1
1
Fork 0
mirror of https://code.mensbeam.com/MensBeam/Arsse.git synced 2024-12-23 09:02:41 +00:00
Arsse/lib/REST/Microsub/Auth.php

392 lines
18 KiB
PHP
Raw Permalink Normal View History

2019-09-10 00:38:27 +00:00
<?php
/** @license MIT
* Copyright 2017 J. King, Dustin Wilson et al.
* See LICENSE and AUTHORS files for details */
declare(strict_types=1);
namespace JKingWeb\Arsse\REST\Microsub;
use JKingWeb\Arsse\Arsse;
2019-09-10 00:38:27 +00:00
use JKingWeb\Arsse\Misc\URL;
2019-09-10 21:48:38 +00:00
use JKingWeb\Arsse\Misc\Date;
2019-09-28 13:55:27 +00:00
use JKingWeb\Arsse\Misc\HTTP;
use JKingWeb\Arsse\Misc\ValueInfo;
2019-09-10 00:38:27 +00:00
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Message\ResponseInterface;
use Laminas\Diactoros\Response\HtmlResponse;
use Laminas\Diactoros\Response\JsonResponse;
use Laminas\Diactoros\Response\EmptyResponse;
2019-09-10 00:38:27 +00:00
class Auth extends \JKingWeb\Arsse\REST\AbstractHandler {
/** The scopes which we grant to Microsub clients. Mute and block are not included because they have no meaning in an RSS/Atom context; this may signal to clients to suppress muting and blocking in their UI */
2019-09-23 02:17:42 +00:00
const SCOPES = ["read", "follow", "channels"];
/** The list of the logical functions of this API, with their implementations */
const FUNCTIONS = [
2019-09-25 12:23:42 +00:00
'' => ['GET' => "opDiscovery"],
'auth' => ['GET' => "opLogin", 'POST' => "opCodeVerification"],
'token' => ['GET' => "opTokenVerification", 'POST' => "opIssueAccessToken"],
];
2019-12-09 03:02:19 +00:00
/** The set of URL characters escaped by rawurlencode() which should be unescaped when constructing user ID URLs */
const USERNAME_UNESCAPES = [
'%21' => "!",
'%24' => "$",
'%26' => "&",
'%27' => "'",
'%28' => "(",
'%29' => ")",
'%2A' => "*",
'%2B' => "+",
'%2C' => ",",
'%3A' => ":",
'%3B' => ";",
'%3D' => "=",
'%40' => "@",
];
/** The acceptable media type of input for POST requests */
2019-09-28 13:55:27 +00:00
const ACCEPTED_TYPE = "application/x-www-form-urlencoded";
2019-09-10 00:38:27 +00:00
public function __construct() {
}
public function dispatch(ServerRequestInterface $req): ResponseInterface {
// if the path contains a slash, this is not a URL we handle
$path = parse_url($req->getRequestTarget())['path'] ?? "";
if (strpos($path, "/") !== false) {
2019-09-10 00:38:27 +00:00
return new EmptyResponse(404);
}
// gather the query parameters and act on the "f" (function) parameter
$process = $req->getQueryParams()['f'] ?? "";
$method = $req->getMethod();
if (!isset(self::FUNCTIONS[$process]) || ($process === "" && !strlen($path)) || ($process !== "" && strlen($path))) {
// the function requested needs to exist
// the path should also be empty unless we're doing discovery
2019-09-10 00:38:27 +00:00
return new EmptyResponse(404);
} elseif ($method === "OPTIONS") {
$fields = ['Allow' => implode(",", array_keys(self::FUNCTIONS[$process]))];
if (isset(self::FUNCTIONS[$process]['POST'])) {
2019-09-28 13:55:27 +00:00
$fields['Accept'] = self::ACCEPTED_TYPE;
}
return new EmptyResponse(204, $fields);
} elseif (!isset(self::FUNCTIONS[$process][$method])) {
return new EmptyResponse(405, ['Allow' => implode(",", array_keys(self::FUNCTIONS[$process]))]);
2019-09-10 00:38:27 +00:00
} else {
2019-09-28 13:55:27 +00:00
if ($req->getMethod() !== "GET" && !HTTP::matchType($req, self::ACCEPTED_TYPE, "")) {
return new EmptyResponse(415, ['Accept' => self::ACCEPTED_TYPE]);
}
2019-09-15 00:51:05 +00:00
try {
$func = self::FUNCTIONS[$process][$method];
return $this->$func($req);
2019-09-15 00:51:05 +00:00
} catch (ExceptionAuth $e) {
// human-readable error messages could be added, but these must be ASCII per OAuth, so there's probably not much point
// see https://tools.ietf.org/html/rfc6749#section-5.2
return new JsonResponse(['error' => $e->getMessage()], 400);
}
2019-09-10 00:38:27 +00:00
}
}
/** Produces the base URL of a server request
2019-12-10 00:48:16 +00:00
*
* This involves reconstructing the scheme and authority based on $_SERVER
* variables; it may fail depending on server configuration
*/
