feat: OAuth 2.0 Device Authorization Grant #2416

client/registry.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/ory/fosite"
 	foauth2 "github.com/ory/fosite/handler/oauth2"
+	"github.com/ory/fosite/handler/rfc8628"
 	"github.com/ory/hydra/v2/jwk"
 	"github.com/ory/hydra/v2/x"
 )
@@ -23,5 +24,6 @@ type Registry interface {
 	ClientHasher() fosite.Hasher
 	OpenIDJWTStrategy() jwk.JWTSigner
 	OAuth2HMACStrategy() *foauth2.HMACSHAStrategy
+	RFC8628HMACStrategy() rfc8628.RFC8628CodeStrategy
 	config.Provider
 }

consent/handler.go

@@ -37,6 +37,7 @@
 	LoginPath    = "/oauth2/auth/requests/login"
 	ConsentPath  = "/oauth2/auth/requests/consent"
 	LogoutPath   = "/oauth2/auth/requests/logout"
+	DevicePath   = "/oauth2/auth/requests/device"
 	SessionsPath = "/oauth2/auth/sessions"
 )
 
@@ -66,6 +67,8 @@
 	admin.GET(LogoutPath, h.getOAuth2LogoutRequest)
 	admin.PUT(LogoutPath+"/accept", h.acceptOAuth2LogoutRequest)
 	admin.PUT(LogoutPath+"/reject", h.rejectOAuth2LogoutRequest)
+
+	admin.PUT(DevicePath+"/verify", h.verifyUserCodeRequest)
 }
 
 // Revoke OAuth 2.0 Consent Session Parameters
@@ -1037,3 +1040,90 @@
 
 	h.r.Writer().Write(w, r, request)
 }
+
+// Verify OAuth 2.0 User Code Request
+//
+// swagger:parameters verifyUserCodeRequest
+type verifyUserCodeRequest struct {
+	// in: query
+	// required: true
+	Challenge string `json:"device_challenge"`
+
+	// in: body
+	Body flow.DeviceGrantVerifyUserCodeRequest
+}
+
+// swagger:route PUT /admin/oauth2/auth/requests/device/verify oAuth2 verifyUserCodeRequest
+//
+// # Verifies a device grant request
+//
+// Verifies a device grant request
+//
+//	Consumes:
+//	- application/json
+//
+//	Produces:
+//	- application/json
+//
+//	Schemes: http, https
+//
+//	Responses:
+//	  200: oAuth2RedirectTo
+//	  default: errorOAuth2
+func (h *Handler) verifyUserCodeRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
+	challenge := stringsx.Coalesce(
+		r.URL.Query().Get("device_challenge"),
+		r.URL.Query().Get("challenge"),
+	)
+	if challenge == "" {
+		h.r.Writer().WriteError(w, r, errorsx.WithStack(fosite.ErrInvalidRequest.WithHint(`Query parameter 'challenge' is not defined but should have been.`)))
+		return
+	}
+
+	var p flow.DeviceGrantVerifyUserCodeRequest
+	d := json.NewDecoder(r.Body)
+	d.DisallowUnknownFields()
+	if err := d.Decode(&p); err != nil {
+		h.r.Writer().WriteError(w, r, errorsx.WithStack(fosite.ErrInvalidRequest.WithWrap(err).WithHintf("Unable to decode body because: %s", err)))
+		return
+	}
+
+	if p.UserCode == "" {
+		h.r.Writer().WriteError(w, r, errorsx.WithStack(fosite.ErrInvalidRequest.WithHint("Field 'user_code' must not be empty.")))
+		return
+	}
+
+	userCodeSignature, err := h.r.RFC8628HMACStrategy().UserCodeSignature(r.Context(), p.UserCode)
+	if err != nil {
+		h.r.Writer().WriteError(w, r, errorsx.WithStack(fosite.ErrServerError.WithWrap(err).WithHint(`'user_code' signature could not be computed`)))
+		return
+	}
+	userCodeRequest, err := h.r.OAuth2Storage().GetUserCodeSession(r.Context(), userCodeSignature, &fosite.DefaultSession{})
+	if err != nil {
+		h.r.Writer().WriteError(w, r, errorsx.WithStack(fosite.ErrNotFound.WithWrap(err).WithHint(`'user_code' session not found`)))
+		return
+	}
+
+	clientId := userCodeRequest.GetClient().GetID()
+	// UserCode & DeviceCode Request shares the same RequestId as it's the same request;
+	deviceRequestId := userCodeRequest.GetID()
+	requestedScopes := userCodeRequest.GetRequestedScopes()
+	requestedAudience := userCodeRequest.GetRequestedAudience()
+
+	err = h.r.OAuth2Storage().InvalidateUserCodeSession(r.Context(), userCodeSignature)
+	if err != nil {
+		h.r.Writer().WriteError(w, r, errorsx.WithStack(fosite.ErrServerError.WithWrap(err).WithHint(`Could not invalidate 'user_code'`)))
+		return
+	}
+
+	// req.GetID() is actually the DeviceCodeSignature
+	grantRequest, err := h.r.ConsentManager().AcceptDeviceGrantRequest(r.Context(), challenge, deviceRequestId, clientId, requestedScopes, requestedAudience)
+	if err != nil {
+		h.r.Writer().WriteError(w, r, errorsx.WithStack(fosite.ErrServerError.WithWrap(err).WithHint(`Could not accept device grant request`)))
+		return
+	}
+
+	h.r.Writer().Write(w, r, &flow.OAuth2RedirectTo{
+		RedirectTo: urlx.SetQuery(h.c.OAuth2DeviceAuthorisationURL(r.Context()), url.Values{"device_verifier": {grantRequest.Verifier}, "client_id": {clientId}}).String(),
+	})
+}

