feat(grpc): add v3 RevokeOAuth2Token

Author: PromiseFru

.gitignore

@@ -152,6 +152,8 @@ dmypy.json
 *.sqlite
 *.sqlite3
 *.db
+*.db-wal
+*.db-shm
 
 # Ignore all .proto files
 *.proto

db.py

@@ -6,7 +6,7 @@
 from typing import Generator, Optional
 from urllib.parse import quote, quote_plus
 
-from sqlalchemy import create_engine, text
+from sqlalchemy import create_engine, event, text
 from sqlalchemy.engine import Engine
 from sqlalchemy.orm import Session, declarative_base, sessionmaker
 from sqlalchemy.pool import QueuePool, StaticPool
@@ -33,7 +33,7 @@ def _make_sqlcipher3_creator(db_path: str, key: str):
     import sqlcipher3
 
     def connect():
-        conn = sqlcipher3.connect(db_path, check_same_thread=False)
+        conn = sqlcipher3.connect(db_path, check_same_thread=False, timeout=30)
         conn.execute("PRAGMA cipher_compatibility = 4;")
         conn.execute(f"PRAGMA key = \"x'{key}'\";")
 
@@ -179,12 +179,19 @@ def _create_engine() -> Engine:
             engine = create_engine(
                 url,
                 echo=False,
-                connect_args={"check_same_thread": False},
+                connect_args={"check_same_thread": False, "timeout": 30},
                 poolclass=QueuePool,
                 pool_size=5,
                 pool_pre_ping=True,
             )
 
+        @event.listens_for(engine, "connect")
+        def set_sqlite_pragma(dbapi_connection, connection_record):
+            cursor = dbapi_connection.cursor()
+            cursor.execute("PRAGMA journal_mode=WAL")
+            cursor.execute("PRAGMA synchronous=NORMAL")
+            cursor.close()
+
     with engine.connect() as conn:
         conn.execute(text("SELECT 1"))
 

docs/grpc.md

@@ -7,6 +7,7 @@
 - [Version 3 API](#version-3-api)
   - [v3: Get OAuth2 Authorization URL](#v3-get-oauth2-authorization-url)
   - [v3: Exchange OAuth2 Code and Store Token](#v3-exchange-oauth2-code-and-store-token)
+  - [v3: Revoke and Delete OAuth2 Token](#v3-revoke-and-delete-oauth2-token)
 - [Version 2 API](#version-2-api)
   - [v2: Get OAuth2 Authorization URL](#v2-get-oauth2-authorization-url)
   - [v2: Exchange OAuth2 Code and Store Token](#v2-exchange-oauth2-code-and-store-token)
@@ -222,6 +223,43 @@ EOF
 
 ---
 
+### v3: Revoke and Delete OAuth2 Token
+
+Revokes and deletes an OAuth2 token from the vault using the token ID and the key ID used for its encryption.
+
+**Request:** `RevokeOAuth2TokenRequest`
+
+| Field | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| token_id | bytes | Yes | Unique identifier for the stored token |
+| key_id | uint32 | Yes | Key index used for encrypting the token |
+
+**Response:** `RevokeOAuth2TokenResponse`
+
+| Field | Type | Description |
+| :--- | :--- | :--- |
+| success | bool | Operation success |
+| message | string | Response message |
+
+**Example:**
+
+```bash
+grpcurl -plaintext \
+  -H 'x-payload-bin: <encrypted_payload_binary>' \
+  -H 'x-public-key-bin: <client_pk_binary>' \
+  -H 'x-key-id: <key_id>' \
+  -H 'x-nonce-bin: <nonce_binary>' \
+  -H 'x-timestamp: <timestamp>' \
+  -d '{
+    "token_id": "<token_id_binary>",
+    "key_id": 123
+  }' \
+  -proto protos/v3/publisher.proto \
+  <your_host>:<your_port> publisher.v3.Publisher/RevokeOAuth2Token
+```
+
+---
+
 ## Version 2 API
 
 **Package:** `publisher.v2`  

grpc_services/v3/exchange_oauth2_code.py

@@ -2,10 +2,13 @@
 """ExchangeOAuth2CodeAndStore gRPC service handler."""
 
