auth
auth/client.go
Note the potential for CSRF attacks. Our auth provider probably shouldn't have security vulnerabilities. Add TODOs to ensure that logging in and authorizing a grant are not susceptible to CSRF attacks, or it becomes pretty easy for an attacker to gain access to user data or to gain access to a user account.
1 package auth
3 import (
4 "secondbit.org/uuid"
5 )
7 // Client information
8 type Client struct {
9 ID uuid.ID
10 Secret string
11 RedirectURI string
12 OwnerID uuid.ID
13 Name string
14 Logo string
15 }
17 func GetClient(id uuid.ID, ctx Context) (Client, error) {
18 return ctx.Clients.GetClient(id)
19 }
21 func createClient(name, logo, redirectURI string, owner uuid.ID, ctx Context) (Client, error) {
22 return ctx.Clients.CreateClient(name, logo, redirectURI, owner)
23 }
25 func updateClient(client *Client, name, logo, redirectURI *string, ctx Context) error {
26 if client == nil {
27 return NilClientError
28 }
29 err := ctx.Clients.UpdateClient(client.ID, name, logo, redirectURI)
30 if err != nil {
31 return err
32 }
33 if name != nil {
34 client.Name = *name
35 }
36 if logo != nil {
37 client.Logo = *logo
38 }
39 if redirectURI != nil {
40 client.RedirectURI = *redirectURI
41 }
42 return nil
43 }
45 func removeClient(id uuid.ID, ctx Context) error {
46 return ctx.Clients.RemoveClient(id)
47 }
49 func listClients(id uuid.ID, page, num int, ctx Context) ([]Client, error) {
50 return ctx.Clients.ListClients(id, page, num)
51 }