auth+cli

internal/app/oidc_auth.go

@@ -0,0 +1,118 @@
+package app
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+type oidcDiscovery struct {
+	Issuer   string `json:"issuer"`
+	UserInfo string `json:"userinfo_endpoint"`
+	TokenURL string `json:"token_endpoint"`
+	AuthURL  string `json:"authorization_endpoint"`
+}
+
+func (a *App) fetchOIDCDiscovery() (oidcDiscovery, error) {
+	if strings.TrimSpace(a.cfg.OIDCIssuerURL) == "" {
+		return oidcDiscovery{}, errors.New("OIDC_ISSUER_URL is required")
+	}
+	u := a.cfg.OIDCIssuerURL + "/.well-known/openid-configuration"
+	resp, err := http.Get(u)
+	if err != nil {
+		return oidcDiscovery{}, err
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode >= 300 {
+		return oidcDiscovery{}, fmt.Errorf("oidc discovery failed status=%d body=%s", resp.StatusCode, strings.TrimSpace(string(body)))
+	}
+	var d oidcDiscovery
+	if err := json.Unmarshal(body, &d); err != nil {
+		return oidcDiscovery{}, err
+	}
+	if strings.TrimSpace(d.UserInfo) == "" {
+		return oidcDiscovery{}, errors.New("oidc discovery missing userinfo_endpoint")
+	}
+	return d, nil
+}
+
+func (a *App) validateBearerToken(token string) (User, error) {
+	d, err := a.fetchOIDCDiscovery()
+	if err != nil {
+		return User{}, err
+	}
+	req, err := http.NewRequest(http.MethodGet, d.UserInfo, nil)
+	if err != nil {
+		return User{}, err
+	}
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return User{}, err
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode >= 300 {
+		return User{}, fmt.Errorf("oidc userinfo failed status=%d body=%s", resp.StatusCode, strings.TrimSpace(string(body)))
+	}
+	var claims map[string]any
+	if err := json.Unmarshal(body, &claims); err != nil {
+		return User{}, err
+	}
+	if aud := strings.TrimSpace(a.cfg.OIDCAudience); aud != "" {
+		if !claimContainsAudience(claims["aud"], aud) {
+			return User{}, errors.New("token audience does not match configured OIDC_AUDIENCE")
+		}
+	}
+	username := firstStringClaim(claims, "preferred_username", "username", "sub")
+	if strings.TrimSpace(username) == "" {
+		return User{}, errors.New("oidc token missing preferred_username/username/sub")
+	}
+	email := firstStringClaim(claims, "email")
+	return User{Username: username, Email: email}, nil
+}
+
+func claimContainsAudience(v any, expected string) bool {
+	switch t := v.(type) {
+	case string:
+		return strings.EqualFold(strings.TrimSpace(t), expected)
+	case []any:
+		for _, item := range t {
+			if s, ok := item.(string); ok && strings.EqualFold(strings.TrimSpace(s), expected) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func firstStringClaim(claims map[string]any, keys ...string) string {
+	for _, k := range keys {
+		if v, ok := claims[k]; ok {
+			if s, ok := v.(string); ok && strings.TrimSpace(s) != "" {
+				return strings.TrimSpace(s)
+			}
+		}
+	}
+	return ""
+}
+
+func postForm(urlStr string, values url.Values) ([]byte, int, error) {
+	req, err := http.NewRequest(http.MethodPost, urlStr, strings.NewReader(values.Encode()))
+	if err != nil {
+		return nil, 0, err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, 0, err
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	return body, resp.StatusCode, nil
+}