···

       
5
       
 
       
	"context"

     

       
6
       
 
       
	"encoding/json"

     

       
7
       
 
       
	"fmt"

     

       
8
       
-
       
	"log"

     

       
9
       
 
       
	"net/http"

     

       
10
       
 
       
	"slices"

     

       
11
       
 
       
	"time"

     
···

       
43
       
 
       
	jwks := o.Config.OAuth.Jwks

     

       
44
       
 
       
	pubKey, err := pubKeyFromJwk(jwks)

     

       
45
       
 
       
	if err != nil {

     

       
46
       
-
       
		log.Printf("error parsing public key: %v", err)

     

       
47
       
 
       
		http.Error(w, err.Error(), http.StatusInternalServerError)

     

       
48
       
 
       
		return

     

       
49
       
 
       
	}

     
···

       
71
       
 
       
		return

     

       
72
       
 
       
	}

     

       
73
       
 
       


     

       
74
       
-
       
	log.Println("session saved successfully")

     

       
75
       
 
       
	go o.addToDefaultKnot(sessData.AccountDID.String())

     

       
76
       
 
       
	go o.addToDefaultSpindle(sessData.AccountDID.String())

     

       
77
       
 
       


     
···

       
81
       
 
       
			Event:      "signin",

     

       
82
       
 
       
		})

     

       
83
       
 
       
		if err != nil {

     

       
84
       
-
       
			log.Println("failed to enqueue posthog event:", err)

     

       
85
       
 
       
		}

     

       
86
       
 
       
	}

     

       
87
       
 
       


     
···

       
89
       
 
       
}

     

       
90
       
 
       


     

       
91
       
 
       
func (o *OAuth) addToDefaultSpindle(did string) {

     

       
0
       
 
       

     

       
0
       
 
       

     

       
92
       
 
       
	// use the tangled.sh app password to get an accessJwt

     

       
93
       
 
       
	// and create an sh.tangled.spindle.member record with that

     

       
94
       
 
       
	spindleMembers, err := db.GetSpindleMembers(

     
···

       
97
       
 
       
		db.FilterEq("subject", did),

     

       
98
       
 
       
	)

     

       
99
       
 
       
	if err != nil {

     

       
100
       
-
       
		log.Printf("failed to get spindle members for did %s: %v", did, err)

     

       
101
       
 
       
		return

     

       
102
       
 
       
	}

     

       
103
       
 
       


     

       
104
       
 
       
	if len(spindleMembers) != 0 {

     

       
105
       
-
       
		log.Printf("did %s is already a member of the default spindle", did)

     

       
106
       
 
       
		return

     

       
107
       
 
       
	}

     

       
108
       
 
       


     

       
109
       
-
       
	log.Printf("adding %s to default spindle", did)

     

       
110
       
 
       
	session, err := o.createAppPasswordSession(o.Config.Core.AppPassword, consts.TangledDid)

     

       
111
       
 
       
	if err != nil {

     

       
112
       
-
       
		log.Printf("failed to create session: %s", err)

     

       
113
       
 
       
		return

     

       
114
       
 
       
	}

     

       
115
       
 
       


     
···

       
121
       
 
       
	}

     

       
122
       
 
       


     

       
123
       
 
       
	if err := session.putRecord(record, tangled.SpindleMemberNSID); err != nil {

     

       
124
       
-
       
		log.Printf("failed to add member to default spindle: %s", err)

     

       
125
       
 
       
		return

     

       
126
       
 
       
	}

     

       
127
       
 
       


     

       
128
       
-
       
	log.Printf("successfully added %s to default spindle", did)

     

       
129
       
 
       
}

     

       
130
       
 
       


     

       
131
       
 
       
func (o *OAuth) addToDefaultKnot(did string) {

     

       
0
       
 
       

     

       
0
       
 
       

     

       
132
       
 
       
	// use the tangled.sh app password to get an accessJwt

     

       
133
       
 
       
	// and create an sh.tangled.spindle.member record with that

     

       
134
       
 
       


     

       
135
       
 
       
	allKnots, err := o.Enforcer.GetKnotsForUser(did)

     

       
136
       
 
       
	if err != nil {

     

       
137
       
-
       
		log.Printf("failed to get knot members for did %s: %v", did, err)

