Fnymmm/authorization code flow frontend

src/Server/src/Abstractions/Model/Session.cs

@@ -0,0 +1,12 @@
+namespace IdOps;
+
+public class Session
+{
+    public string Id { get; set; }
+    public string ClientId { get; set; }
+    public string SecretId { get; set; }
+    public string CodeVerifier { get; set; }
+    public string SignalrConnectionId { get; set; }
+
+    public string RedirectUrl { get; set; }
+}

src/Server/src/Abstractions/Store/ISessionStore.cs

@@ -0,0 +1,8 @@
+namespace IdOps.Store;
+
+public interface ISessionStore
+{
+    Session GetSession(string key);
+
+    void SaveSession(string key, Session session);
+}

src/Server/src/Api.Host/Startup.cs

@@ -67,6 +67,8 @@ public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
                 endpoints.MapGraphQL();
                 endpoints.MapControllers();
                 endpoints.MapHub<OpsHub>("/signal");
+                endpoints.MapHub<AccessTokenHub>("/clients/hub");
+                endpoints.MapAuthorizeClient();
             });
 
             if (!env.IsDevelopment())

src/Server/src/AuthTokenGenerator/Abstractions/IIdentityService.cs

@@ -1,11 +1,12 @@
+using IdentityModel.Client;
 using IdOps.Models;
 
 namespace IdOps.Abstractions
 {
     public interface IIdentityService
     {
         Task<RequestTokenResult> RequestTokenAsync(
-            TokenRequestData request, 
+            TokenRequest request,
             CancellationToken cancellationToken);
     }
 }

src/Server/src/AuthTokenGenerator/Abstractions/IResultFactory.cs

@@ -2,5 +2,5 @@
 
 public interface IResultFactory<TResult, in TInput>
 {
-    Task<TResult> Create(TInput input, CancellationToken cancellationToken);
+    Task<TResult> CreateRequestAsync(TInput input, CancellationToken cancellationToken);
 }

src/Server/src/AuthTokenGenerator/Abstractions/ITokenClient.cs

@@ -15,4 +15,8 @@ Task<TokenResponse> RequestTokenAsync(
     Task<TokenResponse> RequestClientCredentialsTokenAsync(
         ClientCredentialsTokenRequest request, 
         CancellationToken cancellationToken);
+
+    Task<TokenResponse> RequestAuthorizationCodeTokenAsync(
+        AuthorizationCodeTokenRequest request,
+        CancellationToken cancellationToken);
 }

src/Server/src/AuthTokenGenerator/IdentityService.cs

@@ -1,5 +1,3 @@
-using System.Diagnostics;
-using System.IdentityModel.Tokens.Jwt;
 using IdentityModel.Client;
 using IdOps.Abstractions;
 using IdOps.Models;
@@ -20,17 +18,16 @@ public IdentityService(
         }
 
         public async Task<RequestTokenResult> RequestTokenAsync(
-            TokenRequestData request,
+            TokenRequest request,
             CancellationToken cancellationToken)
         {
-            DiscoveryDocumentResponse disco = await _tokenClient.GetDiscoveryDocumentAsync(
-                request.Authority,
-                cancellationToken);
-
             TokenResponse response = request.GrantType switch
             {
-                "client_credentials" => await RequestClientCredentialTokenAsync(request, disco,cancellationToken),
-                _ => await RequestOtherGrantTypeTokenAsync(request, disco, cancellationToken)
+                "client_credentials" => await _tokenClient.RequestClientCredentialsTokenAsync(
+                    (ClientCredentialsTokenRequest)request, cancellationToken),
+                "authorization_code" => await _tokenClient.RequestAuthorizationCodeTokenAsync(
+                    (AuthorizationCodeTokenRequest)request, cancellationToken),
+                _ => await _tokenClient.RequestTokenAsync(request, cancellationToken)
             };
 
             if (response.IsError)
@@ -46,7 +43,7 @@ public async Task<RequestTokenResult> RequestTokenAsync(
 
                 return result;
             }
-            
+
             TokenModel? accessToken = _tokenAnalyzer.Analyze(response.AccessToken);
             if (accessToken == null)
             {
@@ -55,49 +52,8 @@ public async Task<RequestTokenResult> RequestTokenAsync(
                     ErrorMessage = "Access Token could not be analyzed"
                 };
             }
-            return new RequestTokenResult(true)
-            {
-                AccessToken = accessToken
-            };
-        }
 