consent/helper.go

@@ -9,7 +9,7 @@ import (
 	"github.com/ory/hydra/v2/flow"
 )
 
-func sanitizeClientFromRequest(ar fosite.AuthorizeRequester) *client.Client {
+func sanitizeClientFromRequest(ar fosite.Requester) *client.Client {
 	return sanitizeClient(ar.GetClient().(*client.Client))
 }
 

consent/manager.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/gofrs/uuid"
 
+	"github.com/ory/fosite"
 	"github.com/ory/hydra/v2/client"
 	"github.com/ory/hydra/v2/flow"
 )
@@ -60,6 +61,11 @@ type (
 		AcceptLogoutRequest(ctx context.Context, challenge string) (*flow.LogoutRequest, error)
 		RejectLogoutRequest(ctx context.Context, challenge string) error
 		VerifyAndInvalidateLogoutRequest(ctx context.Context, verifier string) (*flow.LogoutRequest, error)
+
+		CreateDeviceGrantRequest(ctx context.Context, req *flow.DeviceGrantRequest) error
+		GetDeviceGrantRequestByVerifier(ctx context.Context, verifier string) (*flow.DeviceGrantRequest, error)
+		AcceptDeviceGrantRequest(ctx context.Context, challenge string, device_code_signature string, clientId string, requested_scopes fosite.Arguments, requested_aud fosite.Arguments) (*flow.DeviceGrantRequest, error)
+		VerifyAndInvalidateDeviceGrantRequest(ctx context.Context, verifier string) (*flow.DeviceGrantRequest, error)
 	}
 
 	ManagerProvider interface {

consent/strategy.go

@@ -20,6 +20,12 @@ type Strategy interface {
 		r *http.Request,
 		req fosite.AuthorizeRequester,
 	) (*flow.AcceptOAuth2ConsentRequest, *flow.Flow, error)
+	HandleOAuth2DeviceAuthorizationRequest(
+		ctx context.Context,
+		w http.ResponseWriter,
+		r *http.Request,
+		req fosite.DeviceAuthorizeRequester,
+	) (*flow.AcceptOAuth2ConsentRequest, *flow.Flow, error)
 	HandleOpenIDConnectLogout(ctx context.Context, w http.ResponseWriter, r *http.Request) (*flow.LogoutResult, error)
 	HandleHeadlessLogout(ctx context.Context, w http.ResponseWriter, r *http.Request, sid string) error
 	ObfuscateSubjectIdentifier(ctx context.Context, cl fosite.Client, subject, forcedIdentifier string) (string, error)