path.replace(/^\/\.well-known/, ""),
|
rewrite: (path) => path.replace(/^\/\.well-known/, ""),
|
||||||
},
|
},
|
||||||
"/robots.txt": {
|
|
||||||
target: "http://tinyauth-backend:3000/robots.txt",
|
|
||||||
changeOrigin: true,
|
|
||||||
rewrite: (path) => path.replace(/^\/robots.txt/, ""),
|
|
||||||
},
|
|
||||||
},
|
},
|
||||||
allowedHosts: true,
|
allowedHosts: true,
|
||||||
},
|
},
|
||||||
|
|||||||
@@ -1 +0,0 @@
|
|||||||
ALTER TABLE "oidc_tokens" DROP COLUMN "code_hash";
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
ALTER TABLE "oidc_tokens" ADD COLUMN "code_hash" TEXT NOT NULL DEFAULT "";
|
|
||||||
@@ -44,8 +44,6 @@ func NewBootstrapApp(config config.Config) *BootstrapApp {
|
|||||||
}
|
}
|
||||||
|
|
||||||
func (app *BootstrapApp) Setup() error {
|
func (app *BootstrapApp) Setup() error {
|
||||||
fmt.Println("Tinyauth is moving to an organization! All versions after v5.0.7 will be released under ghcr.io/tinyauthapp/tinyauth. Existing images will continue to work but new features and updates (including security ones) will only be released under the new image path.")
|
|
||||||
|
|
||||||
// get app url
|
// get app url
|
||||||
appUrl, err := url.Parse(app.config.AppURL)
|
appUrl, err := url.Parse(app.config.AppURL)
|
||||||
|
|
||||||
|
|||||||
@@ -275,9 +275,6 @@ func (controller *OIDCController) Token(c *gin.Context) {
|
|||||||
case "authorization_code":
|
case "authorization_code":
|
||||||
entry, err := controller.oidc.GetCodeEntry(c, controller.oidc.Hash(req.Code), client.ClientID)
|
entry, err := controller.oidc.GetCodeEntry(c, controller.oidc.Hash(req.Code), client.ClientID)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
if err := controller.oidc.DeleteTokenByCodeHash(c, controller.oidc.Hash(req.Code)); err != nil {
|
|
||||||
tlog.App.Error().Err(err).Msg("Failed to delete access token by code hash")
|
|
||||||
}
|
|
||||||
if errors.Is(err, service.ErrCodeNotFound) {
|
if errors.Is(err, service.ErrCodeNotFound) {
|
||||||
tlog.App.Warn().Msg("Code not found")
|
tlog.App.Warn().Msg("Code not found")
|
||||||
c.JSON(400, gin.H{
|
c.JSON(400, gin.H{
|
||||||
|
|||||||
@@ -387,7 +387,7 @@ func TestOIDCController(t *testing.T) {
|
|||||||
err = json.Unmarshal(secondRecorder.Body.Bytes(), &secondRes)
|
err = json.Unmarshal(secondRecorder.Body.Bytes(), &secondRes)
|
||||||
assert.NoError(t, err)
|
assert.NoError(t, err)
|
||||||
|
|
||||||
assert.Equal(t, "invalid_grant", secondRes["error"])
|
assert.Equal(t, secondRes["error"], "invalid_grant")
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
@@ -778,74 +778,6 @@ func TestOIDCController(t *testing.T) {
|
|||||||
assert.NotEmpty(t, error)
|
assert.NotEmpty(t, error)
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
{
|
|
||||||
description: "Ensure access token gets invalidated on double code use",
|
|
||||||
middlewares: []gin.HandlerFunc{
|
|
||||||
simpleCtx,
|
|
||||||
},
|
|
||||||
run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
|
|
||||||
authorizeCodeTest, found := getTestByDescription("Ensure authorize succeeds with valid params")
|
|
||||||
assert.True(t, found, "Authorize test not found")
|
|
||||||
authorizeCodeTest(t, router, recorder)
|
|
||||||
|
|
||||||
var res map[string]any
|
|
||||||
err := json.Unmarshal(recorder.Body.Bytes(), &res)
|
|
||||||
assert.NoError(t, err)
|
|
||||||
|
|
||||||
redirectURI := res["redirect_uri"].(string)
|
|
