Initial commit
Co-authored-by: K <kelseydrhoda@gmail.com>
This commit is contained in:
Simon Bihel
commit
5f5f6af531
3
.dockerignore
Normal file
3
.dockerignore
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
target/
|
||||||
|
js/ui/node_modules/
|
||||||
|
static/build
|
||||||
2
.gitignore
vendored
Normal file
2
.gitignore
vendored
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
/target
|
||||||
|
/static/build
|
||||||
2958
Cargo.lock
generated
Normal file
2958
Cargo.lock
generated
Normal file
File diff suppressed because it is too large
Load Diff
39
Cargo.toml
Normal file
39
Cargo.toml
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
[package]
|
||||||
|
name = "siwe-oidc"
|
||||||
|
version = "0.1.0"
|
||||||
|
edition = "2021"
|
||||||
|
authors = ["Spruce Systems, Inc."]
|
||||||
|
license = "Apache-2.0"
|
||||||
|
repository = "https://github.com/spruceid/siwe-oidc/"
|
||||||
|
|
||||||
|
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
||||||
|
|
||||||
|
[dependencies]
|
||||||
|
anyhow = "1.0.51"
|
||||||
|
axum = { version = "0.3.4", features = ["headers"] }
|
||||||
|
chrono = "0.4.19"
|
||||||
|
headers = "0.3.5"
|
||||||
|
hex = "0.4.3"
|
||||||
|
iri-string = { version = "0.4", features = ["serde-std"] }
|
||||||
|
openidconnect = "2.1.2"
|
||||||
|
rand = "0.8.4"
|
||||||
|
rsa = { version = "0.5.0", features = ["alloc"] }
|
||||||
|
rust-argon2 = "0.8"
|
||||||
|
serde = { version = "1.0", features = ["derive"] }
|
||||||
|
serde_json = "1.0.72"
|
||||||
|
siwe = "0.1"
|
||||||
|
async-session = "3.0.0"
|
||||||
|
thiserror = "1.0.30"
|
||||||
|
tokio = { version = "1.14.0", features = ["full"] }
|
||||||
|
tower-http = { version = "0.2.0", features = ["fs", "trace", "cors"] }
|
||||||
|
tracing = "0.1.29"
|
||||||
|
tracing-subscriber = { version = "0.3.2", features = ["env-filter"] }
|
||||||
|
url = { version = "2.2", features = ["serde"] }
|
||||||
|
urlencoding = "2.1.0"
|
||||||
|
uuid = { version = "0.8", features = ["serde", "v4"] }
|
||||||
|
figment = { version = "0.10.6", features = ["toml", "env"] }
|
||||||
|
sha2 = "0.9.0"
|
||||||
|
cookie = "0.15.1"
|
||||||
|
bincode = "1.3.3"
|
||||||
|
bb8-redis = "0.10.1"
|
||||||
|
async-redis-session = "0.2.2"
|
||||||
38
Dockerfile
Normal file
38
Dockerfile
Normal file
@ -0,0 +1,38 @@
|
|||||||
|
FROM clux/muslrust:1.57.0 as chef
|
||||||
|
WORKDIR /siwe-oidc
|
||||||
|
RUN cargo install cargo-chef
|
||||||
|
|
||||||
|
FROM chef as dep_planner
|
||||||
|
COPY ./src/ ./src/
|
||||||
|
COPY ./Cargo.lock ./
|
||||||
|
COPY ./Cargo.toml ./
|
||||||
|
COPY ./siwe-oidc.toml ./
|
||||||
|
RUN cargo chef prepare --recipe-path recipe.json
|
||||||
|
|
||||||
|
FROM chef as dep_cacher
|
||||||
|
COPY --from=dep_planner /siwe-oidc/recipe.json recipe.json
|
||||||
|
RUN cargo chef cook --release --recipe-path recipe.json
|
||||||
|
|
||||||
|
FROM node:16-alpine as node_builder
|
||||||
|
ADD --chown=node:node ./static /siwe-oidc/static
|
||||||
|
ADD --chown=node:node ./js/ui /siwe-oidc/js/ui
|
||||||
|
WORKDIR /siwe-oidc/js/ui
|
||||||
|
RUN npm install
|
||||||
|
RUN npm run build
|
||||||
|
|
||||||
|
FROM chef as builder
|
||||||
|
COPY --from=dep_cacher /siwe-oidc/target/ ./target/
|
||||||
|
COPY --from=dep_cacher $CARGO_HOME $CARGO_HOME
|
||||||
|
COPY --from=dep_planner /siwe-oidc/ ./
|
||||||
|
RUN cargo build --release
|
||||||
|
|
||||||
|
FROM alpine
|
||||||
|
COPY --from=builder /siwe-oidc/target/x86_64-unknown-linux-musl/release/siwe-oidc /usr/local/bin/
|
||||||
|
WORKDIR /siwe-oidc
|
||||||
|
RUN mkdir -p ./static
|
||||||
|
COPY --from=node_builder /siwe-oidc/static/ ./static/
|
||||||
|
COPY --from=builder /siwe-oidc/siwe-oidc.toml ./
|
||||||
|
EXPOSE 8000
|
||||||
|
ENTRYPOINT ["siwe-oidc"]
|
||||||
|
LABEL org.opencontainers.image.source https://github.com/spruceid/siwe-oidc
|
||||||
|
LABEL org.opencontainers.image.description "OpenID Connect Identity Provider for Sign-In with Ethereum"
|
||||||
27
docker-compose.yml
Normal file
27
docker-compose.yml
Normal file
@ -0,0 +1,27 @@
|
|||||||
|
version: "3"
|
||||||
|
services:
|
||||||
|
siwe-oidc:
|
||||||
|
build: .
|
||||||
|
ports:
|
||||||
|
- "8000:8000"
|
||||||
|
environment:
|
||||||
|
SIWEOIDC_ADDRESS: "0.0.0.0"
|
||||||
|
# Need siwe-oidc in /etc/hosts for localhost to allow both the host and Keycloak to reach the IdP
|
||||||
|
SIWEOIDC_BASE_URL: "http://siwe-oidc:8000/"
|
||||||
|
SIWEOIDC_REDIS_URL: "redis://redis"
|
||||||
|
SIWEOIDC_DEFAULT_CLIENTS: '{sdf="sdf"}'
|
||||||
|
RUST_LOG: "siwe_oidc=debug,tower_http=debug"
|
||||||
|
|
||||||
|
keycloak:
|
||||||
|
image: quay.io/keycloak/keycloak:latest
|
||||||
|
ports:
|
||||||
|
- "8080:8080"
|
||||||
|
environment:
|
||||||
|
DB_VENDOR: H2
|
||||||
|
KEYCLOAK_USER: admin
|
||||||
|
KEYCLOAK_PASSWORD: admin
|
||||||
|
|
||||||
|
redis:
|
||||||
|
image: redis:6-alpine
|
||||||
|
ports:
|
||||||
|
- "6379:6379"
|
||||||
3
js/ui/.gitignore
vendored
Normal file
3
js/ui/.gitignore
vendored
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
.DS_Store
|
||||||
|
node_modules
|
||||||
|
public/build/bundle.*
|
||||||
1
js/ui/.vscode/extensions.json
vendored
Normal file
1
js/ui/.vscode/extensions.json
vendored
Normal file
@ -0,0 +1 @@
|
|||||||
|
{"recommendations": ["svelte.svelte-vscode"]}
|
||||||
64
js/ui/README.md
Normal file
64
js/ui/README.md
Normal file
@ -0,0 +1,64 @@
|
|||||||
|
# svelte app
|
||||||
|
|
||||||
|
This is a project template for [Svelte](https://svelte.dev) apps. It lives at https://github.com/sveltejs/template-webpack.
|
||||||
|
|
||||||
|
To create a new project based on this template using [degit](https://github.com/Rich-Harris/degit):
|
||||||
|
|
||||||
|
```bash
|
||||||
|
npx degit sveltejs/template-webpack svelte-app
|
||||||
|
cd svelte-app
|
||||||
|
```
|
||||||
|
|
||||||
|
*Note that you will need to have [Node.js](https://nodejs.org) installed.*
|
||||||
|
|
||||||
|
|
||||||
|
## Get started
|
||||||
|
|
||||||
|
Install the dependencies...