protected function buildBaseURL(ServerRequestInterface $req): string {
2019-09-10 00:38:27 +00:00
// construct the base user identifier URL; the user is never checked against the database
$s = $req->getServerParams();
$https = ValueInfo::normalize($s['HTTPS'] ?? "", ValueInfo::T_BOOL);
$port = (int) ($s['SERVER_PORT'] ?? 0);
2019-09-10 00:38:27 +00:00
$port = (!$port || ($https && $port == 443) || (!$https && $port == 80)) ? "" : ":$port";
return URL::normalize(($https ? "https" : "http")."://".$s['HTTP_HOST'].$port."/");
}
/** Produces a canoncial identity URL based on a server request and a user name
2019-12-10 00:48:16 +00:00
*
* This involves reconstructing the scheme and authority based on $_SERVER
* variables; it may fail depending on server configuration
*/
protected function buildIdentifier(ServerRequestInterface $req, string $user): string {
2019-12-09 03:02:19 +00:00
return $this->buildBaseURL($req)."u/".str_replace(array_keys(self::USERNAME_UNESCAPES), array_values(self::USERNAME_UNESCAPES), rawurlencode($user));
}
/** Matches an identity URL against its canoncial form
2019-12-10 00:48:16 +00:00
*
* The identifier matches if all of the following are true:
2019-12-10 00:48:16 +00:00
*
* 1. The scheme is http or https
* 2. The normalized hostname matches
* 3. The port matches after dropping default port numbers
* 4. No credentials are included in the authority
* 5. The path is `/u/<username>`
* 6. There is no query content
* 7. The username, when URL-decoded, matches
2019-12-10 00:48:16 +00:00
*
* Though IndieAuth forbids port numbers and fragments in identifiers, we do not enforce this
*/
protected function matchIdentifier(string $canonical, string $me): bool {
$me = parse_url(URL::normalize($me));
2019-09-28 18:41:35 +00:00
if (!$me) {
return false;
}
$me['scheme'] = $me['scheme'] ?? "";
$me['path'] = explode("/", $me['path'] ?? "");
$me['id'] = rawurldecode(array_pop($me['path']) ?? "");
$me['port'] = (($me['scheme'] === "http" && ($me['port'] ?? 80) == 80) || ($me['scheme'] === "https" && ($me['port'] ?? 443) == 443)) ? 0 : $me['port'] ?? 0;
$c = parse_url($canonical);
$c['path'] = explode("/", $c['path']);
$c['id'] = rawurldecode(array_pop($c['path']));
if (
2019-12-10 00:48:16 +00:00
!in_array($me['scheme'] ?? "", ["http", "https"]) ||
($me['host'] ?? "") !== $c['host'] ||
$me['path'] != $c['path'] ||
$me['id'] !== $c['id'] ||
strlen($me['user'] ?? "") ||
strlen($me['pass'] ?? "") ||
strlen($me['query'] ?? "") ||
($me['port'] ?? 0) != ($c['port'] ?? 0)
) {
return false;
}
return true;
}
/** Presents a very basic user profile for discovery purposes
2019-12-10 00:48:16 +00:00
*
* The HTML document itself consists only of link elements and an
* encoding declaration; Link header-fields are also included for
* HEAD requests
2019-12-10 00:48:16 +00:00
*
* Since discovery is publicly accessible, we produce a discovery
* page for all potential user names so as not to facilitate user
* enumeration
2019-12-10 00:48:16 +00:00
*
* @see https://indieweb.org/Microsub-spec#Discovery
*/
protected function opDiscovery(ServerRequestInterface $req): ResponseInterface {
$base = $this->buildBaseURL($req);
$urlAuth = $base."u/?f=auth";
$urlToken = $base."u/?f=token";
2019-09-10 00:38:27 +00:00
$urlService = $base."microsub";
// output an extremely basic identity resource
$html = '<meta charset="UTF-8"><link rel="authorization_endpoint" href="'.htmlspecialchars($urlAuth).'"><link rel="token_endpoint" href="'.htmlspecialchars($urlToken).'"><link rel="microsub" href="'.htmlspecialchars($urlService).'">';
return new HtmlResponse($html, 200, ['Link' => [
"<$urlAuth>; rel=\"authorization_endpoint\"",
"<$urlToken>; rel=\"token_endpoint\"",
"<$urlService>; rel=\"microsub\"",
]]);
2019-09-10 00:38:27 +00:00
}
/** Handles the authentication process
2019-12-10 00:48:16 +00:00
*
* Authentication is achieved via an HTTP Basic authentiation
2019-12-10 00:48:16 +00:00
* challenge; once the user successfully logs in a code is issued
* and redirection occurs. Scopes are for all intents and purposes
2019-12-10 00:48:16 +00:00
* ignored and client information is not presented.
