consent

package
v2.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Feb 12, 2024 License: Apache-2.0 Imports: 45 Imported by: 3

Documentation

Index

Constants

View Source 
const (
	LoginPath    = "/oauth2/auth/requests/login"
	ConsentPath  = "/oauth2/auth/requests/consent"
	LogoutPath   = "/oauth2/auth/requests/logout"
	SessionsPath = "/oauth2/auth/sessions"
)
View Source 
const (
	CookieAuthenticationSIDName = "sid"
)

Variables

View Source 
var ErrAbortOAuth2Request = stderrs.New("the OAuth 2.0 Authorization request must be aborted")
View Source 
var ErrHintDoesNotMatchAuthentication = stderrs.New("subject from hint does not match subject from session")
View Source 
var ErrNoAuthenticationSessionFound = stderrs.New("no previous login session was found")
View Source 
var ErrNoPreviousConsentFound = stderrs.New("no previous OAuth 2.0 Consent could be found for this access request")

Functions

func ManagerTests 

func ManagerTests(deps Deps, m Manager, clientManager client.Manager, fositeManager x.FositeStorer, network string, parallel bool) func(t *testing.T)

func MockAuthRequest 

func MockAuthRequest(key string, authAt bool, network string) (c *flow.LoginRequest, h *flow.HandledLoginRequest, f *flow.Flow)

func MockConsentRequest 

func MockConsentRequest(key string, remember bool, rememberFor int, hasError bool, skip bool, authAt bool, loginChallengeBase string, network string) (c *flow.OAuth2ConsentRequest, h *flow.AcceptOAuth2ConsentRequest, f *flow.Flow)

func MockLogoutRequest 

func MockLogoutRequest(key string, withClient bool, network string) (c *flow.LogoutRequest)

func NewHandledConsentRequest 

func NewHandledConsentRequest(challenge string, hasError bool, requestedAt time.Time, authenticatedAt sqlxx.NullTime) *flow.AcceptOAuth2ConsentRequest

func NewHandledLoginRequest 

func NewHandledLoginRequest(challenge string, hasError bool, requestedAt time.Time, authenticatedAt sqlxx.NullTime) *flow.HandledLoginRequest

func SaneMockAuthRequest 

func SaneMockAuthRequest(t *testing.T, m Manager, ls *flow.LoginSession, cl *client.Client) (c *flow.LoginRequest)

SaneMockAuthRequest does the same thing as MockAuthRequest but uses less insanity and implicit dependencies.

func SaneMockConsentRequest 

func SaneMockConsentRequest(t *testing.T, m Manager, f *flow.Flow, skip bool) (c *flow.OAuth2ConsentRequest)

SaneMockConsentRequest does the same thing as MockConsentRequest but uses less insanity and implicit dependencies.

func SaneMockHandleConsentRequest 

func SaneMockHandleConsentRequest(t *testing.T, m Manager, f *flow.Flow, c *flow.OAuth2ConsentRequest, authAt time.Time, rememberFor int, remember bool, hasError bool) *flow.AcceptOAuth2ConsentRequest

func TestHelperNID 

func TestHelperNID(r interface {
	client.ManagerProvider
	FlowCipher() *aead.XChaCha20Poly1305
}, t1ValidNID Manager, t2InvalidNID Manager) func(t *testing.T)

func ValidateCsrfSession added in v2.2.0 

func ValidateCsrfSession(r *http.Request, conf x.CookieConfigProvider, store sessions.Store, name, expectedCSRF string, f *flow.Flow) error