||||||
url, err := url.Parse(redirectURI)
|
|
||||||
assert.NoError(t, err)
|
|
||||||
|
|
||||||
queryParams := url.Query()
|
|
||||||
code := queryParams.Get("code")
|
|
||||||
assert.NotEmpty(t, code)
|
|
||||||
|
|
||||||
reqBody := controller.TokenRequest{
|
|
||||||
GrantType: "authorization_code",
|
|
||||||
Code: code,
|
|
||||||
RedirectURI: "https://test.example.com/callback",
|
|
||||||
}
|
|
||||||
reqBodyEncoded, err := query.Values(reqBody)
|
|
||||||
assert.NoError(t, err)
|
|
||||||
|
|
||||||
req := httptest.NewRequest("POST", "/api/oidc/token", strings.NewReader(reqBodyEncoded.Encode()))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
req.SetBasicAuth("some-client-id", "some-client-secret")
|
|
||||||
recorder = httptest.NewRecorder()
|
|
||||||
router.ServeHTTP(recorder, req)
|
|
||||||
|
|
||||||
assert.Equal(t, 200, recorder.Code)
|
|
||||||
|
|
||||||
err = json.Unmarshal(recorder.Body.Bytes(), &res)
|
|
||||||
assert.NoError(t, err)
|
|
||||||
|
|
||||||
accessToken := res["access_token"].(string)
|
|
||||||
assert.NotEmpty(t, accessToken)
|
|
||||||
|
|
||||||
req = httptest.NewRequest("GET", "/api/oidc/userinfo", nil)
|
|
||||||
req.Header.Set("Authorization", "Bearer "+accessToken)
|
|
||||||
recorder = httptest.NewRecorder()
|
|
||||||
router.ServeHTTP(recorder, req)
|
|
||||||
assert.Equal(t, 200, recorder.Code)
|
|
||||||
|
|
||||||
req = httptest.NewRequest("POST", "/api/oidc/token", strings.NewReader(reqBodyEncoded.Encode()))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
req.SetBasicAuth("some-client-id", "some-client-secret")
|
|
||||||
recorder = httptest.NewRecorder()
|
|
||||||
router.ServeHTTP(recorder, req)
|
|
||||||
assert.Equal(t, 400, recorder.Code)
|
|
||||||
|
|
||||||
req = httptest.NewRequest("GET", "/api/oidc/userinfo", nil)
|
|
||||||
req.Header.Set("Authorization", "Bearer "+accessToken)
|
|
||||||
recorder = httptest.NewRecorder()
|
|
||||||
router.ServeHTTP(recorder, req)
|
|
||||||
assert.Equal(t, 401, recorder.Code)
|
|
||||||
|
|
||||||
err = json.Unmarshal(recorder.Body.Bytes(), &res)
|
|
||||||
assert.NoError(t, err)
|
|
||||||
assert.Equal(t, "invalid_grant", res["error"])
|
|
||||||
},
|
|
||||||
},
|
|
||||||
}
|
}
|
||||||
|
|
||||||
app := bootstrap.NewBootstrapApp(config.Config{})
|
app := bootstrap.NewBootstrapApp(config.Config{})
|
||||||
|
|||||||
@@ -9,21 +9,19 @@ import (
|
|||||||
)
|
)
|
||||||
|
|
||||||
type OpenIDConnectConfiguration struct {
|
type OpenIDConnectConfiguration struct {
|
||||||
Issuer string `json:"issuer"`
|
Issuer string `json:"issuer"`
|
||||||
AuthorizationEndpoint string `json:"authorization_endpoint"`
|
AuthorizationEndpoint string `json:"authorization_endpoint"`
|
||||||
TokenEndpoint string `json:"token_endpoint"`
|
TokenEndpoint string `json:"token_endpoint"`
|
||||||
UserinfoEndpoint string `json:"userinfo_endpoint"`
|
UserinfoEndpoint string `json:"userinfo_endpoint"`
|
||||||
JwksUri string `json:"jwks_uri"`
|
JwksUri string `json:"jwks_uri"`
|
||||||
ScopesSupported []string `json:"scopes_supported"`
|
ScopesSupported []string `json:"scopes_supported"`
|
||||||
ResponseTypesSupported []string `json:"response_types_supported"`
|
ResponseTypesSupported []string `json:"response_types_supported"`
|
||||||
GrantTypesSupported []string `json:"grant_types_supported"`
|
GrantTypesSupported []string `json:"grant_types_supported"`
|
||||||
