takos-control 1.0.0

package/src/application/services/oauth/authorization.ts

@@ -0,0 +1,286 @@
+import type { D1Database } from '../../../shared/types/bindings.ts';
+import type { SelectOf } from '../../../shared/types/drizzle-helpers';
+import { oauthAuthorizationCodes } from '../../../infra/db';
+import type {
+  OAuthAuthorizationCode,
+  OAuthClient,
+  AuthorizationRequest,
+  CodeChallengeMethod,
+} from '../../../shared/types/oauth';
+import { OAUTH_CONSTANTS } from '../../../shared/types/oauth';
+import {
+  generateRandomString,
+  generateId,
+  verifyCodeChallenge,
+  isValidCodeChallenge,
+} from './pkce';
+import { computeSHA256 } from '../../../shared/utils/hash';
+import {
+  getClientById,
+  validateRedirectUri,
+  supportsGrantType,
+  getClientAllowedScopes,
+} from './client';
+import { parseScopes, areScopesAllowed, validateScopes } from './scopes';
+import { getDb } from '../../../infra/db';
+import { eq, and, lt } from 'drizzle-orm';
+import { revokeTokensByAuthorizationCode } from './token';
+import { toIsoString } from '../../../shared/utils';
+
+type OAuthAuthorizationCodeRow = SelectOf<typeof oauthAuthorizationCodes>;
+
+function toApiAuthorizationCode(row: OAuthAuthorizationCodeRow): OAuthAuthorizationCode {
+  return {
+    id: row.id,
+    code_hash: row.codeHash,
+    client_id: row.clientId,
+    user_id: row.accountId,
+    redirect_uri: row.redirectUri,
+    scope: row.scope,
+    code_challenge: row.codeChallenge,
+    code_challenge_method: row.codeChallengeMethod as CodeChallengeMethod,
+    used: row.used,
+    expires_at: toIsoString(row.expiresAt),
+    created_at: toIsoString(row.createdAt),
+  };
+}
+
+export interface AuthorizationValidationResult {
+  valid: boolean;
+  client?: OAuthClient;
+  error?: string;
+  errorDescription?: string;
+  redirectUri?: string;
+}
+
+function invalidResult(
+  error: string,
+  errorDescription: string,
+  redirectUri?: string,
+): AuthorizationValidationResult {
+  return { valid: false, error, errorDescription, redirectUri };
+}
+
+export async function validateAuthorizationRequest(
+  dbBinding: D1Database,
+  request: Partial<AuthorizationRequest>
+): Promise<AuthorizationValidationResult> {
+  if (request.response_type !== 'code') {
+    return invalidResult('unsupported_response_type', 'Only response_type=code is supported');
+  }
+
+  if (!request.client_id) {
+    return invalidResult('invalid_request', 'client_id is required');
+  }
+
+  const client = await getClientById(dbBinding, request.client_id);
+  if (!client) {
+    return invalidResult('invalid_client', 'Client not found');
+  }
+
+  if (!request.redirect_uri) {
+    return invalidResult('invalid_request', 'redirect_uri is required');
+  }
+
+  if (!validateRedirectUri(client, request.redirect_uri)) {
+    return invalidResult('invalid_request', 'redirect_uri not registered');
+  }
+
+  // From here, errors can safely redirect to the redirect_uri
+  const redirectUri = request.redirect_uri;
+
+  if (!request.state) {
+    return invalidResult('invalid_request', 'state is required', redirectUri);
+  }
+
+  if (!request.code_challenge) {
+    return invalidResult('invalid_request', 'code_challenge is required (PKCE)', redirectUri);
+  }
+
+  if (request.code_challenge_method !== 'S256') {
+    return invalidResult('invalid_request', 'code_challenge_method must be S256', redirectUri);
+  }
+
+  if (!isValidCodeChallenge(request.code_challenge)) {
+    return invalidResult('invalid_request', 'Invalid code_challenge format', redirectUri);
+  }
+
+  if (!supportsGrantType(client, 'authorization_code')) {
+    return invalidResult('unauthorized_client', 'Client does not support authorization_code grant', redirectUri);
+  }
+
+  if (!request.scope) {
+    return invalidResult('invalid_request', 'scope is required', redirectUri);
+  }
+
+  const requestedScopes = parseScopes(request.scope);
+  const { valid: scopesValid, unknown } = validateScopes(requestedScopes);
