VFS_google_oauth2.cpp

Go to the documentation of this file.

 
#include <QUrlQuery>
#include <QNetworkRequest>
 
#include "VFS.h"
#include "VFS_google_oauth2.h"
 
google_oauth2::google_oauth2(QString discovery_uri, QString client_id, QString client_secret, QString redirect_uri, QString tokeninfo_uri, QString hosted_domain, bool debug)
: VFS_auth()
, _debug(debug)
, _client_id(client_id)
, _client_secret(client_secret)
, _redirect_uri(redirect_uri)
, _tokeninfo_uri(tokeninfo_uri)
, _hosted_domain(hosted_domain)
, _discovery_uri(discovery_uri)
//, _discovery_reply(nullptr)
, _manager(this)
, _valid(false)
{
        if (_debug)
        {
                printf("%s\nclient_id: %s\nclient_secret: %s\nredirect_uri: %s\ntokeninfo_uri: %s\n",
                        qUtf8Printable(className()),
                        qUtf8Printable(client_id),
                        qUtf8Printable(client_secret),
                        qUtf8Printable(redirect_uri),
                        qUtf8Printable(tokeninfo_uri)
                );
        }
 
        connect(VFS::root(),SIGNAL(initialized()),this,SLOT(initialize()));
}
 
google_oauth2::~google_oauth2()
{
}
 
void google_oauth2::read(VFS_request *r)
{
        if (_debug)
                printf("OAUTH READ: %s\n",qUtf8Printable(r->_data.toJson()));
 
        if (!_valid)
        {
                //VFS::ERROR( r->_reason = QString("%1 has not initialized.").arg(className()), 0, className() );
                r->_reason = QString("%1 has not initialized.").arg(className());
                r->_success = false;
                return;
        }
 
        QJsonObject d = r->_data.object();
 
        bool auth = r->_path == "";     //if the path is empty we're authenticating.  Otherwise we're just reading the cached data for a user.
 
        if (!auth)
        {
                QString user = r->_path;
 
                QMutexLocker l(&_lock);
 
                if (_userCache.contains(user))
                {
                        r->_data.setObject( _userCache[user] );
                        r->_success = true;
                        return;
                }
                else
                {
                        r->_success = false;
                        r->_reason = "User data is unavailable for '"+user+"'";
                        return;
                }
        }
 
        //QString user = d["username"].toString("");
        //QString pass = d["password"].toString("");
        QString authcode = d["authtokenonce"].toString("");
 
        if (_debug)
                printf("authcode:'%s' auth: %d\n",qUtf8Printable(authcode),auth);
 
        if (authcode.isEmpty())
        {
                r->_reason = "No single use authcode present.";
                r->_success = false;
                return;
        }
 
        //defer the response as if there were a callback.
        r->_isCallback = true;
 
        google_oauth2_auth *a = new google_oauth2_auth(authcode,this);
        connect(a,      SIGNAL(authResult(google_oauth2_auth *)),
                this,   SLOT(authResult(google_oauth2_auth *))  );
 
        _auths[a] = r;
 
        a->authenticate();
}
 
//revoke:
/*
   https://developers.google.com/identity/protocols/oauth2/javascript-implicit-flow#oauth-2.0-endpoints
curl -d -X -POST --header "Content-type:application/x-www-form-urlencoded" \
        https://oauth2.googleapis.com/revoke?token={token}
*/
 
//list:
//https://developers.google.com/admin-sdk/directory/v1/reference/groups/list
 
void google_oauth2::ls(VFS_request *r)
{
        /*
                we need to provide for all users:
                {
                        "username": username,
                        "uidnumber": uid,
                        "realname": realname
                }
        */
/*
        if (_debug)
                printf("filter group: %s\n",qUtf8Printable(_group));
 
        QJsonObject o;
        struct passwd *pw;
 
        setpwent();
        while((pw = getpwent()) != nullptr)
        {
                if (_debug)
                        printf("name=%s uid=%d group=%d real=%s\n",pw->pw_name,pw->pw_uid,pw->pw_gid,pw->pw_gecos);
 
                // kind of inefficient that we have to fetch each user,
                // then fetch all groups for each user,
                // then make sure that user is in the group that we want,
                // but there doesn't seem to be a get all "users in group" mechanism
 
                if (_group.isEmpty() || getGroups(pw).contains(_group))
                {
                        QString username(pw->pw_name);
                        int uidnumber((int)pw->pw_uid);
                        QString realname(pw->pw_gecos);
                        if (realname.isEmpty())
                                realname = username;
 
                        o[username] = QJsonObject {
                                { "username", username },
                                { "uidnumber", uidnumber },
                                { "realname", realname }
                        };
                }
        }
        endpwent();
 
        QJsonObject u = r->_data.object();
        u[r->_initialPath] = o;
        r->_data.setObject(u);
        r->_success = true;
 
        if (_debug)
                printf("USERS: %s",qUtf8Printable( r->_data.toJson() ));
*/
        r->_success = false;
}
 
QString google_oauth2::reportDetails()
{
        return _client_id;
}
 
void google_oauth2::discoverySslErrors(const QList<QSslError> &errors)
{
        for (int i=0;i<errors.size();i++)
                VFS::ERROR( errors.at(i).errorString(), 0, className() );
 
        //discoveryFinished();
        _discovery_reply->deleteLater();
}
 
void google_oauth2::discoveryFinished()
{
        VFS::LOG("Discovery request completed: "+_discovery_reply->url().toString(QUrl::FullyEncoded),9,className());
 
        if (_discovery_reply->error())
        {
                VFS::ERROR( _discovery_reply->errorString(), 0, className() );
                _valid = false;
        }
        else
        {
                QByteArray data = _discovery_reply->readAll();
 
                if (_debug)
                        printf("Discovery response: %s\n",qUtf8Printable(data));
 
                QJsonParseError error;
                QJsonDocument doc = QJsonDocument::fromJson(data,&error);
                if (error.error == QJsonParseError::NoError)
                {
                        _discovery_data = doc.object();
 
                        //confirm the fields we want are there
                        if (    //_discovery_data.contains("authorization_endpoint")    &&
                                _discovery_data.contains("token_endpoint")
                        )
                        {
                                _valid = true;
                        }
                        else
                        {
                                VFS::ERROR( "Discovery response was missing a required field.", 0, className() );
                                _valid = false;
                        }
                }
                else
                {
                        VFS::ERROR( QString("Failed to parse discovery response: '%1' : %2\n%3").arg(_discovery_reply->url().toString()).arg(error.errorString()).arg(QString(data)), 0, className() );
                        _valid = false;
                }
        }
 
        _discovery_reply->deleteLater();
        _discovery_reply = nullptr;
}
 
void google_oauth2::initialize()
{
        //https://developers.google.com/identity/protocols/oauth2/openid-connect#discovery
 
        //fetch the discovery document.  We can't continue until this fetch is complete and successful.
        QNetworkRequest request(_discovery_uri);
        _discovery_reply = _manager.get(request);
 
        connect(        _discovery_reply,       SIGNAL(finished()),
                        this,                   SLOT(discoveryFinished())               );
 
        connect(        _discovery_reply,       SIGNAL(sslErrors(QList<QSslError>)),
                        this,                   SLOT(discoverySslErrors(QList<QSslError>))      );
}
 
void google_oauth2::authResult(google_oauth2_auth *auth)
{
        if (_auths.contains(auth))
        {
                VFS_request *r = _auths.take(auth);
 
                if (auth->_authenticated)
                {
                        QJsonObject d = r->_data.object();
 
                        d["username"] = auth->_username;
                        d["uidnumber"] = auth->_id;
                        d["realname"] = auth->_realname;
                        d["groups"] = auth->_groups;
 
                        _userCache[auth->_username] = d;        //cache the result.  This is a little sloppy, but let's get the car on the road.
 
