auth
auth/client.go
Test our GetClientHandler function, add isAuthError helper. Add a helper that identifies whether the error passed to it is an authentication error or is some other type of error. This is useful fo checking whether or not an internal error occurred while authenticating users. Update all instances where we call our authentication helper to make them use the new error helper. All tests continue to pass. Add a new test case for retrieving a client as an unauthenticated user. This clears the client's secret from the response before sending it. Update the GetClientHandler function to return the secret when the owner of the client used Basic Auth in the request. Add a new test case for retrieving a client as an authenticated user, both the owner and a non-owner user. This makes sure the secret is divulged only in the appropriate cases.
1 package auth
3 import (
4 "crypto/rand"
5 "encoding/hex"
6 "encoding/json"
7 "errors"
8 "log"
9 "net/http"
10 "net/url"
11 "strconv"
12 "strings"
13 "time"
15 "github.com/PuerkitoBio/purell"
16 "github.com/gorilla/mux"
18 "code.secondbit.org/uuid.hg"
19 )
21 func init() {
22 RegisterGrantType("client_credentials", GrantType{
23 Validate: clientCredentialsValidate,
24 Invalidate: nil,
25 IssuesRefresh: true,
26 ReturnToken: RenderJSONToken,
27 AllowsPublic: false,
28 AuditString: clientCredentialsAuditString,
29 })
30 }
32 var (
33 // ErrNoClientStore is returned when a Context tries to act on a clientStore without setting one first.
34 ErrNoClientStore = errors.New("no clientStore was specified for the Context")
35 // ErrClientNotFound is returned when a Client is requested but not found in a clientStore.
36 ErrClientNotFound = errors.New("client not found in clientStore")
37 // ErrClientAlreadyExists is returned when a Client is added to a clientStore, but another Client with
38 // the same ID already exists in the clientStore.
39 ErrClientAlreadyExists = errors.New("client already exists in clientStore")
41 // ErrEmptyChange is returned when a Change has all its properties set to nil.
42 ErrEmptyChange = errors.New("change must have at least one property set")
43 // ErrClientNameTooShort is returned when a Client's Name property is too short.
44 ErrClientNameTooShort = errors.New("client name must be at least 2 characters")
45 // ErrClientNameTooLong is returned when a Client's Name property is too long.
46 ErrClientNameTooLong = errors.New("client name must be at most 32 characters")
47 // ErrClientLogoTooLong is returned when a Client's Logo property is too long.
48 ErrClientLogoTooLong = errors.New("client logo must be at most 1024 characters")
49 // ErrClientLogoNotURL is returned when a Client's Logo property is not a valid absolute URL.
50 ErrClientLogoNotURL = errors.New("client logo must be a valid absolute URL")
51 // ErrClientWebsiteTooLong is returned when a Client's Website property is too long.
52 ErrClientWebsiteTooLong = errors.New("client website must be at most 1024 characters")
53 // ErrClientWebsiteNotURL is returned when a Client's Website property is not a valid absolute URL.
54 ErrClientWebsiteNotURL = errors.New("client website must be a valid absolute URL")
55 // ErrEndpointURINotURL is returned when an Endpoint's URI property is not a valid absolute URL.
56 ErrEndpointURINotURL = errors.New("endpoint URI must be a valid absolute URL")
57 )
59 const (
60 clientTypePublic = "public"
61 clientTypeConfidential = "confidential"
62 minClientNameLen = 2
63 maxClientNameLen = 24
64 defaultClientResponseSize = 20
65 maxClientResponseSize = 50
66 defaultEndpointResponseSize = 20
67 maxEndpointResponseSize = 50
69 normalizeFlags = purell.FlagsUsuallySafeNonGreedy | purell.FlagSortQuery
70 )
72 // Client represents a client that grants access
73 // to the auth server, exchanging grants for tokens,
74 // and tokens for access.