     

       
138
       
 
       
		return

     

       
139
       
 
       
	}

     

       
140
       
 
       


     

       
141
       
 
       
	if slices.Contains(allKnots, consts.DefaultKnot) {

     

       
142
       
-
       
		log.Printf("did %s is already a member of the default knot", did)

     

       
143
       
 
       
		return

     

       
144
       
 
       
	}

     

       
145
       
 
       


     

       
146
       
-
       
	log.Printf("adding %s to default knot", did)

     

       
147
       
 
       
	session, err := o.createAppPasswordSession(o.Config.Core.TmpAltAppPassword, consts.IcyDid)

     

       
148
       
 
       
	if err != nil {

     

       
149
       
-
       
		log.Printf("failed to create session: %s", err)

     

       
150
       
 
       
		return

     

       
151
       
 
       
	}

     

       
152
       
 
       


     
···

       
158
       
 
       
	}

     

       
159
       
 
       


     

       
160
       
 
       
	if err := session.putRecord(record, tangled.KnotMemberNSID); err != nil {

     

       
161
       
-
       
		log.Printf("failed to add member to default knot: %s", err)

     

       
162
       
 
       
		return

     

       
163
       
 
       
	}

     

       
164
       
 
       


     

       
165
       
 
       
	if err := o.Enforcer.AddKnotMember(consts.DefaultKnot, did); err != nil {

     

       
166
       
-
       
		log.Printf("failed to set up enforcer rules: %s", err)

     

       
167
       
 
       
		return

     

       
168
       
 
       
	}

     

       
169
       
 
       


     

       
170
       
-
       
	log.Printf("successfully added %s to default Knot", did)

     

       
171
       
 
       
}

     

       
172
       
 
       


     

       
173
       
 
       
// create a session using apppasswords

     

···

       
5
       
 
       
	"context"

     

       
6
       
 
       
	"encoding/json"

     

       
7
       
 
       
	"fmt"

     

       
0
       
 
       

     

       
8
       
 
       
	"net/http"

     

       
9
       
 
       
	"slices"

     

       
10
       
 
       
	"time"

     
···

       
42
       
 
       
	jwks := o.Config.OAuth.Jwks

     

       
43
       
 
       
	pubKey, err := pubKeyFromJwk(jwks)

     

       
44
       
 
       
	if err != nil {

     

       
45
       
+
       
		o.Logger.Error("error parsing public key", "err", err)

     

       
46
       
 
       
		http.Error(w, err.Error(), http.StatusInternalServerError)

     

       
47
       
 
       
		return

     

       
48
       
 
       
	}

     
···

       
70
       
 
       
		return

     

       
71
       
 
       
	}

     

       
72
       
 
       


     

       
73
       
+
       
	o.Logger.Debug("session saved successfully")

     

       
74
       
 
       
	go o.addToDefaultKnot(sessData.AccountDID.String())

     

       
75
       
 
       
	go o.addToDefaultSpindle(sessData.AccountDID.String())

     

       
76
       
 
       


     
···

       
80
       
 
       
			Event:      "signin",

     

       
81
       
 
       
		})

     

       
82
       
 
       
		if err != nil {

     

       
83
       
+
       
			o.Logger.Error("failed to enqueue posthog event", "err", err)

     

       
84
       
 
       
		}

     

       
85
       
 
       
	}

     

       
86
       
 
       


     
···

       
88
       
 
       
}

     

       
89
       
 
       


     

       
90
       
 
       
func (o *OAuth) addToDefaultSpindle(did string) {

     

       
91
       
+
       
	l := o.Logger.With("subject", did)

     

       
92
       
+
       


     

       
93
       
 
       
	// use the tangled.sh app password to get an accessJwt

     

       
94
       
 
       
	// and create an sh.tangled.spindle.member record with that

     

       
95
       
 
       
	spindleMembers, err := db.GetSpindleMembers(

     
···

       
98
       
 
       
		db.FilterEq("subject", did),

     

       
99
       
 
       
	)

     

       
100
       
 
       
	if err != nil {

     

       
101
       
+
       
		l.Error("failed to get spindle members", "err", err)

     

       
102
       
 
       
		return

     

       
103
       
 
       
	}

     

       
104
       
 
       


     