                        r->_data.setObject(d);
                        r->_success = true;
                }
                else
                {       r->_reason = auth->_reason;
                        r->_success = false;
                }
 
                issueResponse(r);
        }
        else
        {
                VFS::ERROR("Received an auth response but can't associate with a VFS_request.");
        }
}
 
 
 
google_oauth2_auth::google_oauth2_auth(QString authcode, google_oauth2 *auth)
: QObject(auth)
, _auth(auth)
, _authcode(authcode)
//, _csrf(QUuid::createUuid())
, _authenticated(false)
, _reason("Unspecified reason")
, _reply(nullptr)
{
}
 
google_oauth2_auth::~google_oauth2_auth()
{
        if (_reply)
                _reply->deleteLater();
        _reply = nullptr;
}
 
void google_oauth2_auth::authenticate()
{
        QUrlQuery params;
 
        params.addQueryItem( "client_id", _auth->_client_id );
        params.addQueryItem( "client_secret", _auth->_client_secret );
        params.addQueryItem( "grant_type", "authorization_code");
        params.addQueryItem( "code",_authcode );
        params.addQueryItem( "redirect_uri", _auth->_redirect_uri );
 
        QNetworkRequest request(_auth->_discovery_data["token_endpoint"].toString());
        //request.setRawHeader("X-Requested-With",_csrf.toByteArray());
        request.setHeader(QNetworkRequest::ContentTypeHeader, "application/x-www-form-urlencoded");
        //request.setAttribute(QNetworkRequest::RedirectionTargetAttribute ,QNetworkRequest::NoLessSafeRedirectPolicy);
        request.setAttribute(QNetworkRequest::FollowRedirectsAttribute,true);
 
        _reply = _auth->_manager.post(request,params.query().toUtf8());
 
        connect(        _reply, SIGNAL(finished()),
                        this,   SLOT(authResponse())                    );
 
        connect(        _reply, SIGNAL(sslErrors(QList<QSslError>)),
                        this,   SLOT(sslErrors(QList<QSslError>))       );
 
        connect(        _reply, SIGNAL(redirected(const QUrl &)),
                        this,   SLOT(redirected(const QUrl &))          );
}
 
void google_oauth2_auth::redirected(const QUrl &url)
{
        //this is an error url the that developer will need to follow for more information
        printf("REDIRECTED: %s\n",qUtf8Printable(url.toString()));
}
 
void google_oauth2_auth::sslErrors(const QList<QSslError> &errors)
{
        for (int i=0;i<errors.size();i++)
                VFS::ERROR( errors.at(i).errorString(), 0, _auth->className() );
 
        _reply->deleteLater();
        _reply = nullptr;
}
 
void google_oauth2_auth::authResponse()
{
        QByteArray data = _reply->readAll();
 
        if (_auth->_debug)
        {
                //VFS::WARN("Authentication Request completed: "+_reply->url().toString(QUrl::FullyEncoded),9,_auth->className());
                printf( "Authentication Request completed: %s\n", qUtf8Printable(_reply->url().toString(QUrl::FullyEncoded)));
                printf( "Status: %d\n",_reply->error());
 
                printf("\nHeaders:\n");
                const QList<QNetworkReply::RawHeaderPair> headerPairs = _reply->rawHeaderPairs();
                foreach (QNetworkReply::RawHeaderPair h,headerPairs)
                        printf("  %s ::: %s\n", qUtf8Printable(h.first), qUtf8Printable(h.second) );
 
                printf("\nAuthentication response: %s\n",qUtf8Printable(data));
        }
 
        if (_reply->error())
        {
                //VFS::ERROR( _reason = _reply->errorString(), 0, _auth->className() );
                _reason = _reply->errorString();
                _authenticated = false;
        }
        else
        {
//              if (!_reply->hasRawHeader("X-Requested-With") || _reply->rawHeader("X-Requested-With")!=_csrf.toByteArray())
//              {
//                      _authenticated = false;
//                      _reason = "Missing or incorrect header: 'X-Requested-With'";
//              }
//              else
                {
                        //QByteArray data = _reply->readAll();
                        QJsonParseError error;
                        QJsonDocument doc = QJsonDocument::fromJson(data,&error);
 