SubjectTypesSupported []string `json:"subject_types_supported"`
|
SubjectTypesSupported []string `json:"subject_types_supported"`
|
||||||
IDTokenSigningAlgValuesSupported []string `json:"id_token_signing_alg_values_supported"`
|
IDTokenSigningAlgValuesSupported []string `json:"id_token_signing_alg_values_supported"`
|
||||||
TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported"`
|
TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported"`
|
||||||
ClaimsSupported []string `json:"claims_supported"`
|
ClaimsSupported []string `json:"claims_supported"`
|
||||||
ServiceDocumentation string `json:"service_documentation"`
|
ServiceDocumentation string `json:"service_documentation"`
|
||||||
RequestParameterSupported bool `json:"request_parameter_supported"`
|
|
||||||
RequestObjectSigningAlgValuesSupported []string `json:"request_object_signing_alg_values_supported"`
|
|
||||||
}
|
}
|
||||||
|
|
||||||
type WellKnownControllerConfig struct{}
|
type WellKnownControllerConfig struct{}
|
||||||
@@ -50,21 +48,19 @@ func (controller *WellKnownController) SetupRoutes() {
|
|||||||
func (controller *WellKnownController) OpenIDConnectConfiguration(c *gin.Context) {
|
func (controller *WellKnownController) OpenIDConnectConfiguration(c *gin.Context) {
|
||||||
issuer := controller.oidc.GetIssuer()
|
issuer := controller.oidc.GetIssuer()
|
||||||
c.JSON(200, OpenIDConnectConfiguration{
|
c.JSON(200, OpenIDConnectConfiguration{
|
||||||
Issuer: issuer,
|
Issuer: issuer,
|
||||||
AuthorizationEndpoint: fmt.Sprintf("%s/authorize", issuer),
|
AuthorizationEndpoint: fmt.Sprintf("%s/authorize", issuer),
|
||||||
TokenEndpoint: fmt.Sprintf("%s/api/oidc/token", issuer),
|
TokenEndpoint: fmt.Sprintf("%s/api/oidc/token", issuer),
|
||||||
UserinfoEndpoint: fmt.Sprintf("%s/api/oidc/userinfo", issuer),
|
UserinfoEndpoint: fmt.Sprintf("%s/api/oidc/userinfo", issuer),
|
||||||
JwksUri: fmt.Sprintf("%s/.well-known/jwks.json", issuer),
|
JwksUri: fmt.Sprintf("%s/.well-known/jwks.json", issuer),
|
||||||
ScopesSupported: service.SupportedScopes,
|
ScopesSupported: service.SupportedScopes,
|
||||||
ResponseTypesSupported: service.SupportedResponseTypes,
|
ResponseTypesSupported: service.SupportedResponseTypes,
|
||||||
GrantTypesSupported: service.SupportedGrantTypes,
|
GrantTypesSupported: service.SupportedGrantTypes,
|
||||||
SubjectTypesSupported: []string{"pairwise"},
|
SubjectTypesSupported: []string{"pairwise"},
|
||||||
IDTokenSigningAlgValuesSupported: []string{"RS256"},
|
IDTokenSigningAlgValuesSupported: []string{"RS256"},
|
||||||
TokenEndpointAuthMethodsSupported: []string{"client_secret_basic", "client_secret_post"},
|
TokenEndpointAuthMethodsSupported: []string{"client_secret_basic", "client_secret_post"},
|
||||||
ClaimsSupported: []string{"sub", "updated_at", "name", "preferred_username", "email", "email_verified", "groups"},
|
ClaimsSupported: []string{"sub", "updated_at", "name", "preferred_username", "email", "email_verified", "groups"},
|
||||||
ServiceDocumentation: "https://tinyauth.app/docs/guides/oidc",
|
ServiceDocumentation: "https://tinyauth.app/docs/guides/oidc",
|
||||||
RequestParameterSupported: true,
|
|
||||||
RequestObjectSigningAlgValuesSupported: []string{"none"},
|
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -56,21 +56,19 @@ func TestWellKnownController(t *testing.T) {
|
|||||||
assert.NoError(t, err)
|
assert.NoError(t, err)
|
||||||
|
|
||||||
