Oauth - WIP

CHANGELOG.md

@@ -12,7 +12,17 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Added new feature in license key: `OAUTH`
 - Adds new core config:
     - `oauth_provider_public_service_url`
+    - `oauth_provider_admin_service_url`
+    - `oauth_provider_consent_login_base_url`
+    - `oauth_provider_url_configured_in_hydra`
+- Adds POST `/recipe/oauth/auth` for OAuth2 auth flow support
+- Adds POST `/recipe/oauth/clients` for OAuth2 client registration
+- Adds GET `/recipe/oauth/clients?clientId=example_id` for loading OAuth2 client
+- Adds DELETE `/recipe/oauth/clients` for deleting OAuth2 Clients
+- Creates new table `oauth_clients`
 
+### Migration
+TODO: after plugin support
 
 ## [9.1.1] -2024-07-24
 

config.yaml

@@ -159,3 +159,11 @@ core_config_version: 0
 # (OPTIONAL | Default: null) string value. If specified, the core uses this URL to connect to the OAuth provider admin
 #  service.
 # oauth_provider_admin_service_url:
+
+# (OPTIONAL | Default: http://localhost:3000) string value. If specified, the core uses this URL replace the default
+# consent and login URLs to {apiDomain}.
+# oauth_provider_consent_login_base_url:
+
+# (OPTIONAL | Default: oauth_provider_public_service_url) If specified, the core uses this URL to parse responses from the oauth provider when
+# the oauth provider's internal address differs from the known public provider address.
+# oauth_provider_url_configured_in_hydra:

devConfig.yaml

@@ -158,4 +158,13 @@ disable_telemetry: true
 
 # (OPTIONAL | Default: null) string value. If specified, the core uses this URL to connect to the OAuth provider admin
 #  service.
-# oauth_provider_admin_service_url:
+# oauth_provider_admin_service_url:
+
+
+# (OPTIONAL | Default: http://localhost:3000) string value. If specified, the core uses this URL replace the default
+# consent and login URLs to {apiDomain}.
+# oauth_provider_consent_login_base_url:
+
+# (OPTIONAL | Default: oauth_provider_public_service_url) If specified, the core uses this URL to parse responses from the oauth provider when
+# the oauth provider's internal address differs from the known public provider address.
+# oauth_provider_url_configured_in_hydra:

src/main/java/io/supertokens/config/CoreConfig.java

@@ -41,6 +41,8 @@
 import java.io.File;
 import java.io.IOException;
 import java.lang.reflect.Field;
+import java.net.MalformedURLException;
+import java.net.URL;
 import java.util.*;
 import java.util.regex.PatternSyntaxException;
 
@@ -63,7 +65,9 @@ public class CoreConfig {
             "ip_allow_regex",
             "ip_deny_regex",
             "oauth_provider_public_service_url",
-            "oauth_provider_admin_service_url"
+            "oauth_provider_admin_service_url",
+            "oauth_provider_consent_login_base_url",
+            "oauth_provider_url_configured_in_hydra"
     };
 
     @IgnoreForAnnotationCheck
@@ -275,19 +279,36 @@ public class CoreConfig {
                     " address.")
     private String ip_deny_regex = null;
 
-    @ConfigYamlOnly
+    @NotConflictingInApp
     @JsonProperty
     @HideFromDashboard
     @ConfigDescription(
             "If specified, the core uses this URL to connect to the OAuth provider public service.")
     private String oauth_provider_public_service_url = null;
 
-    @ConfigYamlOnly
+    @NotConflictingInApp
     @JsonProperty
+    @HideFromDashboard
     @ConfigDescription(
             "If specified, the core uses this URL to connect to the OAuth provider admin service.")
     private String oauth_provider_admin_service_url = null;
 
+    @NotConflictingInApp
+    @JsonProperty
+    @HideFromDashboard
+    @ConfigDescription(
+            "If specified, the core uses this URL replace the default consent and login URLs to {apiDomain}. Defaults to 'http://localhost:3000'")
+    private String oauth_provider_consent_login_base_url = "http://localhost:3000";
+
+    @NotConflictingInApp
+    @JsonProperty
+    @HideFromDashboard
+    @ConfigDescription(
+            "If specified, the core uses this URL to parse responses from the oauth provider when the oauth provider's internal address differs from the known public provider address. Defaults to the oauth_provider_public_service_url")
+    private String oauth_provider_url_configured_in_hydra;
+
+
+
     @ConfigYamlOnly
     @JsonProperty
     @ConfigDescription(
@@ -347,6 +368,20 @@ public String getOAuthProviderAdminServiceUrl() throws InvalidConfigException {
         return oauth_provider_admin_service_url;
     }
 
