xp-forge / web-auth Goto Github PK

91      return new ByAccessToken(
92        $stored['access_token'],
93        $stored['token_type'],
94        $stored['scope'] ?? null,
95        $stored['expires_in'] ?? null,
96        $stored['refresh_token'] ?? null
97      );

use web\auth\SessionBased;
use web\auth\oauth\{OAuth2Flow, BySecret};

$flow= new OAuth2Flow(
  'http://localhost:8443/oauth/common/authorize',
  'http://localhost:8443/oauth/common/token',
  new BySecret('613aacd1f95ce7ee1b04', '...'),
  '/',
  ['user'],
);
$auth= new SessionBased($flow, $sessions, function($client) use($users) {
  $me= $client->fetch('http://localhost:8443/graph/me')->value();
  return $users->upsert([
    'handle' => $me['id'],
    'name'   => $me['name'],
    // continues mapping fields, shortened for brevity
  ]);
});

return ['/' => $auth->required($frontend)];

use peer\URL;
use util\{UUID, Secret};
use lang\IllegalStateException;

abstract class Credentials {
  protected $tenant, $client;

  public function __construct($tenant, $client) {
    $this->tenant= $tenant;
    $this->client= $client;
  }

  /** @return string */
  public function tenant() { return $this->tenant; }

  /** @return string */
  public function client() { return $this->client; }

  /**
   * Returns request parameters for a given endpoint
   *
   * @param  peer.URL $endpoint
   * @return [:string]
   */
  public abstract function request(URL $endpoint);
}

class ClientSecret extends Credentials {
  private $secret;

  public function __construct($tenant, $client, $secret) {
    parent::__construct($tenant, $client);
    $this->secret= $secret instanceof Secret ? $secret : new Secret($secret);
  }

  public function request(URL $endpoint) {
    return ['client_id' => $this->client, 'client_secret' => $this->secret->reveal()];
  }
}

class WithCertificate extends Credentials {
  private $certificate, $key;

  public function __construct($tenant, $client, $certificate, $key) {
    parent::__construct($tenant, $client);
    $this->certificate= $certificate;
    $this->key= $key;
  }

  public function request(URL $endpoint) {
    $time= time();
    $jwt= new JWT(['alg' => 'RS256', 'typ' => 'JWT', 'x5t' => JWT::base64(hex2bin($this->certificate))], [
      'aud' => $endpoint->toString(),
      'exp' => $time + 3600,
      'iss' => $this->client,
      'jti' => UUID::timeUUID()->hashCode(),
      'nbf' => $time,
      'sub' => $this->client,
    ]);

    return [
      'client_id'             => $this->client,
      'client_assertion'      => $jwt->sign($this->key),
      'client_assertion_type' => 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
    ];
  }
}

/**
 * Very simple JWT implementation (only supporting `RS256`)
 *
 * @see  https://tools.ietf.org/html/rfc7519
 * @ext  openssl
 */
class JWT {
  private $header, $payload;

  /** Creates a new JWT with a given header and payload */
  public function __construct(array $header, array $payload) {
    $this->header= $header;
    $this->payload= $payload;
  }

  /** URL-safe Base64 encoding */
  public static function base64(string $bytes): string {
    return strtr(rtrim(base64_encode($bytes), '='), '+/', '-_');
  }

  /** Sign JWT and return token */
  public function sign(string $key): string {
    $input= self::base64(json_encode($this->header)).'.'.self::base64(json_encode($this->payload));

    // Hardcode SHA256 signing via OpenSSL here, would need algorithm-based
    // handling in order for this to be a full implementation, see e.g.
    // https://github.com/firebase/php-jwt/blob/v6.2.0/src/JWT.php#L220
    if (!openssl_sign($input, $signature, openssl_pkey_get_private($key), 'SHA256')) {
      throw new IllegalStateException(openssl_error_string());
    }

    return $input.'.'.self::base64($signature);
  }
}

use web\auth\SessionBased;
use web\auth\oauth\OAuth2Flow;
use web\session\ForTesting;
use webservices\rest\Endpoint;

$flow= new OAuth2Flow(
  'https://github.com/login/oauth/authorize',
  'https://github.com/login/oauth/access_token',
  [$credentials->named('github_oauth_key'), $credentials->named('github_oauth_secret')],
  $callback
);
$auth= new SessionBased($flow, new ForTesting());

return ['/' => $auth->required(function($req, $res) {
  $endpoint= (new Endpoint('https://api.github.com/'))->with('Authorization', $req->value('user'));

  $user= $endpoint->resource('user')->get()->value();
  $res->send('Hello @'.$user['login'], 'text/html');
})];