expected := controller.OpenIDConnectConfiguration{
|
expected := controller.OpenIDConnectConfiguration{
|
||||||
Issuer: oidcServiceCfg.Issuer,
|
Issuer: oidcServiceCfg.Issuer,
|
||||||
AuthorizationEndpoint: fmt.Sprintf("%s/authorize", oidcServiceCfg.Issuer),
|
AuthorizationEndpoint: fmt.Sprintf("%s/authorize", oidcServiceCfg.Issuer),
|
||||||
TokenEndpoint: fmt.Sprintf("%s/api/oidc/token", oidcServiceCfg.Issuer),
|
TokenEndpoint: fmt.Sprintf("%s/api/oidc/token", oidcServiceCfg.Issuer),
|
||||||
UserinfoEndpoint: fmt.Sprintf("%s/api/oidc/userinfo", oidcServiceCfg.Issuer),
|
UserinfoEndpoint: fmt.Sprintf("%s/api/oidc/userinfo", oidcServiceCfg.Issuer),
|
||||||
JwksUri: fmt.Sprintf("%s/.well-known/jwks.json", oidcServiceCfg.Issuer),
|
JwksUri: fmt.Sprintf("%s/.well-known/jwks.json", oidcServiceCfg.Issuer),
|
||||||
ScopesSupported: service.SupportedScopes,
|
ScopesSupported: service.SupportedScopes,
|
||||||
ResponseTypesSupported: service.SupportedResponseTypes,
|
ResponseTypesSupported: service.SupportedResponseTypes,
|
||||||
GrantTypesSupported: service.SupportedGrantTypes,
|
GrantTypesSupported: service.SupportedGrantTypes,
|
||||||
SubjectTypesSupported: []string{"pairwise"},
|
SubjectTypesSupported: []string{"pairwise"},
|
||||||
IDTokenSigningAlgValuesSupported: []string{"RS256"},
|
IDTokenSigningAlgValuesSupported: []string{"RS256"},
|
||||||
TokenEndpointAuthMethodsSupported: []string{"client_secret_basic", "client_secret_post"},
|
TokenEndpointAuthMethodsSupported: []string{"client_secret_basic", "client_secret_post"},
|
||||||
ClaimsSupported: []string{"sub", "updated_at", "name", "preferred_username", "email", "email_verified", "groups"},
|
ClaimsSupported: []string{"sub", "updated_at", "name", "preferred_username", "email", "email_verified", "groups"},
|
||||||
ServiceDocumentation: "https://tinyauth.app/docs/guides/oidc",
|
ServiceDocumentation: "https://tinyauth.app/docs/guides/oidc",
|
||||||
RequestParameterSupported: true,
|
|
||||||
RequestObjectSigningAlgValuesSupported: []string{"none"},
|
|
||||||
}
|
}
|
||||||
|
|
||||||
assert.Equal(t, expected, res)
|
assert.Equal(t, expected, res)
|
||||||
|
|||||||
@@ -46,11 +46,6 @@ func (m *UIMiddleware) Middleware() gin.HandlerFunc {
|
|||||||
case "api", "resources", ".well-known":
|
case "api", "resources", ".well-known":
|
||||||
c.Next()
|
c.Next()
|
||||||
return
|
return
|
||||||
case "robots.txt":
|
|
||||||
c.Writer.Header().Set("Content-Type", "text/plain")
|
|
||||||
c.Writer.WriteHeader(http.StatusOK)
|
|
||||||
c.Writer.Write([]byte("User-agent: *\nDisallow: /\n"))
|
|
||||||
return
|
|
||||||
default:
|
default:
|
||||||
_, err := fs.Stat(m.uiFs, path)
|
_, err := fs.Stat(m.uiFs, path)
|
||||||
|
|
||||||
|
|||||||
@@ -19,7 +19,6 @@ type OidcToken struct {
|
|||||||
Sub string
|
Sub string
|
||||||
AccessTokenHash string
|
AccessTokenHash string
|
||||||
RefreshTokenHash string
|
RefreshTokenHash string
|
||||||
CodeHash string
|
|
||||||
Scope string
|
Scope string
|
||||||
ClientID string
|
ClientID string
|
||||||
TokenExpiresAt int64
|
TokenExpiresAt int64
|
||||||
|
|||||||
@@ -70,12 +70,11 @@ INSERT INTO "oidc_tokens" (
|
|||||||
"client_id",
|
"client_id",
|
||||||
"token_expires_at",
|
"token_expires_at",
|
||||||
"refresh_token_expires_at",
|
"refresh_token_expires_at",
|
||||||
"code_hash",
|
|
||||||
"nonce"
|
"nonce"
|
||||||
) VALUES (
|
) VALUES (
|
||||||
?, ?, ?, ?, ?, ?, ?, ?, ?