+    public String getOauthProviderConsentLoginBaseUrl() throws InvalidConfigException {
+        if(oauth_provider_consent_login_base_url == null){
+            throw new InvalidConfigException("oauth_provider_consent_login_base_url is not set");
+        }
+        return oauth_provider_consent_login_base_url;
+    }
+
+    public String getOauthProviderUrlConfiguredInHydra() throws InvalidConfigException {
+        if(oauth_provider_url_configured_in_hydra == null) {
+            throw new InvalidConfigException("oauth_provider_url_configured_in_hydra is not set");
+        }
+        return oauth_provider_url_configured_in_hydra;
+    }
+
     public String getIpAllowRegex() {
         return ip_allow_regex;
     }
@@ -833,6 +868,46 @@ void normalizeAndValidate(Main main, boolean includeConfigFilePath) throws Inval
             }
         }
 
+        if(oauth_provider_public_service_url != null) {
+            try {
+                URL url = new URL(oauth_provider_public_service_url);
+            } catch (MalformedURLException malformedURLException){
+                throw new InvalidConfigException("oauth_provider_public_service_url is not a valid URL");
+            }
+        }
+
+        if(oauth_provider_admin_service_url != null) {
+            try {
+                URL url = new URL(oauth_provider_admin_service_url);
+            } catch (MalformedURLException malformedURLException){
+                throw new InvalidConfigException("oauth_provider_admin_service_url is not a valid URL");
+            }
+        }
+
+        if(oauth_provider_consent_login_base_url != null) {
+            try {
+                URL url = new URL(oauth_provider_consent_login_base_url);
+            } catch (MalformedURLException malformedURLException){
+                throw new InvalidConfigException("oauth_provider_consent_login_base_url is not a valid URL");
+            }
+        }
+
+
+        if(oauth_provider_url_configured_in_hydra == null) {
+            oauth_provider_url_configured_in_hydra = oauth_provider_public_service_url;
+        } else {
+            try {
+                URL url = new URL(oauth_provider_url_configured_in_hydra);
+            } catch (MalformedURLException malformedURLException){
+                throw new InvalidConfigException("oauth_provider_url_configured_in_hydra is not a valid URL");
+            }
+        }
+
+        List<String> configsTogetherSet = Arrays.asList(oauth_provider_public_service_url, oauth_provider_admin_service_url, oauth_provider_consent_login_base_url);
+        if(isAnySet(configsTogetherSet) && !isAllSet(configsTogetherSet)) {
+            throw new InvalidConfigException("If any of the following is set, all of them has to be set: oauth_provider_public_service_url, oauth_provider_admin_service_url, oauth_provider_consent_login_base_url");
+        }
+
         isNormalizedAndValid = true;
     }
 
@@ -963,4 +1038,24 @@ void assertThatConfigFromSameAppIdAreNotConflicting(CoreConfig other) throws Inv
     public String getMaxCDIVersion() {
         return this.supertokens_max_cdi_version;
     }
+
+    private boolean isAnySet(List<String> configs){
+        for (String config : configs){
+            if(config!=null){
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private boolean isAllSet(List<String> configs) {
+        boolean foundNotSet = false;
+        for(String config: configs){
+            if(config == null){
+                foundNotSet = true;
+                break;
+            }
+        }
+        return !foundNotSet;
+    }
 }

src/main/java/io/supertokens/httpRequest/HttpRequest.java

@@ -26,6 +26,7 @@
 import java.net.URL;
 import java.net.URLEncoder;
 import java.nio.charset.StandardCharsets;
+import java.util.List;
 import java.util.Map;
 
 public class HttpRequest {
@@ -126,7 +127,7 @@ public static <T> T sendGETRequest(Main main, String requestID, String url, Map<
     public static <T> T sendGETRequestWithResponseHeaders(Main main, String requestID, String url,
                                                           Map<String, String> params,
                                                           int connectionTimeoutMS, int readTimeoutMS, Integer version,
-                                                          Map<String, String> responseHeaders)
+                                                          Map<String, List<String>> responseHeaders, boolean followRedirects)
             throws IOException, HttpResponseException {
         StringBuilder paramBuilder = new StringBuilder();
 