*
* @see https://indieauth.spec.indieweb.org/#authentication-request
* @see https://indieauth.spec.indieweb.org/#authorization-endpoint-0
*/
protected function opLogin(ServerRequestInterface $req): ResponseInterface {
if (!$req->getAttribute("authenticated", false)) {
// user has not yet logged in, or has failed to log in
return new EmptyResponse(401);
} else {
// user has logged in
$query = $req->getQueryParams();
$redir = URL::normalize($query['redirect_uri']);
2019-09-15 00:51:05 +00:00
// check that the redirect URL is an absolute one
if (!URL::absolute($redir)) {
return new EmptyResponse(400);
}
try {
2019-09-28 18:41:35 +00:00
$state = rawurlencode($query['state'] ?? "");
2019-09-15 00:51:05 +00:00
// ensure the logged-in user matches the IndieAuth identifier URL
$user = $req->getAttribute("authenticatedUser");
if (!$this->matchIdentifier($this->buildIdentifier($req, $user), $query['me'])) {
2019-12-10 00:48:16 +00:00
throw new ExceptionAuth("access_denied");
2019-09-10 21:48:38 +00:00
}
2019-09-15 00:51:05 +00:00
$type = !strlen($query['response_type'] ?? "") ? "id" : $query['response_type'];
if (!in_array($type, ["code", "id"])) {
throw new ExceptionAuth("unsupported_response_type");
}
// store the identity URL, client ID, redirect URL, and response type
$data = json_encode([
'me' => $query['me'],
'client_id' => $query['client_id'],
'redirect_uri' => $query['redirect_uri'],
'response_type' => $type,
2019-09-24 17:59:52 +00:00
], \JSON_UNESCAPED_SLASHES | \JSON_UNESCAPED_UNICODE);
2019-09-10 21:48:38 +00:00
// issue an authorization code and build the redirect URL
$code = Arsse::$db->tokenCreate($user, "microsub.auth", null, Date::add("PT2M"), $data);
2019-09-28 18:41:35 +00:00
$next = URL::queryAppend($redir, "state=$state&code=$code");
return new EmptyResponse(302, ['Location' => $next]);
2019-09-15 00:51:05 +00:00
} catch (ExceptionAuth $e) {
$next = URL::queryAppend($redir, "state=$state&error=".$e->getMessage());
return new EmptyResponse(302, ['Location' => $next]);
}
}
}
2019-09-13 01:19:26 +00:00
/** Handles the auth code verification of the basic "Authentication" flow of IndieAuth
2019-12-10 00:48:16 +00:00
*
2019-09-20 22:49:09 +00:00
* This is not used by Microsub, but is part of the IndieAuth specification
2019-12-10 00:48:16 +00:00
*
* @see https://indieauth.spec.indieweb.org/#authorization-code-verification
*/
protected function opCodeVerification(ServerRequestInterface $req): ResponseInterface {
$post = $req->getParsedBody();
$tr = Arsse::$db->begin();
// validate the request parameters; an exception will be thrown if not
list($user, $type) = $this->validateAuthCode($post['code'] ?? "", $post['client_id'] ?? "", $post['redirect_uri'] ?? "");
if ($type !== "id") {
throw new ExceptionAuth("invalid_grant");
}
// delete the auth code since it is valid and may only be used once
Arsse::$db->tokenRevoke($user, "microsub.auth", $post['code']);
$tr->commit();
// return the canonical identity URL
return new JsonResponse(['me' => $this->buildIdentifier($req, $user)]);
}
/** Handles the auth code verification and token issuance of the "Authorization" flow of IndieAuth
2019-12-10 00:48:16 +00:00
*
* @see https://indieauth.spec.indieweb.org/#token-endpoint-0
*/
