2017-09-08 00:56:02 +00:00
|
|
|
<?php
|
|
|
|
|
2022-02-16 04:08:28 +00:00
|
|
|
namespace Code\Module;
|
2017-09-08 00:56:02 +00:00
|
|
|
|
2022-02-16 04:08:28 +00:00
|
|
|
use Code\Web\HTTPSig;
|
|
|
|
use Code\Lib\Verify;
|
|
|
|
use Code\Web\Controller;
|
2018-06-19 02:10:49 +00:00
|
|
|
|
2017-09-08 23:00:27 +00:00
|
|
|
/**
|
|
|
|
* OpenWebAuth verifier and token generator
|
2019-01-23 22:27:51 +00:00
|
|
|
* See spec/OpenWebAuth/Home.md
|
2017-09-08 23:00:27 +00:00
|
|
|
* Requests to this endpoint should be signed using HTTP Signatures
|
|
|
|
* using the 'Authorization: Signature' authentication method
|
2021-12-03 03:01:39 +00:00
|
|
|
* If the signature verifies a token is returned.
|
2017-09-08 23:00:27 +00:00
|
|
|
*
|
2021-12-03 03:01:39 +00:00
|
|
|
* This token may be exchanged for an authenticated cookie.
|
2017-09-08 23:00:27 +00:00
|
|
|
*/
|
2021-12-02 23:02:31 +00:00
|
|
|
class Owa extends Controller
|
|
|
|
{
|
2017-09-08 00:56:02 +00:00
|
|
|
|
2021-12-02 23:02:31 +00:00
|
|
|
public function init()
|
|
|
|
{
|
2017-09-08 00:56:02 +00:00
|
|
|
|
2021-12-02 23:02:31 +00:00
|
|
|
$ret = ['success' => false];
|
2017-09-08 00:56:02 +00:00
|
|
|
|
2021-12-02 23:02:31 +00:00
|
|
|
if (array_key_exists('REDIRECT_REMOTE_USER', $_SERVER) && (!array_key_exists('HTTP_AUTHORIZATION', $_SERVER))) {
|
|
|
|
$_SERVER['HTTP_AUTHORIZATION'] = $_SERVER['REDIRECT_REMOTE_USER'];
|
|
|
|
}
|
2017-09-09 20:34:57 +00:00
|
|
|
|
2018-08-03 23:03:16 +00:00
|
|
|
|
2022-09-04 00:01:52 +00:00
|
|
|
if (array_key_exists('HTTP_AUTHORIZATION', $_SERVER) && str_starts_with(trim($_SERVER['HTTP_AUTHORIZATION']), 'Signature')) {
|
2021-12-02 23:02:31 +00:00
|
|
|
$sigblock = HTTPSig::parse_sigheader($_SERVER['HTTP_AUTHORIZATION']);
|
|
|
|
if ($sigblock) {
|
|
|
|
$keyId = $sigblock['keyId'];
|
|
|
|
if ($keyId) {
|
2021-12-03 03:01:39 +00:00
|
|
|
$r = q(
|
|
|
|
"select * from hubloc left join xchan on hubloc_hash = xchan_hash
|
2022-06-17 02:46:54 +00:00
|
|
|
where ( hubloc_addr = '%s' or hubloc_id_url = '%s' ) and hubloc_deleted = 0 and xchan_pubkey != '' ",
|
2021-12-02 23:02:31 +00:00
|
|
|
dbesc(str_replace('acct:', '', $keyId)),
|
|
|
|
dbesc($keyId)
|
|
|
|
);
|
|
|
|
if (!$r) {
|
2022-09-03 21:30:13 +00:00
|
|
|
$found = discover_resource(str_replace('acct:', '', $keyId));
|
2021-12-02 23:02:31 +00:00
|
|
|
if ($found) {
|
2021-12-03 03:01:39 +00:00
|
|
|
$r = q(
|
|
|
|
"select * from hubloc left join xchan on hubloc_hash = xchan_hash
|
2022-06-17 02:46:54 +00:00
|
|
|
where ( hubloc_addr = '%s' or hubloc_id_url = '%s' ) and hubloc_deleted = 0 and xchan_pubkey != '' ",
|
2021-12-02 23:02:31 +00:00
|
|
|
dbesc(str_replace('acct:', '', $keyId)),
|
|
|
|
dbesc($keyId)
|
|
|
|
);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if ($r) {
|
|
|
|
foreach ($r as $hubloc) {
|
|
|
|
$verified = HTTPSig::verify(file_get_contents('php://input'), $hubloc['xchan_pubkey']);
|
|
|
|
if ($verified && $verified['header_signed'] && $verified['header_valid'] && ($verified['content_valid'] || (!$verified['content_signed']))) {
|
|
|
|
logger('OWA header: ' . print_r($verified, true), LOGGER_DATA);
|
|
|
|
logger('OWA success: ' . $hubloc['hubloc_addr'], LOGGER_DATA);
|
|
|
|
$ret['success'] = true;
|
|
|
|
$token = random_string(32);
|
|
|
|
Verify::create('owt', 0, $token, $hubloc['hubloc_addr']);
|
|
|
|
$result = '';
|
|
|
|
openssl_public_encrypt($token, $result, $hubloc['xchan_pubkey']);
|
|
|
|
$ret['encrypted_token'] = base64url_encode($result);
|
|
|
|
break;
|
|
|
|
} else {
|
|
|
|
logger('OWA fail: ' . $hubloc['hubloc_id'] . ' ' . $hubloc['hubloc_addr']);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2021-12-06 21:19:19 +00:00
|
|
|
json_return_and_die($ret, 'application/x-nomad+json');
|
2021-12-02 23:02:31 +00:00
|
|
|
}
|
2017-09-08 00:56:02 +00:00
|
|
|
}
|