 import grpc
-from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PublicKey
 
 from db import get_session
-from grpc_services.v3.utils import create_token_pools_and_encrypt, get_oauth2_adapter
+from grpc_services.v3.utils import (
+    create_token_pools_and_encrypt,
+    get_oauth2_adapter,
+    validate_client_ephemeral_public_keys,
+)
 from logutils import get_logger
 from models.token import create as create_token
 from platforms.adapter_ipc_handler import AdapterIPCHandler
@@ -14,27 +17,6 @@
 logger = get_logger(__name__)
 
 
-def _validate_client_ephemeral_public_keys(keys) -> None:
-    """Validate client ephemeral public keys format and count."""
-    if len(keys) != 256:
-        raise ValueError(
-            f"client_ephemeral_public_keys must contain exactly 256 keys, "
-            f"got {len(keys)}"
-        )
-    for key_obj in keys:
-        if len(key_obj.public_key) != 32:
-            raise ValueError(
-                f"Invalid key for key_id {key_obj.key_id}: "
-                f"must be 32 bytes, got {len(key_obj.public_key)}"
-            )
-        try:
-            X25519PublicKey.from_public_bytes(key_obj.public_key)
-        except Exception as e:
-            raise ValueError(
-                f"Invalid cryptographic key for key_id {key_obj.key_id}: {e}"
-            )
-
-
 def ExchangeOAuth2CodeAndStore(self, request, context):
     """Exchange an OAuth2 authorization code for a token."""
 
@@ -54,16 +36,17 @@ def ExchangeOAuth2CodeAndStore(self, request, context):
         return invalid
 
     try:
-        _validate_client_ephemeral_public_keys(request.client_ephemeral_public_keys)
-    except ValueError as exc:
-        return self.handle_create_grpc_error_response(
-            context,
-            response,
-            exc,
-            grpc.StatusCode.INVALID_ARGUMENT,
+        validation_error = validate_client_ephemeral_public_keys(
+            request.client_ephemeral_public_keys
         )
+        if validation_error:
+            return self.handle_create_grpc_error_response(
+                context,
+                response,
+                validation_error,
+                grpc.StatusCode.INVALID_ARGUMENT,
+            )
 
-    try:
         adapter = get_oauth2_adapter(request.platform)
 
         pipe = AdapterIPCHandler.invoke(
@@ -100,7 +83,7 @@ def ExchangeOAuth2CodeAndStore(self, request, context):
                 session=s,
             )
 
-            (token_ciphertext, kid_index, server_public_keys) = (
+            token_ciphertext, kid_index, server_public_keys = (
                 create_token_pools_and_encrypt(
                     token_id=token.id,
                     client_ephemeral_public_keys=request.client_ephemeral_public_keys,

grpc_services/v3/get_oauth2_auth_url.py

@@ -29,20 +29,18 @@ def GetOAuth2AuthorizationUrl(self, request, context):
     try:
         adapter = get_oauth2_adapter(request.platform)
 
-        params = {
-            "state": request.state or None,
-            "code_verifier": request.code_verifier or None,
-            "autogenerate_code_verifier": request.autogenerate_code_verifier,
-            "redirect_url": request.redirect_url or None,
-            "request_identifier": request.request_identifier or None,
-            "base_path": adapter["assets_path"],
-        }
-
         pipe = AdapterIPCHandler.invoke(
             adapter_path=adapter["path"],
             venv_path=adapter["venv_path"],
             method="get_authorization_url",
-            params=params,
+            params={
+                "state": request.state or None,
+                "code_verifier": request.code_verifier or None,
+                "autogenerate_code_verifier": request.autogenerate_code_verifier,
+                "redirect_url": request.redirect_url or None,
+                "request_identifier": request.request_identifier or None,
+                "base_path": adapter["assets_path"],
+            },
         )
 
         if pipe.get("error"):

