lib/popcorn/pop_auth.nit

   1 # This file is part of NIT ( http://www.nitlanguage.org ).
   2 #
   3 # Copyright 2016 Alexandre Terrasa <alexandre@moz-code.org>
   4 #
   5 # Licensed under the Apache License, Version 2.0 (the "License");
   6 # you may not use this file except in compliance with the License.
   7 # You may obtain a copy of the License at
   8 #
   9 #     http://www.apache.org/licenses/LICENSE-2.0
  10 #
  11 # Unless required by applicable law or agreed to in writing, software
  12 # distributed under the License is distributed on an "AS IS" BASIS,
  13 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14 # See the License for the specific language governing permissions and
  15 # limitations under the License.
  16
  17 # Authentification handlers.
  18 #
  19 # For now, only Github OAuth is provided.
  20 #
  21 # See https://developer.github.com/v3/oauth/.
  22 #
  23 # This module provide 4 base classes that can be used together to implement a
  24 # Github OAuth handshake.
  25 #
  26 # Here an example of application using the Github Auth as login mechanism.
  27 #
  28 # There is 4 available routes:
  29 # * `/login`: redirects the user to the Github OAuth login page (see `GithubLogin`)
  30 # * `/profile`: shows the currently logged in user (see `Profile Handler`)
  31 # * `/logout`: logs out the user by destroying the entry from the session (see `GithubLogout`)
  32 # * `/oauth`: callback url for Github service after player login (see `GithubOAuthCallBack`)
  33 #
  34 # Routes redirection are handled at the OAuth service registration. Please see
  35 # https://developer.github.com/v3/oauth/#redirect-urls for more niformation on how
  36 # to configure your service to provide smouth redirections beween your routes.
  37 #
  38 # ~~~
  39 # import popcorn
  40 # import popcorn::pop_auth
  41 #
  42 # class ProfileHandler
  43 #       super Handler
  44 #
  45 #       redef fun get(req, res) do
  46 #               var session = req.session
  47 #               if session == null then
  48 #                       res.send "No session :("
  49 #                       return
  50 #               end
  51 #               var user = session.user
  52 #               if user == null then
  53 #                       res.send "Not logged in"
  54 #                       return
  55 #               end
  56 #               res.send "<h1>Hello {user.login}</h1>"
  57 #       end
  58 # end
  59 #
  60 # var client_id = "github client id"
  61 # var client_secret = "github client secret"
  62 #
  63 # var app = new App
  64 # app.use("/*", new SessionInit)
  65 # app.use("/login", new GithubLogin(client_id))
  66 # app.use("/oauth", new GithubOAuthCallBack(client_id, client_secret))
  67 # app.use("/logout", new GithubLogout)
  68 # app.use("/profile", new ProfileHandler)
  69 # app.listen("localhost", 3000)
  70 # ~~~
  71 #
  72 # Optionaly, you can use the `GithubUser` handler to provide access to the
  73 # Github user stored in session:
  74 #
  75 # ~~~
  76 # app.use("/api/user", new GithubUser)
  77 # ~~~
  78 module pop_auth
  79
  80 import pop_sessions
  81 import github
  82
  83 # Github OAuth login handler.
  84 #
  85 # See https://developer.github.com/v3/oauth/.
  86 class GithubLogin
  87         super Handler
  88
  89         # Client ID delivered by GitHub for your application.
  90         #
  91         # See https://github.com/settings/applications/new.
  92         var client_id: String is writable
  93
  94         # The URL in your application where users will be sent after authorization.
  95         #
  96         # If `null`, the URL used in application registration will be used.
  97         #
  98         # See https://developer.github.com/v3/oauth/#redirect-urls.
  99         var redirect_uri: nullable String = null is writable
 100
 101         # A space delimited list of scopes.
 102         #
 103         # See https://developer.github.com/v3/oauth/#scopes.
 104         var scope: nullable String = null is writable
 105
 106         # An optional and unguessable random string.
 107         #
 108         # It is used to protect against cross-site request forgery attacks.
 109         var state: nullable String = null is writable
 110
 111         # Allow signup at login.
 112         #
 113         # Whether or not unauthenticated users will be offered an option to sign up
 114         # for GitHub during the OAuth flow. The default is true.
 115         #
 116         # Use false in the case that a policy prohibits signups.
 117         var allow_signup = true is writable
 118
 119         # Github OAuth login URL.
 120         var auth_url = "https://github.com/login/oauth/authorize" is writable
 121
 122         # Build Github URL to OAuth service.
 123         fun build_auth_redirect: String do
 124                 var url = "{auth_url}?client_id={client_id}&allow_signup={allow_signup}"
 125                 var redirect_uri = self.redirect_uri
 126                 if redirect_uri != null then url = "{url}&redirect_uri={redirect_uri}"
 127                 var scope = self.scope
 128                 if scope != null then url = "{url}&scope={scope}"
 129                 var state = self.state
 130                 if state != null then url = "{url}&state={state}"
 131                 return url
 132         end
 133
 134         redef fun get(req, res) do res.redirect build_auth_redirect
 135 end
 136
 137 # Get the authentification code and translate it to an access token.
 138 class GithubOAuthCallBack
 139         super Handler
 140
 141         # The client ID delivered by GitHub for your application.
 142         #
 143         # See https://github.com/settings/applications/new.
 144         var client_id: String is writable
 145
 146         # The client secret you received from Github when your registered your application.
 147         var client_secret: String is writable
 148
 149         # The URL in your application where users will be sent after authorization.
 150         #
 151         # If `null`, the URL used in application registration will be used.