-        private async Task<TokenResponse> RequestClientCredentialTokenAsync(
-            TokenRequestData request, 
-            DiscoveryDocumentResponse disco, 
-            CancellationToken cancellationToken)
-        {
-            return await _tokenClient.RequestClientCredentialsTokenAsync(
-                new ClientCredentialsTokenRequest
-                {
-                    Address = disco.TokenEndpoint,
-                    ClientId = request.ClientId,
-                    ClientSecret = request.Secret,
-                    GrantType = request.GrantType,
-                    Scope = request.Scopes.Any() ? string.Join(" ", request.Scopes) : null
-                }, cancellationToken);
-        }
-
-        private async Task<TokenResponse> RequestOtherGrantTypeTokenAsync(
-            TokenRequestData request,
-            DiscoveryDocumentResponse disco,
-            CancellationToken cancellationToken)
-        {
-            var pars = new Dictionary<string, string>();
-
-            if (request.Scopes is { } s && s.Any())
-            {
-                pars.Add("scope", string.Join(" ", request.Scopes));
-            }
-
-            return await _tokenClient.RequestTokenAsync(
-                new TokenRequest
-                {
-                    Address = disco.TokenEndpoint,
-                    ClientId = request.ClientId,
-                    ClientSecret = request.Secret,
-                    GrantType = request.GrantType,
-                    Parameters = new Parameters(pars)
-                }, cancellationToken);
+            return new RequestTokenResult(true) { AccessToken = accessToken };
         }
     }
 }

src/Server/src/AuthTokenGenerator/Models/TokenClient.cs

@@ -37,7 +37,18 @@ public async Task<TokenResponse> RequestClientCredentialsTokenAsync(
         CancellationToken cancellationToken)
     {
         using HttpClient httpClient = _httpClientFactory.CreateClient();
-        var response =  await httpClient.RequestClientCredentialsTokenAsync(request, cancellationToken);
+        var response =  
+            await httpClient.RequestClientCredentialsTokenAsync(request, cancellationToken);
+        return response;
+    }
+
+    public async Task<TokenResponse> RequestAuthorizationCodeTokenAsync(
+        AuthorizationCodeTokenRequest request, 
+        CancellationToken cancellationToken)
+    {
+        using HttpClient httpClient = _httpClientFactory.CreateClient();
+        var response =
+            await httpClient.RequestAuthorizationCodeTokenAsync(request, cancellationToken);
         return response;
     }
 }

src/Server/src/Core/Configuration/IdOpsServerBuilderExtensions.cs

@@ -99,8 +99,8 @@ private static void AddEncryptionProviders(
             IConfiguration configuration)
         {
             services.AddAzureKeyVault(configuration);
-            services.AddEncryptionProvider<KeyVaultEncryptionProvider>(isDefault: false);
-            services.AddEncryptionProvider<NoEncryptionProvider>(isDefault: true);
+            services.AddEncryptionProvider<KeyVaultEncryptionProvider>(isDefault: true);
+            services.AddEncryptionProvider<NoEncryptionProvider>(isDefault: false);
         }
 
         private static void AddConsumers(this IBusRegistrationConfigurator busConfigurator)

src/Server/src/GraphQL/Client/ClientMutations.cs

@@ -2,9 +2,11 @@
 using System.Threading.Tasks;
 using HotChocolate;
 using HotChocolate.Types;
+using IdentityModel.Client;
 using IdOps.Abstractions;
 using IdOps.Model;
 using IdOps.Models;
+using IdOps.Store;
 