grpc_services/v3/revoke_oauth2_token.py

@@ -0,0 +1,106 @@
+# SPDX-License-Identifier: GPL-3.0-only
+"""RevokeOAuth2Token gRPC service handler."""
+
+import hashlib
+import secrets
+
+import grpc
+
+from db import get_session
+from grpc_services.v3.utils import get_keys_for_decryption, get_oauth2_adapter
+from lib_relaysms_payload_specs.generated import relaysms_spec_payload as rrs
+from logutils import get_logger
+from models.server_identity_key import mark_key_used as mark_ss_key_used
+from platforms.adapter_ipc_handler import AdapterIPCHandler
+from protos.v3 import publisher_pb2
+
+logger = get_logger(__name__)
+
+
+def RevokeOAuth2Token(self, request, context):
+    """Revoke and delete a stored OAuth2 token."""
+    response = publisher_pb2.RevokeOAuth2TokenResponse
+
+    payload_bin, auth_error = self.handle_v1_request_auth(context, response)
+    if auth_error:
+        return auth_error
+
+    invalid = self.handle_request_field_validation(
+        context, request, response, ["token_id", "key_id"]
+    )
+    if invalid:
+        return invalid
+
+    try:
+        with get_session() as s:
+            token, token_hash_obj, ss_kid, es_kid, ec_kid_pk = get_keys_for_decryption(
+                token_id_bytes=request.token_id,
+                key_id=request.key_id,
+                session=s,
+            )
+
+            try:
+                decrypted_token = rrs.v1_token_decrypt_server(
+                    ss_kid=ss_kid,
+                    es_kid=es_kid,
+                    ec_kid_pk=ec_kid_pk,
+                    key_id=request.key_id,
+                    ciphertext=payload_bin,
+                )
+            except rrs.V1CryptographicError.FailedToDecrypt as e:
+                return self.handle_create_grpc_error_response(
+                    context,
+                    response,
+                    f"token decryption failed: {e}",
+                    grpc.StatusCode.UNAUTHENTICATED,
+                )
+
+            if not secrets.compare_digest(
+                hashlib.sha256(decrypted_token).digest(), token_hash_obj.token_hash
+            ):
+                return self.handle_create_grpc_error_response(
+                    context,
+                    response,
+                    "token hash mismatch",
+                    grpc.StatusCode.UNAUTHENTICATED,
+                )
+
+            adapter = get_oauth2_adapter(token.platform)
+
+            pipe = AdapterIPCHandler.invoke(
+                adapter_path=adapter["path"],
+                venv_path=adapter["venv_path"],
+                method="revoke_token",
+                params={
+                    "token": token.token_data["token"],
+                    "base_path": adapter["assets_path"],
+                },
+            )
+
+            if pipe.get("error"):
+                logger.error("adapter revocation failed: %s", pipe["error"])
+
+            s.delete(token)
+            mark_ss_key_used(request.key_id, s)
+
+        return response(success=True, message="Successfully revoked and deleted token")
+
+    except ValueError as exc:
+        return self.handle_create_grpc_error_response(
+            context, response, exc, grpc.StatusCode.NOT_FOUND
+        )
+
+    except NotImplementedError as exc:
+        return self.handle_create_grpc_error_response(
+            context, response, exc, grpc.StatusCode.UNIMPLEMENTED
+        )
+
+    except Exception as exc:
+        return self.handle_create_grpc_error_response(
+            context,
+            response,
+            exc,
+            grpc.StatusCode.INTERNAL,
+            user_msg="Oops! Something went wrong. Please try again later.",
+            error_type="UNKNOWN",
+        )

grpc_services/v3/service.py

@@ -9,6 +9,7 @@
 
 from grpc_services.v3.exchange_oauth2_code import ExchangeOAuth2CodeAndStore
 from grpc_services.v3.get_oauth2_auth_url import GetOAuth2AuthorizationUrl
+from grpc_services.v3.revoke_oauth2_token import RevokeOAuth2Token
 from grpc_services.v3.utils import verify_v1_request
 from logutils import get_logger
 from protos.v3 import publisher_pb2_grpc
@@ -27,6 +28,7 @@ class PublisherServiceV3(publisher_pb2_grpc.PublisherServicer):
 
     GetOAuth2AuthorizationUrl = GetOAuth2AuthorizationUrl
     ExchangeOAuth2CodeAndStore = ExchangeOAuth2CodeAndStore
+    RevokeOAuth2Token = RevokeOAuth2Token
 
     @classmethod
     def _get_nonce_lock(cls) -> threading.Lock: