commit 89013a78a2b75e58225f790f182b3f8b554deea3 · hailey.at/cocoon

+1 -1

identity/types.go

···

       4
       4
        
       	Context             []string                   `json:"@context"`

     

       5
       5
        
       	Id                  string                     `json:"id"`

     

       6
       6
        
       	AlsoKnownAs         []string                   `json:"alsoKnownAs"`

     

       7
       7
       -
       	VerificationMethods []DidDocVerificationMethod `json:"verificationMethods"`

     

       7
       7
       +
       	VerificationMethods []DidDocVerificationMethod `json:"verificationMethod"`

     

       8
       8
        
       	Service             []DidDocService            `json:"service"`

     

       9
       9
        
       }

     

       10
       10

internal/db/db.go

···

       25
       25
        
       	return db.cli.Clauses(clauses...).Create(value)

     

       26
       26
        
       }

     

       27
       27
        
       

     

       28
       28
       +
       func (db *DB) Save(value any, clauses []clause.Expression) *gorm.DB {

     

       29
       29
       +
       	db.mu.Lock()

     

       30
       30
       +
       	defer db.mu.Unlock()

     

       31
       31
       +
       	return db.cli.Clauses(clauses...).Save(value)

     

       32
       32
       +
       }

     

       33
       33
       +
       

     

       28
       34
        
       func (db *DB) Exec(sql string, clauses []clause.Expression, values ...any) *gorm.DB {

     

       29
       35
        
       	db.mu.Lock()

     

       30
       36
        
       	defer db.mu.Unlock()

+16

internal/helpers/helpers.go

···

       32
       32
        
       	return genericError(e, 400, msg)

     

       33
       33
        
       }

     

       34
       34
        
       

     

       35
       35
       +
       func UnauthorizedError(e echo.Context, suffix *string) error {

     

       36
       36
       +
       	msg := "Unauthorized"

     

       37
       37
       +
       	if suffix != nil {

     

       38
       38
       +
       		msg += ". " + *suffix

     

       39
       39
       +
       	}

     

       40
       40
       +
       	return genericError(e, 401, msg)

     

       41
       41
       +
       }

     

       42
       42
       +
       

     

       43
       43
       +
       func ForbiddenError(e echo.Context, suffix *string) error {

     

       44
       44
       +
       	msg := "Forbidden"

     

       45
       45
       +
       	if suffix != nil {

     

       46
       46
       +
       		msg += ". " + *suffix

     

       47
       47
       +
       	}

     

       48
       48
       +
       	return genericError(e, 403, msg)

     

       49
       49
       +
       }

     

       50
       50
       +
       

     

       35
       51
        
       func InvalidTokenError(e echo.Context) error {

     

       36
       52
        
       	return InputError(e, to.StringPtr("InvalidToken"))

     

       37
       53
        
       }

+45 -35

server/handle_server_create_account.go

···

       10
       10
        
       	"github.com/Azure/go-autorest/autorest/to"

     

       11
       11
        
       	"github.com/bluesky-social/indigo/api/atproto"

     

       12
       12
        
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       13
       13
       -
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       14
       13
        
       	"github.com/bluesky-social/indigo/events"

     

       15
       14
        
       	"github.com/bluesky-social/indigo/repo"

     

       16
       15
        
       	"github.com/bluesky-social/indigo/util"

     
···

       39
       38
        
       func (s *Server) handleCreateAccount(e echo.Context) error {

     

       40
       39
        
       	var request ComAtprotoServerCreateAccountRequest

     

       41
       40
        
       

     

       42
       42
       -
       	var signupDid string

     

       43
       43
       -
       	customDidHeader := e.Request().Header.Get("authorization")

     

       44
       44
       -
       	if customDidHeader != "" {

     

       45
       45
       -
       		pts := strings.Split(customDidHeader, " ")

     

       46
       46
       -
       		if len(pts) != 2 {

     

       47
       47
       -
       			return helpers.InputError(e, to.StringPtr("InvalidDid"))

     

       48
       48
       -
       		}

     

       49
       49
       -
       

     

       50
       50
       -
       		_, err := syntax.ParseDID(pts[1])

     

       51
       51
       -
       		if err != nil {

     

       52
       52
       -
       			return helpers.InputError(e, to.StringPtr("InvalidDid"))

     

       53
       53
       -
       		}

     

       54
       54
       -
       

     

       55
       55
       -
       		signupDid = pts[1]

     