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd svelte-app
|
||||||
|
npm install
|
||||||
|
```
|
||||||
|
|
||||||
|
...then start webpack:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
npm run dev
|
||||||
|
```
|
||||||
|
|
||||||
|
Navigate to [localhost:8080](http://localhost:8080). You should see your app running. Edit a component file in `src`, save it, and the page should reload with your changes.
|
||||||
|
|
||||||
|
|
||||||
|
## Deploying to the web
|
||||||
|
|
||||||
|
### With [now](https://zeit.co/now)
|
||||||
|
|
||||||
|
Install `now` if you haven't already:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
npm install -g now
|
||||||
|
```
|
||||||
|
|
||||||
|
Then, from within your project folder:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
now
|
||||||
|
```
|
||||||
|
|
||||||
|
As an alternative, use the [Now desktop client](https://zeit.co/download) and simply drag the unzipped project folder to the taskbar icon.
|
||||||
|
|
||||||
|
### With [surge](https://surge.sh/)
|
||||||
|
|
||||||
|
Install `surge` if you haven't already:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
npm install -g surge
|
||||||
|
```
|
||||||
|
|
||||||
|
Then, from within your project folder:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
npm run build
|
||||||
|
surge public
|
||||||
|
```
|
||||||
23436
js/ui/package-lock.json
generated
Normal file
23436
js/ui/package-lock.json
generated
Normal file
File diff suppressed because it is too large
Load Diff
43
js/ui/package.json
Normal file
43
js/ui/package.json
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
{
|
||||||
|
"name": "svelte-app",
|
||||||
|
"version": "1.0.0",
|
||||||
|
"devDependencies": {
|
||||||
|
"@tsconfig/svelte": "^1.0.10",
|
||||||
|
"@types/node": "^14.11.1",
|
||||||
|
"assert": "^2.0.0",
|
||||||
|
"buffer": "^6.0.3",
|
||||||
|
"cross-env": "^7.0.3",
|
||||||
|
"crypto-browserify": "^3.12.0",
|
||||||
|
"css-loader": "^5.0.1",
|
||||||
|
"dotenv-webpack": "^7.0.3",
|
||||||
|
"https-browserify": "^1.0.0",
|
||||||
|
"mini-css-extract-plugin": "^1.3.4",
|
||||||
|
"os-browserify": "^0.3.0",
|
||||||
|
"process": "^0.11.10",
|
||||||
|
"stream-browserify": "^3.0.0",
|
||||||
|
"stream-http": "^3.2.0",
|
||||||
|
"svelte": "^3.31.2",
|
||||||
|
"svelte-check": "^1.0.46",
|
||||||
|
"svelte-loader": "^3.0.0",
|
||||||
|
"svelte-preprocess": "^4.3.0",
|
||||||
|
"ts-loader": "^8.0.4",
|
||||||
|
"tslib": "^2.0.1",
|
||||||
|
"typescript": "^4.0.3",
|
||||||
|
"webpack": "^5.16.0",
|
||||||
|
"webpack-cli": "^4.4.0",
|
||||||
|
"webpack-dev-server": "^3.11.2"
|
||||||
|
},
|
||||||
|
"scripts": {
|
||||||
|
"build": "cross-env NODE_ENV=production webpack",
|
||||||
|
"dev": "webpack serve --content-base public",
|
||||||
|
"validate": "svelte-check"
|
||||||
|
},
|
||||||
|
"dependencies": {
|
||||||
|
"@portis/web3": "^4.0.6",
|
||||||
|
"@spruceid/siwe-web3modal": "^0.1.5",
|
||||||
|
"@toruslabs/torus-embed": "^1.18.3",
|
||||||
|
"@walletconnect/web3-provider": "^1.6.6",
|
||||||
|
"fortmatic": "^2.2.1",
|
||||||
|
"walletlink": "^2.2.8"
|
||||||
|
}
|
||||||
|
}
|
||||||
118
js/ui/src/App.svelte
Normal file
118
js/ui/src/App.svelte
Normal file
@ -0,0 +1,118 @@
|
|||||||
|
<script lang="ts">
|
||||||
|
import Portis from "@portis/web3";
|
||||||
|
import { Client, SiweSession } from "@spruceid/siwe-web3modal";
|
||||||
|
import Torus from "@toruslabs/torus-embed";
|
||||||
|
import WalletConnectProvider from "@walletconnect/web3-provider";
|
||||||
|
import Fortmatic from "fortmatic";
|
||||||
|
import WalletLink from "walletlink";
|
||||||
|
|
||||||
|
// TODO: REMOVE DEFAULTS:
|
||||||
|
// main.ts will parse the params from the server
|
||||||
|
export let domain: string;
|
||||||
|
export let nonce: string;
|
||||||
|
export let redirect: string;
|
||||||
|
export let state: string;
|
||||||
|
export let oidc_nonce: string;
|
||||||
|
|
||||||
|
let uri: string = window.location.href.split("?")[0];
|
||||||
|
|
||||||
|
// Could be exposed in the future.
|
||||||
|
export let useENS: boolean = true;
|
||||||
|
|
||||||
|
$: status = "Not Logged In";
|
||||||
|
|
||||||
|
let client = new Client({
|
||||||
|
session: {
|
||||||
|
domain,
|
||||||
|
uri,
|
||||||
|
useENS,
|
||||||
|
version: "1",
|
||||||
|
// TODO: Vet this as the default statement.
|
||||||
|
statement: "Sign-In With Ethereum OpenID-Connect",
|
||||||
|
},
|
||||||
|
modal: {
|
||||||
|
theme: "dark",
|
||||||
|
providerOptions: {
|
||||||
|
walletconnect: {
|
||||||
|
package: WalletConnectProvider,
|
||||||
|
options: {
|
||||||
|
infuraId: process.env.INFURA_ID,
|
||||||
|
pollingInterval: 100000,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
torus: {
|
||||||
|
package: Torus,
|
||||||
|
},
|
||||||
|
portis: {
|
||||||
|
package: Portis,
|
||||||
|
options: {
|
||||||
|
id: process.env.PORTIS_ID,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
fortmatic: {
|
||||||
|
package: Fortmatic,
|
||||||
|
options: {
|
||||||
|
key: process.env.FORTMATIC_KEY,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"custom-coinbase": {
|
||||||
|
display: {
|
||||||
|
logo: "img/coinbase.svg",
|
||||||
|
name: "Coinbase",
|
||||||
|
description: "Scan with WalletLink to connect",
|
||||||
|
},
|
||||||
|
options: {
|
||||||
|
appName: "Sign-In with Ethereum",
|
||||||
|
networkUrl: `https://mainnet.infura.io/v3/${process.env.INFURA_ID}`,
|
||||||
|
chainId: 1,
|
||||||
|
darkMode: false,
|
||||||
|
},
|
||||||
|
package: WalletLink,
|
||||||
|
connector: async (_, options) => {
|
||||||
|
const { appName, networkUrl, chainId, darkMode } =
|
||||||
|
options;
|
||||||
|
const walletLink = new WalletLink({
|
||||||
|
appName,
|
||||||
|
darkMode,
|
||||||
|
});
|
||||||
|
const provider = walletLink.makeWeb3Provider(
|
||||||
|
networkUrl,
|
||||||
|
chainId
|
||||||
|
);
|
||||||
|
await provider.enable();
|
||||||
|
return provider;
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
});
|
||||||
|
|
||||||
|
let oidc_nonce_param = "";
|
||||||
|
if (oidc_nonce != "") {
|
||||||
|
oidc_nonce_param = `&oidc_nonce=${oidc_nonce}`;
|
||||||
|
}
|
||||||
|
client.on("signIn", (result) => {
|
||||||
|
console.log(result);
|
||||||
|
window.location.replace(`/sign_in?redirect_uri=${encodeURI(redirect)}&state=${encodeURI(state)}${encodeURI(oidc_nonce_param)}`);
|
||||||
|
});
|
||||||
|
</script>
|
||||||
|
|
||||||
|
<main>
|
||||||
|
<div>
|
||||||
|
<h2>Sign-In With Ethereum</h2>
|
||||||
|
<p>{status}</p>
|
||||||
|
<!-- TODO: Add copy / info about who is requesting here. -->
|
||||||
|
<button
|
||||||
|
on:click={() => {
|
||||||
|
client.signIn(nonce).catch((e) => {
|
||||||
|
console.error(e);
|
||||||
|
});
|
||||||
|
}}
|
||||||
|
>
|
||||||
|
Sign In
|
||||||
|
</button>
|
||||||
|
</div>
|
||||||
|
</main>
|
||||||
|
|
||||||
|
<style>
|
||||||
|
</style>
|
||||||
63
js/ui/src/global.css
Normal file
63
js/ui/src/global.css
