Css 6646/callback endpoint

cmd/jimmsrv/main.go

@@ -152,6 +152,7 @@ func start(ctx context.Context, s *service.Service) error {
 			Scopes:             scopesParsed,
 			SessionTokenExpiry: sessionTokenExpiryDuration,
 		},
+		DashboardFinalRedirectURL: os.Getenv("JIMM_DASHBOARD_FINAL_REDIRECT_URL"),
 	})
 	if err != nil {
 		return err

docker-compose.yaml

@@ -78,6 +78,7 @@ services:
       JIMM_OAUTH_CLIENT_ID: "jimm-device"
       JIMM_OAUTH_CLIENT_SECRET: "SwjDofnbDzJDm9iyfUhEp67FfUFMY8L4"
       JIMM_OAUTH_SCOPES: "openid profile email" # Space separated list of scopes
+      JIMM_DASHBOARD_FINAL_REDIRECT_URL: "https://my-dashboard.com/final-callback" # Example URL
       JIMM_ACCESS_TOKEN_EXPIRY_DURATION: 1h
     volumes:
       - ./:/jimm/

internal/auth/oauth2.go

@@ -7,6 +7,7 @@ import (
 	"encoding/base64"
 	stderrors "errors"
 	"net/mail"
+	"strings"
 	"time"
 
 	"github.com/coreos/go-oidc/v3/oidc"
@@ -16,6 +17,7 @@ import (
 	"go.uber.org/zap"
 	"golang.org/x/oauth2"
 
+	"github.com/canonical/jimm/internal/dbmodel"
 	"github.com/canonical/jimm/internal/errors"
 )
 
@@ -27,6 +29,13 @@ type AuthenticationService struct {
 	provider *oidc.Provider
 	// sessionTokenExpiry holds the expiry time for JIMM minted session tokens (JWTs).
 	sessionTokenExpiry time.Duration
+
+	db IdentityStore
+}
+
+type IdentityStore interface {
+	GetIdentity(ctx context.Context, u *dbmodel.Identity) error
+	UpdateIdentity(ctx context.Context, u *dbmodel.Identity) error
 }
 
 // AuthenticationServiceParams holds the parameters to initialise
@@ -48,6 +57,11 @@ type AuthenticationServiceParams struct {
 	// codes into access tokens (and id tokens), for JIMM, this is expected
 	// to be the servers own callback endpoint registered under /auth/callback.
 	RedirectURL string
+
+	// Store holds the identity store used by the authentication service
+	// to fetch and update identities. I.e., their access tokens, refresh tokens,
+	// display name, etc.
+	Store IdentityStore
 }
 
 // NewAuthenticationService returns a new authentication service for handling
@@ -71,6 +85,7 @@ func NewAuthenticationService(ctx context.Context, params AuthenticationServiceP
 			RedirectURL:  params.RedirectURL,
 		},
 		sessionTokenExpiry: params.SessionTokenExpiry,
+		db:                 params.Store,
 	}, nil
 }
 
@@ -86,6 +101,27 @@ func (as *AuthenticationService) AuthCodeURL() string {
 	return as.oauthConfig.AuthCodeURL("")
 }
 
+// Exchange exchanges an authorisation code for an access token.
+//
+// TODO(ale8k): How to test this? A callback has to be made and it needs to be valid,
+// this may need some thought as to whether its actually worth testing or are we
+// just testing the library. The handler test essentially covers this so perhaps
+// its ok to leave it as is?
+func (as *AuthenticationService) Exchange(ctx context.Context, code string) (*oauth2.Token, error) {
+	const op = errors.Op("auth.AuthenticationService.Exchange")
+
+	t, err := as.oauthConfig.Exchange(
+		ctx,
+		code,
+		oauth2.SetAuthURLParam("client_secret", as.oauthConfig.ClientSecret),
+	)
+	if err != nil {
+		return nil, errors.E(op, err, "device access token call failed")
+	}
+
+	return t, nil
+}
+
 // Device initiates a device flow login and is step ONE of TWO.
 //
 // This is done via retrieving a:
@@ -203,6 +239,32 @@ func (as *AuthenticationService) VerifySessionToken(token string, secretKey stri
 	return VerifySessionToken(token, secretKey)
 }
 