|
?, ?, ?, ?, ?, ?, ?, ?
|
||||||
)
|
)
|
||||||
RETURNING sub, access_token_hash, refresh_token_hash, code_hash, scope, client_id, token_expires_at, refresh_token_expires_at, nonce
|
RETURNING sub, access_token_hash, refresh_token_hash, scope, client_id, token_expires_at, refresh_token_expires_at, nonce
|
||||||
`
|
`
|
||||||
|
|
||||||
type CreateOidcTokenParams struct {
|
type CreateOidcTokenParams struct {
|
||||||
@@ -86,7 +85,6 @@ type CreateOidcTokenParams struct {
|
|||||||
ClientID string
|
ClientID string
|
||||||
TokenExpiresAt int64
|
TokenExpiresAt int64
|
||||||
RefreshTokenExpiresAt int64
|
RefreshTokenExpiresAt int64
|
||||||
CodeHash string
|
|
||||||
Nonce string
|
Nonce string
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -99,7 +97,6 @@ func (q *Queries) CreateOidcToken(ctx context.Context, arg CreateOidcTokenParams
|
|||||||
arg.ClientID,
|
arg.ClientID,
|
||||||
arg.TokenExpiresAt,
|
arg.TokenExpiresAt,
|
||||||
arg.RefreshTokenExpiresAt,
|
arg.RefreshTokenExpiresAt,
|
||||||
arg.CodeHash,
|
|
||||||
arg.Nonce,
|
arg.Nonce,
|
||||||
)
|
)
|
||||||
var i OidcToken
|
var i OidcToken
|
||||||
@@ -107,7 +104,6 @@ func (q *Queries) CreateOidcToken(ctx context.Context, arg CreateOidcTokenParams
|
|||||||
&i.Sub,
|
&i.Sub,
|
||||||
&i.AccessTokenHash,
|
&i.AccessTokenHash,
|
||||||
&i.RefreshTokenHash,
|
&i.RefreshTokenHash,
|
||||||
&i.CodeHash,
|
|
||||||
&i.Scope,
|
&i.Scope,
|
||||||
&i.ClientID,
|
&i.ClientID,
|
||||||
&i.TokenExpiresAt,
|
&i.TokenExpiresAt,
|
||||||
@@ -202,7 +198,7 @@ func (q *Queries) DeleteExpiredOidcCodes(ctx context.Context, expiresAt int64) (
|
|||||||
const deleteExpiredOidcTokens = `-- name: DeleteExpiredOidcTokens :many
|
const deleteExpiredOidcTokens = `-- name: DeleteExpiredOidcTokens :many
|
||||||
DELETE FROM "oidc_tokens"
|
DELETE FROM "oidc_tokens"
|
||||||
WHERE "token_expires_at" < ? AND "refresh_token_expires_at" < ?
|
WHERE "token_expires_at" < ? AND "refresh_token_expires_at" < ?
