implements authorization code grant

Source/Vinder.Federation.Application/Contracts/IAuthorizationFlowHandler.cs

@@ -0,0 +1,9 @@
+namespace Vinder.Federation.Application.Contracts;
+
+public interface IAuthorizationFlowHandler
+{
+    public Task<Result<ClientAuthenticationResult>> HandleAsync(
+        ClientAuthenticationCredentials parameters,
+        CancellationToken cancellation = default
+    );
+}

Source/Vinder.Federation.Application/Handlers/Authorization/AuthorizationCodeGrantHandler.cs

@@ -0,0 +1,69 @@
+namespace Vinder.Federation.Application.Handlers.Authorization;
+
+public sealed class AuthorizationCodeGrantHandler(ITenantCollection tenantCollection, IUserCollection userCollection, ISecurityTokenService tokenService, ITokenCollection tokenCollection) : IAuthorizationFlowHandler
+{
+    public async Task<Result<ClientAuthenticationResult>> HandleAsync(
+        ClientAuthenticationCredentials parameters, CancellationToken cancellation = default)
+    {
+        var filters = new TokenFiltersBuilder()
+            .WithValue(parameters.Code)
+            .WithType(TokenType.AuthorizationCode)
+            .Build();
+
+        var tokens = await tokenCollection.GetTokensAsync(filters, cancellation: cancellation);
+        var token = tokens.FirstOrDefault();
+
+        if (token is null)
+        {
+            return Result<ClientAuthenticationResult>.Failure(AuthorizationErrors.InvalidAuthorizationCode);
+        }
+
+        if (token.IsExpired)
+        {
+            return Result<ClientAuthenticationResult>.Failure(AuthorizationErrors.AuthorizationCodeExpired);
+        }
+
+        var tenantFilters = new TenantFiltersBuilder()
+            .WithIdentifier(token.TenantId)
+            .Build();
+
+        var tenants = await tenantCollection.GetTenantsAsync(tenantFilters, cancellation: cancellation);
+        var tenant = tenants.FirstOrDefault();
+
+        if (tenant is null)
+        {
+            return Result<ClientAuthenticationResult>.Failure(AuthenticationErrors.ClientNotFound);
+        }
+
+        var codeChallenge = token.Metadata.GetValueOrDefault("code.challenge")!;
+        var codeChallengeMethod = token.Metadata.GetValueOrDefault("code.challenge.method")!;
+
+        if (!PkceCodeVerifier.Validate(parameters.CodeVerifier, codeChallenge, codeChallengeMethod))
+        {
+            return Result<ClientAuthenticationResult>.Failure(AuthorizationErrors.InvalidCodeVerifier);
+        }
+
+        var userFilters = new UserFiltersBuilder()
+            .WithIdentifier(token.UserId)
+            .Build();
+
+        var users = await userCollection.GetUsersAsync(userFilters, cancellation: cancellation);
+        var user = users.FirstOrDefault();
+
+        if (user is null)
+        {
+            return Result<ClientAuthenticationResult>.Failure(AuthenticationErrors.UserNotFound);
+        }
+
+        var tokenResult = await tokenService.GenerateAccessTokenAsync(user, cancellation);
+        if (tokenResult.IsFailure || tokenResult.Data is null)
+        {
+            return Result<ClientAuthenticationResult>.Failure(tokenResult.Error);
+        }
+
+        return Result<ClientAuthenticationResult>.Success(new()
+        {
+            AccessToken = tokenResult.Data.Value
+        });
+    }
+}

Source/Vinder.Federation.Application/Handlers/Authorization/AuthorizationHandler.cs

@@ -0,0 +1,34 @@
+namespace Vinder.Federation.Application.Handlers.Authorization;
+
+public sealed class AuthorizationHandler(ITenantCollection tenantCollection, IRedirectUriPolicy redirectUriPolicy) :
+    IMessageHandler<AuthorizationParameters, Result<AuthorizationScheme>>
+{
+    public async Task<Result<AuthorizationScheme>> HandleAsync(
+        AuthorizationParameters parameters, CancellationToken cancellation = default)
+    {
+        var filters = new TenantFiltersBuilder()
+            .WithClientId(parameters.ClientId)
+            .Build();
+
+        var clients = await tenantCollection.GetTenantsAsync(filters, cancellation);
+        var client = clients.FirstOrDefault();
+
+        if (client is null)
+        {
+            return Result<AuthorizationScheme>.Failure(TenantErrors.TenantDoesNotExist);
+        }
+
+        var redirectUri = parameters.RedirectUri.AsUri();
+
+        // according to oauth 2.0 spec (RFC 6749, section 3.1.2.3):
+        // https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2.3
+
+        var redirectProof = await redirectUriPolicy.EnsureRedirectUriIsAllowedAsync(client, redirectUri, cancellation);
+        if (redirectProof.IsFailure)
+        {
+            return Result<AuthorizationScheme>.Failure(redirectProof.Error);
+        }
+
+        return Result<AuthorizationScheme>.Success(parameters.AsReponse());
+    }
+}