75 type Client struct {
76 ID uuid.ID `json:"id,omitempty"`
77 Secret string `json:"secret,omitempty"`
78 OwnerID uuid.ID `json:"owner_id,omitempty"`
79 Name string `json:"name,omitempty"`
80 Logo string `json:"logo,omitempty"`
81 Website string `json:"website,omitempty"`
82 Type string `json:"type,omitempty"`
83 }
85 // ApplyChange applies the properties of the passed
86 // ClientChange to the Client object it is called on.
87 func (c *Client) ApplyChange(change ClientChange) {
88 if change.Secret != nil {
89 c.Secret = *change.Secret
90 }
91 if change.OwnerID != nil {
92 c.OwnerID = change.OwnerID
93 }
94 if change.Name != nil {
95 c.Name = *change.Name
96 }
97 if change.Logo != nil {
98 c.Logo = *change.Logo
99 }
100 if change.Website != nil {
101 c.Website = *change.Website
102 }
103 }
105 // ClientChange represents a bundle of options for
106 // updating a Client's mutable data.
107 type ClientChange struct {
108 Secret *string
109 OwnerID uuid.ID
110 Name *string
111 Logo *string
112 Website *string
113 }
115 // Validate checks the ClientChange it is called on
116 // and asserts its internal validity, or lack thereof.
117 func (c ClientChange) Validate() []error {
118 errors := []error{}
119 if c.Secret == nil && c.OwnerID == nil && c.Name == nil && c.Logo == nil && c.Website == nil {
120 errors = append(errors, ErrEmptyChange)
121 return errors
122 }
123 if c.Name != nil && len(*c.Name) < 2 {
124 errors = append(errors, ErrClientNameTooShort)
125 }
126 if c.Name != nil && len(*c.Name) > 32 {
127 errors = append(errors, ErrClientNameTooLong)
128 }
129 if c.Logo != nil && *c.Logo != "" {
130 if len(*c.Logo) > 1024 {
131 errors = append(errors, ErrClientLogoTooLong)
132 }
133 u, err := url.Parse(*c.Logo)
134 if err != nil || !u.IsAbs() {
135 errors = append(errors, ErrClientLogoNotURL)
136 }
137 }
138 if c.Website != nil && *c.Website != "" {
139 if len(*c.Website) > 140 {
140 errors = append(errors, ErrClientWebsiteTooLong)
141 }
142 u, err := url.Parse(*c.Website)
143 if err != nil || !u.IsAbs() {
144 errors = append(errors, ErrClientWebsiteNotURL)
145 }
146 }
147 return errors
148 }
150 func getClientAuth(w http.ResponseWriter, r *http.Request, allowPublic bool) (uuid.ID, string, bool) {
151 enc := json.NewEncoder(w)
152 clientIDStr, clientSecret, fromAuthHeader := r.BasicAuth()
153 if !fromAuthHeader {
154 clientIDStr = r.PostFormValue("client_id")
155 }
156 if clientIDStr == "" {
157 w.WriteHeader(http.StatusUnauthorized)
158 if fromAuthHeader {
159 w.Header().Set("WWW-Authenticate", "Basic")
160 }
161 renderJSONError(enc, "invalid_client")
162 return nil, "", false
163 }
164 if !allowPublic && !fromAuthHeader {
165 w.WriteHeader(http.StatusBadRequest)
166 renderJSONError(enc, "unauthorized_client")
167 return nil, "", false
168 }
169 clientID, err := uuid.Parse(clientIDStr)
170 if err != nil {
171 log.Println("Error decoding client ID:", err)
172 w.WriteHeader(http.StatusUnauthorized)
173 if fromAuthHeader {
174 w.Header().Set("WWW-Authenticate", "Basic")
175 }
176 renderJSONError(enc, "invalid_client")
177 return nil, "", false
178 }
179 return clientID, clientSecret, true
180 }
182 func verifyClient(w http.ResponseWriter, r *http.Request, allowPublic bool, context Context) (uuid.ID, bool) {
183 enc := json.NewEncoder(w)
184 clientID, clientSecret, ok := getClientAuth(w, r, allowPublic)
185 if !ok {
186 return nil, false
187 }
188 _, _, fromAuthHeader := r.BasicAuth()
189 client, err := context.GetClient(clientID)
190 if err == ErrClientNotFound {
191 w.WriteHeader(http.StatusUnauthorized)
192 if fromAuthHeader {
193 w.Header().Set("WWW-Authenticate", "Basic")
194 }
195 renderJSONError(enc, "invalid_client")
196 return nil, false
197 } else if err != nil {
198 w.WriteHeader(http.StatusInternalServerError)
199 renderJSONError(enc, "server_error")
200 return nil, false
201 }
202 if client.Secret != clientSecret { // it's important that any client deemed "public" is not issued a client secret.