+// UpdateIdentity updates the database with the display name and access token set for the user.
+// And, if present, a refresh token.
+func (as *AuthenticationService) UpdateIdentity(ctx context.Context, email string, token *oauth2.Token) error {
+	db := as.db
+	u := &dbmodel.Identity{
+		Name: email,
+	}
+	// TODO(babakks): If user does not exist, we will create one with an empty
+	// display name (which we shouldn't). So it would be better to fetch
+	// and then create. At the moment, GetUser is used for both create and fetch,
+	// this should be changed and split apart so it is intentional what entities
+	// we are creating or fetching.
+	if err := db.GetIdentity(ctx, u); err != nil {
+		return err
+	}
+	// Check if user has a display name, if not, set one
+	if u.DisplayName == "" {
+		u.DisplayName = strings.Split(email, "@")[0]
+	}
+	u.AccessToken = token.AccessToken
+	if err := db.UpdateIdentity(ctx, u); err != nil {
+		return err
+	}
+	return nil
+}
+
 // VerifySessionToken symmetrically verifies the validty of the signature on the
 // access token JWT, returning the parsed token.
 //

internal/auth/oauth2_test.go

@@ -14,6 +14,7 @@ import (
 	"time"
 
 	"github.com/canonical/jimm/internal/auth"
+	"github.com/canonical/jimm/internal/db"
 	"github.com/canonical/jimm/internal/jimmtest"
 	"github.com/coreos/go-oidc/v3/oidc"
 	qt "github.com/frankban/quicktest"
@@ -27,6 +28,9 @@ func setupTestAuthSvc(ctx context.Context, c *qt.C, expiry time.Duration) *auth.
 		Scopes:             []string{oidc.ScopeOpenID, "profile", "email"},
 		SessionTokenExpiry: expiry,
 		RedirectURL:        "http://localhost:8080/auth/callback",
+		Store: &db.Database{
+			DB: jimmtest.PostgresDB(c, func() time.Time { return time.Now() }),
+		},
 	})
 	c.Assert(err, qt.IsNil)
 

internal/cmdtest/jimmsuite.go

@@ -91,6 +91,7 @@ func (s *JimmCmdSuite) SetUpTest(c *gc.C) {
 			Scopes:             []string{oidc.ScopeOpenID, "profile", "email"},
 			SessionTokenExpiry: time.Duration(time.Hour),
 		},
+		DashboardFinalRedirectURL: "",
 	}
 
 	srv, err := service.NewService(ctx, s.Params)

internal/jimm/jimm.go

@@ -165,6 +165,10 @@ type OAuthAuthenticator interface {
 	// The subject of the token contains the user's email and can be used
 	// for user object creation.
 	VerifySessionToken(token string, secretKey string) (jwt.Token, error)
+
+	// UpdateIdentity updates the database with the display name and access token set for the user.
+	// And, if present, a refresh token.
+	UpdateIdentity(ctx context.Context, email string, token *oauth2.Token) error
 }
 
 type permission struct {

internal/jimm/user_test.go

@@ -114,6 +114,9 @@ func TestGetOpenFGAUser(t *testing.T) {
 		ClientID:           "jimm-device",
 		Scopes:             []string{"openid", "profile", "email"},
 		SessionTokenExpiry: time.Hour,
+		Store: &db.Database{
+			DB: jimmtest.PostgresDB(c, func() time.Time { return time.Now() }),
+		},
 	})
 	c.Assert(err, qt.IsNil)
 

internal/jimmhttp/auth_handler.go

@@ -1,43 +1,105 @@
 package jimmhttp
 
 import (
+	"context"
 	"net/http"
 
+	"github.com/coreos/go-oidc/v3/oidc"
 	"github.com/go-chi/chi/v5"
+	"github.com/juju/zaputil/zapctx"
+	"go.uber.org/zap"
+	"golang.org/x/oauth2"
+
+	"github.com/canonical/jimm/internal/errors"
 )
 
