Implement a full OAuth2 2.0 and OpenID Connect 1.0 authorization
server with support for authorization code flow (with PKCE),
refresh token rotation, device authorization grant, dynamic
client registration, token introspection, and token revocation.
Includes database schema, coredata layer, service logic, HTTP
handlers, OIDC discovery endpoint, and JWKS publishing.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Allow ACME account keys to be configured via config file to maintain
the same Let's Encrypt account across deployments. Add DecodePrivateKey
function with PEM block type constants to support EC, RSA, and PKCS8
key formats. When no account key is provided, fall back to generating
a new one with a warning.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
ECDSA's Sign() method expects already-hashed data when a hash function
is specified. The test was incorrectly passing unhashed data with
crypto.SHA256, causing signature operations to fail.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Add database field level encryption level to sensitive data to reduce
the risk in term of data leak. I dedice to have only one key for now in
a near future I may move to one master key and one encryption key per
organization to make rotation easiest.
I don't use built-in pg_crypto function to have clear seperation and
avoid any encryption key leak.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