203 w.WriteHeader(http.StatusUnauthorized)
204 if fromAuthHeader {
205 w.Header().Set("WWW-Authenticate", "Basic")
206 }
207 renderJSONError(enc, "invalid_client")
208 return nil, false
209 }
210 return clientID, true
211 }
213 // Endpoint represents a single URI that a Client
214 // controls. Users will be redirected to these URIs
215 // following successful authorization grants and
216 // exchanges for access tokens.
217 type Endpoint struct {
218 ID uuid.ID `json:"id,omitempty"`
219 ClientID uuid.ID `json:"client_id,omitempty"`
220 URI string `json:"uri,omitempty"`
221 NormalizedURI string `json:"-"`
222 Added time.Time `json:"added,omitempty"`
223 }
225 func normalizeURIString(in string) (string, error) {
226 n, err := purell.NormalizeURLString(in, normalizeFlags)
227 if err != nil {
228 log.Println(err)
229 return in, ErrEndpointURINotURL
230 }
231 return n, nil
232 }
234 func normalizeURI(in *url.URL) string {
235 return purell.NormalizeURL(in, normalizeFlags)
236 }
238 type sortedEndpoints []Endpoint
240 func (s sortedEndpoints) Len() int {
241 return len(s)
242 }
244 func (s sortedEndpoints) Less(i, j int) bool {
245 return s[i].Added.Before(s[j].Added)
246 }
248 func (s sortedEndpoints) Swap(i, j int) {
249 s[i], s[j] = s[j], s[i]
250 }
252 type clientStore interface {
253 getClient(id uuid.ID) (Client, error)
254 saveClient(client Client) error
255 updateClient(id uuid.ID, change ClientChange) error
256 deleteClient(id uuid.ID) error
257 listClientsByOwner(ownerID uuid.ID, num, offset int) ([]Client, error)
259 addEndpoints(client uuid.ID, endpoint []Endpoint) error
260 removeEndpoint(client, endpoint uuid.ID) error
261 checkEndpoint(client uuid.ID, endpoint string) (bool, error)
262 listEndpoints(client uuid.ID, num, offset int) ([]Endpoint, error)
263 countEndpoints(client uuid.ID) (int64, error)
264 }
266 func (m *memstore) getClient(id uuid.ID) (Client, error) {
267 m.clientLock.RLock()
268 defer m.clientLock.RUnlock()
269 c, ok := m.clients[id.String()]
270 if !ok {
271 return Client{}, ErrClientNotFound
272 }
273 return c, nil
274 }
276 func (m *memstore) saveClient(client Client) error {
277 m.clientLock.Lock()
278 defer m.clientLock.Unlock()
279 if _, ok := m.clients[client.ID.String()]; ok {
280 return ErrClientAlreadyExists
281 }
282 m.clients[client.ID.String()] = client
283 m.profileClientLookup[client.OwnerID.String()] = append(m.profileClientLookup[client.OwnerID.String()], client.ID)
284 return nil
285 }
287 func (m *memstore) updateClient(id uuid.ID, change ClientChange) error {
288 m.clientLock.Lock()
289 defer m.clientLock.Unlock()
290 c, ok := m.clients[id.String()]
291 if !ok {
292 return ErrClientNotFound
293 }
294 c.ApplyChange(change)
295 m.clients[id.String()] = c
296 return nil
297 }
299 func (m *memstore) deleteClient(id uuid.ID) error {
300 client, err := m.getClient(id)
301 if err != nil {
302 return err
303 }
304 m.clientLock.Lock()
305 defer m.clientLock.Unlock()
306 delete(m.clients, id.String())
307 pos := -1
308 for p, item := range m.profileClientLookup[client.OwnerID.String()] {
309 if item.Equal(id) {
310 pos = p
311 break
312 }
313 }
314 if pos >= 0 {
315 m.profileClientLookup[client.OwnerID.String()] = append(m.profileClientLookup[client.OwnerID.String()][:pos], m.profileClientLookup[client.OwnerID.String()][pos+1:]...)
