Provider policies registration #2

.credo.exs

@@ -100,6 +100,7 @@
         # TODO: enable by default in Credo 1.1
         {Credo.Check.Readability.UnnecessaryAliasExpansion, false},
         {Credo.Check.Readability.VariableNames, []},
+        {Credo.Check.Readability.WithSingleClause, false},
 
         #
         ## Refactoring Opportunities
@@ -129,6 +130,7 @@
         {Credo.Check.Warning.RaiseInsideRescue, []},
         # TODO enable spec with struct check
         {Credo.Check.Warning.SpecWithStruct, false},
+        {Credo.Check.Warning.StructFieldAmount, [max_fields: 40]},
         {Credo.Check.Warning.UnusedEnumOperation, []},
         {Credo.Check.Warning.UnusedFileOperation, []},
         {Credo.Check.Warning.UnusedKeywordOperation, []},

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- `AuthorizeResponse` result expose an `Oauth.Token` struct instead of value
+
 ### Added
 
 - OAuth Resource Indicators support for authorization, token, refresh, and introspection flows, with RFC 8707 validation and optional client-authorized resources

lib/boruta/adapters/codes.ex

@@ -9,6 +9,9 @@ defmodule Boruta.CodesAdapter do
 
   def get_by(params), do: codes().get_by(params)
   def create(params), do: codes().create(params)
+  def update_client_encryption(code, params), do: codes().update_client_encryption(code, params)
   def revoke(code), do: codes().revoke(code)
   def revoke_previous_token(code), do: codes().revoke_previous_token(code)
+  def update_sub(code, sub, metadata_policy), do: codes().update_sub(code, sub, metadata_policy)
+  def code_chain(code), do: codes().code_chain(code)
 end

lib/boruta/adapters/ecto/access_tokens.ex

@@ -58,6 +58,7 @@ defmodule Boruta.Ecto.AccessTokens do
     redirect_uri = params[:redirect_uri]
     previous_token = params[:previous_token]
     previous_code = params[:previous_code]
+    requested_scope = params[:requested_scope]
     resource_owner = params[:resource_owner]
     agent_token = params[:agent_token]
 
@@ -70,6 +71,7 @@ defmodule Boruta.Ecto.AccessTokens do
       redirect_uri: redirect_uri,
       state: state,
       scope: scope,
+      requested_scope: requested_scope || "",
       resource: resource,
       access_token_ttl: access_token_ttl,
       previous_token: previous_token,

lib/boruta/adapters/ecto/agent_tokens.ex

@@ -58,6 +58,7 @@ defmodule Boruta.Ecto.AgentTokens do
     redirect_uri = params[:redirect_uri]
     previous_token = params[:previous_token]
     previous_code = params[:previous_code]
+    requested_scope = params[:requested_scope]
     resource_owner = params[:resource_owner]
     bind_data = params[:bind_data]
     bind_configuration = params[:bind_configuration]
@@ -71,6 +72,7 @@ defmodule Boruta.Ecto.AgentTokens do
       redirect_uri: redirect_uri,
       state: state,
       scope: scope,
+      requested_scope: requested_scope || "",
       resource: resource,
       access_token_ttl: agent_token_ttl,
       previous_token: previous_token,

lib/boruta/adapters/ecto/clients.ex

@@ -123,9 +123,11 @@ defmodule Boruta.Ecto.Clients do
     end
   end
 
-  defp rsa_key(%Client{public_key: public_key, private_key: private_key}) do
+  defp rsa_key(%Client{public_key: public_key, private_key: private_key, id_token_signature_alg: id_token_signature_alg}) do
     {_type, jwk} = public_key |> :jose_jwk.from_pem() |> :jose_jwk.to_map()
 