Types

type DefaultStrategy 

type DefaultStrategy struct {
	// contains filtered or unexported fields
}

func NewStrategy 

func NewStrategy(
	r InternalRegistry,
	c *config.DefaultProvider,
) *DefaultStrategy

func (*DefaultStrategy) HandleHeadlessLogout 

func (s *DefaultStrategy) HandleHeadlessLogout(ctx context.Context, _ http.ResponseWriter, r *http.Request, sid string) error

func (*DefaultStrategy) HandleOAuth2AuthorizationRequest 

func (s *DefaultStrategy) HandleOAuth2AuthorizationRequest(
	ctx context.Context,
	w http.ResponseWriter,
	r *http.Request,
	req fosite.AuthorizeRequester,
) (_ *flow.AcceptOAuth2ConsentRequest, _ *flow.Flow, err error)

func (*DefaultStrategy) HandleOpenIDConnectLogout 

func (s *DefaultStrategy) HandleOpenIDConnectLogout(ctx context.Context, w http.ResponseWriter, r *http.Request) (*flow.LogoutResult, error)

func (*DefaultStrategy) ObfuscateSubjectIdentifier 

func (s *DefaultStrategy) ObfuscateSubjectIdentifier(ctx context.Context, cl fosite.Client, subject, forcedIdentifier string) (string, error)

type Deps added in v2.2.0 

type Deps interface {
	FlowCipher() *aead.XChaCha20Poly1305
	contextx.Provider
}

type ForcedObfuscatedLoginSession 

type ForcedObfuscatedLoginSession struct {
	ClientID          string    `db:"client_id"`
	Subject           string    `db:"subject"`
	SubjectObfuscated string    `db:"subject_obfuscated"`
	NID               uuid.UUID `db:"nid"`
}

func (ForcedObfuscatedLoginSession) TableName 

func (ForcedObfuscatedLoginSession) TableName() string

type Handler 

type Handler struct {
	// contains filtered or unexported fields
}

func NewHandler 

func NewHandler(
	r InternalRegistry,
	c *config.DefaultProvider,
) *Handler

func (*Handler) SetRoutes 

func (h *Handler) SetRoutes(admin *httprouterx.RouterAdmin)

type InternalRegistry 

type InternalRegistry interface {
	x.RegistryWriter
	x.RegistryCookieStore
	x.RegistryLogger
	x.HTTPClientProvider
	kratos.Provider
	Registry
	client.Registry

	FlowCipher() *aead.XChaCha20Poly1305
	OAuth2Storage() x.FositeStorer
	OpenIDConnectRequestValidator() *openid.OpenIDConnectRequestValidator
}

type Manager 

type Manager interface {
	CreateConsentRequest(ctx context.Context, f *flow.Flow, req *flow.OAuth2ConsentRequest) error
	GetConsentRequest(ctx context.Context, challenge string) (*flow.OAuth2ConsentRequest, error)
	HandleConsentRequest(ctx context.Context, f *flow.Flow, r *flow.AcceptOAuth2ConsentRequest) (*flow.OAuth2ConsentRequest, error)
	RevokeSubjectConsentSession(ctx context.Context, user string) error
	RevokeSubjectClientConsentSession(ctx context.Context, user, client string) error

	VerifyAndInvalidateConsentRequest(ctx context.Context, verifier string) (*flow.AcceptOAuth2ConsentRequest, error)
	FindGrantedAndRememberedConsentRequests(ctx context.Context, client, user string) ([]flow.AcceptOAuth2ConsentRequest, error)
	FindSubjectsGrantedConsentRequests(ctx context.Context, user string, limit, offset int) ([]flow.AcceptOAuth2ConsentRequest, error)
	FindSubjectsSessionGrantedConsentRequests(ctx context.Context, user, sid string, limit, offset int) ([]flow.AcceptOAuth2ConsentRequest, error)
	CountSubjectsGrantedConsentRequests(ctx context.Context, user string) (int, error)

	// Cookie management
	GetRememberedLoginSession(ctx context.Context, loginSessionFromCookie *flow.LoginSession, id string) (*flow.LoginSession, error)
	CreateLoginSession(ctx context.Context, session *flow.LoginSession) error
	DeleteLoginSession(ctx context.Context, id string) (deletedSession *flow.LoginSession, err error)
	RevokeSubjectLoginSession(ctx context.Context, user string) error
	ConfirmLoginSession(ctx context.Context, loginSession *flow.LoginSession) error

