Skip to content

fix(dynamic-registration): fix software statement validation and JWK set format #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
tugascript wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

fix(dynamic-registration): fix software statement validation and JWK set format #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions idp/internal/controllers/account_credentials.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,8 +85,8 @@ func (c *Controllers) ListAccountCredentials(ctx fiber.Ctx) error {
}

queryParams := params.PaginationQueryParams{
Offset: fiber.Query[int](ctx, "offset", 0),
Limit: fiber.Query[int](ctx, "limit", 20),
Offset: fiber.Query(ctx, "offset", 0),
Limit: fiber.Query(ctx, "limit", 20),
}
if err := c.validate.StructCtx(ctx.Context(), &queryParams); err != nil {
return validateQueryParamsErrorResponse(logger, ctx, err)
Expand Down Expand Up @@ -243,8 +243,8 @@ func (c *Controllers) ListAccountCredentialsSecrets(ctx fiber.Ctx) error {
}

queryParams := params.PaginationQueryParams{
Offset: fiber.Query[int](ctx, "offset", 0),
Limit: fiber.Query[int](ctx, "limit", 20),
Offset: fiber.Query(ctx, "offset", 0),
Limit: fiber.Query(ctx, "limit", 20),
}
if err := c.validate.StructCtx(ctx.Context(), queryParams); err != nil {
return validateQueryParamsErrorResponse(logger, ctx, err)
Expand Down
8 changes: 4 additions & 4 deletions idp/internal/controllers/apps.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -456,8 +456,8 @@ func (c *Controllers) ListApps(ctx fiber.Ctx) error {
}

queryParams := params.GetAppsQueryParams{
Limit: fiber.Query[int](ctx, "limit", 10),
Offset: fiber.Query[int](ctx, "offset", 0),
Limit: fiber.Query(ctx, "limit", 10),
Offset: fiber.Query(ctx, "offset", 0),
Name: ctx.Query("name"),
Order: ctx.Query("order", "date"),
Type: ctx.Query("type"),
Expand Down Expand Up @@ -1035,8 +1035,8 @@ func (c *Controllers) ListAppSecrets(ctx fiber.Ctx) error {
}

queryParams := params.PaginationQueryParams{
Offset: fiber.Query[int](ctx, "offset", 0),
Limit: fiber.Query[int](ctx, "limit", 20),
Offset: fiber.Query(ctx, "offset", 0),
Limit: fiber.Query(ctx, "limit", 20),
}
if err := c.validate.StructCtx(ctx.Context(), queryParams); err != nil {
return validateQueryParamsErrorResponse(logger, ctx, err)
Expand Down
72 changes: 37 additions & 35 deletions idp/internal/controllers/bodies/oauth_dynamic_registration.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,42 +6,44 @@

package bodies

import "github.com/tugascript/devlogs/idp/internal/utils"

