initial commit

internal/server/oidc.go

@@ -0,0 +1,63 @@
+package server
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/danyel/go-loose/internal/password"
+	"golang.org/x/oauth2"
+)
+
+func (s *Server) configureOIDC(ctx context.Context, issuer, clientID, clientSecret string) error {
+	provider, err := oidc.NewProvider(ctx, issuer)
+	if err != nil {
+		return fmt.Errorf("discover OIDC provider: %w", err)
+	}
+	config := &oauth2.Config{
+		ClientID: clientID, ClientSecret: clientSecret,
+		Endpoint: provider.Endpoint(), RedirectURL: s.cfg.OIDCRedirectURL,
+		Scopes: []string{oidc.ScopeOpenID, "profile", "email"},
+	}
+	s.authMu.Lock()
+	s.oauth = config
+	s.verifier = provider.Verifier(&oidc.Config{ClientID: clientID})
+	s.authMu.Unlock()
+	return nil
+}
+
+func (s *Server) oidcConfiguration() (*oauth2.Config, *oidc.IDTokenVerifier) {
+	s.authMu.RLock()
+	defer s.authMu.RUnlock()
+	return s.oauth, s.verifier
+}
+
+func (s *Server) hasOIDC() bool {
+	config, verifier := s.oidcConfiguration()
+	return config != nil && verifier != nil
+}
+
+func (s *Server) ensureLocalAdministrator(ctx context.Context) error {
+	if !s.cfg.LocalLogin {
+		return nil
+	}
+	dummyHash, err := password.Hash("not-a-real-account-password")
+	if err != nil {
+		return fmt.Errorf("hash password timing value: %w", err)
+	}
+	s.loginGuard.dummyHash = dummyHash
+	if s.cfg.LocalAdminPassword == "" {
+		return nil
+	}
+	passwordHash, err := password.Hash(s.cfg.LocalAdminPassword)
+	if err != nil {
+		return fmt.Errorf("hash local administrator password: %w", err)
+	}
+	if err := s.store.EnsurePasswordUser(
+		ctx, s.cfg.LocalAdminEmail, "Local Administrator", passwordHash,
+		s.cfg.BootstrapTenant, s.cfg.BootstrapApp,
+	); err != nil {
+		return fmt.Errorf("bootstrap local administrator: %w", err)
+	}
+	return nil
+}