	CreateLoginRequest(ctx context.Context, req *flow.LoginRequest) (*flow.Flow, error)
	GetLoginRequest(ctx context.Context, challenge string) (*flow.LoginRequest, error)
	HandleLoginRequest(ctx context.Context, f *flow.Flow, challenge string, r *flow.HandledLoginRequest) (*flow.LoginRequest, error)
	VerifyAndInvalidateLoginRequest(ctx context.Context, verifier string) (*flow.HandledLoginRequest, error)

	CreateForcedObfuscatedLoginSession(ctx context.Context, session *ForcedObfuscatedLoginSession) error
	GetForcedObfuscatedLoginSession(ctx context.Context, client, obfuscated string) (*ForcedObfuscatedLoginSession, error)

	ListUserAuthenticatedClientsWithFrontChannelLogout(ctx context.Context, subject, sid string) ([]client.Client, error)
	ListUserAuthenticatedClientsWithBackChannelLogout(ctx context.Context, subject, sid string) ([]client.Client, error)

	CreateLogoutRequest(ctx context.Context, request *flow.LogoutRequest) error
	GetLogoutRequest(ctx context.Context, challenge string) (*flow.LogoutRequest, error)
	AcceptLogoutRequest(ctx context.Context, challenge string) (*flow.LogoutRequest, error)
	RejectLogoutRequest(ctx context.Context, challenge string) error
	VerifyAndInvalidateLogoutRequest(ctx context.Context, verifier string) (*flow.LogoutRequest, error)
}

type ManagerProvider added in v2.2.0 

type ManagerProvider interface {
	ConsentManager() Manager
}

type Registry 

type Registry interface {
	ConsentManager() Manager
	ConsentStrategy() Strategy
	SubjectIdentifierAlgorithm(ctx context.Context) map[string]SubjectIdentifierAlgorithm
}

type Strategy 

type Strategy interface {
	HandleOAuth2AuthorizationRequest(
		ctx context.Context,
		w http.ResponseWriter,
		r *http.Request,
		req fosite.AuthorizeRequester,
	) (*flow.AcceptOAuth2ConsentRequest, *flow.Flow, error)
	HandleOpenIDConnectLogout(ctx context.Context, w http.ResponseWriter, r *http.Request) (*flow.LogoutResult, error)
	HandleHeadlessLogout(ctx context.Context, w http.ResponseWriter, r *http.Request, sid string) error
	ObfuscateSubjectIdentifier(ctx context.Context, cl fosite.Client, subject, forcedIdentifier string) (string, error)
}

type SubjectIdentifierAlgorithm 

type SubjectIdentifierAlgorithm interface {
	// Obfuscate derives a pairwise subject identifier from the given string.
	Obfuscate(subject string, client *client.Client) (string, error)
}

type SubjectIdentifierAlgorithmPairwise 

type SubjectIdentifierAlgorithmPairwise struct {
	Salt []byte
}

func NewSubjectIdentifierAlgorithmPairwise 

func NewSubjectIdentifierAlgorithmPairwise(salt []byte) *SubjectIdentifierAlgorithmPairwise

func (*SubjectIdentifierAlgorithmPairwise) Obfuscate 

func (g *SubjectIdentifierAlgorithmPairwise) Obfuscate(subject string, client *client.Client) (string, error)

type SubjectIdentifierAlgorithmPublic 

type SubjectIdentifierAlgorithmPublic struct{}

func NewSubjectIdentifierAlgorithmPublic 

func NewSubjectIdentifierAlgorithmPublic() *SubjectIdentifierAlgorithmPublic

func (*SubjectIdentifierAlgorithmPublic) Obfuscate 

func (g *SubjectIdentifierAlgorithmPublic) Obfuscate(subject string, client *client.Client) (string, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.