Initial QSfera import

Server/services/webfinger/pkg/relations/openid_discovery.go

@@ -0,0 +1,50 @@
+package relations
+
+import (
+	"context"
+
+	"github.com/qsfera/server/services/webfinger/pkg/config"
+	"github.com/qsfera/server/services/webfinger/pkg/service/v0"
+	"github.com/qsfera/server/services/webfinger/pkg/webfinger"
+)
+
+const (
+	OpenIDConnectRel   = "http://openid.net/specs/connect/1.0/issuer"
+	clientIDProp       = "http://qsfera.eu/ns/oidc/client_id"
+	scopesProp         = "http://qsfera.eu/ns/oidc/scopes"
+	legacyClientIDProp = "http://opencloud.eu/ns/oidc/client_id"
+	legacyScopesProp   = "http://opencloud.eu/ns/oidc/scopes"
+)
+
+type openIDDiscovery struct {
+	Href        string
+	OIDCClients map[string]config.OIDCClientConfig
+}
+
+// OpenIDDiscovery adds the Openid Connect issuer relation
+func OpenIDDiscovery(href string, clients map[string]config.OIDCClientConfig) service.RelationProvider {
+	return &openIDDiscovery{
+		Href:        href,
+		OIDCClients: clients,
+	}
+}
+
+func (l *openIDDiscovery) Add(_ context.Context, platform string, jrd *webfinger.JSONResourceDescriptor) {
+	if jrd == nil {
+		jrd = &webfinger.JSONResourceDescriptor{}
+	}
+	jrd.Links = append(jrd.Links, webfinger.Link{
+		Rel:  OpenIDConnectRel,
+		Href: l.Href,
+	})
+
+	if platform != "" {
+		if clientConfig, ok := l.OIDCClients[platform]; ok {
+			jrd.Properties = make(map[string]any)
+			jrd.Properties[clientIDProp] = clientConfig.ClientID
+			jrd.Properties[scopesProp] = clientConfig.Scopes
+			jrd.Properties[legacyClientIDProp] = clientConfig.ClientID
+			jrd.Properties[legacyScopesProp] = clientConfig.Scopes
+		}
+	}
+}

Server/services/webfinger/pkg/relations/openid_discovery_test.go

@@ -0,0 +1,59 @@
+package relations
+
+import (
+	"context"
+	"testing"
+
+	"github.com/qsfera/server/services/webfinger/pkg/config"
+	"github.com/qsfera/server/services/webfinger/pkg/webfinger"
+)
+
+func TestOpenidDiscovery(t *testing.T) {
+	clients := map[string]config.OIDCClientConfig{
+		"web": {
+			ClientID: "web",
+			Scopes:   []string{"openid", "profile", "email"},
+		},
+		"test": {
+			ClientID: "test",
+			Scopes:   []string{"test"},
+		},
+	}
+
+	provider := OpenIDDiscovery("http://issuer.url", clients)
+
+	jrd := webfinger.JSONResourceDescriptor{}
+
+	provider.Add(context.Background(), "", &jrd)
+
+	if len(jrd.Links) != 1 {
+		t.Errorf("provider returned wrong number of links: %v, expected 1", len(jrd.Links))
+	}
+	if jrd.Links[0].Href != "http://issuer.url" {
+		t.Errorf("provider returned wrong issuer link href: %v, expected %v", jrd.Links[0].Href, "http://issuer.url")
+	}
+	if jrd.Links[0].Rel != "http://openid.net/specs/connect/1.0/issuer" {
+		t.Errorf("provider returned wrong openid connect rel: %v, expected %v", jrd.Links[0].Href, OpenIDConnectRel)
+	}
+	if len(jrd.Properties) != 0 {
+		t.Errorf("provider returned properties for empty platform: %v, expected 0", len(jrd.Properties))
+	}
+
+	jrd = webfinger.JSONResourceDescriptor{}
+	provider.Add(context.Background(), "test", &jrd)
+	if len(jrd.Properties) != 4 {
+		t.Errorf("provider returned wrong number of properties for platform test: %v, expected 4", len(jrd.Properties))
+	}
+	if jrd.Properties["http://qsfera.eu/ns/oidc/client_id"] != "test" {
+		t.Errorf("provider returned wrong client_id property: %v, expected %v", jrd.Properties["http://qsfera.eu/ns/oidc/client_id"], "test")
+	}
+	if scopes, ok := jrd.Properties["http://qsfera.eu/ns/oidc/scopes"].([]string); !ok || len(scopes) != 1 || scopes[0] != "test" {
+		t.Errorf("provider returned wrong scopes property: %v, expected %v", jrd.Properties["http://qsfera.eu/ns/oidc/scopes"], []string{"test"})
+	}
+	if jrd.Properties["http://opencloud.eu/ns/oidc/client_id"] != "test" {
+		t.Errorf("provider returned wrong legacy client_id property: %v, expected %v", jrd.Properties["http://opencloud.eu/ns/oidc/client_id"], "test")
+	}
+	if scopes, ok := jrd.Properties["http://opencloud.eu/ns/oidc/scopes"].([]string); !ok || len(scopes) != 1 || scopes[0] != "test" {
+		t.Errorf("provider returned wrong legacy scopes property: %v, expected %v", jrd.Properties["http://opencloud.eu/ns/oidc/scopes"], []string{"test"})
+	}
+}