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
html, body {
|
||||||
|
position: relative;
|
||||||
|
width: 100%;
|
||||||
|
height: 100%;
|
||||||
|
}
|
||||||
|
|
||||||
|
body {
|
||||||
|
color: #333;
|
||||||
|
margin: 0;
|
||||||
|
padding: 8px;
|
||||||
|
box-sizing: border-box;
|
||||||
|
font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;
|
||||||
|
}
|
||||||
|
|
||||||
|
a {
|
||||||
|
color: rgb(0,100,200);
|
||||||
|
text-decoration: none;
|
||||||
|
}
|
||||||
|
|
||||||
|
a:hover {
|
||||||
|
text-decoration: underline;
|
||||||
|
}
|
||||||
|
|
||||||
|
a:visited {
|
||||||
|
color: rgb(0,80,160);
|
||||||
|
}
|
||||||
|
|
||||||
|
label {
|
||||||
|
display: block;
|
||||||
|
}
|
||||||
|
|
||||||
|
input, button, select, textarea {
|
||||||
|
font-family: inherit;
|
||||||
|
font-size: inherit;
|
||||||
|
-webkit-padding: 0.4em 0;
|
||||||
|
padding: 0.4em;
|
||||||
|
margin: 0 0 0.5em 0;
|
||||||
|
box-sizing: border-box;
|
||||||
|
border: 1px solid #ccc;
|
||||||
|
border-radius: 2px;
|
||||||
|
}
|
||||||
|
|
||||||
|
input:disabled {
|
||||||
|
color: #ccc;
|
||||||
|
}
|
||||||
|
|
||||||
|
button {
|
||||||
|
color: #333;
|
||||||
|
background-color: #f4f4f4;
|
||||||
|
outline: none;
|
||||||
|
}
|
||||||
|
|
||||||
|
button:disabled {
|
||||||
|
color: #999;
|
||||||
|
}
|
||||||
|
|
||||||
|
button:not(:disabled):active {
|
||||||
|
background-color: #ddd;
|
||||||
|
}
|
||||||
|
|
||||||
|
button:focus {
|
||||||
|
border-color: #666;
|
||||||
|
}
|
||||||
18
js/ui/src/main.ts
Normal file
18
js/ui/src/main.ts
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
import './global.css';
|
||||||
|
|
||||||
|
import App from './App.svelte';
|
||||||
|
|
||||||
|
const params = new URLSearchParams(window.location.search);
|
||||||
|
|
||||||
|
const app = new App({
|
||||||
|
target: document.body,
|
||||||
|
props: {
|
||||||
|
domain: params.get('domain'),
|
||||||
|
nonce: params.get('nonce'),
|
||||||
|
redirect: params.get('redirect_uri'),
|
||||||
|
state: params.get('state'),
|
||||||
|
oidc_nonce: params.get('oidc_nonce')
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
export default app;
|
||||||
5
js/ui/tsconfig.json
Normal file
5
js/ui/tsconfig.json
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
{
|
||||||
|
"extends": "@tsconfig/svelte/tsconfig.json",
|
||||||
|
"include": ["src/**/*", "src/node_modules/**/*"],
|
||||||
|
"exclude": ["node_modules/*", "__sapper__/*", "static/*"]
|
||||||
|
}
|
||||||
91
js/ui/webpack.config.js
Normal file
91
js/ui/webpack.config.js
Normal file
@ -0,0 +1,91 @@
|
|||||||
|
const MiniCssExtractPlugin = require('mini-css-extract-plugin');
|
||||||
|
const path = require('path');
|
||||||
|
const sveltePreprocess = require('svelte-preprocess');
|
||||||
|
const Dotenv = require('dotenv-webpack');
|
||||||
|
const webpack = require('webpack');
|
||||||
|
|
||||||
|
const mode = process.env.NODE_ENV || 'development';
|
||||||
|
const prod = mode === 'production';
|
||||||
|
|
||||||
|
module.exports = {
|
||||||
|
entry: {
|
||||||
|
'build/bundle': ['./src/main.ts']
|
||||||
|
},
|
||||||
|
resolve: {
|
||||||
|
alias: {
|
||||||
|
svelte: path.dirname(require.resolve('svelte/package.json'))
|
||||||
|
},
|
||||||
|
extensions: ['.mjs', '.js', '.ts', '.svelte'],
|
||||||
|
mainFields: ['svelte', 'browser', 'module', 'main'],
|
||||||
|
fallback: {
|
||||||
|
assert: require.resolve("assert"),
|
||||||
|
buffer: require.resolve('buffer/'),
|
||||||
|
crypto: require.resolve('crypto-browserify'),
|
||||||
|
fs: false,
|
||||||
|
http: require.resolve('stream-http'),
|
||||||
|
https: require.resolve('https-browserify'),
|
||||||
|
os: require.resolve('os-browserify/browser'),
|
||||||
|
path: false,
|
||||||
|
process: require.resolve('process/browser'),
|
||||||
|
stream: require.resolve('stream-browserify'),
|
||||||
|
// util: false,
|
||||||
|
}
|
||||||
|
},
|
||||||
|
output: {
|
||||||
|
path: path.join(__dirname, '../../static'),
|
||||||
|
filename: '[name].js',
|
||||||
|
chunkFilename: '[name].[id].js'
|
||||||
|
},
|
||||||
|
module: {
|
||||||
|
rules: [
|
||||||
|
{
|
||||||
|
test: /\.ts$/,
|
||||||
|
loader: 'ts-loader',
|
||||||
|
exclude: /node_modules/
|
||||||
|
},
|
||||||
|
{
|
||||||
|
test: /\.svelte$/,
|
||||||
|
use: {
|
||||||
|
loader: 'svelte-loader',
|
||||||
|
options: {
|
||||||
|
compilerOptions: {
|
||||||
|
dev: !prod
|
||||||
|
},
|
||||||
|
emitCss: prod,
|
||||||
|
hotReload: !prod,
|
||||||
|
preprocess: sveltePreprocess({ sourceMap: !prod })
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
test: /\.css$/,
|
||||||
|
use: [
|
||||||
|
MiniCssExtractPlugin.loader,
|
||||||
|
'css-loader'
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
// required to prevent errors from Svelte on Webpack 5+
|
||||||
|
test: /node_modules\/svelte\/.*\.mjs$/,
|
||||||
|
resolve: {
|
||||||
|
fullySpecified: false
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
mode,
|
||||||
|
plugins: [
|
||||||
|
new webpack.ProvidePlugin({
|
||||||
|
Buffer: ["buffer", "Buffer"],
|
||||||
|
process: path.resolve(path.join(__dirname, "node_modules/process/browser")),
|
||||||
|
}),
|
||||||
|
new MiniCssExtractPlugin({
|
||||||
|
filename: '[name].css'
|
||||||
|
}),
|
||||||
|
new Dotenv(),
|
||||||
|
],
|
||||||
|
devtool: prod ? false : 'source-map',
|
||||||
|
devServer: {
|
||||||
|
hot: true
|
||||||
|
}
|
||||||
|
};
|
||||||
0
siwe-oidc.toml
Normal file
0
siwe-oidc.toml
Normal file
32
src/config.rs
Normal file
32
src/config.rs
Normal file
@ -0,0 +1,32 @@
|
|||||||
|
use serde::{Deserialize, Serialize};
|
||||||
|
use std::{
|
||||||
|
collections::HashMap,
|
||||||
|
net::{IpAddr, Ipv4Addr},
|
||||||
|
};
|
||||||
|
use url::Url;
|
||||||
|
|
||||||
|
#[derive(Serialize, Deserialize, Clone)]
|
||||||
|
pub struct Config {
|
||||||
|
pub address: IpAddr,
|
||||||
|
pub port: u16,
|
||||||
|
pub base_url: Url,
|
||||||
|
pub rsa_pem: Option<String>,
|
||||||
|
pub redis_url: Url,
|
||||||
|
pub default_clients: HashMap<String, String>,
|
||||||
|
// TODO secret is more complicated than that, and needs to be in the well-known config
|
||||||
|
pub require_secret: bool,
|
||||||
|
}
|
||||||
|
|
||||||
|
impl Default for Config {
|
||||||
|
fn default() -> Self {
|
||||||
|
Self {
|
||||||
|
address: Ipv4Addr::new(127, 0, 0, 1).into(),
|
||||||
|
port: 8000,
|
||||||
|
base_url: Url::parse("http://127.0.0.1:8000").unwrap(),
|
||||||
|
rsa_pem: None,
|
||||||
|
redis_url: Url::parse("redis://localhost").unwrap(),
|
||||||
|
default_clients: HashMap::default(),
|
||||||
|
require_secret: true,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
707
src/main.rs
Normal file
707
src/main.rs
Normal file
@ -0,0 +1,707 @@
|
|||||||
|
use anyhow::{anyhow, Result};
|
||||||
|
use async_redis_session::RedisSessionStore;
|
||||||
|
use axum::{
|
||||||
|
body::{Bytes, Full},
|
||||||
|
error_handling::HandleErrorExt,
|
||||||
|
