|
| 1 | +/*+***************************************************************************** |
| 2 | + * ___ _ ____ ____ |
| 3 | + * / _ \ _ _ ___ ___| |_| _ \| __ ) |
| 4 | + * | | | | | | |/ _ \/ __| __| | | | _ \ |
| 5 | + * | |_| | |_| | __/\__ \ |_| |_| | |_) | |
| 6 | + * \__\_\\__,_|\___||___/\__|____/|____/ |
| 7 | + * |
| 8 | + * Copyright (c) 2014-2019 Appsicle |
| 9 | + * Copyright (c) 2019-2026 QuestDB |
| 10 | + * |
| 11 | + * Licensed under the Apache License, Version 2.0 (the "License"); |
| 12 | + * you may not use this file except in compliance with the License. |
| 13 | + * You may obtain a copy of the License at |
| 14 | + * |
| 15 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 16 | + * |
| 17 | + * Unless required by applicable law or agreed to in writing, software |
| 18 | + * distributed under the License is distributed on an "AS IS" BASIS, |
| 19 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 20 | + * See the License for the specific language governing permissions and |
| 21 | + * limitations under the License. |
| 22 | + * |
| 23 | + ******************************************************************************/ |
| 24 | + |
| 25 | +package io.questdb.client.cutlass.auth; |
| 26 | + |
| 27 | +import java.nio.charset.StandardCharsets; |
| 28 | +import java.security.MessageDigest; |
| 29 | +import java.security.NoSuchAlgorithmException; |
| 30 | + |
| 31 | +/** |
| 32 | + * The non-secret identity a persisted token belongs to: the client id, the (canonicalised) token and |
| 33 | + * device-authorization endpoints, the scope, the optional audience, and whether the server expects |
| 34 | + * groups encoded in the token. A {@link TokenStore} keys its entries by this so a token minted for one |
| 35 | + * server / identity provider / scope / audience is never served to a process configured for another. |
| 36 | + * <p> |
| 37 | + * {@link #hash()} is a stable, lowercase-hex SHA-256 over a canonical, NUL-separated rendering of the |
| 38 | + * fields - intended as a file name (or any opaque key) that is identical across client implementations |
| 39 | + * (the Python client mirrors this), so several processes - and languages - sharing one identity address |
| 40 | + * the same persisted entry. The fields themselves are exposed (they are not secret) so a store can also |
| 41 | + * record them and re-check them on load as a defence against a hash collision or a copied file. |
| 42 | + */ |
| 43 | +public final class TokenStoreKey { |
| 44 | + // the canonical-string prefix doubles as a domain tag and a schema version, so a future format change |
| 45 | + // produces a different hash (and hence a different file) rather than silently colliding with v1 entries |
| 46 | + private static final String CANONICAL_PREFIX = "questdb-oidc-token-v1"; |
| 47 | + private static final char[] HEX = "0123456789abcdef".toCharArray(); |
| 48 | + private final String audience; |
| 49 | + private final String clientId; |
| 50 | + private final String deviceAuthorizationEndpoint; |
| 51 | + private final boolean groupsInToken; |
| 52 | + private final String hash; |
| 53 | + private final String scope; |
| 54 | + private final String tokenEndpoint; |
| 55 | + |
| 56 | + /** |
| 57 | + * @param clientId the OIDC client id |
| 58 | + * @param tokenEndpoint the canonical token endpoint ({@code scheme://host:port/path}, |
| 59 | + * scheme and host lower-cased, port explicit) |
| 60 | + * @param deviceAuthorizationEndpoint the canonical device-authorization endpoint, same form |
| 61 | + * @param scope the requested scope |
| 62 | + * @param audience the audience, or {@code null} if none |
| 63 | + * @param groupsInToken whether the id token (rather than the access token) is served |
