···
jwksCache cache.Cache[string, jwk.Key]
-
metadataCache cache.Cache[string, Metadata]
type ManagerArgs struct {
···
jwksCache := cache.NewCache[string, jwk.Key]().WithLRU().WithMaxKeys(500).WithTTL(5 * time.Minute)
-
metadataCache := cache.NewCache[string, Metadata]().WithLRU().WithMaxKeys(500).WithTTL(5 * time.Minute)
···
-
if metadata.JWKS != nil && len(metadata.JWKS.Keys) > 0 {
-
// TODO: this is kinda bad but whatever for now. there could obviously be more than one jwk, and we need to
-
// make sure we use the right one
-
b, err := json.Marshal(metadata.JWKS.Keys[0])
-
k, err := helpers.ParseJWKFromBytes(b)
-
} else if metadata.JWKSURI != nil {
-
maybeJwks, err := cm.getClientJwks(ctx, clientId, *metadata.JWKSURI)
-
return nil, fmt.Errorf("no valid jwks found in oauth client metadata")
···
func (cm *Manager) getClientMetadata(ctx context.Context, clientId string) (*Metadata, error) {
-
metadataCached, ok := cm.metadataCache.Get(clientId)
req, err := http.NewRequestWithContext(ctx, "GET", clientId, nil)
···
-
return &metadataCached, nil
···
return nil, fmt.Errorf("error unmarshaling metadata: %w", err)
u, err := url.Parse(metadata.ClientURI)
return nil, fmt.Errorf("unable to parse client uri: %w", err)
if isLocalHostname(u.Hostname()) {
-
return nil, errors.New("`client_uri` hostname is invalid")
if metadata.Scope == "" {
···
return nil, fmt.Errorf("loopback redirect uri %s must use http", ruri)
return nil, errors.New("only loopbvack redirect uris are allowed to use the `http` scheme")
case u.Scheme == "https":
if isLocalHostname(u.Hostname()) {
return nil, fmt.Errorf("redirect uri %s's domain must not be a local hostname", ruri)
case strings.Contains(u.Scheme, "."):
if metadata.ApplicationType != "native" {
return nil, errors.New("private-use uri scheme redirect uris are only allowed for native apps")
···
jwksCache cache.Cache[string, jwk.Key]
+
metadataCache cache.Cache[string, *Metadata]
type ManagerArgs struct {
···
jwksCache := cache.NewCache[string, jwk.Key]().WithLRU().WithMaxKeys(500).WithTTL(5 * time.Minute)
+
metadataCache := cache.NewCache[string, *Metadata]().WithLRU().WithMaxKeys(500).WithTTL(5 * time.Minute)
···
+
if metadata.TokenEndpointAuthMethod == "private_key_jwt" {
+
if metadata.JWKS != nil && len(metadata.JWKS.Keys) > 0 {
+
// TODO: this is kinda bad but whatever for now. there could obviously be more than one jwk, and we need to
+
// make sure we use the right one
+
b, err := json.Marshal(metadata.JWKS.Keys[0])
+
k, err := helpers.ParseJWKFromBytes(b)
+
} else if metadata.JWKS != nil {
+
} else if metadata.JWKSURI != nil {
+
maybeJwks, err := cm.getClientJwks(ctx, clientId, *metadata.JWKSURI)
+
return nil, fmt.Errorf("no valid jwks found in oauth client metadata")
···
func (cm *Manager) getClientMetadata(ctx context.Context, clientId string) (*Metadata, error) {
+
cached, ok := cm.metadataCache.Get(clientId)
req, err := http.NewRequestWithContext(ctx, "GET", clientId, nil)
···
+
cm.metadataCache.Set(clientId, validated, 10*time.Minute)
···
return nil, fmt.Errorf("error unmarshaling metadata: %w", err)
+
if metadata.ClientURI == "" {
+
u, err := url.Parse(metadata.ClientID)
+
return nil, fmt.Errorf("unable to parse client id: %w", err)
+
metadata.ClientURI = u.String()
u, err := url.Parse(metadata.ClientURI)
return nil, fmt.Errorf("unable to parse client uri: %w", err)
+
if metadata.ClientName == "" {
+
metadata.ClientName = metadata.ClientURI
if isLocalHostname(u.Hostname()) {
+
return nil, fmt.Errorf("`client_uri` hostname is invalid: %s", u.Hostname())
if metadata.Scope == "" {
···
return nil, fmt.Errorf("loopback redirect uri %s must use http", ruri)
return nil, errors.New("only loopbvack redirect uris are allowed to use the `http` scheme")
case u.Scheme == "https":
if isLocalHostname(u.Hostname()) {
return nil, fmt.Errorf("redirect uri %s's domain must not be a local hostname", ruri)
case strings.Contains(u.Scheme, "."):
if metadata.ApplicationType != "native" {
return nil, errors.New("private-use uri scheme redirect uris are only allowed for native apps")
hailey.at