extract::{self, Extension, Form, Query, TypedHeader},
|
||||||
|
http::{
|
||||||
|
header::{self, HeaderMap},
|
||||||
|
Response, StatusCode,
|
||||||
|
},
|
||||||
|
response::{IntoResponse, Redirect},
|
||||||
|
routing::{get, post, service_method_routing},
|
||||||
|
AddExtensionLayer, Json, Router,
|
||||||
|
};
|
||||||
|
use bb8_redis::{bb8, bb8::Pool, redis::AsyncCommands, RedisConnectionManager};
|
||||||
|
use chrono::{Duration, Utc};
|
||||||
|
use figment::{
|
||||||
|
providers::{Env, Format, Serialized, Toml},
|
||||||
|
Figment,
|
||||||
|
};
|
||||||
|
use headers::{self, authorization::Bearer, Authorization};
|
||||||
|
use hex::FromHex;
|
||||||
|
use iri_string::types::{UriAbsoluteString, UriString};
|
||||||
|
use openidconnect::{
|
||||||
|
core::{
|
||||||
|
CoreClaimName, CoreClientAuthMethod, CoreClientMetadata, CoreClientRegistrationResponse,
|
||||||
|
CoreGrantType, CoreIdToken, CoreIdTokenClaims, CoreIdTokenFields, CoreJsonWebKeySet,
|
||||||
|
CoreJwsSigningAlgorithm, CoreProviderMetadata, CoreResponseType, CoreRsaPrivateSigningKey,
|
||||||
|
CoreSubjectIdentifierType, CoreTokenResponse, CoreTokenType, CoreUserInfoClaims,
|
||||||
|
},
|
||||||
|
registration::{EmptyAdditionalClientMetadata, EmptyAdditionalClientRegistrationResponse},
|
||||||
|
AccessToken, Audience, AuthUrl, ClientId, EmptyAdditionalClaims,
|
||||||
|
EmptyAdditionalProviderMetadata, EmptyExtraTokenFields, IssuerUrl, JsonWebKeyId,
|
||||||
|
JsonWebKeySetUrl, Nonce, PrivateSigningKey, RedirectUrl, RegistrationUrl, ResponseTypes, Scope,
|
||||||
|
StandardClaims, SubjectIdentifier, TokenUrl, UserInfoUrl,
|
||||||
|
};
|
||||||
|
use rand::rngs::OsRng;
|
||||||
|
use rsa::{
|
||||||
|
pkcs1::{FromRsaPrivateKey, ToRsaPrivateKey},
|
||||||
|
RsaPrivateKey,
|
||||||
|
};
|
||||||
|
use serde::{Deserialize, Serialize};
|
||||||
|
use siwe::eip4361::{Message, Version};
|
||||||
|
use std::{convert::Infallible, net::SocketAddr, str::FromStr};
|
||||||
|
use thiserror::Error;
|
||||||
|
use tower_http::{
|
||||||
|
services::{ServeDir, ServeFile},
|
||||||
|
trace::TraceLayer,
|
||||||
|
};
|
||||||
|
use tracing::info;
|
||||||
|
use urlencoding::decode;
|
||||||
|
use uuid::Uuid;
|
||||||
|
|
||||||
|
mod config;
|
||||||
|
mod session;
|
||||||
|
|
||||||
|
use session::*;
|
||||||
|
|
||||||
|
const KID: &str = "key1";
|
||||||
|
const KV_CLIENT_PREFIX: &str = "clients";
|
||||||
|
const ENTRY_LIFETIME: usize = 60 * 60 * 24 * 2;
|
||||||
|
|
||||||
|
type ConnectionPool = Pool<RedisConnectionManager>;
|
||||||
|
|
||||||
|
#[derive(Debug, Error)]
|
||||||
|
pub enum CustomError {
|
||||||
|
#[error("{0}")]
|
||||||
|
BadRequest(String),
|
||||||
|
#[error("{0}")]
|
||||||
|
Unauthorized(String),
|
||||||
|
#[error(transparent)]
|
||||||
|
Other(#[from] anyhow::Error),
|
||||||
|
}
|
||||||
|
|
||||||
|
impl IntoResponse for CustomError {
|
||||||
|
type Body = Full<Bytes>;
|
||||||
|
type BodyError = Infallible;
|
||||||
|
|
||||||
|
fn into_response(self) -> Response<Self::Body> {
|
||||||
|
match self {
|
||||||
|
CustomError::BadRequest(_) => (StatusCode::BAD_REQUEST, self.to_string()),
|
||||||
|
CustomError::Unauthorized(_) => (StatusCode::UNAUTHORIZED, self.to_string()),
|
||||||
|
CustomError::Other(_) => (StatusCode::INTERNAL_SERVER_ERROR, self.to_string()),
|
||||||
|
}
|
||||||
|
.into_response()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn jwk_set(
|
||||||
|
Extension(private_key): Extension<RsaPrivateKey>,
|
||||||
|
) -> Result<Json<CoreJsonWebKeySet>, CustomError> {
|
||||||
|
let pem = private_key
|
||||||
|
.to_pkcs1_pem()
|
||||||
|
.map_err(|e| anyhow!("Failed to serialise key as PEM: {}", e))?;
|
||||||
|
let jwks = CoreJsonWebKeySet::new(vec![CoreRsaPrivateSigningKey::from_pem(
|
||||||
|
&pem,
|
||||||
|
Some(JsonWebKeyId::new(KID.to_string())),
|
||||||
|
)
|
||||||
|
.map_err(|e| anyhow!("Invalid RSA private key: {}", e))?
|
||||||
|
.as_verification_key()]);
|
||||||
|
Ok(jwks.into())
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn provider_metadata(
|
||||||
|
Extension(config): Extension<config::Config>,
|
||||||
|
) -> Result<Json<CoreProviderMetadata>, CustomError> {
|
||||||
|
let pm = CoreProviderMetadata::new(
|
||||||
|
IssuerUrl::from_url(config.base_url.clone()),
|
||||||
|
AuthUrl::from_url(
|
||||||
|
config
|
||||||
|
.base_url
|
||||||
|
.join("authorize")
|
||||||
|
.map_err(|e| anyhow!("Unable to join URL: {}", e))?,
|
||||||
|
),
|
||||||
|
JsonWebKeySetUrl::from_url(
|
||||||
|
config
|
||||||
|
.base_url
|
||||||
|
.join("jwk")
|
||||||
|
.map_err(|e| anyhow!("Unable to join URL: {}", e))?,
|
||||||
|
),
|
||||||
|
vec![
|
||||||
|
ResponseTypes::new(vec![CoreResponseType::Code]),
|
||||||
|
ResponseTypes::new(vec![CoreResponseType::Token, CoreResponseType::IdToken]),
|
||||||
|
],
|
||||||
|
vec![CoreSubjectIdentifierType::Pairwise],
|
||||||
|
vec![CoreJwsSigningAlgorithm::RsaSsaPssSha256],
|
||||||
|
EmptyAdditionalProviderMetadata {},
|
||||||
|
)
|
||||||
|
.set_token_endpoint(Some(TokenUrl::from_url(
|
||||||
|
config
|
||||||
|
.base_url
|
||||||
|
.join("token")
|
||||||
|
.map_err(|e| anyhow!("Unable to join URL: {}", e))?,
|
||||||
|
)))
|
||||||
|
.set_userinfo_endpoint(Some(UserInfoUrl::from_url(
|
||||||
|
config
|
||||||
|
.base_url
|
||||||
|
.join("userinfo")
|
||||||
|
.map_err(|e| anyhow!("Unable to join URL: {}", e))?,
|
||||||
|
)))
|
||||||
|
.set_scopes_supported(Some(vec![
|
||||||
|
Scope::new("openid".to_string()),
|
||||||
|
// Scope::new("email".to_string()),
|
||||||
|
// Scope::new("profile".to_string()),
|
||||||
|
]))
|
||||||
|
.set_claims_supported(Some(vec![
|
||||||
|
CoreClaimName::new("sub".to_string()),
|
||||||
|
CoreClaimName::new("aud".to_string()),
|
||||||
|
// CoreClaimName::new("email".to_string()),
|
||||||
|
// CoreClaimName::new("email_verified".to_string()),
|
||||||
|
CoreClaimName::new("exp".to_string()),
|
||||||
|
CoreClaimName::new("iat".to_string()),
|
||||||
|
CoreClaimName::new("iss".to_string()),
|
||||||
|
// CoreClaimName::new("name".to_string()),
|
||||||
|
// CoreClaimName::new("given_name".to_string()),
|
||||||
|
// CoreClaimName::new("family_name".to_string()),
|
||||||
|
// CoreClaimName::new("picture".to_string()),
|
||||||
|
// CoreClaimName::new("locale".to_string()),
|
||||||
|
]))
|
||||||
|
.set_registration_endpoint(Some(RegistrationUrl::from_url(
|
||||||
|
config
|
||||||
|
.base_url
|
||||||
|
.join("register")
|
||||||
|
.map_err(|e| anyhow!("Unable to join URL: {}", e))?,
|
||||||
|
)))
|
||||||
|
.set_token_endpoint_auth_methods_supported(Some(vec![CoreClientAuthMethod::ClientSecretPost]));
|
||||||
|
|
||||||
|
Ok(pm.into())
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Deserialize)]
|
||||||
|
struct TokenForm {
|
||||||
|
code: String,
|
||||||
|
client_id: String,
|
||||||
|
client_secret: Option<String>,
|
||||||
|
grant_type: CoreGrantType, // TODO should just be authorization_code apparently?
