1 package org.make.api.user.social
2 
3 import akka.http.scaladsl.model._
4 import akka.http.scaladsl.model.headers.RawHeader
5 import akka.http.scaladsl.{Http, HttpExt}
6 import cats.data.EitherT
7 import cats.syntax.bifunctor._
8 import cats.syntax.either._
9 import cats.syntax.traverse._
10 import grizzled.slf4j.Logging
11 import io.circe
12 import io.circe.Decoder.Result
13 import io.circe.DecodingFailure.Reason
14 import io.circe.generic.semiauto.deriveDecoder
15 import io.circe.parser.parse
16 import io.circe.{Decoder, DecodingFailure, HCursor}
17 import org.make.api.technical.ActorSystemComponent
18 import org.make.api.user.social.models.oidc.{UserInfo => OidcUserInfo}
19 import org.make.core.Validation
20 import org.make.core.operation.OidcConfiguration
21 import pdi.jwt.{JwtAlgorithm, JwtCirce, JwtOptions}
22 
23 import java.nio.charset.Charset
24 import scala.concurrent.duration.DurationInt
25 import scala.concurrent.{ExecutionContextExecutor, Future}
26 
27 trait OpenIDConnectApiComponent {
28   def openIDConnectApi: OpenIDConnectApi
29 }
30 
31 trait OpenIDConnectApi {
32   def getUserInfo(
33     authorizationCode: String,
34     oidcConfiguration: OidcConfiguration,
35     redirectUri: String
36   ): Future[OidcUserInfo]
37 }
38 
39 final private[social] case class OidcTokenResponse(
40   access_token: String,
41   token_type: String,
42   expires_in: Int,
43   id_token: String,
44   scope: Option[String]
45 )
46 private[social] object OidcTokenResponse {
47   implicit val decoder: Decoder[OidcTokenResponse] = deriveDecoder
48 }
49 
50 final private[social] case class OidcTokenPayload(
51   email: String,
52   firstName: Option[String],
53   externalUserId: Option[String],
54   iat: Long,
55   exp: Long
56 ) {
57   lazy val toUserInfo: OidcUserInfo = OidcUserInfo(email, firstName, externalUserId, iat, exp)
58 }
59 private[social] object OidcTokenPayload {
60   def decoder(oidcConfiguration: OidcConfiguration): Decoder[OidcTokenPayload] = new Decoder[OidcTokenPayload] {
61     final def apply(c: HCursor): Result[OidcTokenPayload] =
62       for {
63         email <- c
64           .downField("sub")
65           .as[String]
66           .toOption
67           .filter(Validation.emailRegex.matches)
68           .orElse(
69             oidcConfiguration.jwtEmailAltField
70               .flatMap(c.downField(_).as[String].toOption.filter(Validation.emailRegex.matches))
71           )
72           .toRight(DecodingFailure(Reason.CustomReason("email is mandatory and must be valid"), c.history))
73         iat <- c.downField("iat").as[Long]
74         exp <- c.downField("exp").as[Long]
75       } yield {
76         val firstName = oidcConfiguration.jwtGivenNameAltField.traverse(c.downField(_).as[String].toOption).flatten
77         val externalUserId = oidcConfiguration.jwtUserIdAltField.traverse(c.downField(_).as[String].toOption).flatten
78         OidcTokenPayload(email, firstName, externalUserId, iat, exp)
79       }
80   }
81 }
82 
83 trait DefaultOpenIDConnectApiComponent extends OpenIDConnectApiComponent {
84   self: ActorSystemComponent =>
85 
86   override def openIDConnectApi: OpenIDConnectApi = new DefaultOpenIDConnectApi
87 
88   private class DefaultOpenIDConnectApi extends OpenIDConnectApi with Logging {
89     implicit val executor: ExecutionContextExecutor = actorSystem.executionContext
90 
91     private val http: HttpExt = Http()
92 
93     private def claimUserInfoData(
94       userInfoEndpoint: String,
95       accessToken: String
96     ): EitherT[Future, circe.Error, Map[String, String]] =
97       for {
98         userInfoResponse <- EitherT.right(
99           http.singleRequest(