+  if (!scopesValid) {
+    return invalidResult('invalid_scope', `Unknown scopes: ${unknown.join(', ')}`, redirectUri);
+  }
+
+  const allowedScopes = getClientAllowedScopes(client);
+  if (!areScopesAllowed(requestedScopes, allowedScopes)) {
+    return invalidResult('invalid_scope', 'Requested scope exceeds allowed scopes', redirectUri);
+  }
+
+  return { valid: true, client, redirectUri };
+}
+
+export async function generateAuthorizationCode(
+  dbBinding: D1Database,
+  params: {
+    clientId: string;
+    userId: string;
+    redirectUri: string;
+    scope: string;
+    codeChallenge: string;
+    codeChallengeMethod: CodeChallengeMethod;
+  }
+): Promise<string> {
+  const db = getDb(dbBinding);
+
+  const code = generateRandomString(OAUTH_CONSTANTS.AUTHORIZATION_CODE_LENGTH);
+  const codeHash = await computeSHA256(code);
+  const id = generateId();
+
+  const expiresAt = new Date(
+    Date.now() + OAUTH_CONSTANTS.AUTHORIZATION_CODE_EXPIRES_IN * 1000
+  );
+
+  await db.insert(oauthAuthorizationCodes).values({
+    id,
+    codeHash,
+    clientId: params.clientId,
+    accountId: params.userId,
+    redirectUri: params.redirectUri,
+    scope: params.scope,
+    codeChallenge: params.codeChallenge,
+    codeChallengeMethod: params.codeChallengeMethod,
+    used: false,
+    expiresAt: expiresAt.toISOString(),
+    createdAt: new Date().toISOString(),
+  });
+
+  return code;
+}
+
+export interface CodeExchangeResult {
+  valid: boolean;
+  code?: OAuthAuthorizationCode;
+  error?: string;
+  errorDescription?: string;
+}
+
+export async function exchangeAuthorizationCode(
+  dbBinding: D1Database,
+  params: {
+    code: string;
+    clientId: string;
+    redirectUri: string;
+    codeVerifier: string;
+  }
+): Promise<CodeExchangeResult> {
+  const db = getDb(dbBinding);
+  const { code, clientId, redirectUri, codeVerifier } = params;
+
+  function invalidGrant(errorDescription: string): CodeExchangeResult {
+    return { valid: false, error: 'invalid_grant', errorDescription };
+  }
+
+  const codeHash = await computeSHA256(code);
+  const authCode = await db.select().from(oauthAuthorizationCodes)
+    .where(eq(oauthAuthorizationCodes.codeHash, codeHash)).get();
+
+  if (!authCode) {
+    return invalidGrant('Authorization code not found');
+  }
+
+  const apiAuthCode = toApiAuthorizationCode(authCode);
+
+  // Replay attack detection: revoke all tokens if code was already used
+  if (apiAuthCode.used) {
+    await revokeTokensByAuthorizationCode(dbBinding, apiAuthCode.id);
+    return invalidGrant('Authorization code already used');
+  }
+
+  if (new Date(apiAuthCode.expires_at) < new Date()) {
+    return invalidGrant('Authorization code expired');
+  }
+
+  if (apiAuthCode.client_id !== clientId) {
+    return invalidGrant('Client ID mismatch');
+  }
+
+  if (apiAuthCode.redirect_uri !== redirectUri) {
+    return invalidGrant('Redirect URI mismatch');
+  }
+
+  if (apiAuthCode.code_challenge_method !== 'S256') {
+    return invalidGrant('Unsupported PKCE code challenge method');
+  }
+
+  const pkceValid = await verifyCodeChallenge(
+    codeVerifier,
+    apiAuthCode.code_challenge,
+    apiAuthCode.code_challenge_method
+  );
+
+  if (!pkceValid) {
+    return invalidGrant('PKCE verification failed');
+  }
+
+  // Atomic CAS to prevent race conditions
+  const updateResult = await db.update(oauthAuthorizationCodes)
+    .set({ used: true })
+    .where(
+      and(
+        eq(oauthAuthorizationCodes.id, apiAuthCode.id),
+        eq(oauthAuthorizationCodes.used, false),
+      )
+    );
+
+  if ((updateResult.meta.changes ?? 0) === 0) {
+    await revokeTokensByAuthorizationCode(dbBinding, apiAuthCode.id);
+    return invalidGrant('Authorization code already used');
+  }
+
+  return { valid: true, code: apiAuthCode };
+}
+
+export async function deleteExpiredCodes(dbBinding: D1Database): Promise<number> {
+  const db = getDb(dbBinding);
