defmodule Boruta.Oauth.Authorization.Code do
@moduledoc """
Check against given params and return the corresponding code
"""
alias Boruta.CodesAdapter
alias Boruta.Oauth.Client
alias Boruta.Oauth.Error
alias Boruta.Oauth.Token
@doc """
Authorize the code corresponding to the given params.
## Examples
iex> authorize(value: "value", redirect_uri: "redirect_uri")
{:ok, %Boruta.Oauth.Token{...}}
"""
@spec authorize(%{
value: String.t(),
redirect_uri: String.t(),
client: Client.t(),
code_verifier: String.t()
}) ::
{:error,
%Error{
:error => :invalid_code,
:error_description => String.t(),
:format => nil,
:redirect_uri => nil,
:status => :bad_request
}}
| {:ok, Token.t()}
def authorize(%{
value: value,
redirect_uri: redirect_uri,
client: %Client{id: client_id, pkce: false}
}) do
with %Token{client: %Client{id: ^client_id}} = token <-
CodesAdapter.get_by(value: value, redirect_uri: redirect_uri),
:ok <- Token.ensure_valid(token) do
{:ok, token}
else
_ ->
{:error,
%Error{
status: :bad_request,
error: :invalid_grant,
error_description: "Given authorization code is invalid, revoked, or expired."
}}
end
end
def authorize(%{
value: value,
redirect_uri: redirect_uri,
client: %Client{id: client_id, pkce: true},
code_verifier: code_verifier
}) do
with %Token{client: %Client{id: ^client_id}} = token <-
CodesAdapter.get_by(value: value, redirect_uri: redirect_uri),
:ok <- check_code_challenge(token, code_verifier),
:ok <- Token.ensure_valid(token) do
{:ok, token}
else
{:error, :invalid_code_verifier} ->
{:error,
%Error{
status: :bad_request,
error: :invalid_request,
error_description: "Code verifier is invalid."
}}
_ ->
{:error,
%Error{
status: :bad_request,
error: :invalid_grant,
error_description: "Given authorization code is invalid, revoked, or expired."
}}
end
end
defp check_code_challenge(
%Token{
code_challenge_hash: code_challenge_hash,
code_challenge_method: "plain"
},
code_verifier
) do
case Token.hash(code_verifier) == code_challenge_hash do
true -> :ok
false -> {:error, :invalid_code_verifier}
end
end
defp check_code_challenge(
%Token{
code_challenge_hash: code_challenge_hash,
code_challenge_method: "S256"
},
code_verifier
) do
case :crypto.hash(:sha256, code_verifier) |> Base.url_encode64(padding: false) |> Token.hash() ==
code_challenge_hash do
true -> :ok
false -> {:error, :invalid_code_verifier}
end
end
end