       
105
       
 
       
	if len(spindleMembers) != 0 {

     

       
106
       
+
       
		l.Warn("already a member of the default spindle")

     

       
107
       
 
       
		return

     

       
108
       
 
       
	}

     

       
109
       
 
       


     

       
110
       
+
       
	l.Debug("adding to default spindle")

     

       
111
       
 
       
	session, err := o.createAppPasswordSession(o.Config.Core.AppPassword, consts.TangledDid)

     

       
112
       
 
       
	if err != nil {

     

       
113
       
+
       
		l.Error("failed to create session", "err", err)

     

       
114
       
 
       
		return

     

       
115
       
 
       
	}

     

       
116
       
 
       


     
···

       
122
       
 
       
	}

     

       
123
       
 
       


     

       
124
       
 
       
	if err := session.putRecord(record, tangled.SpindleMemberNSID); err != nil {

     

       
125
       
+
       
		l.Error("failed to add to default spindle", "err", err)

     

       
126
       
 
       
		return

     

       
127
       
 
       
	}

     

       
128
       
 
       


     

       
129
       
+
       
	l.Debug("successfully added to default spindle", "did", did)

     

       
130
       
 
       
}

     

       
131
       
 
       


     

       
132
       
 
       
func (o *OAuth) addToDefaultKnot(did string) {

     

       
133
       
+
       
	l := o.Logger.With("subject", did)

     

       
134
       
+
       


     

       
135
       
 
       
	// use the tangled.sh app password to get an accessJwt

     

       
136
       
 
       
	// and create an sh.tangled.spindle.member record with that

     

       
137
       
 
       


     

       
138
       
 
       
	allKnots, err := o.Enforcer.GetKnotsForUser(did)

     

       
139
       
 
       
	if err != nil {

     

       
140
       
+
       
		l.Error("failed to get knot members for did", "err", err)

     

       
141
       
 
       
		return

     

       
142
       
 
       
	}

     

       
143
       
 
       


     

       
144
       
 
       
	if slices.Contains(allKnots, consts.DefaultKnot) {

     

       
145
       
+
       
		l.Warn("already a member of the default knot")

     

       
146
       
 
       
		return

     

       
147
       
 
       
	}

     

       
148
       
 
       


     

       
149
       
+
       
	l.Debug("addings to default knot")

     

       
150
       
 
       
	session, err := o.createAppPasswordSession(o.Config.Core.TmpAltAppPassword, consts.IcyDid)

     

       
151
       
 
       
	if err != nil {

     

       
152
       
+
       
		l.Error("failed to create session", "err", err)

     

       
153
       
 
       
		return

     

       
154
       
 
       
	}

     

       
155
       
 
       


     
···

       
161
       
 
       
	}

     

       
162
       
 
       


     

       
163
       
 
       
	if err := session.putRecord(record, tangled.KnotMemberNSID); err != nil {

     

       
164
       
+
       
		l.Error("failed to add to default knot", "err", err)

     

       
165
       
 
       
		return

     

       
166
       
 
       
	}

     

       
167
       
 
       


     

       
168
       
 
       
	if err := o.Enforcer.AddKnotMember(consts.DefaultKnot, did); err != nil {

     

       
169
       
+
       
		l.Error("failed to set up enforcer rules", "err", err)

     

       
170
       
 
       
		return

     

       
171
       
 
       
	}

     

       
172
       
 
       


     

       
173
       
+
       
	l.Debug("successfully addeds to default Knot")

     

       
174
       
 
       
}

     

       
175
       
 
       


     

       
176
       
 
       
// create a session using apppasswords

     

···

       
3
       
 
       
import (

     

       
4
       
 
       
	"errors"

     

       
5
       
 
       
	"fmt"

     

       
0
       
 
       

     

       
6
       
 
       
	"net/http"

     

       
7
       
 
       
	"time"

     

       
8
       
 
       


     
···

       
20
       
 
       
	"tangled.org/core/rbac"

     

       
21
       
 
       
)

     

       
22
       
 
       


     

       
23
       
-
       
func New(config *config.Config, ph posthog.Client, db *db.DB, enforcer *rbac.Enforcer, res *idresolver.Resolver) (*OAuth, error) {

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
24
       
 
       


     