|
||||||
|
}
|
||||||
|
|
||||||
|
// TODO should check Authorization header
|
||||||
|
// Actually, client secret can be
|
||||||
|
// 1. in the POST (currently supported)
|
||||||
|
// 2. Authorization header
|
||||||
|
// 3. JWT
|
||||||
|
// 4. signed JWT
|
||||||
|
// according to Keycloak
|
||||||
|
|
||||||
|
async fn token(
|
||||||
|
form: Form<TokenForm>,
|
||||||
|
Extension(private_key): Extension<RsaPrivateKey>,
|
||||||
|
Extension(config): Extension<config::Config>,
|
||||||
|
Extension(pool): Extension<ConnectionPool>,
|
||||||
|
) -> Result<Json<CoreTokenResponse>, CustomError> {
|
||||||
|
let mut conn = pool
|
||||||
|
.get()
|
||||||
|
.await
|
||||||
|
.map_err(|e| anyhow!("Failed to get connection to database: {}", e))?;
|
||||||
|
|
||||||
|
if let Some(secret) = form.client_secret.clone() {
|
||||||
|
let stored_secret: Option<String> = conn
|
||||||
|
.get(format!("{}/{}", KV_CLIENT_PREFIX, form.client_id))
|
||||||
|
.await
|
||||||
|
.map_err(|e| anyhow!("Failed to get kv: {}", e))?;
|
||||||
|
if stored_secret.is_none() {
|
||||||
|
Err(CustomError::Unauthorized(
|
||||||
|
"Unrecognised client id.".to_string(),
|
||||||
|
))?;
|
||||||
|
}
|
||||||
|
if secret != stored_secret.unwrap() {
|
||||||
|
Err(CustomError::Unauthorized("Bad secret.".to_string()))?;
|
||||||
|
}
|
||||||
|
} else if config.require_secret {
|
||||||
|
Err(CustomError::Unauthorized("Secret required.".to_string()))?;
|
||||||
|
}
|
||||||
|
|
||||||
|
let serialized_entry: Option<Vec<u8>> = conn
|
||||||
|
.get(form.code.to_string())
|
||||||
|
.await
|
||||||
|
.map_err(|e| anyhow!("Failed to get kv: {}", e))?;
|
||||||
|
if serialized_entry.is_none() {
|
||||||
|
Err(CustomError::BadRequest("Unknown code.".to_string()))?;
|
||||||
|
}
|
||||||
|
let code_entry: CodeEntry = bincode::deserialize(
|
||||||
|
&hex::decode(serialized_entry.unwrap())
|
||||||
|
.map_err(|e| anyhow!("Failed to decode code entry: {}", e))?,
|
||||||
|
)
|
||||||
|
.map_err(|e| anyhow!("Failed to deserialize code: {}", e))?;
|
||||||
|
|
||||||
|
if code_entry.exchange_count > 0 {
|
||||||
|
// TODO use Oauth error response
|
||||||
|
Err(anyhow!("Code was previously exchanged."))?;
|
||||||
|
}
|
||||||
|
conn.set_ex(
|
||||||
|
form.code.to_string(),
|
||||||
|
hex::encode(
|
||||||
|
bincode::serialize(&code_entry)
|
||||||
|
.map_err(|e| anyhow!("Failed to serialise code: {}", e))?,
|
||||||
|
),
|
||||||
|
ENTRY_LIFETIME,
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.map_err(|e| anyhow!("Failed to set kv: {}", e))?;
|
||||||
|
|
||||||
|
let access_token = AccessToken::new(form.code.clone());
|
||||||
|
let core_id_token = CoreIdTokenClaims::new(
|
||||||
|
IssuerUrl::from_url(config.base_url),
|
||||||
|
vec![Audience::new(form.client_id.clone())],
|
||||||
|
Utc::now() + Duration::seconds(60),
|
||||||
|
Utc::now(),
|
||||||
|
StandardClaims::new(SubjectIdentifier::new(code_entry.address)),
|
||||||
|
EmptyAdditionalClaims {},
|
||||||
|
)
|
||||||
|
.set_nonce(code_entry.nonce);
|
||||||
|
|
||||||
|
let pem = private_key
|
||||||
|
.to_pkcs1_pem()
|
||||||
|
.map_err(|e| anyhow!("Failed to serialise key as PEM: {}", e))?;
|
||||||
|
|
||||||
|
let id_token = CoreIdToken::new(
|
||||||
|
core_id_token,
|
||||||
|
&CoreRsaPrivateSigningKey::from_pem(&pem, Some(JsonWebKeyId::new(KID.to_string())))
|
||||||
|
.map_err(|e| anyhow!("Invalid RSA private key: {}", e))?,
|
||||||
|
CoreJwsSigningAlgorithm::RsaSsaPkcs1V15Sha256,
|
||||||
|
Some(&access_token),
|
||||||
|
None,
|
||||||
|
)
|
||||||
|
.map_err(|e| anyhow!("{}", e))?;
|
||||||
|
|
||||||
|
Ok(CoreTokenResponse::new(
|
||||||
|
access_token,
|
||||||
|
CoreTokenType::Bearer,
|
||||||
|
CoreIdTokenFields::new(Some(id_token), EmptyExtraTokenFields {}),
|
||||||
|
)
|
||||||
|
.into())
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Deserialize)]
|
||||||
|
struct AuthorizeParams {
|
||||||
|
client_id: String,
|
||||||
|
redirect_uri: RedirectUrl,
|
||||||
|
scope: Scope,
|
||||||
|
response_type: CoreResponseType,
|
||||||
|
state: String,
|
||||||
|
nonce: Option<Nonce>,
|
||||||
|
}
|
||||||
|
|
||||||
|
// TODO handle `registration` parameter
|
||||||
|
async fn authorize(
|
||||||
|
session: UserSessionFromSession,
|
||||||
|
params: Query<AuthorizeParams>,
|
||||||
|
// Extension(private_key): Extension<RsaPrivateKey>,
|
||||||
|
) -> Result<(HeaderMap, Redirect), CustomError> {
|
||||||
|
// TODO: Enforce Client Registration
|
||||||
|
// let d = std::str::from_utf8(
|
||||||
|
// &jwk.decrypt(
|
||||||
|
// PaddingScheme::new_pkcs1v15_encrypt(),
|
||||||
|
// ¶ms.client_id.as_bytes(),
|
||||||
|
// )
|
||||||
|
// .map_err(|e| anyhow!("Failed to decrypt client id: {}", e))?,
|
||||||
|
// )
|
||||||
|
// .map_err(|e| anyhow!("Failed to decrypt client id: {}", e))?
