Internal server error.
{{end}}")), Blank: template.Must(template.New("").Parse("{{define \"base\"}}{{.Content}}
{{end}}")), }, - sessionStore: apper.App().sessionStore, + sessionStore: apper.App().SessionStore(), app: apper, } diff --git a/main_test.go b/main_test.go new file mode 100644 index 0000000..3d16ece --- /dev/null +++ b/main_test.go @@ -0,0 +1,18 @@ +package writefreely + +import ( + "encoding/gob" + "math/rand" + "os" + "testing" + "time" +) + +// TestMain provides testing infrastructure within this package. +func TestMain(m *testing.M) { + rand.Seed(time.Now().UTC().UnixNano()) + + gob.Register(&User{}) + + os.Exit(m.Run()) +} \ No newline at end of file diff --git a/oauth.go b/oauth.go new file mode 100644 index 0000000..4b37277 --- /dev/null +++ b/oauth.go @@ -0,0 +1,252 @@ +package writefreely + +import ( + "context" + "encoding/json" + "github.com/gorilla/sessions" + "github.com/guregu/null/zero" + "github.com/writeas/impart" + "github.com/writeas/web-core/auth" + "github.com/writeas/web-core/log" + "github.com/writeas/writefreely/config" + "io" + "io/ioutil" + "net/http" + "net/url" + "strings" + "time" +) + +// TokenResponse contains data returned when a token is created either +// through a code exchange or using a refresh token. +type TokenResponse struct { + AccessToken string `json:"access_token"` + ExpiresIn int `json:"expires_in"` + RefreshToken string `json:"refresh_token"` + TokenType string `json:"token_type"` +} + +// InspectResponse contains data returned when an access token is inspected. +type InspectResponse struct { + ClientID string `json:"client_id"` + UserID int64 `json:"user_id"` + ExpiresAt time.Time `json:"expires_at"` + Username string `json:"username"` + Email string `json:"email"` +} + +// tokenRequestMaxLen is the most bytes that we'll read from the /oauth/token +// endpoint. One megabyte is plenty. +const tokenRequestMaxLen = 1000000 + +// infoRequestMaxLen is the most bytes that we'll read from the +// /oauth/inspect endpoint. +const infoRequestMaxLen = 1000000 + +// OAuthDatastoreProvider provides a minimal interface of data store, config, +// and session store for use with the oauth handlers. +type OAuthDatastoreProvider interface { + DB() OAuthDatastore + Config() *config.Config + SessionStore() sessions.Store +} + +// OAuthDatastore provides a minimal interface of data store methods used in +// oauth functionality. +type OAuthDatastore interface { + GenerateOAuthState(context.Context) (string, error) + ValidateOAuthState(context.Context, string) error + GetIDForRemoteUser(context.Context, int64) (int64, error) + CreateUser(*config.Config, *User, string) error + RecordRemoteUserID(context.Context, int64, int64) error + GetUserForAuthByID(int64) (*User, error) +} + +type HttpClient interface { + Do(req *http.Request) (*http.Response, error) +} + +type oauthHandler struct { + HttpClient HttpClient +} + +// buildAuthURL returns a URL used to initiate authentication. +func buildAuthURL(app OAuthDatastoreProvider, ctx context.Context, clientID, authLocation, callbackURL string) (string, error) { + state, err := app.DB().GenerateOAuthState(ctx) + if err != nil { + return "", err + } + + u, err := url.Parse(authLocation) + if err != nil { + return "", err + } + q := u.Query() + q.Set("client_id", clientID) + q.Set("redirect_uri", callbackURL) + q.Set("response_type", "code") + q.Set("state", state) + u.RawQuery = q.Encode() + + return u.String(), nil +} + +func (h oauthHandler) viewOauthInit(app OAuthDatastoreProvider, w http.ResponseWriter, r *http.Request) error { + location, err := buildAuthURL(app, r.Context(), app.Config().App.OAuthClientID, app.Config().App.OAuthProviderAuthLocation, app.Config().App.OAuthClientCallbackLocation) + if err != nil { + log.ErrorLog.Println(err) + return impart.HTTPError{Status: http.StatusInternalServerError, Message: "Could not prepare OAuth redirect URL."