       
25
       
 
       
	var oauthConfig oauth.ClientConfig

     

       
26
       
 
       
	var clientUri string

     
···

       
54
       
 
       
		Db:         db,

     

       
55
       
 
       
		Enforcer:   enforcer,

     

       
56
       
 
       
		IdResolver: res,

     

       
0
       
 
       

     

       
57
       
 
       
	}, nil

     

       
58
       
-
       
}

     

       
59
       
-
       


     

       
60
       
-
       
type OAuth struct {

     

       
61
       
-
       
	ClientApp  *oauth.ClientApp

     

       
62
       
-
       
	SessStore  *sessions.CookieStore

     

       
63
       
-
       
	Config     *config.Config

     

       
64
       
-
       
	JwksUri    string

     

       
65
       
-
       
	Posthog    posthog.Client

     

       
66
       
-
       
	Db         *db.DB

     

       
67
       
-
       
	Enforcer   *rbac.Enforcer

     

       
68
       
-
       
	IdResolver *idresolver.Resolver

     

       
69
       
 
       
}

     

       
70
       
 
       


     

       
71
       
 
       
func (o *OAuth) SaveSession(w http.ResponseWriter, r *http.Request, sessData *oauth.ClientSessionData) error {

     

···

       
3
       
 
       
import (

     

       
4
       
 
       
	"errors"

     

       
5
       
 
       
	"fmt"

     

       
6
       
+
       
	"log/slog"

     

       
7
       
 
       
	"net/http"

     

       
8
       
 
       
	"time"

     

       
9
       
 
       


     
···

       
21
       
 
       
	"tangled.org/core/rbac"

     

       
22
       
 
       
)

     

       
23
       
 
       


     

       
24
       
+
       
type OAuth struct {

     

       
25
       
+
       
	ClientApp  *oauth.ClientApp

     

       
26
       
+
       
	SessStore  *sessions.CookieStore

     

       
27
       
+
       
	Config     *config.Config

     

       
28
       
+
       
	JwksUri    string

     

       
29
       
+
       
	Posthog    posthog.Client

     

       
30
       
+
       
	Db         *db.DB

     

       
31
       
+
       
	Enforcer   *rbac.Enforcer

     

       
32
       
+
       
	IdResolver *idresolver.Resolver

     

       
33
       
+
       
	Logger     *slog.Logger

     

       
34
       
+
       
}

     

       
35
       
+
       


     

       
36
       
+
       
func New(config *config.Config, ph posthog.Client, db *db.DB, enforcer *rbac.Enforcer, res *idresolver.Resolver, logger *slog.Logger) (*OAuth, error) {

     

       
37
       
 
       


     

       
38
       
 
       
	var oauthConfig oauth.ClientConfig

     

       
39
       
 
       
	var clientUri string

     
···

       
67
       
 
       
		Db:         db,

     

       
68
       
 
       
		Enforcer:   enforcer,

     

       
69
       
 
       
		IdResolver: res,

     

       
70
       
+
       
		Logger:     logger,

     

       
71
       
 
       
	}, nil

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
72
       
 
       
}

     

       
73
       
 
       


     

       
74
       
 
       
func (o *OAuth) SaveSession(w http.ResponseWriter, r *http.Request, sessData *oauth.ClientSessionData) error {

     

···

       
82
       
 
       
	}

     

       
83
       
 
       


     

       
84
       
 
       
	pages := pages.NewPages(config, res, log.SubLogger(logger, "pages"))

     

       
85
       
-
       
	oauth, err := oauth.New(config, posthog, d, enforcer, res)

     

       
86
       
 
       
	if err != nil {

     

       
87
       
 
       
		return nil, fmt.Errorf("failed to start oauth handler: %w", err)

     

       
88
       
 
       
	}

     

···

       
82
       
 
       
	}

     

       
83
       
 
       


     

       
84
       
 
       
	pages := pages.NewPages(config, res, log.SubLogger(logger, "pages"))

     

       
85
       
+
       
	oauth, err := oauth.New(config, posthog, d, enforcer, res, log.SubLogger(logger, "oauth"))

     

       
86
       
 
       
	if err != nil {

     

       
87
       
 
       
		return nil, fmt.Errorf("failed to start oauth handler: %w", err)

     

       
88
       
 
       
	}