|
||||||
|
// if d != params.redirect_uri.as_str() {
|
||||||
|
// return Err(anyhow!("Client id not composed of redirect url"));
|
||||||
|
// };
|
||||||
|
|
||||||
|
if params.scope != Scope::new("openid".to_string()) {
|
||||||
|
Err(anyhow!("Scope not supported"))?;
|
||||||
|
}
|
||||||
|
|
||||||
|
let (nonce, headers) = match session {
|
||||||
|
UserSessionFromSession::FoundUserSession(nonce) => (nonce, HeaderMap::new()),
|
||||||
|
UserSessionFromSession::InvalidUserSession(cookie) => {
|
||||||
|
let mut headers = HeaderMap::new();
|
||||||
|
headers.insert(header::SET_COOKIE, cookie);
|
||||||
|
return Ok((
|
||||||
|
headers,
|
||||||
|
Redirect::to(
|
||||||
|
format!(
|
||||||
|
"/authorize?client_id={}&redirect_uri={}&scope={}&response_type={}&state={}{}",
|
||||||
|
¶ms.0.client_id,
|
||||||
|
¶ms.0.redirect_uri.to_string(),
|
||||||
|
¶ms.0.scope.to_string(),
|
||||||
|
¶ms.0.response_type.as_ref(),
|
||||||
|
¶ms.0.state,
|
||||||
|
¶ms.0.nonce.map(|n| format!("&nonce={}", n.secret())).unwrap_or(String::new())
|
||||||
|
)
|
||||||
|
.to_string()
|
||||||
|
.parse()
|
||||||
|
.map_err(|e| anyhow!("Could not parse URI: {}", e))?,
|
||||||
|
),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
UserSessionFromSession::CreatedFreshUserSession { header, nonce } => {
|
||||||
|
let mut headers = HeaderMap::new();
|
||||||
|
headers.insert(header::SET_COOKIE, header);
|
||||||
|
(nonce, headers)
|
||||||
|
}
|
||||||
|
};
|
||||||
|
|
||||||
|
let domain = params.redirect_uri.url().host().unwrap();
|
||||||
|
let oidc_nonce_param = if let Some(n) = ¶ms.nonce {
|
||||||
|
format!("&oidc_nonce={}", n.secret())
|
||||||
|
} else {
|
||||||
|
"".to_string()
|
||||||
|
};
|
||||||
|
Ok((
|
||||||
|
headers,
|
||||||
|
Redirect::to(
|
||||||
|
format!(
|
||||||
|
"/?nonce={}&domain={}&redirect_uri={}&state={}{}",
|
||||||
|
nonce,
|
||||||
|
domain,
|
||||||
|
params.redirect_uri.to_string(),
|
||||||
|
params.state,
|
||||||
|
oidc_nonce_param
|
||||||
|
)
|
||||||
|
.parse()
|
||||||
|
.map_err(|e| anyhow!("Could not parse URI: {}", e))?,
|
||||||
|
),
|
||||||
|
))
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Serialize, Deserialize)]
|
||||||
|
struct SiweCookie {
|
||||||
|
message: Web3ModalMessage,
|
||||||
|
signature: String,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Serialize, Deserialize)]
|
||||||
|
#[serde(rename_all = "camelCase")]
|
||||||
|
struct Web3ModalMessage {
|
||||||
|
pub domain: String,
|
||||||
|
pub address: String,
|
||||||
|
pub statement: String,
|
||||||
|
pub uri: String,
|
||||||
|
pub version: String,
|
||||||
|
pub chain_id: String,
|
||||||
|
pub nonce: String,
|
||||||
|
pub issued_at: String,
|
||||||
|
pub expiration_time: Option<String>,
|
||||||
|
pub not_before: Option<String>,
|
||||||
|
pub request_id: Option<String>,
|
||||||
|
pub resources: Option<Vec<String>>,
|
||||||
|
}
|
||||||
|
|
||||||
|
impl Web3ModalMessage {
|
||||||
|
pub fn to_eip4361_message(&self) -> Result<Message> {
|
||||||
|
let mut next_resources: Vec<UriString> = Vec::new();
|
||||||
|
match &self.resources {
|
||||||
|
Some(resources) => {
|
||||||
|
for resource in resources {
|
||||||
|
let x = UriString::from_str(resource)?;
|
||||||
|
next_resources.push(x)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
None => {}
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(Message {
|
||||||
|
domain: self.domain.clone().try_into()?,
|
||||||
|
address: <[u8; 20]>::from_hex(self.address.chars().skip(2).collect::<String>())?,
|
||||||
|
statement: self.statement.to_string(),
|
||||||
|
uri: UriAbsoluteString::from_str(&self.uri)?,
|
||||||
|
version: Version::from_str(&self.version)?,
|
||||||
|
chain_id: self.chain_id.to_string(),
|
||||||
|
nonce: self.nonce.to_string(),
|
||||||
|
issued_at: self.issued_at.to_string(),
|
||||||
|
expiration_time: self.expiration_time.clone(),
|
||||||
|
not_before: self.not_before.clone(),
|
||||||
|
request_id: self.request_id.clone(),
|
||||||
|
resources: next_resources,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Serialize, Deserialize)]
|
||||||
|
struct CodeEntry {
|
||||||
|
exchange_count: usize,
|
||||||
|
address: String,
|
||||||
|
nonce: Option<Nonce>,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Deserialize)]
|
||||||
|
struct SignInParams {
|
||||||
|
redirect_uri: RedirectUrl,
|
||||||
|
state: String,
|
||||||
|
oidc_nonce: Option<Nonce>,
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn sign_in(
|
||||||
|
session: UserSessionFromSession,
|
||||||
|
params: Query<SignInParams>,
|
||||||
|
TypedHeader(cookies): TypedHeader<headers::Cookie>,
|
||||||
|
Extension(pool): Extension<ConnectionPool>,
|
||||||
|
) -> Result<(HeaderMap, Redirect), CustomError> {
|
||||||
|
let mut headers = HeaderMap::new();
|
||||||
|
let siwe_cookie: SiweCookie = match cookies.get("siwe") {
|
||||||
|
Some(c) => serde_json::from_str(
|
||||||
|
&decode(c).map_err(|e| anyhow!("Could not decode siwe cookie: {}", e))?,
|
||||||
|
)
|
||||||
|
.map_err(|e| anyhow!("Could not deserialize siwe cookie: {}", e))?,
|
||||||
|
None => Err(anyhow!("No `siwe` cookie"))?,
|
||||||
|
};
|
||||||
|
|
||||||
|
let (nonce, headers) = match session {
|
||||||
|
UserSessionFromSession::FoundUserSession(nonce) => (nonce, HeaderMap::new()),
|
||||||
|
UserSessionFromSession::InvalidUserSession(header) => {
|
||||||
|
headers.insert(header::SET_COOKIE, header);
|
||||||
|
return Ok((
|
||||||
|
headers,
|
||||||
|
Redirect::to(
|
||||||
|
format!(
|
||||||
|
"/authorize?client_id={}&redirect_uri={}&scope=openid&response_type=code&state={}",
|
||||||
|
¶ms.0.redirect_uri.to_string(),
|
||||||
|
¶ms.0.redirect_uri.to_string(),
|
||||||
|
¶ms.0.state,
|
||||||
|
)
|
||||||
|
.to_string()
|
||||||
|
.parse()
|
||||||
|
.map_err(|e| anyhow!("Could not parse URI: {}", e))?,
|
||||||
|
),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
UserSessionFromSession::CreatedFreshUserSession { .. } => {
|
||||||
|
return Ok((
|
||||||
|
headers,
|
||||||
|
Redirect::to(
|
||||||
|
format!(
|
||||||
|
"/authorize?client_id={}&redirect_uri={}&scope=openid&response_type=code&state={}",
|
||||||
|
¶ms.0.redirect_uri.to_string(),
|
||||||
|
¶ms.0.redirect_uri.to_string(),
|
||||||
|
¶ms.0.state,
|
||||||
|
)
|
||||||
|
.to_string()
|
||||||
|
.parse()
|
||||||
|
.map_err(|e| anyhow!("Could not parse URI: {}", e))?,
|
||||||
|
),
|
||||||
|
))
|
||||||
|
}
|
||||||
|
};
|
||||||
|
|
||||||
|
let signature = match <[u8; 65]>::from_hex(
|
||||||
|
siwe_cookie
|
||||||
|
.signature
|
||||||
|
.chars()
|
||||||
|
.skip(2)
|
||||||
|
.take(130)
|
||||||
|
.collect::<String>()
|
||||||
|
.clone(),
|
||||||
|
) {
|
||||||
|
Ok(s) => s,
|
||||||
|
Err(e) => Err(CustomError::BadRequest(format!("Bad signature: {}", e)))?,
|
||||||
|
};
|
||||||
|
|
||||||
|
let message = siwe_cookie
|
||||||
|
.message
|
||||||
|
.to_eip4361_message()
|
||||||
|
.map_err(|e| anyhow!("Failed to serialise message: {}", e))?;
|
||||||
|
info!("{}", message);
|
||||||
|
message
|
||||||
|
.verify_eip191(signature)
|
||||||
|
.map_err(|e| anyhow!("Failed signature validation: {}", e))?;
|
||||||
|
|
||||||
|
let domain = params.redirect_uri.url().host().unwrap();
|
||||||
|
if domain.to_string() != siwe_cookie.message.domain {
|
||||||
|
Err(anyhow!("Conflicting domains in message and redirect"))?
