Initial QSfera import

Server/vendor/github.com/libregraph/lico/oidc/payload/endsession.go

@@ -0,0 +1,132 @@
+/*
+ * Copyright 2017-2019 Kopano and its licensors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package payload
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/libregraph/oidc-go"
+
+	konnectoidc "github.com/libregraph/lico/oidc"
+)
+
+// EndSessionRequest holds the incoming parameters and request data for OpenID
+// Connect Session Management 1.0 RP initiaed logout requests as specified at
+// https://openid.net/specs/openid-connect-session-1_0.html#RPLogout
+type EndSessionRequest struct {
+	providerMetadata *oidc.WellKnown
+
+	RawIDTokenHint           string `schema:"id_token_hint"`
+	RawPostLogoutRedirectURI string `schema:"post_logout_redirect_uri"`
+	State                    string `schema:"state"`
+
+	IDTokenHint           *jwt.Token `schema:"-"`
+	PostLogoutRedirectURI *url.URL   `schema:"-"`
+}
+
+// DecodeEndSessionRequest returns a EndSessionRequest holding the
+// provided requests form data.
+func DecodeEndSessionRequest(req *http.Request, providerMetadata *oidc.WellKnown) (*EndSessionRequest, error) {
+	return NewEndSessionRequest(req.Form, providerMetadata)
+}
+
+// NewEndSessionRequest returns a EndSessionRequest holding the
+// provided url values.
+func NewEndSessionRequest(values url.Values, providerMetadata *oidc.WellKnown) (*EndSessionRequest, error) {
+	esr := &EndSessionRequest{
+		providerMetadata: providerMetadata,
+	}
+	err := DecodeSchema(esr, values)
+	if err != nil {
+		return nil, err
+	}
+
+	esr.PostLogoutRedirectURI, _ = url.Parse(esr.RawPostLogoutRedirectURI)
+
+	return esr, nil
+}
+
+// Validate validates the request data of the accociated endSession request.
+func (esr *EndSessionRequest) Validate(keyFunc jwt.Keyfunc) error {
+	if esr.RawIDTokenHint != "" {
+		parser := jwt.NewParser(jwt.WithoutClaimsValidation())
+		idTokenHint, err := parser.ParseWithClaims(esr.RawIDTokenHint, &konnectoidc.IDTokenClaims{}, func(token *jwt.Token) (interface{}, error) {
+			if keyFunc != nil {
+				return keyFunc(token)
+			}
+
+			return nil, fmt.Errorf("Not validated")
+		})
+		if err != nil {
+			return esr.NewBadRequest(oidc.ErrorCodeOAuth2InvalidRequest, err.Error())
+		}
+		esr.IDTokenHint = idTokenHint
+	}
+
+	return nil
+}
+
+// Verify checks that the passed parameters match the accociated requirements.
+func (esr *EndSessionRequest) Verify(userID string) error {
+	if esr.IDTokenHint != nil {
+		// Compare userID with IDTokenHint.
+		if userID != esr.IDTokenHint.Claims.(*konnectoidc.IDTokenClaims).Subject {
+			return esr.NewBadRequest(oidc.ErrorCodeOAuth2InvalidRequest, "userid mismatch")
+		}
+	}
+
+	return nil
+}
+
+// NewError creates a new error with id and string and the associated request's
+// state.
+func (esr *EndSessionRequest) NewError(id string, description string) *AuthenticationError {
+	return &AuthenticationError{
+		ErrorID:          id,
+		ErrorDescription: description,
+		State:            esr.State,
+	}
+}
+
+// NewBadRequest creates a new error with id and string and the associated
+// request's state.
+func (esr *EndSessionRequest) NewBadRequest(id string, description string) *AuthenticationBadRequest {
+	return &AuthenticationBadRequest{
+		ErrorID:          id,
+		ErrorDescription: description,
+		State:            esr.State,
+	}
+}
+
+func (esr *EndSessionRequest) MakeRedirectEndSessionRequestURL() *url.URL {
+	if esr.PostLogoutRedirectURI == nil || esr.PostLogoutRedirectURI.String() == "" {
+		return nil
+	}
+
+	if esr.State == "" {
+		return esr.PostLogoutRedirectURI
+	}
+	uri, _ := url.Parse(esr.PostLogoutRedirectURI.String())
+	query := uri.Query()
+	query.Add("state", esr.State)
+	uri.RawQuery = query.Encode()
+	return uri
+}