@@ -152,12 +153,12 @@ public static <T> T sendGETRequestWithResponseHeaders(Main main, String requestI
             if (version != null) {
                 con.setRequestProperty("api-version", version + "");
             }
-
+            con.setInstanceFollowRedirects(followRedirects);
             int responseCode = con.getResponseCode();
 
             con.getHeaderFields().forEach((key, value) -> {
                 if (key != null) {
-                    responseHeaders.put(key, value.get(0));
+                    responseHeaders.put(key, value);
                 }
             });
 

src/main/java/io/supertokens/httpRequest/HttpResponseException.java

@@ -21,9 +21,11 @@ public class HttpResponseException extends Exception {
     private static final long serialVersionUID = 1L;
 
     public final int statusCode;
+    public final String rawMessage;
 
     HttpResponseException(int statusCode, String message) {
         super("Http error. Status Code: " + statusCode + ". Message: " + message);
         this.statusCode = statusCode;
+        this.rawMessage = message;
     }
 }

src/main/java/io/supertokens/inmemorydb/Start.java

@@ -55,6 +55,8 @@
 import io.supertokens.pluginInterface.multitenancy.exceptions.DuplicateThirdPartyIdException;
 import io.supertokens.pluginInterface.multitenancy.exceptions.TenantOrAppNotFoundException;
 import io.supertokens.pluginInterface.multitenancy.sqlStorage.MultitenancySQLStorage;
+import io.supertokens.pluginInterface.oauth.exceptions.OAuth2ClientAlreadyExistsForAppException;
+import io.supertokens.pluginInterface.oauth.sqlStorage.OAuthSQLStorage;
 import io.supertokens.pluginInterface.passwordless.PasswordlessCode;
 import io.supertokens.pluginInterface.passwordless.PasswordlessDevice;
 import io.supertokens.pluginInterface.passwordless.exception.*;
@@ -102,7 +104,7 @@ public class Start
         implements SessionSQLStorage, EmailPasswordSQLStorage, EmailVerificationSQLStorage, ThirdPartySQLStorage,
         JWTRecipeSQLStorage, PasswordlessSQLStorage, UserMetadataSQLStorage, UserRolesSQLStorage, UserIdMappingStorage,
         UserIdMappingSQLStorage, MultitenancyStorage, MultitenancySQLStorage, TOTPSQLStorage, ActiveUsersStorage,
-        ActiveUsersSQLStorage, DashboardSQLStorage, AuthRecipeSQLStorage {
+        ActiveUsersSQLStorage, DashboardSQLStorage, AuthRecipeSQLStorage, OAuthSQLStorage {
 
     private static final Object appenderLock = new Object();
     private static final String APP_ID_KEY_NAME = "app_id";
@@ -3007,4 +3009,41 @@ public int countUsersThatHaveMoreThanOneLoginMethodOrTOTPEnabledAndActiveSince(A
             throw new StorageQueryException(e);
         }
     }
+
+    @Override
+    public boolean doesClientIdExistForThisApp(AppIdentifier appIdentifier, String clientId)
+            throws StorageQueryException {
+        try {
+            return OAuthQueries.isClientIdForAppId(this, clientId, appIdentifier);
+        } catch (SQLException e) {
+            throw new StorageQueryException(e);
+        }
+    }
+
+    @Override
+    public void addClientForApp(AppIdentifier appIdentifier, String clientId)
+            throws StorageQueryException, OAuth2ClientAlreadyExistsForAppException {
+        try {
+            OAuthQueries.insertClientIdForAppId(this, clientId, appIdentifier);
+        } catch (SQLException e) {
+
+            SQLiteConfig config = Config.getConfig(this);
+            String serverErrorMessage = e.getMessage();
+
+            if (isPrimaryKeyError(serverErrorMessage, config.getOAuthClientTable(),
+                    new String[]{"app_id", "client_id"})) {
+                throw new OAuth2ClientAlreadyExistsForAppException();
+            }
+            throw new StorageQueryException(e);
+        }
+    }
+
+    @Override
+    public boolean removeAppClientAssociation(AppIdentifier appIdentifier, String clientId) throws StorageQueryException {
+        try {
+            return OAuthQueries.deleteClientIdForAppId(this, clientId, appIdentifier);
+        } catch (SQLException e) {
+            throw new StorageQueryException(e);
+        }
+    }
 }