protected function opIssueAccessToken(ServerRequestInterface $req): ResponseInterface {
$post = $req->getParsedBody();
2019-09-24 17:59:52 +00:00
// revocation is a special case of POSTing to the token URL
2019-12-09 00:07:59 +00:00
if (($post['action'] ?? "") === "revoke") {
2019-09-24 17:59:52 +00:00
return $this->opRevokeToken($req);
}
if (($post['grant_type'] ?? "") !== "authorization_code") {
throw new ExceptionAuth("unsupported_grant_type");
}
$tr = Arsse::$db->begin();
2019-12-09 00:07:59 +00:00
list($user, $type) = $this->validateAuthCode($post['code'] ?? "", $post['client_id'] ?? "", $post['redirect_uri'] ?? "", $post['me'] ?? "");
if ($type !== "code") {
throw new ExceptionAuth("invalid_grant");
}
// issue an access token
2019-09-24 17:59:52 +00:00
$data = json_encode([
'me' => $post['me'],
'client_id' => $post['client_id'],
], \JSON_UNESCAPED_SLASHES | \JSON_UNESCAPED_UNICODE);
$token = Arsse::$db->tokenCreate($user, "microsub.access", null, null, $data);
Arsse::$db->tokenRevoke($user, "microsub.auth", $post['code']);
$tr->commit();
// return the Bearer token and associated data
return new JsonResponse([
'me' => $this->buildIdentifier($req, $user),
'token_type' => "Bearer",
'access_token' => $token,
2019-09-23 02:17:42 +00:00
'scope' => implode(" ", self::SCOPES),
]);
}
/** Validates an auth code and throws appropriate exceptions otherwise
2019-12-10 00:48:16 +00:00
*
2019-09-20 22:49:09 +00:00
* Returns an indexed array containing the username and the grant type (either "id" or "code")
2019-12-10 00:48:16 +00:00
*
2019-09-20 22:49:09 +00:00
* It is the responsibility of the calling function to revoke the auth code if the code is ultimately accepted
*/
protected function validateAuthCode(string $code, string $clientId, string $redirUrl, string $me = null): array {
2019-12-09 00:07:59 +00:00
if (!strlen($code) || !strlen($clientId) || !strlen($redirUrl) || (isset($me) && !strlen($me))) {
2019-09-15 00:51:05 +00:00
throw new ExceptionAuth("invalid_request");
}
// check that the auth code exists
2019-09-20 22:49:09 +00:00
try {
$token = Arsse::$db->tokenLookup("microsub.auth", $code);
} catch (\JKingWeb\Arsse\Db\ExceptionInput $e) {
throw new ExceptionAuth("invalid_grant");
2019-09-15 00:51:05 +00:00
}
2019-12-06 15:44:01 +00:00
$data = @json_decode((string) $token['data'], true);
// validate the auth code
2019-12-09 00:07:59 +00:00
if (!is_array($data) || !isset($data['redirect_uri']) || !isset($data['client_id']) || (isset($me) && !isset($data['me']))) {
throw new ExceptionAuth("invalid_grant");
} elseif ($data['client_id'] !== $clientId || $data['redirect_uri'] !== $redirUrl) {
throw new ExceptionAuth("invalid_client");
} elseif (isset($me) && $me !== $data['me']) {
throw new ExceptionAuth("invalid_grant");
}
// return the associated user name and the auth-code type
return [$token['user'], $data['response_type'] ?? "id"];
}
2019-12-10 18:26:13 +00:00
/**
* Handles token verification as an API call; this will not normally be used since
* the token and service endpoints are tightly coupled
2019-12-10 00:48:16 +00:00
*
2019-09-24 17:59:52 +00:00
* The static `validateBearer` method should be used to check the validity of a bearer token in normal use
2019-12-10 00:48:16 +00:00
