Jakub Zych
ddda59a12b
- DefaultOptions().Resource is empty; comments name the host application, no consuming application (folded todo) - Tests set an explicit neutral resource; TestDefaultOptionsResourceEmpty - wristband README: new summary, two flavours, OIDC usage, API reference, OIDC defaults, dependencies, testing; root README row matches - docs/services/oauth-server.md: OpenID Connect provider section; Resource described as required with an empty default - ExampleNewOIDCServer and the newOIDCServer docs region
41 lines
1.8 KiB
Go
41 lines
1.8 KiB
Go
// Shared client-issuing primitives used by both RFC 7591 registration
|
|
// (register.go) and the host application's operator command that issues
|
|
// clients (08-CONTEXT.md D-19; T-08-SECRET-TIMING: "Shared hash/validation path and
|
|
// one-time secret"). Exporting these rather than letting the command
|
|
// re-derive its own random-id/hash/redirect-URI-validation logic keeps
|
|
// exactly one code path responsible for how an OAuth client secret is
|
|
// generated and hashed.
|
|
package wristband
|
|
|
|
// IssueClientCredentials mints a random opaque client_id (16 raw bytes,
|
|
// base64url) and, for every token_endpoint_auth_method other than "none", a
|
|
// client_secret (32 raw bytes) plus its sha256 hex hash -- the identical
|
|
// fixed transform RFC 7591 registration uses (D-04). secret is "" and
|
|
// secretHash is nil for a public ("none") client. The raw secret is
|
|
// returned exactly once; only secretHash is meant to be persisted.
|
|
func IssueClientCredentials(authMethod string) (clientID, secret string, secretHash *string, err error) {
|
|
clientID, err = randomBase64URL(16)
|
|
if err != nil {
|
|
return "", "", nil, err
|
|
}
|
|
if authMethod == "none" {
|
|
return clientID, "", nil, nil
|
|
}
|
|
secret, err = randomBase64URL(32)
|
|
if err != nil {
|
|
return "", "", nil, err
|
|
}
|
|
h := sha256Hex(secret)
|
|
return clientID, secret, &h, nil
|
|
}
|
|
|
|
// RejectRedirectURI is the exported form of the redirect-URI validation
|
|
// RFC 7591 registration already enforces (PHP OAuthClient::rejectRedirectUri):
|
|
// at most 512 characters, a valid URL with scheme+host, https:// or loopback
|
|
// http://127.0.0.1 / http://localhost. It returns "" when uri is accepted,
|
|
// or a human-readable rejection reason otherwise. The operator command
|
|
// shares this exact rule with DCR rather than re-deriving it (D-19).
|
|
func RejectRedirectURI(uri string) string {
|
|
return rejectRedirectURI(uri)
|
|
}
|