Server/services/webfinger/pkg/relations/qsfera_instance.go

@@ -0,0 +1,88 @@
+package relations
+
+import (
+	"context"
+	"net/url"
+	"regexp"
+	"strings"
+	"text/template"
+
+	"github.com/qsfera/server/pkg/oidc"
+	"github.com/qsfera/server/services/webfinger/pkg/config"
+	"github.com/qsfera/server/services/webfinger/pkg/service/v0"
+	"github.com/qsfera/server/services/webfinger/pkg/webfinger"
+)
+
+const (
+	QsferaInstanceRel = "http://webfinger.qsfera/rel/server-instance"
+)
+
+type compiledInstance struct {
+	config.Instance
+	compiledRegex *regexp.Regexp
+	hrefTemplate  *template.Template
+}
+
+type qsferaInstance struct {
+	instances    []compiledInstance
+	qsferaURL    string
+	instanceHost string
+}
+
+// QsferaInstance adds one or more КуСфера instance relations
+func QsferaInstance(instances []config.Instance, qsferaURL string) (service.RelationProvider, error) {
+	compiledInstances := make([]compiledInstance, 0, len(instances))
+	var err error
+	for _, instance := range instances {
+		compiled := compiledInstance{Instance: instance}
+		compiled.compiledRegex, err = regexp.Compile(instance.Regex)
+		if err != nil {
+			return nil, err
+		}
+		compiled.hrefTemplate, err = template.New(instance.Claim + ":" + instance.Regex + ":" + instance.Href).Parse(instance.Href)
+		if err != nil {
+			return nil, err
+		}
+		compiledInstances = append(compiledInstances, compiled)
+	}
+
+	u, err := url.Parse(qsferaURL)
+	if err != nil {
+		return nil, err
+	}
+	return &qsferaInstance{
+		instances:    compiledInstances,
+		qsferaURL:    qsferaURL,
+		instanceHost: u.Host + u.Path,
+	}, nil
+}
+
+func (l *qsferaInstance) Add(ctx context.Context, _ string, jrd *webfinger.JSONResourceDescriptor) {
+	if jrd == nil {
+		jrd = &webfinger.JSONResourceDescriptor{}
+	}
+	if claims := oidc.FromContext(ctx); claims != nil {
+		if value, ok := claims[oidc.PreferredUsername].(string); ok {
+			jrd.Subject = "acct:" + value + "@" + l.instanceHost
+		} else if value, ok := claims[oidc.Email].(string); ok {
+			jrd.Subject = "mailto:" + value
+		}
+		// allow referencing QSFERA_URL in the template
+		claims["QSFERA_URL"] = l.qsferaURL
+		claims["OC_URL"] = l.qsferaURL
+		for _, instance := range l.instances {
+			if value, ok := claims[instance.Claim].(string); ok && instance.compiledRegex.MatchString(value) {
+				var tmplWriter strings.Builder
+				instance.hrefTemplate.Execute(&tmplWriter, claims)
+				jrd.Links = append(jrd.Links, webfinger.Link{
+					Rel:    QsferaInstanceRel,
+					Href:   tmplWriter.String(),
+					Titles: instance.Titles,
+				})
+				if instance.Break {
+					break
+				}
+			}
+		}
+	}
+}

Server/services/webfinger/pkg/relations/qsfera_instance_test.go

@@ -0,0 +1,65 @@
+package relations
+
+import (
+	"context"
+	"testing"
+
+	"github.com/qsfera/server/pkg/oidc"
+	"github.com/qsfera/server/services/webfinger/pkg/config"
+	"github.com/qsfera/server/services/webfinger/pkg/webfinger"
+)
+
+func TestQsferaInstanceErr(t *testing.T) {
+	_, err := QsferaInstance([]config.Instance{}, "http://\n\rinvalid")
+	if err == nil {
+		t.Errorf("provider did not err on invalid url: %v", err)
+	}
+	_, err = QsferaInstance([]config.Instance{{Regex: "("}}, "http://qsfera.tld")
+	if err == nil {
+		t.Errorf("provider did not err on invalid regex: %v", err)
+	}
+	_, err = QsferaInstance([]config.Instance{{Href: "{{invalid}}ee"}}, "http://qsfera.tld")
+	if err == nil {
+		t.Errorf("provider did not err on invalid href template: %v", err)
+	}
+}
+
+func TestQsferaInstanceAddLink(t *testing.T) {
+	provider, err := QsferaInstance([]config.Instance{{
+		Claim: "customclaim",
+		Regex: ".+@.+\\..+",
+		Href:  "https://{{.otherclaim}}.domain.tld",
+		Titles: map[string]string{
+			"foo": "bar",
+		},
+		Break: true,
+	}}, "http://qsfera.tld")
+	if err != nil {
+		t.Error(err)
+	}
+
+	ctx := context.Background()
+	ctx = oidc.NewContext(ctx, map[string]any{
+		"customclaim": "some@fizz.buzz",
+		"otherclaim":  "someone",
+	})
+	jrd := webfinger.JSONResourceDescriptor{}
+	provider.Add(ctx, "", &jrd)
+
+	if len(jrd.Links) != 1 {
+		t.Errorf("provider returned wrong number of links: %v, expected 1", len(jrd.Links))
+	}
+	if jrd.Links[0].Href != "https://someone.domain.tld" {
+		t.Errorf("provider returned wrong issuer link href: %v, expected %v", jrd.Links[0].Href, "https://someone.domain.tld")
+	}
+	if jrd.Links[0].Rel != QsferaInstanceRel {
+		t.Errorf("provider returned qsfera server instance rel: %v, expected %v", jrd.Links[0].Rel, QsferaInstanceRel)
+	}
+	if len(jrd.Links[0].Titles) != 1 {
+		t.Errorf("provider returned wrong number of titles: %v, expected 1", len(jrd.Links[0].Titles))
+	}
+	if jrd.Links[0].Titles["foo"] != "bar" {
+		t.Errorf("provider returned wrong title: %v, expected bar", len(jrd.Links[0].Titles["foo"]))
+	}
+
+}