} + } + http.Redirect(w, r, location, http.StatusTemporaryRedirect) + return nil +} + +func (h oauthHandler) viewOauthCallback(app OAuthDatastoreProvider, w http.ResponseWriter, r *http.Request) error { + ctx := r.Context() + + code := r.FormValue("code") + state := r.FormValue("state") + + err := app.DB().ValidateOAuthState(ctx, state) + if err != nil { + return err + } + + tokenResponse, err := h.exchangeOauthCode(app, ctx, code) + if err != nil { + return err + } + + // Now that we have the access token, let's use it real quick to make sur + // it really really works. + tokenInfo, err := h.inspectOauthAccessToken(app, ctx, tokenResponse.AccessToken) + if err != nil { + return err + } + + localUserID, err := app.DB().GetIDForRemoteUser(ctx, tokenInfo.UserID) + if err != nil { + return err + } + + if localUserID == -1 { + // We don't have, nor do we want, the password from the origin, so we + //create a random string. If the user needs to set a password, they + //can do so through the settings page or through the password reset + //flow. + randPass, err := randString(14) + if err != nil { + return err + } + hashedPass, err := auth.HashPass([]byte(randPass)) + if err != nil { + log.ErrorLog.Println(err) + return impart.HTTPError{http.StatusInternalServerError, "Could not create password hash."} + } + newUser := &User{ + Username: tokenInfo.Username, + HashedPass: hashedPass, + HasPass: true, + Email: zero.NewString("", tokenInfo.Email != ""), + Created: time.Now().Truncate(time.Second).UTC(), + } + + err = app.DB().CreateUser(app.Config(), newUser, newUser.Username) + if err != nil { + return err + } + + err = app.DB().RecordRemoteUserID(ctx, newUser.ID, tokenInfo.UserID) + if err != nil { + return err + } + + return loginOrFail(app, w, r, newUser) + } + + user, err := app.DB().GetUserForAuthByID(localUserID) + if err != nil { + return err + } + return loginOrFail(app, w, r, user) +} + +func (h oauthHandler) exchangeOauthCode(app OAuthDatastoreProvider, ctx context.Context, code string) (*TokenResponse, error) { + form := url.Values{} + form.Add("grant_type", "authorization_code") + form.Add("redirect_uri", app.Config().App.OAuthClientCallbackLocation) + form.Add("code", code) + req, err := http.NewRequest("POST", app.Config().App.OAuthProviderTokenLocation, strings.NewReader(form.Encode())) + if err != nil { + return nil, err + } + req.WithContext(ctx) + req.Header.Set("User-Agent", "writefreely") + req.Header.Set("Accept", "application/json") + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + req.SetBasicAuth(app.Config().App.OAuthClientID, app.Config().App.OAuthClientSecret) + + resp, err := h.HttpClient.Do(req) + if err != nil { + return nil, err + } + + // Nick: I like using limited readers to reduce the risk of an endpoint + // being broken or compromised. + lr := io.LimitReader(resp.Body, tokenRequestMaxLen) + body, err := ioutil.ReadAll(lr) + if err != nil { + return nil, err + } + + var tokenResponse TokenResponse + err = json.Unmarshal(body, &tokenResponse) + if err != nil { + return nil, err + } + return &tokenResponse, nil +} + +func (h oauthHandler) inspectOauthAccessToken(app OAuthDatastoreProvider, ctx context.Context, accessToken string) (*InspectResponse, error) { + req, err := http.NewRequest("GET", app.Config().App.OAuthProviderInspectLocation, nil) + if err != nil { + return nil, err + } + req.WithContext(ctx) + req.Header.Set("User-Agent", "writefreely") + req.Header.Set("Accept", "application/json") + req.Header.Set("Authorization", "Bearer "+accessToken) + + resp, err := h.HttpClient.Do(req) + if err != nil { + return nil, err + } + + // Nick: I like using limited readers to reduce the risk of an endpoint + // being broken or compromised. + lr := io.LimitReader(resp.Body, infoRequestMaxLen) + body, err := ioutil.ReadAll(lr) + if err != nil { + return nil, err + } + + var inspectResponse InspectResponse + err = json.Unmarshal(body, &inspectResponse) + if err != nil { + return nil, err + } + return &inspectResponse, nil +} + +func loginOrFail(app OAuthDatastoreProvider, w http.ResponseWriter, r *http.Request, user *User) error { + session, err := app.SessionStore().Get(r, cookieName) + if err != nil { + return err + } + session.Values[cookieUserVal] = user.Cookie() + if err = session.Save(r, w); err != nil { + return err + } + http.Redirect(w, r, "/", http.StatusTemporaryRedirect) + return nil +} diff --git a/oauth/state.go b/oauth/state.go new file mode 100644 index 0000000..e8dd154 --- /dev/null +++ b/oauth/state.go @@ -0,0 +1,10 @@ +package oauth + +import "context" + +// ClientStateStore provides state management used by the OAuth client. +type ClientStateStore interface { + Generate(ctx context.Context) (string, error) + Validate(ctx context.Context, state string) error +} + diff --git a/oauth_test.go b/oauth_test.go new file mode 100644 index 0000000..02e357d --- /dev/null +++ b/oauth_test.go @@ -0,0 +1,198 @@ +package writefreely + +import ( + "context" + "fmt" + "github.com/gorilla/sessions" + "github.com/stretchr/testify/assert" + "github.com/writeas/impart" + "github.com/writeas/writefreely/config" + "net/http" + "net/http/httptest" + "net/url" + "strings" + "testing" +) + +type MockOAuthDatastoreProvider struct { + DoDB func() OAuthDatastore + DoConfig func() *config.Config + DoSessionStore func() sessions.Store +} + +type MockOAuthDatastore struct { + DoGenerateOAuthState func(ctx context.Context) (string, error) + DoValidateOAuthState func(context.Context, string) error + DoGetIDForRemoteUser func(context.Context, int64) (int64, error) + DoCreateUser func(*config.Config, *User, string) error + DoRecordRemoteUserID func(context.Context, int64, int64) error + DoGetUserForAuthByID func(int64) (*User, error) +} + +type StringReadCloser struct { + *strings.Reader +} + +func (src *StringReadCloser) Close() error { + return nil +} + +type MockHTTPClient struct { + DoDo func(req *http.Request) (*http.Response, error) +} + +func (m *MockHTTPClient) Do(req *http.Request) (*http.Response, error) { + if m.DoDo != nil { + return m.DoDo(req) + } + return &http.Response{}, nil +} + +func (m *MockOAuthDatastoreProvider) SessionStore() sessions.Store { + if m.DoSessionStore != nil { + return m.DoSessionStore() + } + return sessions.NewCookieStore([]byte("secret-key")) +} + +func (m *MockOAuthDatastoreProvider) DB() OAuthDatastore { + if m.DoDB != nil { + return m.DoDB() + } + return &MockOAuthDatastore{} +} + +func (m *MockOAuthDatastoreProvider) Config() *config.Config { + if m.DoConfig != nil { + return m.DoConfig() + } + cfg := config.New() + cfg.UseSQLite(true) + cfg.App.EnableOAuth = true + cfg.App.OAuthProviderAuthLocation = "https://write.as/oauth/login" + cfg.App.OAuthProviderTokenLocation = "https://write.as/oauth/token" + cfg.App.OAuthProviderInspectLocation = "https://write.as/oauth/inspect" + cfg.App.OAuthClientCallbackLocation = "http://localhost/oauth/callback" + cfg.App.OAuthClientID = "development" + cfg.App.OAuthClientSecret = "development" + return cfg +} + +func (m *MockOAuthDatastore) ValidateOAuthState(ctx context.Context, state string) error { + if