316 }
317 return nil
318 }
320 func (m *memstore) listClientsByOwner(ownerID uuid.ID, num, offset int) ([]Client, error) {
321 ids := m.lookupClientsByProfileID(ownerID.String())
322 if len(ids) > num+offset {
323 ids = ids[offset : num+offset]
324 } else if len(ids) > offset {
325 ids = ids[offset:]
326 } else {
327 return []Client{}, nil
328 }
329 clients := []Client{}
330 for _, id := range ids {
331 client, err := m.getClient(id)
332 if err != nil {
333 return []Client{}, err
334 }
335 clients = append(clients, client)
336 }
337 return clients, nil
338 }
340 func (m *memstore) addEndpoints(client uuid.ID, endpoints []Endpoint) error {
341 m.endpointLock.Lock()
342 defer m.endpointLock.Unlock()
343 m.endpoints[client.String()] = append(m.endpoints[client.String()], endpoints...)
344 return nil
345 }
347 func (m *memstore) removeEndpoint(client, endpoint uuid.ID) error {
348 m.endpointLock.Lock()
349 defer m.endpointLock.Unlock()
350 pos := -1
351 for p, item := range m.endpoints[client.String()] {
352 if item.ID.Equal(endpoint) {
353 pos = p
354 break
355 }
356 }
357 if pos >= 0 {
358 m.endpoints[client.String()] = append(m.endpoints[client.String()][:pos], m.endpoints[client.String()][pos+1:]...)
359 }
360 return nil
361 }
363 func (m *memstore) checkEndpoint(client uuid.ID, endpoint string) (bool, error) {
364 m.endpointLock.RLock()
365 defer m.endpointLock.RUnlock()
366 for _, candidate := range m.endpoints[client.String()] {
367 if endpoint == candidate.NormalizedURI {
368 return true, nil
369 }
370 }
371 return false, nil
372 }
374 func (m *memstore) listEndpoints(client uuid.ID, num, offset int) ([]Endpoint, error) {
375 m.endpointLock.RLock()
376 defer m.endpointLock.RUnlock()
377 return m.endpoints[client.String()], nil
378 }
380 func (m *memstore) countEndpoints(client uuid.ID) (int64, error) {
381 m.endpointLock.RLock()
382 defer m.endpointLock.RUnlock()
383 return int64(len(m.endpoints[client.String()])), nil
384 }
386 type newClientReq struct {
387 Name string `json:"name"`
388 Logo string `json:"logo"`
389 Website string `json:"website"`
390 Type string `json:"type"`
391 Endpoints []string `json:"endpoints"`
392 }
394 func RegisterClientHandlers(r *mux.Router, context Context) {
395 r.Handle("/clients", wrap(context, CreateClientHandler)).Methods("POST")
396 r.Handle("/clients", wrap(context, ListClientsHandler)).Methods("GET")
397 r.Handle("/clients/{id}", wrap(context, GetClientHandler)).Methods("GET")
398 r.Handle("/clients/{id}", wrap(context, UpdateClientHandler)).Methods("PATCH")
399 // BUG(paddy): We need to implement a handler to delete a client. Also, what should that do with the grants and tokens belonging to that client?
400 r.Handle("/clients/{id}/endpoints", wrap(context, AddEndpointsHandler)).Methods("POST")
401 // BUG(paddy): We need to implement a handler to remove an endpoint from a client.