       56
       56
       -
       	}

     

       57
       57
       -
       

     

       58
       41
        
       	if err := e.Bind(&request); err != nil {

     

       59
       42
        
       		s.logger.Error("error receiving request", "endpoint", "com.atproto.server.createAccount", "error", err)

     

       60
       43
        
       		return helpers.ServerError(e, nil)

     
···

       85
       68
        
       			}

     

       86
       69
        
       		}

     

       87
       70
        
       	}

     

       71
       71
       +
       	

     

       72
       72
       +
       	var signupDid string

     

       73
       73
       +
       	if request.Did != nil {

     

       74
       74
       +
       		signupDid = *request.Did;

     

       75
       75
       +
       		

     

       76
       76
       +
       		token := strings.TrimSpace(strings.Replace(e.Request().Header.Get("authorization"), "Bearer ", "", 1))

     

       77
       77
       +
       		if token == "" {

     

       78
       78
       +
       			return helpers.UnauthorizedError(e, to.StringPtr("must authenticate to use an existing did"))

     

       79
       79
       +
       		}

     

       80
       80
       +
       		authDid, err := s.validateServiceAuth(e.Request().Context(), token, "com.atproto.server.createAccount")

     

       81
       81
       +
       

     

       82
       82
       +
       		if err != nil {

     

       83
       83
       +
       			s.logger.Warn("error validating authorization token", "endpoint", "com.atproto.server.createAccount", "error", err)

     

       84
       84
       +
       			return helpers.UnauthorizedError(e, to.StringPtr("invalid authorization token"))

     

       85
       85
       +
       		}

     

       86
       86
       +
       

     

       87
       87
       +
       		if authDid != signupDid {

     

       88
       88
       +
       			return helpers.ForbiddenError(e, to.StringPtr("auth did did not match signup did"))

     

       89
       89
       +
       		}

     

       90
       90
       +
       	}

     

       88
       91
        
       

     

       89
       92
        
       	// see if the handle is already taken

     

       90
       90
       -
       	_, err := s.getActorByHandle(request.Handle)

     

       93
       93
       +
       	actor, err := s.getActorByHandle(request.Handle)

     

       91
       94
        
       	if err != nil && err != gorm.ErrRecordNotFound {

     

       92
       95
        
       		s.logger.Error("error looking up handle in db", "endpoint", "com.atproto.server.createAccount", "error", err)

     

       93
       96
        
       		return helpers.ServerError(e, nil)

     

       94
       97
        
       	}

     

       95
       95
       -
       	if err == nil {

     

       98
       98
       +
       	if err == nil && actor.Did != signupDid {

     

       96
       99
        
       		return helpers.InputError(e, to.StringPtr("HandleNotAvailable"))

     

       97
       100
        
       	}

     

       98
       101
        
       

     

       99
       99
       -
       	if did, err := s.passport.ResolveHandle(e.Request().Context(), request.Handle); err == nil && did != "" {

     

       102
       102
       +
       	if did, err := s.passport.ResolveHandle(e.Request().Context(), request.Handle); err == nil && did != signupDid {

     

       100
       103
        
       		return helpers.InputError(e, to.StringPtr("HandleNotAvailable"))

     

       101
       104
        
       	}

     

       102
       105
        
       

     
···

       114
       117
        
       	}

     

       115
       118
        
       

     

       116
       119
        
       	// see if the email is already taken

     

       117
       117
       -
       	_, err = s.getRepoByEmail(request.Email)

     

       120
       120
       +
       	existingRepo, err := s.getRepoByEmail(request.Email)

     

       118
       121
        
       	if err != nil && err != gorm.ErrRecordNotFound {

     

       119
       122
        
       		s.logger.Error("error looking up email in db", "endpoint", "com.atproto.server.createAccount", "error", err)

     

       120
       123
        
       		return helpers.ServerError(e, nil)

     

       121
       124
        
       	}

     

       122
       122
       -
       	if err == nil {

     

       125
       125
       +
       	if err == nil && existingRepo.Did != signupDid {

     

       123
       126
        
       		return helpers.InputError(e, to.StringPtr("EmailNotAvailable"))

     

       124
       127
        
       	}

     

       125
       128
        
       

     
···

       160
       163
        
       		SigningKey:            k.Bytes(),

     

       161
       164
        
       	}

     

       162
       165
        
       

     

       163
       163
       -
       	actor := models.Actor{

     

       164
       164
       -
       		Did:    signupDid,

     