|
||||||
RETURNING sub, access_token_hash, refresh_token_hash, code_hash, scope, client_id, token_expires_at, refresh_token_expires_at, nonce
|
RETURNING sub, access_token_hash, refresh_token_hash, scope, client_id, token_expires_at, refresh_token_expires_at, nonce
|
||||||
`
|
`
|
||||||
|
|
||||||
type DeleteExpiredOidcTokensParams struct {
|
type DeleteExpiredOidcTokensParams struct {
|
||||||
@@ -223,7 +219,6 @@ func (q *Queries) DeleteExpiredOidcTokens(ctx context.Context, arg DeleteExpired
|
|||||||
&i.Sub,
|
&i.Sub,
|
||||||
&i.AccessTokenHash,
|
&i.AccessTokenHash,
|
||||||
&i.RefreshTokenHash,
|
&i.RefreshTokenHash,
|
||||||
&i.CodeHash,
|
|
||||||
&i.Scope,
|
&i.Scope,
|
||||||
&i.ClientID,
|
&i.ClientID,
|
||||||
&i.TokenExpiresAt,
|
&i.TokenExpiresAt,
|
||||||
@@ -273,16 +268,6 @@ func (q *Queries) DeleteOidcToken(ctx context.Context, accessTokenHash string) e
|
|||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
||||||
const deleteOidcTokenByCodeHash = `-- name: DeleteOidcTokenByCodeHash :exec
|
|
||||||
DELETE FROM "oidc_tokens"
|
|
||||||
WHERE "code_hash" = ?
|
|
||||||
`
|
|
||||||
|
|
||||||
func (q *Queries) DeleteOidcTokenByCodeHash(ctx context.Context, codeHash string) error {
|
|
||||||
_, err := q.db.ExecContext(ctx, deleteOidcTokenByCodeHash, codeHash)
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
const deleteOidcTokenBySub = `-- name: DeleteOidcTokenBySub :exec
|
const deleteOidcTokenBySub = `-- name: DeleteOidcTokenBySub :exec
|
||||||
DELETE FROM "oidc_tokens"
|
DELETE FROM "oidc_tokens"
|
||||||
WHERE "sub" = ?
|
WHERE "sub" = ?
|
||||||
@@ -390,7 +375,7 @@ func (q *Queries) GetOidcCodeUnsafe(ctx context.Context, codeHash string) (OidcC
|
|||||||
}
|
}
|
||||||
|
|
||||||
const getOidcToken = `-- name: GetOidcToken :one
|
const getOidcToken = `-- name: GetOidcToken :one
|
||||||
SELECT sub, access_token_hash, refresh_token_hash, code_hash, scope, client_id, token_expires_at, refresh_token_expires_at, nonce FROM "oidc_tokens"
|
SELECT sub, access_token_hash, refresh_token_hash, scope, client_id, token_expires_at, refresh_token_expires_at, nonce FROM "oidc_tokens"
|
||||||
WHERE "access_token_hash" = ?
|
WHERE "access_token_hash" = ?
|
||||||
`
|
`
|
||||||
|
|
||||||
@@ -401,7 +386,6 @@ func (q *Queries) GetOidcToken(ctx context.Context, accessTokenHash string) (Oid
|
|||||||
&i.Sub,
|
&i.Sub,
|
||||||
&i.AccessTokenHash,
|
&i.AccessTokenHash,
|
||||||
&i.RefreshTokenHash,
|
&i.RefreshTokenHash,
|
||||||
&i.CodeHash,
|
|
||||||
&i.Scope,
|
&i.Scope,
|
||||||
&i.ClientID,
|
&i.ClientID,
|
||||||
&i.TokenExpiresAt,
|
&i.TokenExpiresAt,
|
||||||
@@ -412,7 +396,7 @@ func (q *Queries) GetOidcToken(ctx context.Context, accessTokenHash string) (Oid
|
|||||||
}
|
}
|
||||||
|
|
||||||
const getOidcTokenByRefreshToken = `-- name: GetOidcTokenByRefreshToken :one
|
const getOidcTokenByRefreshToken = `-- name: GetOidcTokenByRefreshToken :one
|
||||||
SELECT sub, access_token_hash, refresh_token_hash, code_hash, scope, client_id, token_expires_at, refresh_token_expires_at, nonce FROM "oidc_tokens"
|
SELECT sub, access_token_hash, refresh_token_hash, scope, client_id, token_expires_at, refresh_token_expires_at, nonce FROM "oidc_tokens"
|
||||||
WHERE "refresh_token_hash" = ?