+  const now = new Date().toISOString();
+
+  const result = await db.delete(oauthAuthorizationCodes).where(
+    lt(oauthAuthorizationCodes.expiresAt, now)
+  );
+
+  return result.meta.changes ?? 0;
+}
+
+export function buildErrorRedirect(
+  redirectUri: string,
+  state: string,
+  error: string,
+  errorDescription?: string
+): string {
+  const url = new URL(redirectUri);
+  url.searchParams.set('error', error);
+  if (errorDescription) {
+    url.searchParams.set('error_description', errorDescription);
+  }
+  url.searchParams.set('state', state);
+  return url.toString();
+}
+
+export function buildSuccessRedirect(
+  redirectUri: string,
+  state: string,
+  code: string
+): string {
+  const url = new URL(redirectUri);
+  url.searchParams.set('code', code);
+  url.searchParams.set('state', state);
+  return url.toString();
+}

package/src/application/services/oauth/client.ts

@@ -0,0 +1,346 @@
+import type { D1Database } from '../../../shared/types/bindings.ts';
+import type { SelectOf } from '../../../shared/types/drizzle-helpers';
+import { oauthClients } from '../../../infra/db';
+import type {
+  OAuthClient,
+  OAuthClientStatus,
+  ClientRegistrationRequest,
+  ClientRegistrationResponse,
+} from '../../../shared/types/oauth';
+import { OAUTH_CONSTANTS } from '../../../shared/types/oauth';
+import { generateRandomString, generateId } from './pkce';
+import { constantTimeEqual, computeSHA256 } from '../../../shared/utils/hash';
+import { parseScopes, validateScopes } from './scopes';
+import { safeJsonParseOrDefault, toIsoString } from '../../../shared/utils';
+import { getDb } from '../../../infra/db';
+import { eq, and, desc } from 'drizzle-orm';
+
+type OAuthClientRow = SelectOf<typeof oauthClients>;
+
+function toApiClient(row: OAuthClientRow): OAuthClient {
+  return {
+    id: row.id,
+    client_id: row.clientId,
+    client_secret_hash: row.clientSecretHash ?? null,
+    client_type: row.clientType as 'confidential' | 'public',
+    name: row.name,
+    description: row.description ?? null,
+    logo_uri: row.logoUri ?? null,
+    client_uri: row.clientUri ?? null,
+    policy_uri: row.policyUri ?? null,
+    tos_uri: row.tosUri ?? null,
+    redirect_uris: row.redirectUris,
+    grant_types: row.grantTypes,
+    response_types: row.responseTypes,
+    allowed_scopes: row.allowedScopes,
+    owner_id: row.ownerAccountId ?? null,
+    registration_access_token_hash: row.registrationAccessTokenHash ?? null,
+    status: row.status as OAuthClientStatus,
+    created_at: toIsoString(row.createdAt),
+    updated_at: toIsoString(row.updatedAt),
+  };
+}
+
+export async function getClientById(
+  dbBinding: D1Database,
+  clientId: string
+): Promise<OAuthClient | null> {
+  const db = getDb(dbBinding);
+
+  const client = await db.select().from(oauthClients).where(
+    and(
+      eq(oauthClients.clientId, clientId),
+      eq(oauthClients.status, 'active'),
+    )
+  ).get();
+
+  if (!client) {
+    return null;
+  }
+
+  return toApiClient(client);
+}
+
+export async function getClientByInternalId(
+  dbBinding: D1Database,
+  id: string
+): Promise<OAuthClient | null> {
+  const db = getDb(dbBinding);
+
+  const client = await db.select().from(oauthClients).where(eq(oauthClients.id, id)).get();
+
+  if (!client) {
+    return null;
+  }
+
+  return toApiClient(client);
+}
+
+export async function getClientsByOwner(
+  dbBinding: D1Database,
+  ownerId: string
+): Promise<OAuthClient[]> {
+  const db = getDb(dbBinding);
+
+  const clients = await db.select().from(oauthClients)
+    .where(eq(oauthClients.ownerAccountId, ownerId))
+    .orderBy(desc(oauthClients.createdAt))
+    .all();
+
+  return clients.map(toApiClient);
+}
+
+export async function createClient(
+  dbBinding: D1Database,
+  request: ClientRegistrationRequest,
+  ownerId?: string
+): Promise<ClientRegistrationResponse> {
+  const db = getDb(dbBinding);
+
+  const id = generateId();
