| 1 | package connect |
| 2 | |
| 3 | import ( |
| 4 | "amadan.net/oficina/estilo.git/homeconnect" |
| 5 | "bytes" |
| 6 | "net/http" |
| 7 | "net/url" |
| 8 | "strings" |
| 9 | ) |
| 10 | |
| 11 | // OAuthContinuation ends the local POST before navigating to Keymail. Safari |
| 12 | // otherwise applies form-action to the entire external redirect chain. |
| 13 | // Wrap only the trusted local authentication plugin's Begin handler. |
| 14 | func OAuthContinuation(origin string, next http.HandlerFunc, render func(http.ResponseWriter, *http.Request, string)) http.HandlerFunc { |
| 15 | return func(w http.ResponseWriter, r *http.Request) { |
| 16 | if next == nil || render == nil { |
| 17 | http.Error(w, "Sign-in unavailable.", http.StatusServiceUnavailable) |
| 18 | return |
| 19 | } |
| 20 | result := &oauthResponse{header: make(http.Header)} |
| 21 | next(result, r) |
| 22 | destination := result.header.Get("Location") |
| 23 | external := destination != "" && (!strings.HasPrefix(destination, "/") || strings.HasPrefix(destination, "//")) |
| 24 | if result.status == http.StatusSeeOther && external { |
| 25 | if !keymailDestination(destination, origin) { |
| 26 | w.Header().Set("Cache-Control", "no-store") |
| 27 | http.Error(w, "Sign-in unavailable.", http.StatusBadGateway) |
| 28 | return |
| 29 | } |
| 30 | for _, cookie := range result.header.Values("Set-Cookie") { |
| 31 | w.Header().Add("Set-Cookie", cookie) |
| 32 | } |
| 33 | w.Header().Set("Cache-Control", "no-store") |
| 34 | w.Header().Set("Referrer-Policy", "no-referrer") |
| 35 | render(w, r, destination) |
| 36 | return |
| 37 | } |
| 38 | for name, values := range result.header { |
| 39 | for _, value := range values { |
| 40 | w.Header().Add(name, value) |
| 41 | } |
| 42 | } |
| 43 | if result.status == 0 { |
| 44 | result.status = http.StatusOK |
| 45 | } |
| 46 | w.WriteHeader(result.status) |
| 47 | _, _ = w.Write(result.body.Bytes()) |
| 48 | } |
| 49 | } |
| 50 | |
| 51 | func keymailDestination(destination, origin string) bool { |
| 52 | u, err := url.Parse(destination) |
| 53 | if err != nil || u.Scheme != "https" || u.Host == "" || u.User != nil || u.Fragment != "" || u.Path != "/oauth/authorize" || u.RawPath != "" { |
| 54 | return false |
| 55 | } |
| 56 | q, err := url.ParseQuery(u.RawQuery) |
| 57 | if err != nil { |
| 58 | return false |
| 59 | } |
| 60 | for _, key := range []string{"client_id", "redirect_uri", "scope", "code_challenge_method", "state", "code_challenge"} { |
| 61 | if len(q[key]) != 1 || q.Get(key) == "" { |
| 62 | return false |
| 63 | } |
| 64 | } |
| 65 | origin = strings.TrimSuffix(origin, "/") |
| 66 | return q.Get("client_id") == origin && q.Get("redirect_uri") == origin+"/auth/callback" && q.Get("scope") == "identify" && q.Get("code_challenge_method") == "S256" |
| 67 | } |
| 68 | |
| 69 | type oauthResponse struct { |
| 70 | header http.Header |
| 71 | status int |
| 72 | body bytes.Buffer |
| 73 | } |
| 74 | |
| 75 | func (w *oauthResponse) Header() http.Header { return w.header } |
| 76 | func (w *oauthResponse) WriteHeader(status int) { |
| 77 | if w.status == 0 { |
| 78 | w.status = status |
| 79 | } |
| 80 | } |
| 81 | func (w *oauthResponse) Write(p []byte) (int, error) { |
| 82 | if w.status == 0 { |
| 83 | w.WriteHeader(http.StatusOK) |
| 84 | } |
| 85 | return w.body.Write(p) |
| 86 | } |
| 87 | |
| 88 | type OAuthData = homeconnect.OAuthData |
| 89 | |
| 90 | func OAuthPage(destination string) OAuthData { |
| 91 | return OAuthData{URL: destination, Title: "Continue signing in", ActionLabel: "Continue to Keymail"} |
| 92 | } |
| 93 | |
amadan