100             HttpRequest(method = HttpMethods.GET, uri = userInfoEndpoint)
101               .withHeaders(RawHeader("Authorization", s"Bearer $accessToken"))
102           )
103         )
104         userInfoData <- EitherT(strictToString(userInfoResponse).map(parse(_).flatMap(_.as[Map[String, String]])))
105       } yield userInfoData
106 
107     @SuppressWarnings(Array("org.wartremover.warts.Throw"))
108     def getUserInfo(
109       authorizationCode: String,
110       oidcConfiguration: OidcConfiguration,
111       redirectUri: String
112     ): Future[OidcUserInfo] = {
113       (for {
114         clientSecret <- oidcConfiguration.clientSecret
115           .toRight(new IllegalArgumentException("Client secret is required"))
116           .toEitherT[Future]
117         tokenResponse <- EitherT.right(
118           http
119             .singleRequest(
120               HttpRequest(method = HttpMethods.POST, uri = oidcConfiguration.tokenEndpoint)
121                 .withHeaders(RawHeader("Content-Type", "application/x-www-form-urlencoded"))
122                 .withEntity(
123                   FormData(
124                     "grant_type" -> "authorization_code",
125                     "client_id" -> oidcConfiguration.clientId,
126                     "client_secret" -> clientSecret,
127                     "redirect_uri" -> redirectUri,
128                     "code" -> authorizationCode
129                   ).toEntity
130                 )
131             )
132         )
133         tokenResponse <- EitherT(strictToString(tokenResponse).map(parse(_).flatMap(_.as[OidcTokenResponse])))
134         jwtUserInfo <- JwtCirce
135           .decodeJson(tokenResponse.id_token, clientSecret, Seq(JwtAlgorithm.RS512), JwtOptions(signature = false))
136           .toEither
137           .flatMap(_.as[OidcTokenPayload](OidcTokenPayload.decoder(oidcConfiguration)).map(_.toUserInfo))
138           .toEitherT[Future]
139         userInfo <- (jwtUserInfo.firstName, oidcConfiguration.userInfoEndpoint) match {
140           case (None, Some(userInfoEndpoint)) =>
141             claimUserInfoData(userInfoEndpoint, tokenResponse.access_token).map { data =>
142               val firstName = oidcConfiguration.jwtGivenNameAltField
143                 .flatMap(data.get)
144                 .orElse(jwtUserInfo.firstName)
145               val externalUserId =
146                 oidcConfiguration.jwtUserIdAltField.flatMap(data.get).orElse(jwtUserInfo.externalUserId)
147               jwtUserInfo.copy(firstName = firstName, externalUserId = externalUserId)
148             }.leftWiden[Throwable]
149           case _ => EitherT.rightT[Future, Throwable](jwtUserInfo)
150         }
151       } yield userInfo).value.flatMap {
152         case Right(userInfo) => Future.successful(userInfo)
153         case Left(thr)       => Future.failed(thr)
154       }
155     }
156 
157     private def strictToString(response: HttpResponse, expectedCode: StatusCode = StatusCodes.OK): Future[String] = {
158       logger.debug(s"Server answered $response")
159       response match {
160         case HttpResponse(`expectedCode`, _, entity, _) =>
161           val result = entity
162             .toStrict(2.second)
163             .map(_.data.decodeString(Charset.forName("UTF-8")))
164           result
165         case HttpResponse(code, _, entity, _) =>
166           entity.toStrict(2.second).flatMap { entity =>
167             val response = entity.data.decodeString(Charset.forName("UTF-8"))
168             Future.failed(SocialProviderException(s"Got unexpected response code: $code, with body: $response"))
169           }
170       }
171     }
172   }
173 }