402 r.Handle("/clients/{id}/endpoints", wrap(context, ListEndpointsHandler)).Methods("GET")
403 }
405 func CreateClientHandler(w http.ResponseWriter, r *http.Request, c Context) {
406 errors := []requestError{}
407 username, password, ok := r.BasicAuth()
408 if !ok {
409 errors = append(errors, requestError{Slug: requestErrAccessDenied})
410 encode(w, r, http.StatusUnauthorized, response{Errors: errors})
411 return
412 }
413 profile, err := authenticate(username, password, c)
414 if err != nil {
415 if isAuthError(err) {
416 errors = append(errors, requestError{Slug: requestErrAccessDenied})
417 encode(w, r, http.StatusUnauthorized, response{Errors: errors})
418 } else {
419 errors = append(errors, requestError{Slug: requestErrActOfGod})
420 encode(w, r, http.StatusInternalServerError, response{Errors: errors})
421 }
422 return
423 }
424 var req newClientReq
425 decoder := json.NewDecoder(r.Body)
426 err = decoder.Decode(&req)
427 if err != nil {
428 encode(w, r, http.StatusBadRequest, invalidFormatResponse)
429 return
430 }
431 if req.Type == "" {
432 errors = append(errors, requestError{Slug: requestErrMissing, Field: "/type"})
433 } else if req.Type != clientTypePublic && req.Type != clientTypeConfidential {
434 errors = append(errors, requestError{Slug: requestErrInvalidValue, Field: "/type"})
435 }
436 if req.Name == "" {
437 errors = append(errors, requestError{Slug: requestErrMissing, Field: "/name"})
438 } else if len(req.Name) < minClientNameLen {
439 errors = append(errors, requestError{Slug: requestErrInsufficient, Field: "/name"})
440 } else if len(req.Name) > maxClientNameLen {
441 errors = append(errors, requestError{Slug: requestErrOverflow, Field: "/name"})
442 }
443 if len(errors) > 0 {
444 encode(w, r, http.StatusBadRequest, response{Errors: errors})
445 return
446 }
447 client := Client{
448 ID: uuid.NewID(),
449 OwnerID: profile.ID,
450 Name: req.Name,
451 Logo: req.Logo,
452 Website: req.Website,
453 Type: req.Type,
454 }
455 if client.Type == clientTypeConfidential {
456 secret := make([]byte, 32)
457 _, err = rand.Read(secret)
458 if err != nil {
459 encode(w, r, http.StatusInternalServerError, actOfGodResponse)
460 return
461 }
462 client.Secret = hex.EncodeToString(secret)
463 }
464 err = c.SaveClient(client)
465 if err != nil {
466 if err == ErrClientAlreadyExists {
467 errors = append(errors, requestError{Slug: requestErrConflict, Field: "/id"})
468 encode(w, r, http.StatusBadRequest, response{Errors: errors})
469 return
470 }
471 encode(w, r, http.StatusInternalServerError, actOfGodResponse)
472 return
473 }
474 endpoints := []Endpoint{}
475 for pos, u := range req.Endpoints {
476 uri, err := url.Parse(u)
477 if err != nil {
478 errors = append(errors, requestError{Slug: requestErrInvalidFormat, Field: "/endpoints/" + strconv.Itoa(pos)})
479 continue
480 }
481 if !uri.IsAbs() {
482 errors = append(errors, requestError{Slug: requestErrInvalidValue, Field: "/endpoints/" + strconv.Itoa(pos)})
483 continue
484 }
485 endpoint := Endpoint{
486 ID: uuid.NewID(),
487 ClientID: client.ID,
488 URI: uri.String(),
489 Added: time.Now(),
490 }
491 endpoints = append(endpoints, endpoint)
492 }
493 err = c.AddEndpoints(client.ID, endpoints)
494 if err != nil {
495 errors = append(errors, requestError{Slug: requestErrActOfGod})
496 encode(w, r, http.StatusInternalServerError, response{Errors: errors, Clients: []Client{client}})
497 return
498 }
499 resp := response{
500 Clients: []Client{client},
501 Endpoints: endpoints,
502 Errors: errors,
503 }
504 encode(w, r, http.StatusCreated, resp)
505 }