src/main/java/io/supertokens/inmemorydb/config/SQLiteConfig.java

@@ -164,4 +164,6 @@ public String getDashboardUsersTable() {
     public String getDashboardSessionsTable() {
         return "dashboard_user_sessions";
     }
+
+    public String getOAuthClientTable(){ return "oauth_clients"; }
 }

src/main/java/io/supertokens/inmemorydb/queries/GeneralQueries.java

@@ -423,6 +423,10 @@ public static void createTablesIfNotExists(Start start, Main main) throws SQLExc
             update(start, TOTPQueries.getQueryToCreateUsedCodesExpiryTimeIndex(start), NO_OP_SETTER);
         }
 
+        if (!doesTableExists(start, Config.getConfig(start).getOAuthClientTable())) {
+            getInstance(main).addState(CREATING_NEW_TABLE, null);
+            update(start, OAuthQueries.getQueryToCreateOAuthClientTable(start), NO_OP_SETTER);
+        }
     }
 
 

src/main/java/io/supertokens/inmemorydb/queries/OAuthQueries.java

@@ -0,0 +1,75 @@
+/*
+ *    Copyright (c) 2024, VRAI Labs and/or its affiliates. All rights reserved.
+ *
+ *    This software is licensed under the Apache License, Version 2.0 (the
+ *    "License") as published by the Apache Software Foundation.
+ *
+ *    You may not use this file except in compliance with the License. You may
+ *    obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *    Unless required by applicable law or agreed to in writing, software
+ *    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ *    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ *    License for the specific language governing permissions and limitations
+ *    under the License.
+ */
+
+package io.supertokens.inmemorydb.queries;
+
+import io.supertokens.inmemorydb.Start;
+import io.supertokens.inmemorydb.config.Config;
+import io.supertokens.pluginInterface.exceptions.StorageQueryException;
+import io.supertokens.pluginInterface.multitenancy.AppIdentifier;
+
+import java.sql.ResultSet;
+import java.sql.SQLException;
+
+import static io.supertokens.inmemorydb.QueryExecutorTemplate.execute;
+import static io.supertokens.inmemorydb.QueryExecutorTemplate.update;
+
+public class OAuthQueries {
+
+    public static String getQueryToCreateOAuthClientTable(Start start) {
+        String oAuth2ClientTable = Config.getConfig(start).getOAuthClientTable();
+        // @formatter:off
+        return "CREATE TABLE IF NOT EXISTS " + oAuth2ClientTable + " ("
+                + "app_id VARCHAR(64),"
+                + "client_id VARCHAR(128) NOT NULL,"
+                + " PRIMARY KEY (app_id, client_id),"
+                + " FOREIGN KEY(app_id) REFERENCES " + Config.getConfig(start).getAppsTable() + "(app_id) ON DELETE CASCADE);";
+        // @formatter:on
+    }
+
+    public static boolean isClientIdForAppId(Start start, String clientId, AppIdentifier appIdentifier)
+            throws SQLException, StorageQueryException {
+        String QUERY = "SELECT app_id FROM " + Config.getConfig(start).getOAuthClientTable() +
+            " WHERE client_id = ? AND app_id = ?";
+
+        return execute(start, QUERY, pst -> {
+            pst.setString(1, clientId);
+            pst.setString(2, appIdentifier.getAppId());
+        }, ResultSet::next);
+    }
+
+    public static void insertClientIdForAppId(Start start, String clientId, AppIdentifier appIdentifier)
+            throws SQLException, StorageQueryException {
+        String INSERT = "INSERT INTO " + Config.getConfig(start).getOAuthClientTable()
+                + "(app_id, client_id) VALUES(?, ?)";
+        update(start, INSERT, pst -> {
+            pst.setString(1, appIdentifier.getAppId());
+            pst.setString(2, clientId);
+        });
+    }
+
+    public static boolean deleteClientIdForAppId(Start start, String clientId, AppIdentifier appIdentifier)
+            throws SQLException, StorageQueryException {
+        String DELETE = "DELETE FROM " + Config.getConfig(start).getOAuthClientTable()
+                + " WHERE app_id = ? AND client_id = ?";
+        int numberOfRow = update(start, DELETE, pst -> {
+            pst.setString(1, appIdentifier.getAppId());
+            pst.setString(2, clientId);
+        });
+        return numberOfRow > 0;
+    }
+
+}