type OAuthDynamicClientRegistrationBody struct {
RedirectURIs []string `json:"redirect_uris,omitempty" validate:"omitempty,min=1,dive,uri"`
TokenEndpointAuthMethod string `json:"token_endpoint_auth_method,omitempty" validate:"omitempty,oneof=none client_secret_basic client_secret_post client_secret_jwt private_key_jwt"`
ResponseTypes []string `json:"response_types,omitempty" validate:"omitempty,dive,oneof=code 'code id_token'"`
GrantTypes []string `json:"grant_types,omitempty" validate:"omitempty,min=1,dive,oneof=authorization_code refresh_token client_credentials urn:ietf:params:oauth:grant-type:jwt-bearer"`
ApplicationType string `json:"application_type" validate:"required,oneof=native service mcp web spa backend device"`
ClientName string `json:"client_name" validate:"required,min=1,max=255"`
ClientURI string `json:"client_uri" validate:"required,url"`
LogoURI string `json:"logo_uri,omitempty" validate:"omitempty,url"`
Scope string `json:"scope" validate:"required,multiple_scope"`
Contacts []string `json:"contacts,omitempty" validate:"omitempty,unique,dive,email"`
TOSURI string `json:"tos_uri,omitempty" validate:"omitempty,url"`
PolicyURI string `json:"policy_uri,omitempty" validate:"omitempty,url"`
JWKsURI string `json:"jwks_uri,omitempty" validate:"omitempty,url"`
JWKs []string `json:"jwks,omitempty" validate:"omitempty,json"`
SoftwareID string `json:"software_id,omitempty" validate:"omitempty,max=512"`
SoftwareVersion string `json:"software_version,omitempty" validate:"omitempty,max=512"`
SubjectType string `json:"subject_type,omitempty" validate:"omitempty,oneof=public pairwise"`
SectorIdentifierURI string `json:"sector_identifier_uri,omitempty" validate:"omitempty,url"`
DefaultMaxAge int64 `json:"default_max_age,omitempty" validate:"omitempty,min=0"`
RequireAuthTime bool `json:"require_auth_time,omitempty" validate:"omitempty,bool"`
DefaultACRValues []string `json:"default_acr_values,omitempty" validate:"omitempty,unique,dive,max=100"`
InitiateLoginURI string `json:"initiate_login_uri,omitempty" validate:"omitempty,url"`
RequestURIs []string `json:"request_uris,omitempty" validate:"omitempty,unique,dive,url"`
IDTokenSignedResponseAlg string `json:"id_token_signed_response_alg,omitempty" validate:"omitempty,oneof=RS256 ES256 EdDSA"`
IDTokenEncryptedResponseAlg string `json:"id_token_encrypted_response_alg,omitempty" validate:"omitempty,oneof=RSA-OAEP-256 ECDH-ES ECDH-ES+A256KW"`
IDTokenEncryptedResponseEnc string `json:"id_token_encrypted_response_enc,omitempty" validate:"omitempty,oneof=A128CBC-HS256 A192CBC-HS384 A256CBC-HS512 A128GCM A192GCM A256GCM"`
UserInfoSignedResponseAlg string `json:"userinfo_signed_response_alg,omitempty" validate:"omitempty,oneof=RS256 ES256 EdDSA"`
UserInfoEncryptedResponseAlg string `json:"userinfo_encrypted_response_alg,omitempty" validate:"omitempty,oneof=RSA-OAEP-256 ECDH-ES ECDH-ES+A256KW"`
UserInfoEncryptedResponseEnc string `json:"userinfo_encrypted_response_enc,omitempty" validate:"omitempty,oneof=A128CBC-HS256 A192CBC-HS384 A256CBC-HS512 A128GCM A192GCM A256GCM"`
RequestObjectSigningAlg string `json:"request_object_signing_alg,omitempty" validate:"omitempty,oneof=RS256 ES256 EdDSA"`
RequestObjectEncryptionAlg string `json:"request_object_encryption_alg,omitempty" validate:"omitempty,oneof=RSA-OAEP-256 ECDH-ES ECDH-ES+A256KW"`
RequestObjectEncryptionEnc string `json:"request_object_encryption_enc,omitempty" validate:"omitempty,oneof=A128CBC-HS256 A192CBC-HS384 A256CBC-HS512 A128GCM A192GCM A256GCM"`
TokenEndpointAuthSigningAlg string `json:"token_endpoint_auth_signing_alg,omitempty" validate:"omitempty,oneof=RS256 ES256 EdDSA"`
AccessTokenSigningAlg string `json:"access_token_signing_alg,omitempty" validate:"omitempty,oneof=RS256 ES256 EdDSA"`
SoftwareStatement string `json:"software_statement,omitempty" validate:"omitempty,jwt"`
RedirectURIs []string `json:"redirect_uris,omitempty" validate:"omitempty,min=1,dive,uri"`
TokenEndpointAuthMethod string `json:"token_endpoint_auth_method,omitempty" validate:"omitempty,oneof=none client_secret_basic client_secret_post client_secret_jwt private_key_jwt"`
ResponseTypes []string `json:"response_types,omitempty" validate:"omitempty,dive,oneof=code 'code id_token'"`
GrantTypes []string `json:"grant_types,omitempty" validate:"omitempty,min=1,dive,oneof=authorization_code refresh_token client_credentials urn:ietf:params:oauth:grant-type:jwt-bearer"`
ApplicationType string `json:"application_type" validate:"required,oneof=native service mcp web spa backend device"`
ClientName string `json:"client_name" validate:"required,min=1,max=255"`
ClientURI string `json:"client_uri" validate:"required,url"`
LogoURI string `json:"logo_uri,omitempty" validate:"omitempty,url"`
Scope string `json:"scope" validate:"required,multiple_scope"`
Contacts []string `json:"contacts,omitempty" validate:"omitempty,unique,dive,email"`
TOSURI string `json:"tos_uri,omitempty" validate:"omitempty,url"`
PolicyURI string `json:"policy_uri,omitempty" validate:"omitempty,url"`
JWKsURI string `json:"jwks_uri,omitempty" validate:"omitempty,url"`
JWKs *utils.JWKSet `json:"jwks,omitempty" validate:"omitempty,json"`
SoftwareID string `json:"software_id,omitempty" validate:"omitempty,max=512"`
SoftwareVersion string `json:"software_version,omitempty" validate:"omitempty,max=512"`
SubjectType string `json:"subject_type,omitempty" validate:"omitempty,oneof=public pairwise"`
SectorIdentifierURI string `json:"sector_identifier_uri,omitempty" validate:"omitempty,url"`
DefaultMaxAge int64 `json:"default_max_age,omitempty" validate:"omitempty,min=0"`
RequireAuthTime bool `json:"require_auth_time,omitempty" validate:"omitempty,bool"`
DefaultACRValues []string `json:"default_acr_values,omitempty" validate:"omitempty,unique,dive,max=100"`
InitiateLoginURI string `json:"initiate_login_uri,omitempty" validate:"omitempty,url"`
RequestURIs []string `json:"request_uris,omitempty" validate:"omitempty,unique,dive,url"`
IDTokenSignedResponseAlg string `json:"id_token_signed_response_alg,omitempty" validate:"omitempty,oneof=RS256 ES256 EdDSA"`
IDTokenEncryptedResponseAlg string `json:"id_token_encrypted_response_alg,omitempty" validate:"omitempty,oneof=RSA-OAEP-256 ECDH-ES ECDH-ES+A256KW"`
IDTokenEncryptedResponseEnc string `json:"id_token_encrypted_response_enc,omitempty" validate:"omitempty,oneof=A128CBC-HS256 A192CBC-HS384 A256CBC-HS512 A128GCM A192GCM A256GCM"`
UserInfoSignedResponseAlg string `json:"userinfo_signed_response_alg,omitempty" validate:"omitempty,oneof=RS256 ES256 EdDSA"`
UserInfoEncryptedResponseAlg string `json:"userinfo_encrypted_response_alg,omitempty" validate:"omitempty,oneof=RSA-OAEP-256 ECDH-ES ECDH-ES+A256KW"`
UserInfoEncryptedResponseEnc string `json:"userinfo_encrypted_response_enc,omitempty" validate:"omitempty,oneof=A128CBC-HS256 A192CBC-HS384 A256CBC-HS512 A128GCM A192GCM A256GCM"`
RequestObjectSigningAlg string `json:"request_object_signing_alg,omitempty" validate:"omitempty,oneof=RS256 ES256 EdDSA"`
RequestObjectEncryptionAlg string `json:"request_object_encryption_alg,omitempty" validate:"omitempty,oneof=RSA-OAEP-256 ECDH-ES ECDH-ES+A256KW"`
RequestObjectEncryptionEnc string `json:"request_object_encryption_enc,omitempty" validate:"omitempty,oneof=A128CBC-HS256 A192CBC-HS384 A256CBC-HS512 A128GCM A192GCM A256GCM"`
TokenEndpointAuthSigningAlg string `json:"token_endpoint_auth_signing_alg,omitempty" validate:"omitempty,oneof=RS256 ES256 EdDSA"`
AccessTokenSigningAlg string `json:"access_token_signing_alg,omitempty" validate:"omitempty,oneof=RS256 ES256 EdDSA"`
SoftwareStatement string `json:"software_statement,omitempty" validate:"omitempty,jwt"`
}