       165
       165
       -
       		Handle: request.Handle,

     

       166
       166
       -
       	}

     

       167
       167
       -
       

     

       168
       168
       -
       	if err := s.db.Create(&urepo, nil).Error; err != nil {

     

       169
       169
       -
       		s.logger.Error("error inserting new repo", "error", err)

     

       170
       170
       -
       		return helpers.ServerError(e, nil)

     

       171
       171
       -
       	}

     

       166
       166
       +
       	if actor == nil {

     

       167
       167
       +
       		actor = &models.Actor{

     

       168
       168
       +
       			Did:    signupDid,

     

       169
       169
       +
       			Handle: request.Handle,

     

       170
       170
       +
       		}

     

       172
       171
        
       

     

       173
       173
       -
       	if err := s.db.Create(&actor, nil).Error; err != nil {

     

       174
       174
       -
       		s.logger.Error("error inserting new actor", "error", err)

     

       175
       175
       -
       		return helpers.ServerError(e, nil)

     

       172
       172
       +
       		if err := s.db.Create(&urepo, nil).Error; err != nil {

     

       173
       173
       +
       			s.logger.Error("error inserting new repo", "error", err)

     

       174
       174
       +
       			return helpers.ServerError(e, nil)

     

       175
       175
       +
       		}

     

       176
       176
       +
       	

     

       177
       177
       +
       		if err := s.db.Create(&actor, nil).Error; err != nil {

     

       178
       178
       +
       			s.logger.Error("error inserting new actor", "error", err)

     

       179
       179
       +
       			return helpers.ServerError(e, nil)

     

       180
       180
       +
       		}

     

       181
       181
       +
       	} else {

     

       182
       182
       +
       		if err := s.db.Save(&actor, nil).Error; err != nil {

     

       183
       183
       +
       			s.logger.Error("error inserting new actor", "error", err)

     

       184
       184
       +
       			return helpers.ServerError(e, nil)

     

       185
       185
       +
       		}

     

       176
       186
        
       	}

     

       177
       187
        
       

     

       178
       178
       -
       	if customDidHeader == "" {

     

       188
       188
       +
       	if request.Did == nil || *request.Did == "" {

     

       179
       189
        
       		bs := s.getBlockstore(signupDid)

     

       180
       190
        
       		r := repo.NewRepo(context.TODO(), signupDid, bs)

     

       181
       191

-1

server/server.go

···

       423
       423
        
       	// public

     

       424
       424
        
       	s.echo.GET("/xrpc/com.atproto.identity.resolveHandle", s.handleResolveHandle)

     

       425
       425
        
       	s.echo.POST("/xrpc/com.atproto.server.createAccount", s.handleCreateAccount)

     

       426
       426
       -
       	s.echo.POST("/xrpc/com.atproto.server.createAccount", s.handleCreateAccount)

     

       427
       426
        
       	s.echo.POST("/xrpc/com.atproto.server.createSession", s.handleCreateSession)

     

       428
       427
        
       	s.echo.GET("/xrpc/com.atproto.server.describeServer", s.handleDescribeServer)

     

       429
       428

+91

server/service_auth.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"fmt"

     

       6
       6
       +
       	"strings"

     

       7
       7
       +
       

     

       8
       8
       +
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       9
       9
       +
       	"github.com/bluesky-social/indigo/atproto/identity"

     

       10
       10
       +
       	atproto_identity "github.com/bluesky-social/indigo/atproto/identity"

     

       11
       11
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       12
       12
       +
       	"github.com/golang-jwt/jwt/v4"

     

       13
       13
       +
       )

     

       14
       14
       +
       

     

       15
       15
       +
       type ES256KSigningMethod struct {

     

       16
       16
       +
       	alg string

     

       17
       17
       +
       }

     

       18
       18
       +
       

     

       19
       19
       +
       func (m *ES256KSigningMethod) Alg() string {

     

       20
       20
       +
       	return m.alg

     

       21
       21
       +
       }

     

       22
       22
       +
       

     

       23
       23
       +
       func (m *ES256KSigningMethod) Verify(signingString string, signature string, key interface{}) error {

     

       24
       24
       +
       	signatureBytes, err := jwt.DecodeSegment(signature)

     

       25
       25
       +
       	if err != nil {

     

       26
       26
       +
       		return err

     

       27
       27
       +
       	}

     

       28
       28
       +
       	return key.(atcrypto.PublicKey).HashAndVerifyLenient([]byte(signingString), signatureBytes)

