probo/pkg/server/api/connect/v1/oauth2_resolvers.go

package connect_v1

// This file will be automatically regenerated based on the schema, any resolver
// implementations
// will be copied through when generating and any unknown code will be moved to the end.
// Code generated by github.com/99designs/gqlgen version v0.17.93

import (
	"context"
	"errors"
	"net/url"
	"strings"

	"go.gearno.de/kit/log"
	"go.probo.inc/probo/pkg/iam/oauth2"
	"go.probo.inc/probo/pkg/server/api/authn"
	"go.probo.inc/probo/pkg/server/api/connect/v1/schema"
	"go.probo.inc/probo/pkg/server/api/connect/v1/types"
	"go.probo.inc/probo/pkg/server/gqlutils"
)

// Application is the resolver for the application field.
func (r *consentResolver) Application(ctx context.Context, obj *types.Consent) (*types.Application, error) {
	client, err := r.iam.OAuth2ServerService.GetClientByID(ctx, obj.Application.ID)
	if err != nil {
		r.logger.ErrorCtx(ctx, "cannot load oauth2 client", log.Error(err))
		return nil, gqlutils.Internal(ctx)
	}

	return types.NewApplication(client), nil
}

// AuthorizeDevice is the resolver for the authorizeDevice field.
func (r *mutationResolver) AuthorizeDevice(ctx context.Context, input types.AuthorizeDeviceInput) (*types.AuthorizeDevicePayload, error) {
	identity := authn.IdentityFromContext(ctx)
	session := authn.SessionFromContext(ctx)

	userCode := strings.ToUpper(strings.TrimSpace(strings.ReplaceAll(input.UserCode, "-", "")))

	err := r.iam.OAuth2ServerService.AuthorizeDevice(ctx, identity.ID, session.ID, userCode)
	if err != nil {
		if consentErr, ok := errors.AsType[*oauth2.ConsentRequiredError](err); ok {
			return &types.AuthorizeDevicePayload{
				ConsentID: &consentErr.ConsentID,
			}, nil
		}

		if oauthErr, ok := errors.AsType[*oauth2.OAuth2Error](err); ok {
			return nil, gqlutils.Invalidf(ctx, "%s", oauthErr.Description())
		}

		r.logger.ErrorCtx(ctx, "cannot authorize device", log.Error(err))

		return nil, gqlutils.Internal(ctx)
	}

	return &types.AuthorizeDevicePayload{
		Success: true,
	}, nil
}

// ApproveConsent is the resolver for the approveConsent field.
func (r *mutationResolver) ApproveConsent(ctx context.Context, input types.ApproveConsentInput) (*types.ApproveConsentPayload, error) {
	identity := authn.IdentityFromContext(ctx)
	session := authn.SessionFromContext(ctx)

	result, err := r.iam.OAuth2ServerService.ApproveConsent(
		ctx,
		&oauth2.ConsentApprovalRequest{
			ConsentID:  input.ConsentID,
			IdentityID: identity.ID,
			SessionID:  session.ID,
			Approved:   input.Approved,
			AuthTime:   session.CreatedAt,
		},
	)
	if err != nil {
		r.logger.ErrorCtx(ctx, "cannot approve oauth2 consent", log.Error(err))
		return nil, gqlutils.Internal(ctx)
	}

	if result.Denied {
		if result.IsDeviceFlow {
			return &types.ApproveConsentPayload{
				DeviceAuthorized: new(false),
			}, nil
		}

		u, _ := url.Parse(result.RedirectURI)
		q := u.Query()
		q.Set("error", "access_denied")
		q.Set("error_description", "user denied the request")

		if result.State != "" {
			q.Set("state", result.State)
		}

		u.RawQuery = q.Encode()

		redirectURL := u.String()

		return &types.ApproveConsentPayload{
			RedirectURL: &redirectURL,
		}, nil
	}

	if result.IsDeviceFlow {
		return &types.ApproveConsentPayload{
			DeviceAuthorized: new(true),
		}, nil
	}

	u, _ := url.Parse(result.RedirectURI)
	q := u.Query()
	q.Set("code", result.Code)

	if result.State != "" {
		q.Set("state", result.State)
	}

	u.RawQuery = q.Encode()

	redirectURL := u.String()

	return &types.ApproveConsentPayload{
		RedirectURL: &redirectURL,
	}, nil
}

// Consent returns schema.ConsentResolver implementation.
func (r *Resolver) Consent() schema.ConsentResolver { return &consentResolver{r} }

type consentResolver struct{ *Resolver }