 152         #
 153         # See https://developer.github.com/v3/oauth/#redirect-urls.
 154         var redirect_uri: nullable String is writable
 155
 156         # An optional and unguessable random string.
 157         #
 158         # It is used to protect against cross-site request forgery attacks.
 159         var state: nullable String is writable
 160
 161         # Github OAuth token URL.
 162         var token_url = "https://github.com/login/oauth/access_token" is writable
 163
 164         # Header map sent with the OAuth token request.
 165         var headers: HeaderMap do
 166                 var map = new HeaderMap
 167                 map["Accept"] = "application/json"
 168                 return map
 169         end
 170
 171         # Build the OAuth post data.
 172         fun build_auth_body(code: String): HeaderMap do
 173                 var map = new HeaderMap
 174                 map["client_id"] = client_id
 175                 map["client_secret"] = client_secret
 176                 map["code"] = code
 177                 var redirect_uri = self.redirect_uri
 178                 if redirect_uri != null then map["redirect_uri"] = redirect_uri
 179                 var state = self.state
 180                 if state != null then map["state"] = state
 181                 return map
 182         end
 183
 184         redef fun get(req, res) do
 185                 # Get OAuth code
 186                 var code = req.string_arg("code")
 187                 if code == null then
 188                         res.error 401
 189                         return
 190                 end
 191
 192                 # Exchange it for an access token
 193                 var access_token = request_access_token(code)
 194                 if access_token == null then
 195                         res.error 401
 196                         return
 197                 end
 198
 199                 # FIXME reinit curl before next request to avoid weird 404
 200                 curl = new Curl
 201
 202                 # Load github user
 203                 var gh_api = new GithubAPI(access_token)
 204                 var user = gh_api.load_auth_user
 205                 if user == null then
 206                         res.error 401
 207                         return
 208                 end
 209                 # Set session and redirect to user page
 210                 var session = req.session
 211                 if session == null then
 212                         res.error 500
 213                         return
 214                 end
 215                 session.user = user
 216                 res.redirect redirect_uri or else "/"
 217         end
 218
 219         # Request an access token from an access `code`.
 220         private fun request_access_token(code: String): nullable String do
 221                 var request = new CurlHTTPRequest(token_url)
 222                 request.headers = headers
 223                 request.data = build_auth_body(code)
 224                 var response = request.execute
 225                 return parse_token_response(response)
 226         end
 227
 228         # Parse the Github access_token response and extract the access_token.
 229         private fun parse_token_response(response: CurlResponse): nullable String do
 230                 if response isa CurlResponseFailed then
 231                         print "Request to Github OAuth failed"
 232                         print "Requested URI: {token_url}"
 233                         print "Error code: {response.error_code}"
 234                         print "Error msg: {response.error_msg}"
 235                         return null
 236                 else if response isa CurlResponseSuccess then
 237                         var obj = response.body_str.parse_json
 238                         if not obj isa JsonObject then
 239                                 print "Error: Cannot parse json response"
 240                                 print response.body_str
 241                                 return null
 242                         end
 243                         var access_token = obj.get_or_null("access_token")
 244                         if not access_token isa String then
 245                                 print "Error: No `access_token` key in response"
 246                                 print obj.to_json
 247                                 return null
 248                         end
 249                         return access_token
 250                 end
 251                 return null
 252         end
 253 end
 254
 255 # Destroy user session and redirect to homepage.
 256 class GithubLogout
 257         super Handler
 258
 259         # The URL in your application where users will be sent after logout.
 260         #
 261         # If `null`, the root uri `/` will be used.
 262         var redirect_uri: nullable String is writable
 263
 264         redef fun get(req, res) do
 265                 var session = req.session
 266                 if session != null then
 267                         session.user = null
 268                 end
 269                 res.redirect redirect_uri or else "/"
 270         end
 271 end
 272
 273 # AuthHandler allows access to session user
 274 #
 275 # Inherit this handler to access to session user from your custom handler.
 276 #
 277 # For example, you need a profile handler that checks if the user is logged
 278 # before returning it in json format.
 279 # ~~~
 280 # import popcorn::pop_auth
 281 #
 282 # class ProfileHandler
 283 #       super AuthHandler
 284 #
 285 #       redef fun get(req, res) do
 286 #               var user = check_session_user(req, res)
 287 #               if user == null then return
 288 #               res.json user
 289 #       end
 290 # end
 291 # ~~~
 292 #
 293 # By using `check_session_user`, we delegate to the `AuthHandler` the responsability
 294 # to set the HTTP 403 error.
 295 # We then check is the user is not null before pursuing.
 296 abstract class AuthHandler
 297         super Handler
 298
 299         # Returns `user` from `req.session` or null if no user is authenticated.
 300         fun session_user(req: HttpRequest): nullable User do
 301                 var session = req.session
 302                 if session == null then return null
 303                 var user = session.user
 304                 return user
 305         end
 306
 307         # Check the session for user and return it.
 308         #
 309         # If no `user` can be found in session, set res as a HTTP 403 error and return `null`.
 310         fun check_session_user(req: HttpRequest, res: HttpResponse): nullable User do
 311                 var user = session_user(req)
 312                 if user == null then
 313                         res.error 403
 314                 end
 315                 return user
 316         end
 317 end
 318
 319 # Get the currently logged in user from session.
 320 class GithubUser
 321         super AuthHandler
 322
 323         redef fun get(req, res) do
 324                 var user = check_session_user(req, res)
 325                 if user == null then return
 326                 res.json user
 327         end
 328 end
 329
 330 redef class Session
 331
 332         # Github user if logged in.
 333         var user: nullable User = null is writable
 334 end