     

       29
       29
       +
       }

     

       30
       30
       +
       

     

       31
       31
       +
       func (m *ES256KSigningMethod) Sign(signingString string, key interface{}) (string, error) {

     

       32
       32
       +
       	return "", fmt.Errorf("unimplemented")

     

       33
       33
       +
       }

     

       34
       34
       +
       

     

       35
       35
       +
       func init() {

     

       36
       36
       +
       	ES256K := ES256KSigningMethod{alg: "ES256K"}

     

       37
       37
       +
       	jwt.RegisterSigningMethod(ES256K.Alg(), func() jwt.SigningMethod {

     

       38
       38
       +
       		return &ES256K

     

       39
       39
       +
       	})

     

       40
       40
       +
       }

     

       41
       41
       +
       

     

       42
       42
       +
       func (s *Server) validateServiceAuth(ctx context.Context, rawToken string, nsid string) (string, error) {

     

       43
       43
       +
       	token := strings.TrimSpace(rawToken)

     

       44
       44
       +
       

     

       45
       45
       +
       	parsedToken, err := jwt.ParseWithClaims(token, jwt.MapClaims{}, func(token *jwt.Token) (interface{}, error) {

     

       46
       46
       +
       		did := syntax.DID(token.Claims.(jwt.MapClaims)["iss"].(string))

     

       47
       47
       +
       		didDoc, err := s.passport.FetchDoc(ctx, did.String());

     

       48
       48
       +
       		if err != nil {

     

       49
       49
       +
       			return nil, fmt.Errorf("unable to resolve did %s: %s", did, err)

     

       50
       50
       +
       		}

     

       51
       51
       +
       

     

       52
       52
       +
       		verificationMethods := make([]atproto_identity.DocVerificationMethod, len(didDoc.VerificationMethods))

     

       53
       53
       +
       		for i, verificationMethod := range didDoc.VerificationMethods {

     

       54
       54
       +
       			verificationMethods[i] = atproto_identity.DocVerificationMethod{

     

       55
       55
       +
       				ID: verificationMethod.Id,

     

       56
       56
       +
       				Type: verificationMethod.Type,

     

       57
       57
       +
       				PublicKeyMultibase: verificationMethod.PublicKeyMultibase,

     

       58
       58
       +
       				Controller: verificationMethod.Controller,

     

       59
       59
       +
       			}

     

       60
       60
       +
       		}

     

       61
       61
       +
       		services := make([]atproto_identity.DocService, len(didDoc.Service))

     

       62
       62
       +
       		for i, service := range didDoc.Service {

     

       63
       63
       +
       			services[i] = atproto_identity.DocService{

     

       64
       64
       +
       				ID: service.Id,

     

       65
       65
       +
       				Type: service.Type,

     

       66
       66
       +
       				ServiceEndpoint: service.ServiceEndpoint,

     

       67
       67
       +
       			}

     

       68
       68
       +
       		}

     

       69
       69
       +
       		parsedIdentity := atproto_identity.ParseIdentity(&identity.DIDDocument{

     

       70
       70
       +
       			DID: did,

     

       71
       71
       +
       			AlsoKnownAs: didDoc.AlsoKnownAs,

     

       72
       72
       +
       			VerificationMethod: verificationMethods,

     

       73
       73
       +
       			Service: services,

     

       74
       74
       +
       		})

     

       75
       75
       +
       

     

       76
       76
       +
       		key, err := parsedIdentity.PublicKey()

     

       77
       77
       +
       		if err != nil {

     

       78
       78
       +
       			return nil, fmt.Errorf("signing key not found for did %s: %s", did, err)

     

       79
       79
       +
       		}

     

       80
       80
       +
       		return key, nil

     

       81
       81
       +
       	})

     

       82
       82
       +
       	if err != nil {

     

       83
       83
       +
       		return "", fmt.Errorf("invalid token: %s", err)

     

       84
       84
       +
       	}

     

       85
       85
       +
       

     

       86
       86
       +
       	claims := parsedToken.Claims.(jwt.MapClaims)

     

       87
       87
       +
       	if claims["lxm"] != nsid {

     

       88
       88
       +
       		return "", fmt.Errorf("bad jwt lexicon method (\"lxm\"). must match: %s", nsid)

     

       89
       89
       +
       	}

     

       90
       90
       +
       	return claims["iss"].(string), nil

     

       91
       91
       +
       }