                        if (error.error == QJsonParseError::NoError)
                        {
                                //free the old one
                                _reply->deleteLater();
                                _reply = nullptr;
 
                                //we should now have something like:
                                //{
                                //  "access_token": "ya29.a0AfH6SMDKdMkGpbcJwonCaqzGu_Sk7ydTsbCHUBg7Fo3YrBUxyqdmgIvacj-6Bp1dnX0uSGa9bz_iIUMR8FDEzZmb_QNU9XtwGnkpzTik3AG-KYB-e1XXEWrWHfdASm-tP3KfLRY3NbyMBPdK1y3h6MZ28HmXPeG0luv5YKMpImwQ",
                                //  "expires_in": 3598,
                                //  "scope": "https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email openid",
                                //  "token_type": "Bearer",
                                //  "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImRlZGMwMTJkMDdmNTJhZWRmZDVmOTc3ODRlMWJjYmUyM2MxOTcyNGQiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJhenAiOiIzNDgyODgxMjk5OTItZTJnbm1sYmVhczhxOG9rZm5tc3Y4ZW50YjB2MGx0dGsuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJhdWQiOiIzNDgyODgxMjk5OTItZTJnbm1sYmVhczhxOG9rZm5tc3Y4ZW50YjB2MGx0dGsuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJzdWIiOiIxMDgwNDMxNzI1MzY3NDM4Nzg4MDAiLCJoZCI6ImV5ZWxhc2guYWkiLCJlbWFpbCI6ImNocmlzQGV5ZWxhc2guYWkiLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwiYXRfaGFzaCI6InJZQnV0RF9LUFNKaS00OW5qLVBXUXciLCJuYW1lIjoiQ2hyaXMgSGVhbGVyIiwicGljdHVyZSI6Imh0dHBzOi8vbGg2Lmdvb2dsZXVzZXJjb250ZW50LmNvbS8tOG5JWjZPcV9fQzgvQUFBQUFBQUFBQUkvQUFBQUFBQUFBQUEvQU1adXVjbDhvcFhtajdrYjZua2Y2MFM5aXE2dUxscHZCUS9zOTYtYy9waG90by5qcGciLCJnaXZlbl9uYW1lIjoiQ2hyaXMiLCJmYW1pbHlfbmFtZSI6IkhlYWxlciIsImxvY2FsZSI6ImVuIiwiaWF0IjoxNjA2MzA2MTYwLCJleHAiOjE2MDYzMDk3NjB9.Zivl6KpdZmZqq36bSl_yXGcxzdEDDsqFLPTZttzwNsERzZw9l5T9zsg7qf3i51u5M5zG1TnkjyqpmZEYLUt3_2FgD_0IyMxSxJpFh1yAWOFZoA_g-8rkrVKVJ9i_8XTb96ZpAfyDCQLVEgAdAj2CEAkNw8BwoaN5M4b6Q4ZvEg5LeSLMSjiai9G4abXOn5rl1Xd6iUn6SKFKORJlaWWGelzB4qHQfUzsHAr5F49rETQZ0Wblde9Y3pYaXYtOH-BRbV2v4VLPateEXTVGM3BbB_CZ2hh0IRHi6w7kvTVwTBIkXjniIurbC_clERN07VVHPnBFEQ-n_msBSPqjyR3a_g"
                                //}
                                QJsonObject d = doc.object();
 
                                _id_token = d["id_token"].toString();
                                _access_token = d["access_token"].toString();
 