-    Map.put(jwk, "kid", Oauth.Client.Crypto.kid_from_private_key(private_key))
+    jwk
+    |> Map.put("kid", Oauth.Client.Crypto.kid_from_private_key(private_key))
+    |> Map.put("alg", id_token_signature_alg)
   end
 end

lib/boruta/adapters/ecto/codes.ex

@@ -39,10 +39,12 @@ defmodule Boruta.Ecto.Codes do
 
   def get_by(id: id) do
     with {:ok, id} <- Ecto.UUID.cast(id),
-     {:ok, token} <- TokenStore.get(id: id) do
-        token
+         {:ok, token} <- TokenStore.get(id: id) do
+      token
     else
-      :error -> nil
+      :error ->
+        nil
+
       {:error, "Not cached."} ->
         with %Token{} = token <-
                repo().one(
@@ -64,7 +66,8 @@ defmodule Boruta.Ecto.Codes do
         token
 
       {:error, "Not cached."} ->
-        with %Token{} = token <-
+        with "" <> value <- value,
+             %Token{} = token <-
                repo().one(
                  from t in Token,
                    where: t.type in ["code", "preauthorized_code"] and t.value == ^value
@@ -74,6 +77,9 @@ defmodule Boruta.Ecto.Codes do
                |> to_oauth_schema()
                |> TokenStore.put() do
           token
+        else
+          {:error, error} -> {:error, error}
+          nil -> {:error, "Code not found."}
         end
     end
   end
@@ -100,19 +106,24 @@ defmodule Boruta.Ecto.Codes do
       apply(Token, changeset_method(client), [
         %Token{resource_owner: params[:resource_owner]},
         %{
+          response_type: params[:response_type],
           client_id: client_id,
           sub: sub,
           redirect_uri: redirect_uri,
           state: state,
           nonce: params[:nonce],
           scope: scope,
+          requested_scope: params[:requested_scope] || "",
           resource: params[:resource],
           authorization_code_ttl: authorization_code_ttl,
           code_challenge: code_challenge,
           code_challenge_method: code_challenge_method,
           authorization_details: authorization_details,
           presentation_definition: params[:presentation_definition],
-          public_client_id: params[:public_client_id]
+          public_client_id: params[:public_client_id],
+          client_encryption_key: params[:client_encryption_key],
+          client_encryption_alg: params[:client_encryption_alg],
+          previous_code: params[:previous_code]
         }
       ])
 
@@ -131,13 +142,62 @@ defmodule Boruta.Ecto.Codes do
   defp changeset_method(%Oauth.Client{pkce: true}), do: :pkce_code_changeset
 
   @impl Boruta.Oauth.Codes
+  def update_sub(%Oauth.Token{id: id}, sub, metadata_policy) do
+    with %Token{} = code <-
+           repo().one(
+             from t in Token,
+               where: t.type in ["code", "preauthorized_code"] and t.id == ^id
+           ),
+         {:ok, code} <- Token.sub_changeset(code, sub, metadata_policy) |> repo().update(),
+         {:ok, token} <- TokenStore.put(to_oauth_schema(code)) do
+      {:ok, token}
+    else
+      _ ->
+        {:error, "Preauthorized code not found."}
+    end
+  end
+
+  @impl Boruta.Oauth.Codes
+  def update_client_encryption(%Oauth.Token{value: value}, params) do
+    with %Token{} = token <- repo().get_by(Token, value: value),
+         {:ok, token} <- Token.client_encryption_changeset(token, params) |> repo().update(),
+         token <- to_oauth_schema(token) do
+      TokenStore.put(token)
+    end
+  end
+
+  @impl Boruta.Oauth.Codes
+  def revoke(codes) when is_list(codes) do
+    code_count = Enum.count(codes)
+    code_ids = Enum.map(codes, fn code -> code.id end)
+    now = DateTime.utc_now()
+
+    with {^code_count, _} <-
+           from(t in Token, where: t.id in ^code_ids)
+           |> repo().update_all(set: [revoked_at: now]),
+         :ok <-
+           Enum.reduce(codes, :ok, fn code, acc ->
+             case TokenStore.invalidate(code) do
+               {:ok, _token} ->
+                 acc
+
+               error ->
+                 error
+             end
+           end) do
+      {:ok, Enum.map(codes, fn code -> %{code | revoked_at: now} end)}
+    else
+      _ -> {:error, "Could not revoke code chain."}
+    end
+  end
+
   def revoke(%Oauth.Token{value: value} = code) do
     with %Token{} = token <- repo().get_by(Token, value: value),
          {:ok, token} <-
            Token.revoke_changeset(token)
            |> repo().update(),
          {:ok, _token} <- TokenStore.invalidate(code) do
-      {:ok, token}
+      {:ok, %{code | revoked_at: token.revoked_at}}
     else
       nil ->
         {:error, "Code not found."}
@@ -156,4 +216,33 @@ defmodule Boruta.Ecto.Codes do
       {:ok, code}
     end
   end
+
+  @impl Boruta.Oauth.Codes
+  def code_chain(token, acc \\ [])
+
+  def code_chain(%Oauth.Token{previous_code: nil} = code, acc) do
+    Enum.reject([code | acc], &is_nil/1) |> Enum.reverse()
+  end
+
+  def code_chain(%Oauth.Token{type: "preauthorized_code", previous_code: value} = code, acc) do
+    case code_chain(get_by(value: value)) do
+      chain when is_list(chain) ->
+        [code | acc ++ chain]
+
+      _ ->
+        acc
+    end
+  end
+
+  def code_chain(%Oauth.Token{type: "code", previous_code: value} = code, acc) do
+    case code_chain(get_by(value: value)) do
+      chain when is_list(chain) ->
+        [code | acc ++ chain]
+
+      _ ->
+        acc
+    end
+  end
+
+  def code_chain(nil, _acc), do: {:error, "Previous code not found."}
 end