507 func GetClientHandler(w http.ResponseWriter, r *http.Request, c Context) {
508 errors := []requestError{}
509 vars := mux.Vars(r)
510 if vars["id"] == "" {
511 errors = append(errors, requestError{Slug: requestErrMissing, Param: "id"})
512 encode(w, r, http.StatusBadRequest, response{Errors: errors})
513 return
514 }
515 id, err := uuid.Parse(vars["id"])
516 if err != nil {
517 errors = append(errors, requestError{Slug: requestErrInvalidFormat, Param: "id"})
518 encode(w, r, http.StatusBadRequest, response{Errors: errors})
519 return
520 }
521 client, err := c.GetClient(id)
522 if err != nil {
523 if err == ErrClientNotFound {
524 errors = append(errors, requestError{Slug: requestErrNotFound, Param: "id"})
525 encode(w, r, http.StatusNotFound, response{Errors: errors})
526 return
527 }
528 errors = append(errors, requestError{Slug: requestErrActOfGod})
529 encode(w, r, http.StatusInternalServerError, response{Errors: errors})
530 return
531 }
532 username, password, ok := r.BasicAuth()
533 if !ok {
534 client.Secret = ""
535 } else {
536 profile, err := authenticate(username, password, c)
537 if err != nil {
538 if isAuthError(err) {
539 errors = append(errors, requestError{Slug: requestErrAccessDenied})
540 encode(w, r, http.StatusUnauthorized, response{Errors: errors})
541 } else {
542 errors = append(errors, requestError{Slug: requestErrActOfGod})
543 encode(w, r, http.StatusInternalServerError, response{Errors: errors})
544 }
545 return
546 }
547 if !client.OwnerID.Equal(profile.ID) {
548 client.Secret = ""
549 }
550 }
551 resp := response{
552 Clients: []Client{client},
553 Errors: errors,
554 }
555 encode(w, r, http.StatusOK, resp)
556 }
558 func ListClientsHandler(w http.ResponseWriter, r *http.Request, c Context) {
559 errors := []requestError{}
560 var err error
561 // BUG(paddy): If ids are provided in query params, retrieve only those clients
562 // BUG(paddy): We should have auth when listing clients
563 num := defaultClientResponseSize
564 offset := 0
565 ownerIDStr := r.URL.Query().Get("owner_id")
566 numStr := r.URL.Query().Get("num")
567 offsetStr := r.URL.Query().Get("offset")
568 if numStr != "" {
569 num, err = strconv.Atoi(numStr)
570 if err != nil {
571 errors = append(errors, requestError{Slug: requestErrInvalidFormat, Param: "num"})
572 }
573 if num > maxClientResponseSize {
574 errors = append(errors, requestError{Slug: requestErrOverflow, Param: "num"})
575 }
576 }
577 if offsetStr != "" {
578 offset, err = strconv.Atoi(offsetStr)
579 if err != nil {
580 errors = append(errors, requestError{Slug: requestErrInvalidFormat, Param: "offset"})
581 }
582 }
583 if ownerIDStr == "" {
584 errors = append(errors, requestError{Slug: requestErrMissing, Param: "owner_id"})
585 }
586 if len(errors) > 0 {
587 encode(w, r, http.StatusBadRequest, response{Errors: errors})
588 return
589 }
590 ownerID, err := uuid.Parse(ownerIDStr)
591 if err != nil {
592 errors = append(errors, requestError{Slug: requestErrInvalidFormat, Param: "owner_id"})
593 encode(w, r, http.StatusInternalServerError, response{Errors: errors})
594 return
595 }
596 clients, err := c.ListClientsByOwner(ownerID, num, offset)
597 if err != nil {
598 errors = append(errors, requestError{Slug: requestErrActOfGod})
599 encode(w, r, http.StatusInternalServerError, response{Errors: errors})
600 return
601 }
602 for pos, client := range clients {
603 client.Secret = ""
604 clients[pos] = client
605 }
606 resp := response{
607 Clients: clients,
608 Errors: errors,
609 }
610 encode(w, r, http.StatusOK, resp)
611 }