                                QNetworkRequest request( _auth->_tokeninfo_uri );       //not provided by discovery, may change, and advised we don't rely on their debug link, but for a small number of users, fuck it.
                                request.setHeader(QNetworkRequest::ContentTypeHeader, "application/x-www-form-urlencoded");
                                //request.setAttribute(QNetworkRequest::RedirectionTargetAttribute ,QNetworkRequest::NoLessSafeRedirectPolicy);
                                request.setAttribute(QNetworkRequest::FollowRedirectsAttribute,true);
 
                                QUrlQuery params;
                                params.addQueryItem("id_token",_id_token);
                                _reply = _auth->_manager.post(request,params.query().toUtf8());
 
                                connect(        _reply, SIGNAL(finished()),
                                                this,   SLOT(tokenResponse())                   );
 
                                connect(        _reply, SIGNAL(sslErrors(QList<QSslError>)),
                                                this,   SLOT(sslErrors(QList<QSslError>))       );
 
                                connect(        _reply, SIGNAL(redirected(const QUrl &)),
                                                this,   SLOT(redirected(const QUrl &))          );
 
                                return;
                        }
                        else
                        {
                                //VFS::ERROR( _reason = QString("Failed to parse authResponse: '%1' : %2\n%3").arg(_reply->url().toString()).arg(error.errorString()).arg(QString(data)), 0, _auth->className() );
                                _reason = QString("Failed to parse authResponse: '%1' : %2\n%3").arg(_reply->url().toString()).arg(error.errorString()).arg(QString(data));
                                _authenticated = false;
                        }
                }
        }
 
        emit authResult(this);
        deleteLater();
}
 
void google_oauth2_auth::tokenResponse()
{
        QByteArray data = _reply->readAll();
 
        if (_auth->_debug)
        {       //VFS::WARN("Tokeninfo Request completed: "+_reply->url().toString(QUrl::FullyEncoded),9,_auth->className());
                printf( "Tokeninfo Request completed: %s\n", qUtf8Printable(_reply->url().toString(QUrl::FullyEncoded)));
                printf( "Status: %d\n",_reply->error());
 
                printf("\nHeaders:\n");
                const QList<QNetworkReply::RawHeaderPair> headerPairs = _reply->rawHeaderPairs();
                foreach (QNetworkReply::RawHeaderPair h,headerPairs)
                        printf("  %s ::: %s\n", qUtf8Printable(h.first), qUtf8Printable(h.second) );
 
                printf("\nAuthentication response: %s\n",qUtf8Printable(data));
        }
 
        if (_reply->error())
        {
                //VFS::ERROR( _reason = _reply->errorString(), 0, _auth->className() );
                _reason = _reply->errorString();
                _authenticated = false;
        }
        else
        {
                QJsonParseError error;
                QJsonDocument doc = QJsonDocument::fromJson(data,&error);
 
                if (error.error == QJsonParseError::NoError)
                {
                        QJsonObject o = doc.object();
 
                        if (o["aud"].toString() == _auth->_client_id)
                        {
                                _authenticated = true;
                                _username = o["email"].toString();
                                _realname = o["name"].toString();
                                _id = o["sub"].toString();
 
                                _groups = QJsonArray();                 //FIXME
                                _groups << "staff";
                        }
                        else
                        {
                                //VFS::ERROR( _reason = QString("Failed to parse tokeninfo response: '%1' : %2\n%3").arg(_reply->url().toString()).arg(error.errorString()).arg(QString(data)), 0, _auth->className() );
                                _reason = "Tokeninfo response did not contain the correct client_id";
                                _authenticated = false;
                        }
                }
                else
                {
                        //VFS::ERROR( _reason = QString("Failed to parse tokeninfo response: '%1' : %2\n%3").arg(_reply->url().toString()).arg(error.errorString()).arg(QString(data)), 0, _auth->className() );
                        _reason = QString("Failed to parse tokeninfo response: '%1' : %2\n%3").arg(_reply->url().toString()).arg(error.errorString()).arg(QString(data));
                        _authenticated = false;
                }
        }
 
        emit authResult(this);
        deleteLater();
}