 // OAuthHandler handles the oauth2.0 browser flow for JIMM.
 // Implements jimmhttp.JIMMHttpHandler.
 type OAuthHandler struct {
-	Router        *chi.Mux
-	Authenticator BrowserOAuthAuthenticator
+	Router                    *chi.Mux
+	Authenticator             BrowserOAuthAuthenticator
+	DashboardFinalRedirectURL string
 }
 
 // BrowserOAuthAuthenticator handles authorisation code authentication within JIMM
 // via OIDC.
 type BrowserOAuthAuthenticator interface {
-	// AuthCodeURL returns a URL that will be used to redirect a browser to the identity provider.
 	AuthCodeURL() string
+	Exchange(ctx context.Context, code string) (*oauth2.Token, error)
+	ExtractAndVerifyIDToken(ctx context.Context, oauth2Token *oauth2.Token) (*oidc.IDToken, error)
+	Email(idToken *oidc.IDToken) (string, error)
+	UpdateIdentity(ctx context.Context, email string, token *oauth2.Token) error
 }
 
 // NewOAuthHandler returns a new OAuth handler.
-func NewOAuthHandler(authenticator BrowserOAuthAuthenticator) *OAuthHandler {
-	return &OAuthHandler{Router: chi.NewRouter(), Authenticator: authenticator}
+func NewOAuthHandler(authenticator BrowserOAuthAuthenticator, dashboardFinalRedirectURL string) (*OAuthHandler, error) {
+	if authenticator == nil {
+		return nil, errors.E("nil authenticator")
+	}
+	if dashboardFinalRedirectURL == "" {
+		return nil, errors.E("final redirect url not specified")
+	}
+	return &OAuthHandler{
+		Router:                    chi.NewRouter(),
+		Authenticator:             authenticator,
+		DashboardFinalRedirectURL: dashboardFinalRedirectURL,
+	}, nil
 }
 
 // Routes returns the grouped routers routes with group specific middlewares.
 func (oah *OAuthHandler) Routes() chi.Router {
 	oah.SetupMiddleware()
 	oah.Router.Get("/login", oah.Login)
+	oah.Router.Get("/callback", oah.Callback)
 	return oah.Router
 }
 
 // SetupMiddleware applies middlewares.
 func (oah *OAuthHandler) SetupMiddleware() {
 }
 
-// Login handles /auth/login,
+// Login handles /auth/login.
 func (oah *OAuthHandler) Login(w http.ResponseWriter, r *http.Request) {
 	redirectURL := oah.Authenticator.AuthCodeURL()
 	http.Redirect(w, r, redirectURL, http.StatusTemporaryRedirect)
 }
+
+func write500(ctx context.Context, err error, w http.ResponseWriter, logMsg string) {
+	zapctx.Error(ctx, logMsg, zap.Error(err))
+	w.WriteHeader(http.StatusInternalServerError)
+	w.Write([]byte("Internal Server Error."))
+}
+
+// Callback handles /auth/callback.
+func (oah *OAuthHandler) Callback(w http.ResponseWriter, r *http.Request) {
+	ctx := context.Background()
+
+	code := r.URL.Query().Get("code")
+
+	authSvc := oah.Authenticator
+
+	token, err := authSvc.Exchange(ctx, code)
+	if err != nil {
+		write500(ctx, err, w, "failed to exchange authcode")
+		return
+	}
+
+	idToken, err := authSvc.ExtractAndVerifyIDToken(ctx, token)
+	if err != nil {
+		write500(ctx, err, w, "failed to extract and verify id token")
+		return
+	}
+
+	email, err := authSvc.Email(idToken)
+	if err != nil {
+		write500(ctx, err, w, "failed to extract email from id token")
+		return
+	}
+
+	if err := authSvc.UpdateIdentity(ctx, email, token); err != nil {
+		write500(ctx, err, w, "failed to update identity")
+		return
+	}
+
+	http.Redirect(w, r, oah.DashboardFinalRedirectURL, http.StatusPermanentRedirect)
+}