type OAuthDynamicRegistrationIATAuthHiddenFieldsBody struct {
Expand Down
4 changes: 2 additions & 2 deletions idp/internal/controllers/dynamic_registration_domains.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,8 +66,8 @@ func (c *Controllers) ListAccountCredentialsRegistrationDomains(ctx fiber.Ctx) e
}

queryParams := params.DynamicRegistrationDomainQueryParams{
Limit: fiber.Query[int](ctx, "limit", 10),
Offset: fiber.Query[int](ctx, "offset", 0),
Limit: fiber.Query(ctx, "limit", 10),
Offset: fiber.Query(ctx, "offset", 0),
Order: ctx.Query("order", "date"),
Search: ctx.Query("search"),
}
Expand Down
3 changes: 3 additions & 0 deletions idp/internal/controllers/oauth_dynamic_registration.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,9 @@ func (c *Controllers) OAuthDynamicRegistration(ctx fiber.Ctx) error {
if err := c.validate.StructCtx(ctx.Context(), body); err != nil {
return oauthErrorResponse(logger, ctx, exceptions.OAuthErrorInvalidClientMetadata)
}
if body.JWKs != nil && body.JWKsURI != "" {
return oauthErrorResponse(logger, ctx, exceptions.OAuthErrorInvalidClientMetadata)
}

isAuthenticated, ok := ctx.Locals("isAuthenticated").(bool)
if !ok {
Expand Down
4 changes: 2 additions & 2 deletions idp/internal/controllers/users.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,8 +107,8 @@ func (c *Controllers) ListUsers(ctx fiber.Ctx) error {
}

queryParams := params.ListUsersQueryParams{
Limit: fiber.Query[int](ctx, "limit", 10),
Offset: fiber.Query[int](ctx, "offset", 0),
Limit: fiber.Query(ctx, "limit", 10),
Offset: fiber.Query(ctx, "offset", 0),
Order: ctx.Query("order", "date"),
Search: ctx.Query("search"),
}
Expand Down
7 changes: 6 additions & 1 deletion idp/internal/providers/crypto/jwk.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,7 +195,12 @@ func (e *Crypto) GenerateES256KeyPair(
}

kid := utils.ExtractECDSAKeyID(priv.Public().(*ecdsa.PublicKey))
publicJwk := utils.EncodeP256Jwk(&priv.PublicKey, kid)
publicJwk, err := utils.EncodeP256Jwk(&priv.PublicKey, kid)
if err != nil {
logger.ErrorContext(ctx, "Failed to encode JWK", "error", err)
return KeyPair{}, exceptions.NewInternalServerError()
}

if _, err := opts.StoreFN(dekID, utils.SupportedCryptoSuiteES256, kid, encryptedPrivateKey, &publicJwk); err != nil {
logger.ErrorContext(ctx, "Failed to store private key", "error", err)
return KeyPair{}, exceptions.NewInternalServerError()
Expand Down
Loading