*
2019-09-24 17:59:52 +00:00
* @see https://indieauth.spec.indieweb.org/#access-token-verification
*/
protected function opTokenVerification(ServerRequestInterface $req): ResponseInterface {
try {
if (!$req->hasHeader("Authorization")) {
throw new ExceptionAuth("invalid_token");
}
2019-12-10 18:26:13 +00:00
$authorization = $req->getHeader("Authorization");
if (sizeof($authorization) > 1) {
throw new ExceptionAuth("invalid_request");
}
list($user, $data) = self::validateBearer($authorization[0]);
2019-09-24 17:59:52 +00:00
} catch (ExceptionAuth $e) {
$errCode = $e->getMessage();
$httpCode = [
'invalid_request' => 400,
'invalid_token' => 401,
][$errCode] ?? 500;
2019-12-10 18:26:13 +00:00
$out = new EmptyResponse($httpCode, ['WWW-Authenticate' => "Bearer error=\"$errCode\""]);
if ($httpCode == 401) {
$out = $out->withHeader("X-Arsse-Suppress-General-Auth", "1");
}
return $out;
2019-09-24 17:59:52 +00:00
}
return new JsonResponse([
'me' => $data['me'] ?? "",
'client_id' => $data['client_id'] ?? "",
2019-12-10 18:26:13 +00:00
'scope' => implode(" ", (array) ($data['scope'] ?? self::SCOPES)),
2019-09-24 17:59:52 +00:00
]);
2019-09-13 01:19:26 +00:00
}
2019-09-20 22:49:09 +00:00
2019-09-24 17:59:52 +00:00
/** Handles token revocation
2019-12-10 00:48:16 +00:00
*
2019-09-24 17:59:52 +00:00
* @see https://indieauth.spec.indieweb.org/#token-revocation
*/
protected function opRevokeToken(ServerRequestInterface $req): ResponseInterface {
$token = ($req->getParsedBody() ?? [])['token'] ?? "";
if (!strlen($token)) {
return new EmptyResponse(422);
}
try {
$info = Arsse::$db->tokenLookup("microsub.access", $token);
2019-12-10 18:26:13 +00:00
Arsse::$db->tokenRevoke($info['user'], "microsub.access", $token);
2019-09-24 17:59:52 +00:00
} catch (\JKingWeb\Arsse\Db\ExceptionInput $e) {
}
return new EmptyResponse(200);
}
/** Checks that the supplied bearer token is valid i.e. logs a bearer in
2019-12-10 00:48:16 +00:00
*
* Returns an indexed array with the user associated with the token, as well as other data
2019-09-24 17:59:52 +00:00
*
2019-09-20 22:49:09 +00:00
* @throws \JKingWeb\Arsse\REST\Microsub\ExceptionAuth
*/
2019-09-23 02:17:42 +00:00
public static function validateBearer(string $authorization, array $scopes = []): array {
2019-12-10 00:48:16 +00:00
if (!preg_match("<^Bearer ([a-z0-9\._~/+-]+=*)$>i", $authorization, $match)) {
2019-09-23 02:17:42 +00:00
throw new ExceptionAuth("invalid_request");
}
$token = $match[1];
2019-09-20 22:49:09 +00:00
try {
2019-09-23 02:17:42 +00:00
$token = Arsse::$db->tokenLookup("microsub.access", $token);
2019-09-20 22:49:09 +00:00
} catch (\JKingWeb\Arsse\Db\ExceptionInput $e) {
2019-09-23 02:17:42 +00:00
throw new ExceptionAuth("invalid_token");
2019-09-20 22:49:09 +00:00
}
2019-12-10 00:48:16 +00:00
$data = @json_decode((string) $token['data'], true) ?? [];
2019-09-24 17:59:52 +00:00
$data['scope'] = $data['scope'] ?? self::SCOPES;
2019-09-20 22:49:09 +00:00
// scope is hard-coded for now
2019-09-24 17:59:52 +00:00
if (array_diff($scopes, $data['scope'])) {
2019-09-23 02:17:42 +00:00
throw new ExceptionAuth("insufficient_scope");
}
2019-09-24 17:59:52 +00:00
return [$token['user'], $data];
2019-09-20 22:49:09 +00:00
}
2019-09-10 00:38:27 +00:00
}