613 func UpdateClientHandler(w http.ResponseWriter, r *http.Request, c Context) {
614 errors := []requestError{}
615 vars := mux.Vars(r)
616 if _, ok := vars["id"]; !ok {
617 errors = append(errors, requestError{Slug: requestErrMissing, Param: "id"})
618 encode(w, r, http.StatusBadRequest, response{Errors: errors})
619 return
620 }
621 var change ClientChange
622 err := decode(r, &change)
623 if err != nil {
624 errors = append(errors, requestError{Slug: requestErrInvalidFormat, Field: "/"})
625 encode(w, r, http.StatusBadRequest, response{Errors: errors})
626 return
627 }
628 errs := change.Validate()
629 for _, err := range errs {
630 switch err {
631 case ErrEmptyChange:
632 errors = append(errors, requestError{Slug: requestErrMissing, Field: "/"})
633 case ErrClientNameTooShort:
634 errors = append(errors, requestError{Slug: requestErrInsufficient, Field: "/name"})
635 case ErrClientNameTooLong:
636 errors = append(errors, requestError{Slug: requestErrOverflow, Field: "/name"})
637 case ErrClientLogoTooLong:
638 errors = append(errors, requestError{Slug: requestErrOverflow, Field: "/logo"})
639 case ErrClientLogoNotURL:
640 errors = append(errors, requestError{Slug: requestErrInvalidFormat, Field: "/logo"})
641 case ErrClientWebsiteTooLong:
642 errors = append(errors, requestError{Slug: requestErrOverflow, Field: "/website"})
643 case ErrClientWebsiteNotURL:
644 errors = append(errors, requestError{Slug: requestErrInvalidFormat, Field: "/website"})
645 default:
646 log.Println("Unrecognised error from client change validation:", err)
647 }
648 }
649 id, err := uuid.Parse(vars["id"])
650 if err != nil {
651 errors = append(errors, requestError{Slug: requestErrInvalidFormat, Param: "id"})
652 }
653 if len(errors) > 0 {
654 encode(w, r, http.StatusBadRequest, response{Errors: errors})
655 return
656 }
657 client, err := c.GetClient(id)
658 if err == ErrClientNotFound {
659 errors = append(errors, requestError{Slug: requestErrNotFound, Param: "id"})
660 encode(w, r, http.StatusNotFound, response{Errors: errors})
661 return
662 } else if err != nil {
663 log.Println("Error retrieving client:", err)
664 errors = append(errors, requestError{Slug: requestErrActOfGod})
665 encode(w, r, http.StatusInternalServerError, response{Errors: errors})
666 return
667 }
668 if change.Secret != nil && client.Type == clientTypeConfidential {
669 secret := make([]byte, 32)
670 _, err = rand.Read(secret)
671 if err != nil {
672 encode(w, r, http.StatusInternalServerError, actOfGodResponse)
673 return
674 }
675 newSecret := hex.EncodeToString(secret)
676 change.Secret = &newSecret
677 }
678 err = c.UpdateClient(id, change)
679 if err != nil {
680 log.Println("Error updating client:", err)
681 errors = append(errors, requestError{Slug: requestErrActOfGod})
682 encode(w, r, http.StatusInternalServerError, response{Errors: errors})
683 return
684 }
685 client.ApplyChange(change)
686 encode(w, r, http.StatusOK, response{Clients: []Client{client}, Errors: errors})
687 return
688 }
690 func AddEndpointsHandler(w http.ResponseWriter, r *http.Request, c Context) {
691 type addEndpointReq struct {
692 Endpoints []string `json:"endpoints"`
693 }
694 errors := []requestError{}
695 vars := mux.Vars(r)
696 if vars["id"] == "" {
697 errors = append(errors, requestError{Slug: requestErrMissing, Param: "id"})
698 encode(w, r, http.StatusBadRequest, response{Errors: errors})
699 return
700 }
701 id, err := uuid.Parse(vars["id"])
702 if err != nil {
703 errors = append(errors, requestError{Slug: requestErrInvalidFormat, Param: "id"})
704 encode(w, r, http.StatusBadRequest, response{Errors: errors})