+  const clientId = generateRandomString(OAUTH_CONSTANTS.CLIENT_ID_LENGTH);
+  const clientSecret = generateRandomString(OAUTH_CONSTANTS.CLIENT_SECRET_LENGTH);
+  const registrationAccessToken = generateRandomString(OAUTH_CONSTANTS.REGISTRATION_ACCESS_TOKEN_LENGTH);
+
+  const clientSecretHash = await computeSHA256(clientSecret);
+  const registrationAccessTokenHash = await computeSHA256(registrationAccessToken);
+
+  const requestedScopes = request.scope ? parseScopes(request.scope) : [];
+  const { valid, unknown } = validateScopes(requestedScopes);
+  if (!valid) {
+    throw new Error(`Unknown scopes: ${unknown.join(', ')}`);
+  }
+
+  validateRedirectUris(request.redirect_uris);
+
+  const grantTypes = request.grant_types ?? ['authorization_code', 'refresh_token'];
+  const responseTypes = request.response_types ?? ['code'];
+
+  const clientType =
+    request.token_endpoint_auth_method === 'none' ? 'public' : 'confidential';
+
+  const now = new Date().toISOString();
+
+  await db.insert(oauthClients).values({
+    id,
+    clientId,
+    clientSecretHash: clientType === 'confidential' ? clientSecretHash : null,
+    clientType,
+    name: request.client_name,
+    description: null,
+    logoUri: request.logo_uri ?? null,
+    clientUri: request.client_uri ?? null,
+    policyUri: request.policy_uri ?? null,
+    tosUri: request.tos_uri ?? null,
+    redirectUris: JSON.stringify(request.redirect_uris),
+    grantTypes: JSON.stringify(grantTypes),
+    responseTypes: JSON.stringify(responseTypes),
+    allowedScopes: JSON.stringify(requestedScopes),
+    ownerAccountId: ownerId ?? null,
+    registrationAccessTokenHash,
+    status: 'active',
+    createdAt: now,
+    updatedAt: now,
+  });
+
+  return {
+    client_id: clientId,
+    client_secret: clientType === 'confidential' ? clientSecret : undefined,
+    client_id_issued_at: Math.floor(Date.now() / 1000),
+    // 0 = secret never expires per RFC 7591. Expiry enforcement is not yet
+    // implemented in validateClient(); changing this value to a future
+    // timestamp would be misleading until the validation check is added.
+    client_secret_expires_at: 0,
+    registration_access_token: registrationAccessToken,
+    registration_client_uri: `/oauth/register/${clientId}`,
+    client_name: request.client_name,
+    redirect_uris: request.redirect_uris,
+    grant_types: grantTypes,
+    response_types: responseTypes,
+    scope: requestedScopes.join(' '),
+    client_uri: request.client_uri,
+    logo_uri: request.logo_uri,
+    policy_uri: request.policy_uri,
+    tos_uri: request.tos_uri,
+  };
+}
+
+export async function updateClient(
+  dbBinding: D1Database,
+  clientId: string,
+  updates: Partial<ClientRegistrationRequest>
+): Promise<OAuthClient | null> {
+  const db = getDb(dbBinding);
+
+  const client = await getClientById(dbBinding, clientId);
+  if (!client) {
+    return null;
+  }
+
+  const updateData: Record<string, unknown> = {};
+
+  if (updates.client_name) {
+    updateData.name = updates.client_name;
+  }
+
+  if (updates.redirect_uris) {
+    validateRedirectUris(updates.redirect_uris);
+    updateData.redirectUris = JSON.stringify(updates.redirect_uris);
+  }
+
+  if (updates.logo_uri !== undefined) {
+    updateData.logoUri = updates.logo_uri;
+  }
+
+  if (updates.client_uri !== undefined) {
+    updateData.clientUri = updates.client_uri;
+  }
+
+  if (updates.policy_uri !== undefined) {
+    updateData.policyUri = updates.policy_uri;
+  }
+
+  if (updates.tos_uri !== undefined) {
+    updateData.tosUri = updates.tos_uri;
+  }
+
+  if (updates.scope !== undefined) {
+    const scopes = parseScopes(updates.scope);
+    const { valid, unknown } = validateScopes(scopes);
+    if (!valid) {
+      throw new Error(`Unknown scopes: ${unknown.join(', ')}`);
+    }
+    updateData.allowedScopes = JSON.stringify(scopes);
+  }
+
+  if (Object.keys(updateData).length === 0) {