lib/boruta/adapters/ecto/oauth_mapper.ex

@@ -8,11 +8,11 @@ end
 defimpl Boruta.Ecto.OauthMapper, for: Boruta.Ecto.Token do
   import Boruta.Config, only: [repo: 0, resource_owners: 0, clients: 0]
 
-  alias Boruta.Oauth
-  alias Boruta.Oauth.ResourceOwner
   alias Boruta.Ecto
   alias Boruta.Ecto.AgentTokens
   alias Boruta.Ecto.OauthMapper
+  alias Boruta.Oauth
+  alias Boruta.Oauth.ResourceOwner
 
   def to_oauth_schema(%Ecto.Token{} = token) do
     client =
@@ -33,15 +33,16 @@ defimpl Boruta.Ecto.OauthMapper, for: Boruta.Ecto.Token do
           _ -> nil
         end
 
-    resource_owner = with "" <> agent_token <- token.agent_token,
-         %Oauth.Token{} = token <- AgentTokens.get_by(value: agent_token),
-         {:ok, claims} <- AgentTokens.claims_from_agent_token(token) do
-      resource_owner = resource_owner || %ResourceOwner{sub: nil}
-      %{resource_owner | extra_claims: Map.merge(resource_owner.extra_claims, claims)}
-    else
-      _ ->
-        resource_owner
-    end
+    resource_owner =
+      with "" <> agent_token <- token.agent_token,
+           %Oauth.Token{} = token <- AgentTokens.get_by(value: agent_token),
+           {:ok, claims} <- AgentTokens.claims_from_agent_token(token) do
+        resource_owner = resource_owner || %ResourceOwner{sub: ResourceOwner.agent_sub()}
+        %{resource_owner | extra_claims: Map.merge(resource_owner.extra_claims, claims)}
+      else
+        _ ->
+          resource_owner
+      end
 
     struct(
       Oauth.Token,
@@ -59,9 +60,9 @@ end
 defimpl Boruta.Ecto.OauthMapper, for: Boruta.Ecto.Client do
   import Boruta.Config, only: [repo: 0]
 