705 return
706 }
707 _, err = c.GetClient(id)
708 if err != nil {
709 if err == ErrClientNotFound {
710 errors = append(errors, requestError{Slug: requestErrNotFound, Param: "id"})
711 encode(w, r, http.StatusBadRequest, response{Errors: errors})
712 return
713 }
714 errors = append(errors, requestError{Slug: requestErrActOfGod})
715 encode(w, r, http.StatusInternalServerError, response{Errors: errors})
716 return
717 }
718 var req addEndpointReq
719 decoder := json.NewDecoder(r.Body)
720 err = decoder.Decode(&req)
721 if err != nil {
722 encode(w, r, http.StatusBadRequest, invalidFormatResponse)
723 return
724 }
725 if len(req.Endpoints) < 1 {
726 errors = append(errors, requestError{Slug: requestErrMissing, Field: "/endpoints"})
727 encode(w, r, http.StatusBadRequest, response{Errors: errors})
728 return
729 }
730 endpoints := []Endpoint{}
731 for pos, u := range req.Endpoints {
732 if parsed, err := url.Parse(u); err != nil {
733 errors = append(errors, requestError{Slug: requestErrInvalidFormat, Field: "/endpoints/" + strconv.Itoa(pos)})
734 continue
735 } else if !parsed.IsAbs() {
736 errors = append(errors, requestError{Slug: requestErrInvalidValue, Field: "/endpoints" + strconv.Itoa(pos)})
737 continue
738 }
739 e := Endpoint{
740 ID: uuid.NewID(),
741 ClientID: id,
742 URI: u,
743 Added: time.Now(),
744 }
745 endpoints = append(endpoints, e)
746 }
747 if len(errors) > 0 {
748 encode(w, r, http.StatusBadRequest, response{Errors: errors})
749 return
750 }
751 err = c.AddEndpoints(id, endpoints)
752 if err != nil {
753 encode(w, r, http.StatusInternalServerError, actOfGodResponse)
754 return
755 }
756 resp := response{
757 Errors: errors,
758 Endpoints: endpoints,
759 }
760 encode(w, r, http.StatusCreated, resp)
761 }
763 func ListEndpointsHandler(w http.ResponseWriter, r *http.Request, c Context) {
764 errors := []requestError{}
765 vars := mux.Vars(r)
766 clientID, err := uuid.Parse(vars["id"])
767 if err != nil {
768 errors = append(errors, requestError{Slug: requestErrInvalidFormat, Param: "client_id"})
769 encode(w, r, http.StatusBadRequest, response{Errors: errors})
770 return
771 }
772 num := defaultEndpointResponseSize
773 offset := 0
774 numStr := r.URL.Query().Get("num")
775 offsetStr := r.URL.Query().Get("offset")
776 if numStr != "" {
777 num, err = strconv.Atoi(numStr)
778 if err != nil {
779 errors = append(errors, requestError{Slug: requestErrInvalidFormat, Param: "num"})
780 }
781 if num > maxEndpointResponseSize {
782 errors = append(errors, requestError{Slug: requestErrOverflow, Param: "num"})
783 }
784 }
785 if offsetStr != "" {
786 offset, err = strconv.Atoi(offsetStr)
787 if err != nil {
788 errors = append(errors, requestError{Slug: requestErrInvalidFormat, Param: "offset"})
789 }
790 }
791 if len(errors) > 0 {
792 encode(w, r, http.StatusBadRequest, response{Errors: errors})
793 return
794 }
795 endpoints, err := c.ListEndpoints(clientID, num, offset)
796 if err != nil {
797 errors = append(errors, requestError{Slug: requestErrActOfGod})
798 encode(w, r, http.StatusInternalServerError, response{Errors: errors})
799 return
800 }
801 resp := response{
802 Endpoints: endpoints,
803 Errors: errors,
804 }
805 encode(w, r, http.StatusOK, resp)
806 }
808 func clientCredentialsValidate(w http.ResponseWriter, r *http.Request, context Context) (scopes []string, profileID uuid.ID, valid bool) {
809 scopes = strings.Split(r.PostFormValue("scope"), " ")
810 valid = true
811 return
812 }
814 func clientCredentialsAuditString(r *http.Request) string {
815 return "client_credentials"
816 }