|
WHERE "refresh_token_hash" = ?
|
||||||
`
|
`
|
||||||
|
|
||||||
@@ -423,7 +407,6 @@ func (q *Queries) GetOidcTokenByRefreshToken(ctx context.Context, refreshTokenHa
|
|||||||
&i.Sub,
|
&i.Sub,
|
||||||
&i.AccessTokenHash,
|
&i.AccessTokenHash,
|
||||||
&i.RefreshTokenHash,
|
&i.RefreshTokenHash,
|
||||||
&i.CodeHash,
|
|
||||||
&i.Scope,
|
&i.Scope,
|
||||||
&i.ClientID,
|
&i.ClientID,
|
||||||
&i.TokenExpiresAt,
|
&i.TokenExpiresAt,
|
||||||
@@ -434,7 +417,7 @@ func (q *Queries) GetOidcTokenByRefreshToken(ctx context.Context, refreshTokenHa
|
|||||||
}
|
}
|
||||||
|
|
||||||
const getOidcTokenBySub = `-- name: GetOidcTokenBySub :one
|
const getOidcTokenBySub = `-- name: GetOidcTokenBySub :one
|
||||||
SELECT sub, access_token_hash, refresh_token_hash, code_hash, scope, client_id, token_expires_at, refresh_token_expires_at, nonce FROM "oidc_tokens"
|
SELECT sub, access_token_hash, refresh_token_hash, scope, client_id, token_expires_at, refresh_token_expires_at, nonce FROM "oidc_tokens"
|
||||||
WHERE "sub" = ?
|
WHERE "sub" = ?
|
||||||
`
|
`
|
||||||
|
|
||||||
@@ -445,7 +428,6 @@ func (q *Queries) GetOidcTokenBySub(ctx context.Context, sub string) (OidcToken,
|
|||||||
&i.Sub,
|
&i.Sub,
|
||||||
&i.AccessTokenHash,
|
&i.AccessTokenHash,
|
||||||
&i.RefreshTokenHash,
|
&i.RefreshTokenHash,
|
||||||
&i.CodeHash,
|
|
||||||
&i.Scope,
|
&i.Scope,
|
||||||
&i.ClientID,
|
&i.ClientID,
|
||||||
&i.TokenExpiresAt,
|
&i.TokenExpiresAt,
|
||||||
@@ -481,7 +463,7 @@ UPDATE "oidc_tokens" SET
|
|||||||
"token_expires_at" = ?,
|
"token_expires_at" = ?,
|
||||||
"refresh_token_expires_at" = ?
|
"refresh_token_expires_at" = ?
|
||||||
WHERE "refresh_token_hash" = ?
|
WHERE "refresh_token_hash" = ?
|
||||||
RETURNING sub, access_token_hash, refresh_token_hash, code_hash, scope, client_id, token_expires_at, refresh_token_expires_at, nonce
|
RETURNING sub, access_token_hash, refresh_token_hash, scope, client_id, token_expires_at, refresh_token_expires_at, nonce
|
||||||
`
|
`
|
||||||
|
|
||||||
type UpdateOidcTokenByRefreshTokenParams struct {
|
type UpdateOidcTokenByRefreshTokenParams struct {
|
||||||
@@ -505,7 +487,6 @@ func (q *Queries) UpdateOidcTokenByRefreshToken(ctx context.Context, arg UpdateO
|
|||||||
&i.Sub,
|
&i.Sub,
|
||||||
&i.AccessTokenHash,
|
&i.AccessTokenHash,
|
||||||
&i.RefreshTokenHash,
|
&i.RefreshTokenHash,
|
||||||
&i.CodeHash,
|
|
||||||
&i.Scope,
|
&i.Scope,
|
||||||
&i.ClientID,
|
&i.ClientID,
|
||||||
&i.TokenExpiresAt,
|
&i.TokenExpiresAt,
|
||||||
|
|||||||
@@ -506,7 +506,6 @@ func (service *OIDCService) GenerateAccessToken(c *gin.Context, client config.OI
|
|||||||
TokenExpiresAt: tokenExpiresAt,
|
TokenExpiresAt: tokenExpiresAt,