 namespace IdOps.GraphQL
 {
@@ -64,18 +66,26 @@ public async Task<SaveClientPayload> RemoveClientSecretAsync(
         [AuthorizeClientAuthoring(AccessMode.Write, includeTenantAuth: false)]
         public async Task<RequestTokenPayload> RequestTokenAsync(
             [Service] IIdentityService identityService,
-            [Service] IResultFactory<TokenRequestData, RequestTokenInput> requestResultFactory,
-            RequestTokenInput input,
+            [Service] IResultFactory<TokenRequest, RequestTokenInput> requestResultFactory,
+            RequestClientCredentialsTokenInput input,
             CancellationToken cancellationToken)
         {
-            var tokenRequestData =
-                await requestResultFactory.Create(input,cancellationToken);
-
-
+            TokenRequest tokenRequest =
+                await requestResultFactory.CreateRequestAsync(input,cancellationToken);
+
             RequestTokenResult tokenResult =
-                await identityService.RequestTokenAsync(tokenRequestData, cancellationToken);
+                await identityService.RequestTokenAsync(tokenRequest, cancellationToken);
 
             return new RequestTokenPayload(tokenResult);
         }
+
+        [AuthorizeClientAuthoring(AccessMode.Write, includeTenantAuth: false)]
+        public async Task<string> SaveSessionAsync(
+            [Service] ISessionStore sessionStore,
+            Session session)
+        {
+            sessionStore.SaveSession(session.Id, session);
+            return session.Id;
+        }
     }
 }

src/Server/src/GraphQL/Client/ClientSubscriptions.cs

@@ -0,0 +1,6 @@
+namespace IdOps.GraphQL;
+
+public class ClientSubscriptions
+{
+
+}

src/Server/src/GraphQL/Client/RequestAuthorizationCodeTokenInput.cs

@@ -0,0 +1,26 @@
+namespace IdOps.GraphQL;
+
+public class RequestAuthorizationCodeTokenInput : RequestTokenInput
+{
+    public string Code { get; set; }
+    public string Verifier { get; set; }
+    public string RedirectUri { get; set; }
+
+    public RequestAuthorizationCodeTokenInput(
+        string authority,
+        string clientId,
+        string secretId, 
+        string grantType, 
+        string code, 
+        string verifier, 
+        string redirectUri)
+    {
+        Authority = authority;
+        ClientId = clientId;
+        SecretId = secretId;
+        GrantType = grantType;
+        Code = code;
+        Verifier = verifier;
+        RedirectUri = redirectUri;
+    }
+}

src/Server/src/GraphQL/Client/RequestClientCredentialsTokenInput.cs

@@ -0,0 +1,24 @@
+using System;
+
+namespace IdOps.GraphQL
+{
+    public class RequestClientCredentialsTokenInput : RequestTokenInput
+    {
+
+        public bool SaveTokens { get; set; }
+
+        public RequestClientCredentialsTokenInput(
+            string authority,
+            string clientId,
+            string secretId,
+            string grantType,
+            bool saveTokens)
+        {
+            Authority = authority;
+            ClientId = clientId;
+            SecretId = secretId;
+            GrantType = grantType;
+            SaveTokens = saveTokens;
+        }
+    }
+}

src/Server/src/GraphQL/Client/RequestTokenInput.cs

@@ -1,14 +1,11 @@
-using System;
-using System.Collections.Generic;
-using IdOps.Abstractions;
-using IdOps.Models;
+using System;
 
-namespace IdOps.GraphQL
+namespace IdOps.GraphQL;
+
+public class RequestTokenInput
 {
-    public record RequestTokenInput(
-        string Authority, 
-        Guid ClientId, 
-        Guid SecretId,
-        string grantType,
-        bool SaveTokens);
+  public string Authority { get; set; }
+  public string ClientId { get; set; }
+  public string SecretId { get; set; }
+  public string GrantType { get; set; }
 }