|
||||||
|
}
|
||||||
|
if nonce != siwe_cookie.message.nonce {
|
||||||
|
Err(anyhow!("Conflicting nonces in message and session"))?
|
||||||
|
}
|
||||||
|
|
||||||
|
let code_entry = CodeEntry {
|
||||||
|
address: siwe_cookie.message.address,
|
||||||
|
nonce: params.oidc_nonce.clone(),
|
||||||
|
exchange_count: 0,
|
||||||
|
};
|
||||||
|
|
||||||
|
let code = Uuid::new_v4();
|
||||||
|
let mut conn = pool
|
||||||
|
.get()
|
||||||
|
.await
|
||||||
|
.map_err(|e| anyhow!("Failed to get connection to database: {}", e))?;
|
||||||
|
conn.set_ex(
|
||||||
|
code.to_string(),
|
||||||
|
hex::encode(
|
||||||
|
bincode::serialize(&code_entry)
|
||||||
|
.map_err(|e| anyhow!("Failed to serialise code: {}", e))?,
|
||||||
|
),
|
||||||
|
ENTRY_LIFETIME,
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.map_err(|e| anyhow!("Failed to set kv: {}", e))?;
|
||||||
|
|
||||||
|
let mut url = params.redirect_uri.url().clone();
|
||||||
|
url.query_pairs_mut().append_pair("code", &code.to_string());
|
||||||
|
url.query_pairs_mut().append_pair("state", ¶ms.state);
|
||||||
|
Ok((
|
||||||
|
headers,
|
||||||
|
Redirect::to(
|
||||||
|
url.as_str()
|
||||||
|
.parse()
|
||||||
|
.map_err(|e| anyhow!("Could not parse URI: {}", e))?,
|
||||||
|
),
|
||||||
|
))
|
||||||
|
// TODO clear session
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn register(
|
||||||
|
extract::Json(payload): extract::Json<CoreClientMetadata>,
|
||||||
|
Extension(pool): Extension<ConnectionPool>,
|
||||||
|
) -> Result<Json<CoreClientRegistrationResponse>, CustomError> {
|
||||||
|
let id = Uuid::new_v4();
|
||||||
|
let secret = Uuid::new_v4();
|
||||||
|
|
||||||
|
let mut conn = pool
|
||||||
|
.get()
|
||||||
|
.await
|
||||||
|
.map_err(|e| anyhow!("Failed to get connection to database: {}", e))?;
|
||||||
|
conn.set(format!("{}/{}", KV_CLIENT_PREFIX, id), secret.to_string())
|
||||||
|
.await
|
||||||
|
.map_err(|e| anyhow!("Failed to set kv: {}", e))?;
|
||||||
|
|
||||||
|
Ok(CoreClientRegistrationResponse::new(
|
||||||
|
ClientId::new(id.to_string()),
|
||||||
|
payload.redirect_uris().to_vec(),
|
||||||
|
EmptyAdditionalClientMetadata::default(),
|
||||||
|
EmptyAdditionalClientRegistrationResponse::default(),
|
||||||
|
)
|
||||||
|
.into())
|
||||||
|
}
|
||||||
|
|
||||||
|
// TODO CORS
|
||||||
|
// TODO need validation of the token
|
||||||
|
// TODO restrict access token use to only once?
|
||||||
|
async fn userinfo(
|
||||||
|
// access_token: AccessTokenUserInfo, // TODO maybe go through FromRequest https://github.com/tokio-rs/axum/blob/main/examples/jwt/src/main.rs
|
||||||
|
TypedHeader(Authorization(bearer)): TypedHeader<Authorization<Bearer>>, // TODO maybe go through FromRequest https://github.com/tokio-rs/axum/blob/main/examples/jwt/src/main.rs
|
||||||
|
Extension(pool): Extension<ConnectionPool>,
|
||||||
|
) -> Result<Json<CoreUserInfoClaims>, CustomError> {
|
||||||
|
let code = bearer.token().to_string();
|
||||||
|
let mut conn = pool
|
||||||
|
.get()
|
||||||
|
.await
|
||||||
|
.map_err(|e| anyhow!("Failed to get connection to database: {}", e))?;
|
||||||
|
let serialized_entry: Option<Vec<u8>> = conn
|
||||||
|
.get(code)
|
||||||
|
.await
|
||||||
|
.map_err(|e| anyhow!("Failed to get kv: {}", e))?;
|
||||||
|
if serialized_entry.is_none() {
|
||||||
|
Err(CustomError::BadRequest("Unknown code.".to_string()))?;
|
||||||
|
}
|
||||||
|
let code_entry: CodeEntry = bincode::deserialize(
|
||||||
|
&hex::decode(serialized_entry.unwrap())
|
||||||
|
.map_err(|e| anyhow!("Failed to decode code entry: {}", e))?,
|
||||||
|
)
|
||||||
|
.map_err(|e| anyhow!("Failed to deserialize code: {}", e))?;
|
||||||
|
|
||||||
|
Ok(CoreUserInfoClaims::new(
|
||||||
|
StandardClaims::new(SubjectIdentifier::new(code_entry.address)),
|
||||||
|
EmptyAdditionalClaims::default(),
|
||||||
|
)
|
||||||
|
.into())
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn healthcheck() {}
|
||||||
|
|
||||||
|
#[tokio::main]
|
||||||
|
async fn main() {
|
||||||
|
let config = Figment::from(Serialized::defaults(config::Config::default()))
|
||||||
|
.merge(Toml::file("siwe-oidc.toml").nested())
|
||||||
|
.merge(Env::prefixed("SIWEOIDC_").split("__").global());
|
||||||
|
let config = config.extract::<config::Config>().unwrap();
|
||||||
|
|
||||||
|
tracing_subscriber::fmt::init();
|
||||||
|
|
||||||
|
let manager = RedisConnectionManager::new(config.redis_url.clone()).unwrap();
|
||||||
|
let pool = bb8::Pool::builder().build(manager.clone()).await.unwrap();
|
||||||
|
let pool2 = bb8::Pool::builder().build(manager).await.unwrap();
|
||||||
|
|
||||||
|
let mut conn = pool2
|
||||||
|
.get()
|
||||||
|
.await
|
||||||
|
.map_err(|e| anyhow!("Failed to get connection to database: {}", e))
|
||||||
|
.unwrap();
|
||||||
|
for (id, secret) in &config.default_clients.clone() {
|
||||||
|
let _: () = conn
|
||||||
|
.set(format!("{}/{}", KV_CLIENT_PREFIX, id), secret)
|
||||||
|
.await
|
||||||
|
.map_err(|e| anyhow!("Failed to set kv: {}", e))
|
||||||
|
.unwrap();
|
||||||
|
}
|
||||||
|
|
||||||
|
let private_key = if let Some(key) = &config.rsa_pem {
|
||||||
|
RsaPrivateKey::from_pkcs1_pem(&key)
|
||||||
|
.map_err(|e| anyhow!("Failed to load private key: {}", e))
|
||||||
|
.unwrap()
|
||||||
|
} else {
|
||||||
|
info!("Generating key...");
|
||||||
|
let mut rng = OsRng;
|
||||||
|
let bits = 2048;
|
||||||
|
let private = RsaPrivateKey::new(&mut rng, bits)
|
||||||
|
.map_err(|e| anyhow!("Failed to generate a key: {}", e))
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
info!("Generated key.");
|
||||||
|
info!("{:?}", private.to_pkcs1_pem().unwrap());
|
||||||
|
private
|
||||||
|
};
|
||||||
|
|
||||||
|
let app = Router::new()
|
||||||
|
.nest(
|
||||||
|
"/build",
|
||||||
|
service_method_routing::get(ServeDir::new("./static/build")).handle_error(
|
||||||
|
|error: std::io::Error| {
|
||||||
|
(
|
||||||
|
StatusCode::INTERNAL_SERVER_ERROR,
|
||||||
|
format!("Unhandled internal error: {}", error),
|
||||||
|
)
|
||||||
|
},
|
||||||
|
),
|
||||||
|
)
|
||||||
|
.route(
|
||||||
|
"/",
|
||||||
|
service_method_routing::get(ServeFile::new("./static/index.html")).handle_error(
|
||||||
|
|error: std::io::Error| {
|
||||||
|
(
|
||||||
|
StatusCode::INTERNAL_SERVER_ERROR,
|
||||||
|
format!("Unhandled internal error: {}", error),
|
||||||
|
)
|
||||||
|
},
|
||||||
|
),
|
||||||
|
)
|
||||||
|
.route(
|
||||||
|