+    return client;
+  }
+
+  updateData.updatedAt = new Date().toISOString();
+
+  await db.update(oauthClients).set(updateData).where(eq(oauthClients.clientId, clientId));
+
+  return getClientById(dbBinding, clientId);
+}
+
+export async function deleteClient(dbBinding: D1Database, clientId: string): Promise<boolean> {
+  return updateClientStatus(dbBinding, clientId, 'revoked');
+}
+
+export async function updateClientStatus(
+  dbBinding: D1Database,
+  clientId: string,
+  status: OAuthClientStatus
+): Promise<boolean> {
+  const db = getDb(dbBinding);
+
+  try {
+    const result = await db.update(oauthClients).set({
+      status,
+      updatedAt: new Date().toISOString(),
+    }).where(eq(oauthClients.clientId, clientId));
+    return (result.meta.changes ?? 0) > 0;
+  } catch {
+    return false;
+  }
+}
+
+export async function validateClientCredentials(
+  dbBinding: D1Database,
+  clientId: string,
+  clientSecret?: string
+): Promise<{ valid: boolean; client: OAuthClient | null; error?: string }> {
+  const client = await getClientById(dbBinding, clientId);
+
+  if (!client) {
+    return { valid: false, client: null, error: 'Client not found' };
+  }
+
+  if (client.status !== 'active') {
+    return { valid: false, client: null, error: 'Client is not active' };
+  }
+
+  if (client.client_type === 'confidential') {
+    if (!clientSecret) {
+      return { valid: false, client, error: 'Client secret required' };
+    }
+
+    const secretHash = await computeSHA256(clientSecret);
+    if (!client.client_secret_hash || !constantTimeEqual(secretHash, client.client_secret_hash)) {
+      return { valid: false, client: null, error: 'Invalid client secret' };
+    }
+  }
+
+  return { valid: true, client };
+}
+
+export async function validateRegistrationToken(
+  dbBinding: D1Database,
+  clientId: string,
+  token: string
+): Promise<boolean> {
+  const client = await getClientById(dbBinding, clientId);
+  if (!client || !client.registration_access_token_hash) {
+    return false;
+  }
+
+  const tokenHash = await computeSHA256(token);
+  return constantTimeEqual(tokenHash, client.registration_access_token_hash);
+}
+
+export function validateRedirectUri(client: OAuthClient, redirectUri: string): boolean {
+  const registeredUris = safeJsonParseOrDefault<string[]>(client.redirect_uris, []);
+  return registeredUris.includes(redirectUri);
+}
+
+export function validateRedirectUris(uris: string[]): void {
+  if (!uris || uris.length === 0) {
+    throw new Error('At least one redirect_uri is required');
+  }
+
+  for (const uri of uris) {
+    try {
+      const parsed = new URL(uri);
+
+      if (!parsed.protocol) {
+        throw new Error(`Invalid redirect_uri: ${uri} - must be absolute URI`);
+      }
+
+      if (parsed.protocol !== 'https:' && !isLocalhost(parsed.hostname)) {
+        throw new Error(`Invalid redirect_uri: ${uri} - must use HTTPS`);
+      }
+
+      if (parsed.hash) {
+        throw new Error(`Invalid redirect_uri: ${uri} - fragment not allowed`);
+      }
+    } catch (e) {
+      if (e instanceof Error && e.message.startsWith('Invalid redirect_uri')) {
+        throw e;
+      }
+      throw new Error(`Invalid redirect_uri: ${uri}`);
+    }
+  }
+}
+
+function isLocalhost(hostname: string): boolean {
+  return (
+    hostname === 'localhost' ||
+    hostname === '127.0.0.1' ||
+    hostname === '[::1]' ||
+    hostname.endsWith('.localhost')
+  );
+}
+
+export function supportsGrantType(client: OAuthClient, grantType: string): boolean {
+  const grantTypes = safeJsonParseOrDefault<string[]>(client.grant_types, []);
+  return grantTypes.includes(grantType);
+}
+
+export function getClientAllowedScopes(client: OAuthClient): string[] {
+  return safeJsonParseOrDefault<string[]>(client.allowed_scopes, []);
+}
+
+export function getClientRedirectUris(client: OAuthClient): string[] {
+  return safeJsonParseOrDefault<string[]>(client.redirect_uris, []);
+}