|
||||||
RefreshTokenExpiresAt: refrshTokenExpiresAt,
|
RefreshTokenExpiresAt: refrshTokenExpiresAt,
|
||||||
Nonce: codeEntry.Nonce,
|
Nonce: codeEntry.Nonce,
|
||||||
CodeHash: codeEntry.CodeHash,
|
|
||||||
})
|
})
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
@@ -591,10 +590,6 @@ func (service *OIDCService) DeleteToken(c *gin.Context, tokenHash string) error
|
|||||||
return service.queries.DeleteOidcToken(c, tokenHash)
|
return service.queries.DeleteOidcToken(c, tokenHash)
|
||||||
}
|
}
|
||||||
|
|
||||||
func (service *OIDCService) DeleteTokenByCodeHash(c *gin.Context, codeHash string) error {
|
|
||||||
return service.queries.DeleteOidcTokenByCodeHash(c, codeHash)
|
|
||||||
}
|
|
||||||
|
|
||||||
func (service *OIDCService) GetAccessToken(c *gin.Context, tokenHash string) (repository.OidcToken, error) {
|
func (service *OIDCService) GetAccessToken(c *gin.Context, tokenHash string) (repository.OidcToken, error) {
|
||||||
entry, err := service.queries.GetOidcToken(c, tokenHash)
|
entry, err := service.queries.GetOidcToken(c, tokenHash)
|
||||||
|
|
||||||
|
|||||||
@@ -48,10 +48,9 @@ INSERT INTO "oidc_tokens" (
|
|||||||
"client_id",
|
"client_id",
|
||||||
"token_expires_at",
|
"token_expires_at",
|
||||||
"refresh_token_expires_at",
|
"refresh_token_expires_at",
|
||||||
"code_hash",
|
|
||||||
"nonce"
|
"nonce"
|
||||||
) VALUES (
|
) VALUES (
|
||||||
?, ?, ?, ?, ?, ?, ?, ?, ?
|
?, ?, ?, ?, ?, ?, ?, ?
|
||||||
)
|
)
|
||||||
RETURNING *;
|
RETURNING *;
|
||||||
|
|
||||||
@@ -76,10 +75,6 @@ WHERE "refresh_token_hash" = ?;
|
|||||||
SELECT * FROM "oidc_tokens"
|
SELECT * FROM "oidc_tokens"
|
||||||
WHERE "sub" = ?;
|
WHERE "sub" = ?;
|
||||||
|
|
||||||
-- name: DeleteOidcTokenByCodeHash :exec
|
|
||||||
DELETE FROM "oidc_tokens"
|
|
||||||
WHERE "code_hash" = ?;
|
|
||||||
|
|
||||||
-- name: DeleteOidcToken :exec
|
-- name: DeleteOidcToken :exec
|
||||||
DELETE FROM "oidc_tokens"
|
DELETE FROM "oidc_tokens"
|
||||||
WHERE "access_token_hash" = ?;
|
WHERE "access_token_hash" = ?;
|
||||||
|
|||||||
@@ -13,7 +13,6 @@ CREATE TABLE IF NOT EXISTS "oidc_tokens" (
|
|||||||
"sub" TEXT NOT NULL UNIQUE,
|
"sub" TEXT NOT NULL UNIQUE,
|
||||||
"access_token_hash" TEXT NOT NULL PRIMARY KEY UNIQUE,
|
"access_token_hash" TEXT NOT NULL PRIMARY KEY UNIQUE,
|
||||||
"refresh_token_hash" TEXT NOT NULL,
|
"refresh_token_hash" TEXT NOT NULL,
|
||||||
"code_hash" TEXT NOT NULL,
|
|
||||||
"scope" TEXT NOT NULL,
|
"scope" TEXT NOT NULL,
|
||||||
"client_id" TEXT NOT NULL,
|
"client_id" TEXT NOT NULL,
|
||||||
"token_expires_at" INTEGER NOT NULL,
|
"token_expires_at" INTEGER NOT NULL,
|
||||||
|
|||||||
Reference in New Issue
Block a user