"/favicon.png",
|
||||||
|
service_method_routing::get(ServeFile::new("./static/favicon.png")).handle_error(
|
||||||
|
|error: std::io::Error| {
|
||||||
|
(
|
||||||
|
StatusCode::INTERNAL_SERVER_ERROR,
|
||||||
|
format!("Unhandled internal error: {}", error),
|
||||||
|
)
|
||||||
|
},
|
||||||
|
),
|
||||||
|
)
|
||||||
|
.route("/.well-known/openid-configuration", get(provider_metadata))
|
||||||
|
.route("/jwk", get(jwk_set))
|
||||||
|
.route("/token", post(token))
|
||||||
|
.route("/authorize", get(authorize))
|
||||||
|
.route("/register", post(register))
|
||||||
|
.route("/userinfo", get(userinfo).post(userinfo))
|
||||||
|
.route("/sign_in", get(sign_in))
|
||||||
|
.route("/health", get(healthcheck))
|
||||||
|
.layer(AddExtensionLayer::new(private_key))
|
||||||
|
.layer(AddExtensionLayer::new(config.clone()))
|
||||||
|
.layer(AddExtensionLayer::new(pool))
|
||||||
|
.layer(AddExtensionLayer::new(
|
||||||
|
RedisSessionStore::new(config.redis_url.clone())
|
||||||
|
.unwrap()
|
||||||
|
.with_prefix("async-sessions/"),
|
||||||
|
))
|
||||||
|
.layer(TraceLayer::new_for_http());
|
||||||
|
|
||||||
|
let addr = SocketAddr::from((config.address, config.port));
|
||||||
|
tracing::info!("Listening on {}", addr);
|
||||||
|
axum::Server::bind(&addr)
|
||||||
|
.serve(app.into_make_service())
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
}
|
||||||
124
src/session.rs
Normal file
124
src/session.rs
Normal file
@ -0,0 +1,124 @@
|
|||||||
|
use async_redis_session::RedisSessionStore;
|
||||||
|
use async_session::{Session, SessionStore as _};
|
||||||
|
use axum::{
|
||||||
|
async_trait,
|
||||||
|
extract::{Extension, FromRequest, RequestParts},
|
||||||
|
http::{self, header::HeaderValue, StatusCode},
|
||||||
|
};
|
||||||
|
use cookie::Cookie;
|
||||||
|
use rand::{distributions::Alphanumeric, Rng};
|
||||||
|
use serde::{Deserialize, Serialize};
|
||||||
|
use tracing::debug;
|
||||||
|
use uuid::Uuid;
|
||||||
|
|
||||||
|
const SESSION_COOKIE_NAME: &str = "session";
|
||||||
|
const SESSION_KEY: &str = "user_session";
|
||||||
|
|
||||||
|
pub enum UserSessionFromSession {
|
||||||
|
FoundUserSession(String),
|
||||||
|
CreatedFreshUserSession { header: HeaderValue, nonce: String },
|
||||||
|
InvalidUserSession(HeaderValue),
|
||||||
|
}
|
||||||
|
|
||||||
|
#[async_trait]
|
||||||
|
impl<B> FromRequest<B> for UserSessionFromSession
|
||||||
|
where
|
||||||
|
B: Send,
|
||||||
|
{
|
||||||
|
type Rejection = (StatusCode, String);
|
||||||
|
|
||||||
|
async fn from_request(req: &mut RequestParts<B>) -> Result<Self, Self::Rejection> {
|
||||||
|
let Extension(store) = match Extension::<RedisSessionStore>::from_request(req).await {
|
||||||
|
Ok(s) => s,
|
||||||
|
Err(e) => {
|
||||||
|
return Err((
|
||||||
|
StatusCode::INTERNAL_SERVER_ERROR,
|
||||||
|
format!("`MemoryStore` extension missing: {}", e),
|
||||||
|
))
|
||||||
|
}
|
||||||
|
};
|
||||||
|
|
||||||
|
let headers = if let Some(h) = req.headers() {
|
||||||
|
h
|
||||||
|
} else {
|
||||||
|
return Err((
|
||||||
|
StatusCode::INTERNAL_SERVER_ERROR,
|
||||||
|
"other extractor taken headers".to_string(),
|
||||||
|
));
|
||||||
|
};
|
||||||
|
|
||||||
|
let session_cookie: Cookie = if let Some(session_cookie) = headers
|
||||||
|
.get(http::header::COOKIE)
|
||||||
|
.and_then(|value| value.to_str().ok())
|
||||||
|
.map(|header| {
|
||||||
|
header
|
||||||
|
.split(";")
|
||||||
|
.map(|cookie| Cookie::parse(cookie).ok())
|
||||||
|
.filter(|cookie| {
|
||||||
|
cookie.is_some() && cookie.as_ref().unwrap().name() == SESSION_COOKIE_NAME
|
||||||
|
})
|
||||||
|
.next()
|
||||||
|
})
|
||||||
|
.flatten()
|
||||||
|
.flatten()
|
||||||
|
{
|
||||||
|
session_cookie
|
||||||
|
} else {
|
||||||
|
let user_session = UserSession::new();
|
||||||
|
let mut session = Session::new();
|
||||||
|
session.insert(SESSION_KEY, user_session.clone()).unwrap();
|
||||||
|
let cookie = store.store_session(session).await.unwrap().unwrap();
|
||||||
|
|
||||||
|
return Ok(Self::CreatedFreshUserSession {
|
||||||
|
header: Cookie::new(SESSION_COOKIE_NAME, cookie)
|
||||||
|
.to_string()
|
||||||
|
.parse()
|
||||||
|
.unwrap(),
|
||||||
|
nonce: user_session.nonce,
|
||||||
|
});
|
||||||
|
};
|
||||||
|
|
||||||
|
let session = match store.load_session(session_cookie.value().to_string()).await {
|
||||||
|
Ok(Some(s)) => s,
|
||||||
|
_ => {
|
||||||
|
debug!("Could not load session");
|
||||||
|
let mut cookie = session_cookie.clone();
|
||||||
|
cookie.make_removal();
|
||||||
|
return Ok(Self::InvalidUserSession(
|
||||||
|
cookie.to_string().parse().unwrap(),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
};
|
||||||
|
let user_session = if let Some(user_session) = session.get::<UserSession>(SESSION_KEY) {
|
||||||
|
user_session
|
||||||
|
} else {
|
||||||
|
debug!("No `user_session` found in session");
|
||||||
|
let mut cookie = session_cookie.clone();
|
||||||
|
cookie.make_removal();
|
||||||
|
return Ok(Self::InvalidUserSession(
|
||||||
|
cookie.to_string().parse().unwrap(),
|
||||||
|
));
|
||||||
|
};
|
||||||
|
|
||||||
|
Ok(Self::FoundUserSession(user_session.nonce))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Serialize, Deserialize, Debug, Clone)]
|
||||||
|
struct UserSession {
|
||||||
|
id: Uuid,
|
||||||
|
nonce: String,
|
||||||
|
}
|
||||||
|
|
||||||
|
impl UserSession {
|
||||||
|
fn new() -> Self {
|
||||||
|
Self {
|
||||||
|
id: Uuid::new_v4(),
|
||||||
|
nonce: rand::thread_rng()
|
||||||
|
.sample_iter(&Alphanumeric)
|
||||||
|
.take(16)
|
||||||
|
.map(char::from)
|
||||||
|
.collect(),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
BIN
static/favicon.png
Normal file
BIN
static/favicon.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 3.1 KiB |
17
static/index.html
Normal file
17
static/index.html
Normal file
@ -0,0 +1,17 @@
|
|||||||
|
<!DOCTYPE html>
|
||||||
|
<html lang="en">
|
||||||
|
<head>
|
||||||
|
<meta charset='utf-8'>
|
||||||
|
<meta name='viewport' content='width=device-width,initial-scale=1'>
|
||||||
|
|
||||||
|
<title>Svelte app</title>
|
||||||
|
|
||||||
|
<link rel='icon' type='image/png' href='/favicon.png'>
|
||||||
|
<link rel='stylesheet' href='/build/bundle.css'>
|
||||||
|
|
||||||
|
<script defer src='/build/bundle.js'></script>
|
||||||
|
</head>
|
||||||
|
|
||||||
|
<body>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
Loading…
Reference in New Issue
Block a user