f1136cb748
OAuth client_name should be the short brand label, not the composed English hero heading. Signed-off-by: Émile Ré <emile@probo.com>
106 lines
3.2 KiB
Go
106 lines
3.2 KiB
Go
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
|
|
//
|
|
// Permission to use, copy, modify, and/or distribute this software for any
|
|
// purpose with or without fee is hereby granted, provided that the above
|
|
// copyright notice and this permission notice appear in all copies.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
|
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
|
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
// PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
package visitor
|
|
|
|
import (
|
|
"fmt"
|
|
"net/url"
|
|
|
|
"go.probo.inc/probo/pkg/coredata"
|
|
"go.probo.inc/probo/pkg/iam/oauth2"
|
|
)
|
|
|
|
const (
|
|
VisitorOAuthScope = "openid profile email"
|
|
CIMDMetadataPath = "/.well-known/oauth-client-metadata"
|
|
OAuthCallbackPath = "/callback"
|
|
)
|
|
|
|
func CIMDClientIDURL(portalBaseURL string) (string, error) {
|
|
return portalEndpointURL(portalBaseURL, CIMDMetadataPath)
|
|
}
|
|
|
|
func OAuthCallbackURL(portalBaseURL string) (string, error) {
|
|
return portalEndpointURL(portalBaseURL, OAuthCallbackPath)
|
|
}
|
|
|
|
func PortalRootURL(rawURL string) (string, error) {
|
|
return portalEndpointURL(rawURL, "")
|
|
}
|
|
|
|
// portalEndpointURL replaces the path on a portal base URL and clears
|
|
// query/fragment. Shared by CIMD, OAuth callback, and brand asset URLs.
|
|
func portalEndpointURL(portalBaseURL string, path string) (string, error) {
|
|
parsed, err := url.Parse(portalBaseURL)
|
|
if err != nil {
|
|
return "", fmt.Errorf("cannot parse portal URL: %w", err)
|
|
}
|
|
|
|
parsed.Path = path
|
|
parsed.RawQuery = ""
|
|
parsed.Fragment = ""
|
|
|
|
return parsed.String(), nil
|
|
}
|
|
|
|
func PortalBaseURLFromCIMDClientID(clientIDURL string) (string, error) {
|
|
portalURL, err := PortalRootURL(clientIDURL)
|
|
if err != nil {
|
|
return "", fmt.Errorf("cannot parse cimd client_id URL: %w", err)
|
|
}
|
|
|
|
return portalURL, nil
|
|
}
|
|
|
|
func BuildClientMetadataDocument(
|
|
portal *coredata.CompliancePortal,
|
|
portalBaseURL string,
|
|
) (oauth2.ClientMetadataDocument, error) {
|
|
clientID, err := CIMDClientIDURL(portalBaseURL)
|
|
if err != nil {
|
|
return oauth2.ClientMetadataDocument{}, fmt.Errorf("cannot build cimd client_id URL: %w", err)
|
|
}
|
|
|
|
redirectURI, err := OAuthCallbackURL(portalBaseURL)
|
|
if err != nil {
|
|
return oauth2.ClientMetadataDocument{}, fmt.Errorf("cannot build oauth callback URL: %w", err)
|
|
}
|
|
|
|
portalRootURL, err := PortalRootURL(portalBaseURL)
|
|
if err != nil {
|
|
return oauth2.ClientMetadataDocument{}, fmt.Errorf("cannot build cimd client_uri URL: %w", err)
|
|
}
|
|
|
|
doc := oauth2.ClientMetadataDocument{
|
|
ClientID: clientID,
|
|
ClientName: portal.EntityName,
|
|
ClientURI: portalRootURL,
|
|
RedirectURIs: []string{redirectURI},
|
|
TokenEndpointAuthMethod: "none",
|
|
GrantTypes: []string{"authorization_code", "refresh_token"},
|
|
ResponseTypes: []string{"code"},
|
|
Scope: VisitorOAuthScope,
|
|
}
|
|
|
|
if portal.LogoFileID != nil {
|
|
logoURI, err := BrandLogoURL(portalBaseURL)
|
|
if err == nil {
|
|
doc.LogoURI = logoURI
|
|
}
|
|
}
|
|
|
|
return doc, nil
|
|
}
|