gitea

1
// Copyright 2021 The Gitea Authors. All rights reserved.
2
// SPDX-License-Identifier: MIT
3

4
package oauth2_provider //nolint
5

6
import (
7
	"fmt"
8
	"time"
9

10
	"code.gitea.io/gitea/modules/timeutil"
11

12
	"github.com/golang-jwt/jwt/v5"
13
)
14

15
// Token represents an Oauth grant
16

17
// TokenKind represents the type of token for an oauth application
18
type TokenKind int
19

20
const (
21
	// KindAccessToken is a token with short lifetime to access the api
22
	KindAccessToken TokenKind = 0
23
	// KindRefreshToken is token with long lifetime to refresh access tokens obtained by the client
24
	KindRefreshToken = iota
25
)
26

27
// Token represents a JWT token used to authenticate a client
28
type Token struct {
29
	GrantID int64     `json:"gnt"`
30
	Kind    TokenKind `json:"tt"`
31
	Counter int64     `json:"cnt,omitempty"`
32
	jwt.RegisteredClaims
33
}
34

35
// ParseToken parses a signed jwt string
36
func ParseToken(jwtToken string, signingKey JWTSigningKey) (*Token, error) {
37
	parsedToken, err := jwt.ParseWithClaims(jwtToken, &Token{}, func(token *jwt.Token) (any, error) {
38
		if token.Method == nil || token.Method.Alg() != signingKey.SigningMethod().Alg() {
39
			return nil, fmt.Errorf("unexpected signing algo: %v", token.Header["alg"])
40
		}
41
		return signingKey.VerifyKey(), nil
42
	})
43
	if err != nil {
44
		return nil, err
45
	}
46
	if !parsedToken.Valid {
47
		return nil, fmt.Errorf("invalid token")
48
	}
49
	var token *Token
50
	var ok bool
51
	if token, ok = parsedToken.Claims.(*Token); !ok || !parsedToken.Valid {
52
		return nil, fmt.Errorf("invalid token")
53
	}
54
	return token, nil
55
}
56

57
// SignToken signs the token with the JWT secret
58
func (token *Token) SignToken(signingKey JWTSigningKey) (string, error) {
59
	token.IssuedAt = jwt.NewNumericDate(time.Now())
60
	jwtToken := jwt.NewWithClaims(signingKey.SigningMethod(), token)
61
	signingKey.PreProcessToken(jwtToken)
62
	return jwtToken.SignedString(signingKey.SignKey())
63
}
64

65
// OIDCToken represents an OpenID Connect id_token
66
type OIDCToken struct {
67
	jwt.RegisteredClaims
68
	Nonce string `json:"nonce,omitempty"`
69

70
	// Scope profile
71
	Name              string             `json:"name,omitempty"`
72
	PreferredUsername string             `json:"preferred_username,omitempty"`
73
	Profile           string             `json:"profile,omitempty"`
74
	Picture           string             `json:"picture,omitempty"`
75
	Website           string             `json:"website,omitempty"`
76
	Locale            string             `json:"locale,omitempty"`
77
	UpdatedAt         timeutil.TimeStamp `json:"updated_at,omitempty"`
78

79
	// Scope email
80
	Email         string `json:"email,omitempty"`
81
	EmailVerified bool   `json:"email_verified,omitempty"`
82

83
	// Groups are generated by organization and team names
84
	Groups []string `json:"groups,omitempty"`
85
}
86

87
// SignToken signs an id_token with the (symmetric) client secret key
88
func (token *OIDCToken) SignToken(signingKey JWTSigningKey) (string, error) {
89
	token.IssuedAt = jwt.NewNumericDate(time.Now())
90
	jwtToken := jwt.NewWithClaims(signingKey.SigningMethod(), token)
91
	signingKey.PreProcessToken(jwtToken)
92
	return jwtToken.SignedString(signingKey.SignKey())
93
}
94