m.DoValidateOAuthState != nil { + return m.DoValidateOAuthState(ctx, state) + } + return nil +} + +func (m *MockOAuthDatastore) GetIDForRemoteUser(ctx context.Context, remoteUserID int64) (int64, error) { + if m.DoGetIDForRemoteUser != nil { + return m.DoGetIDForRemoteUser(ctx, remoteUserID) + } + return -1, nil +} + +func (m *MockOAuthDatastore) CreateUser(cfg *config.Config, u *User, username string) error { + if m.DoCreateUser != nil { + return m.DoCreateUser(cfg, u, username) + } + u.ID = 1 + return nil +} + +func (m *MockOAuthDatastore) RecordRemoteUserID(ctx context.Context, localUserID int64, remoteUserID int64) error { + if m.DoRecordRemoteUserID != nil { + return m.DoRecordRemoteUserID(ctx, localUserID, remoteUserID) + } + return nil +} + +func (m *MockOAuthDatastore) GetUserForAuthByID(userID int64) (*User, error) { + if m.DoGetUserForAuthByID != nil { + return m.DoGetUserForAuthByID(userID) + } + user := &User{ + + } + return user, nil +} + +func (m *MockOAuthDatastore) GenerateOAuthState(ctx context.Context) (string, error) { + if m.DoGenerateOAuthState != nil { + return m.DoGenerateOAuthState(ctx) + } + return randString(14) +} + +func TestViewOauthInit(t *testing.T) { + h := oauthHandler{} + t.Run("success", func(t *testing.T) { + app := &MockOAuthDatastoreProvider{} + req, err := http.NewRequest("GET", "/oauth/client", nil) + assert.NoError(t, err) + rr := httptest.NewRecorder() + err = h.viewOauthInit(app, rr, req) + assert.NoError(t, err) + assert.Equal(t, http.StatusTemporaryRedirect, rr.Code) + locURI, err := url.Parse(rr.Header().Get("Location")) + assert.NoError(t, err) + assert.Equal(t, "/oauth/login", locURI.Path) + assert.Equal(t, "development", locURI.Query().Get("client_id")) + assert.Equal(t, "http://localhost/oauth/callback", locURI.Query().Get("redirect_uri")) + assert.Equal(t, "code", locURI.Query().Get("response_type")) + assert.NotEmpty(t, locURI.Query().Get("state")) + }) + + t.Run("state failure", func(t *testing.T) { + app := &MockOAuthDatastoreProvider{ + DoDB: func() OAuthDatastore { + return &MockOAuthDatastore{ + DoGenerateOAuthState: func(ctx context.Context) (string, error) { + return "", fmt.Errorf("pretend unable to write state error") + }, + } + }, + } + req, err := http.NewRequest("GET", "/oauth/client", nil) + assert.NoError(t, err) + rr := httptest.NewRecorder() + err = h.viewOauthInit(app, rr, req) + assert.Error(t, err) + assert.Equal(t, impart.HTTPError{Status: http.StatusInternalServerError, Message: "Could not prepare OAuth redirect URL."}, err) + }) +} + +func TestViewOauthCallback(t *testing.T) { + t.Run("success", func(t *testing.T) { + app := &MockOAuthDatastoreProvider{} + h := oauthHandler{ + HttpClient: &MockHTTPClient{ + DoDo: func(req *http.Request) (*http.Response, error) { + switch req.URL.String() { + case "https://write.as/oauth/token": + return &http.Response{ + StatusCode: 200, + Body: &StringReadCloser{strings.NewReader(`{"access_token": "access_token", "expires_in": 1000, "refresh_token": "refresh_token", "token_type": "access"}`)}, + }, nil + case "https://write.as/oauth/inspect": + return &http.Response{ + StatusCode: 200, + Body: &StringReadCloser{strings.NewReader(`{"client_id": "development", "user_id": 1, "expires_at": "2019-12-19T11:42:01Z", "username": "nick", "email": "nick@testing.write.as"}`)}, + }, nil + } + + return &http.Response{ + StatusCode: http.StatusNotFound, + }, nil + }, + }, + } + req, err := http.NewRequest("GET", "/oauth/callback", nil) + assert.NoError(t, err) + rr := httptest.NewRecorder() + err = h.viewOauthCallback(app, rr, req) + assert.NoError(t, err) + assert.Equal(t, http.StatusTemporaryRedirect, rr.Code) + + }) +}