| 64 | + */ |
| 65 | + public TokenStoreKey( |
| 66 | + String clientId, |
| 67 | + String tokenEndpoint, |
| 68 | + String deviceAuthorizationEndpoint, |
| 69 | + String scope, |
| 70 | + String audience, |
| 71 | + boolean groupsInToken |
| 72 | + ) { |
| 73 | + this.clientId = clientId; |
| 74 | + this.tokenEndpoint = tokenEndpoint; |
| 75 | + this.deviceAuthorizationEndpoint = deviceAuthorizationEndpoint; |
| 76 | + this.scope = scope; |
| 77 | + this.audience = audience; |
| 78 | + this.groupsInToken = groupsInToken; |
| 79 | + this.hash = computeHash(clientId, tokenEndpoint, deviceAuthorizationEndpoint, scope, audience, groupsInToken); |
| 80 | + } |
| 81 | + |
| 82 | + public String getAudience() { |
| 83 | + return audience; |
| 84 | + } |
| 85 | + |
| 86 | + public String getClientId() { |
| 87 | + return clientId; |
| 88 | + } |
| 89 | + |
| 90 | + public String getDeviceAuthorizationEndpoint() { |
| 91 | + return deviceAuthorizationEndpoint; |
| 92 | + } |
| 93 | + |
| 94 | + public String getScope() { |
| 95 | + return scope; |
| 96 | + } |
| 97 | + |
| 98 | + public String getTokenEndpoint() { |
| 99 | + return tokenEndpoint; |
| 100 | + } |
| 101 | + |
| 102 | + /** |
| 103 | + * @return a stable lowercase-hex SHA-256 of the canonical identity string; suitable as an opaque file |
| 104 | + * name. Identical inputs (across processes and language implementations) yield an identical hash. |
| 105 | + */ |
| 106 | + public String hash() { |
| 107 | + return hash; |
| 108 | + } |
| 109 | + |
| 110 | + public boolean isGroupsInToken() { |
| 111 | + return groupsInToken; |
| 112 | + } |
| 113 | + |
| 114 | + private static String computeHash( |
| 115 | + String clientId, |
| 116 | + String tokenEndpoint, |
| 117 | + String deviceAuthorizationEndpoint, |
| 118 | + String scope, |
| 119 | + String audience, |
| 120 | + boolean groupsInToken |
| 121 | + ) { |
| 122 | + // NUL-separate the fields so no field value can be confused with a separator; an OAuth client id, |
| 123 | + // url, scope or audience never contains a NUL. The prefix tags the domain and schema version. |
| 124 | + StringBuilder canonical = new StringBuilder(); |
| 125 | + canonical.append(CANONICAL_PREFIX).append('\0') |
| 126 | + .append(nullToEmpty(clientId)).append('\0') |
| 127 | + .append(nullToEmpty(tokenEndpoint)).append('\0') |
| 128 | + .append(nullToEmpty(deviceAuthorizationEndpoint)).append('\0') |
| 129 | + .append(nullToEmpty(scope)).append('\0') |
| 130 | + .append(nullToEmpty(audience)).append('\0') |
| 131 | + .append(groupsInToken ? '1' : '0'); |
| 132 | + try { |
| 133 | + MessageDigest digest = MessageDigest.getInstance("SHA-256"); |
| 134 | + byte[] bytes = digest.digest(canonical.toString().getBytes(StandardCharsets.UTF_8)); |
| 135 | + return toHex(bytes); |
| 136 | + } catch (NoSuchAlgorithmException e) { |
| 137 | + // SHA-256 is mandated on every JVM, so this is unreachable; rethrow defensively rather than |
| 138 | + // declare a checked exception across the whole construction path |
| 139 | + throw new OidcAuthException(e).put("SHA-256 is not available to key the OIDC token store"); |
| 140 | + } |
| 141 | + } |
| 142 | + |
| 143 | + private static String nullToEmpty(String s) { |
| 144 | + return s != null ? s : ""; |
| 145 | + } |
| 146 | + |
| 147 | + private static String toHex(byte[] bytes) { |
| 148 | + char[] out = new char[bytes.length * 2]; |
| 149 | + for (int i = 0; i < bytes.length; i++) { |
| 150 | + int v = bytes[i] & 0xff; |
| 151 | + out[i * 2] = HEX[v >>> 4]; |
| 152 | + out[i * 2 + 1] = HEX[v & 0x0f]; |
| 153 | + } |
| 154 | + return new String(out); |
| 155 | + } |
| 156 | +} |
0 commit comments