-  alias Boruta.Oauth
   alias Boruta.Ecto
   alias Boruta.Ecto.OauthMapper
+  alias Boruta.Oauth
 
   def to_oauth_schema(%Ecto.Client{} = client) do
     client = repo().preload(client, :authorized_scopes)

lib/boruta/adapters/ecto/preauthorized_codes.ex

@@ -31,16 +31,25 @@ defmodule Boruta.Ecto.PreauthorizedCodes do
       apply(Token, changeset_method(client), [
         %Token{resource_owner: resource_owner},
         %{
-          client_id: client_id,
-          sub: sub,
-          state: state,
-          nonce: params[:nonce],
           agent_token: params[:agent_token],
-          scope: scope,
           resource: params[:resource],
-          redirect_uri: redirect_uri,
           authorization_code_ttl: authorization_code_ttl,
-          authorization_details: resource_owner.authorization_details
+          authorization_details: resource_owner.authorization_details,
+          client_id: client_id,
+          client_encryption_key: params[:client_encryption_key],
+          client_encryption_alg: params[:client_encryption_alg],
+          code_challenge: params[:code_challenge],
+          code_challenge_method: params[:code_challenge_method],
+          nonce: params[:nonce],
+          presentation_definition: params[:presentation_definition],
+          previous_code: params[:previous_code],
+          public_client_id: params[:public_client_id],
+          redirect_uri: redirect_uri,
+          response_type: params[:response_type],
+          scope: scope,
+          requested_scope: params[:requested_scope] || "",
+          state: state,
+          sub: sub
         }
       ])
 

lib/boruta/adapters/ecto/schemas/client.ex

@@ -51,7 +51,8 @@ defmodule Boruta.Ecto.Client do
           public_key: String.t(),
           private_key: String.t(),
           response_mode: String.t(),
-          signatures_adapter: String.t()
+          signatures_adapter: String.t(),
+          key_pair_type: map()
         }
 
   @token_endpoint_auth_methods [
@@ -405,9 +406,15 @@ defmodule Boruta.Ecto.Client do
 
     case key_pair_type do
       %{"type" => "universal"} ->
-        validate_inclusion(changeset, :signatures_adapter, [Atom.to_string(Boruta.Universal.Signatures)])
+        validate_inclusion(changeset, :signatures_adapter, [
+          Atom.to_string(Boruta.Universal.Signatures)
+        ])
+
       %{"type" => type} when type in ["ec", "rsa"] ->
-        validate_inclusion(changeset, :signatures_adapter, [Atom.to_string(Boruta.Internal.Signatures)])
+        validate_inclusion(changeset, :signatures_adapter, [
+          Atom.to_string(Boruta.Internal.Signatures)
+        ])
+
       _ ->
         add_error(changeset, :signatures_adapter, "unknown key pair type")
     end
@@ -536,9 +543,12 @@ defmodule Boruta.Ecto.Client do
     Regex.match?(@resource_indicator_uri_characters, uri)
   end
 
-  defp valid_resource_authority?(%URI{authority: nil}), do: true
-  defp valid_resource_authority?(%URI{host: host}) when is_binary(host) and host != "", do: true
-  defp valid_resource_authority?(_uri), do: false
+  defp valid_resource_authority?(%URI{} = uri) do
+    is_nil(Map.get(uri, :authority)) or valid_resource_host?(uri)
+  end
+
+  defp valid_resource_host?(%URI{host: host}) when is_binary(host) and host != "", do: true
+  defp valid_resource_host?(_uri), do: false
 
   defp validate_id_token_signature_alg(changeset) do
     signature_algorithms = Enum.map(Client.Crypto.signature_algorithms(), &Atom.to_string/1)
@@ -582,9 +592,7 @@ defmodule Boruta.Ecto.Client do
         %{"type" => "rsa", "modulus_size" => modulus_size, "exponent_size" => exponent_size} ->
           case parse_rsa_modulus_size(modulus_size) do
             {:ok, modulus_size} when modulus_size >= @minimum_rsa_modulus_size ->
-              JOSE.JWK.generate_key(
-                {:rsa, modulus_size, String.to_integer(exponent_size)}
-              )
+              JOSE.JWK.generate_key({:rsa, modulus_size, String.to_integer(exponent_size)})
 
             _ ->
               nil