Source/Vinder.Federation.Application/Handlers/Authorization/ClientCredentialsGrantHandler.cs

@@ -0,0 +1,37 @@
+namespace Vinder.Federation.Application.Handlers.Authorization;
+
+public sealed class ClientCredentialsGrantHandler(ITenantCollection tenantCollection, ISecurityTokenService tokenService) : IAuthorizationFlowHandler
+{
+    public async Task<Result<ClientAuthenticationResult>> HandleAsync(ClientAuthenticationCredentials parameters, CancellationToken cancellation = default)
+    {
+        var filters = new TenantFiltersBuilder()
+            .WithClientId(parameters.ClientId)
+            .Build();
+
+        var tenants = await tenantCollection.GetTenantsAsync(filters, cancellation: cancellation);
+        var tenant = tenants.FirstOrDefault();
+
+        if (tenant is null)
+        {
+            return Result<ClientAuthenticationResult>.Failure(AuthenticationErrors.ClientNotFound);
+        }
+
+        if (parameters.ClientSecret != tenant.SecretHash)
+        {
+            return Result<ClientAuthenticationResult>.Failure(AuthenticationErrors.InvalidClientCredentials);
+        }
+
+        var tokenResult = await tokenService.GenerateAccessTokenAsync(tenant, cancellation);
+        if (tokenResult.IsFailure)
+        {
+            return Result<ClientAuthenticationResult>.Failure(tokenResult.Error);
+        }
+
+        var response = new ClientAuthenticationResult
+        {
+            AccessToken = tokenResult.Data!.Value
+        };
+
+        return Result<ClientAuthenticationResult>.Success(response);
+    }
+}

Source/Vinder.Federation.Application/Handlers/Identity/ClientAuthenticationHandler.cs

@@ -1,41 +1,17 @@
 namespace Vinder.Federation.Application.Handlers.Identity;
 
-public sealed class ClientAuthenticationHandler(
-    ITenantCollection tenantCollection,
-    ISecurityTokenService tokenService
-) : IMessageHandler<ClientAuthenticationCredentials, Result<ClientAuthenticationResult>>
+public sealed class ClientAuthenticationHandler(ITenantCollection tenantCollection, IUserCollection userCollection, ITokenCollection tokenCollection, ISecurityTokenService tokenService) :
+    IMessageHandler<ClientAuthenticationCredentials, Result<ClientAuthenticationResult>>
 {
     public async Task<Result<ClientAuthenticationResult>> HandleAsync(
         ClientAuthenticationCredentials parameters, CancellationToken cancellation = default)
     {
-        var filters = TenantFilters.WithSpecifications()
-            .WithClientId(parameters.ClientId)
-            .Build();
-
-        var tenants = await tenantCollection.GetTenantsAsync(filters, cancellation: cancellation);
-        var tenant = tenants.FirstOrDefault();
-
-        if (tenant is null)
-        {
-            return Result<ClientAuthenticationResult>.Failure(AuthenticationErrors.ClientNotFound);
-        }
-
-        if (parameters.ClientSecret != tenant.SecretHash)
-        {
-            return Result<ClientAuthenticationResult>.Failure(AuthenticationErrors.InvalidClientCredentials);
-        }
-
-        var tokenResult = await tokenService.GenerateAccessTokenAsync(tenant, cancellation);
-        if (tokenResult.IsFailure)
-        {
-            return Result<ClientAuthenticationResult>.Failure(tokenResult.Error);
-        }
-
-        var response = new ClientAuthenticationResult
+        IAuthorizationFlowHandler handler = parameters.GrantType switch
         {
-            AccessToken = tokenResult.Data!.Value
+            SupportedGrantType.AuthorizationCode => new AuthorizationCodeGrantHandler(tenantCollection, userCollection, tokenService, tokenCollection),
+            SupportedGrantType.ClientCredentials => new ClientCredentialsGrantHandler(tenantCollection, tokenService),
         };
 
-        return Result<ClientAuthenticationResult>.Success(response);
+        return await handler.HandleAsync(parameters, cancellation);
     }
-}
+}

Source/Vinder.Federation.Application/Mappers/AuthorizationMapper.cs

@@ -0,0 +1,13 @@
+namespace Vinder.Federation.Application.Mappers;
+
+public static class AuthorizationMapper
+{
+    public static AuthorizationScheme AsReponse(this AuthorizationParameters parameters) => new()
+    {
+        ClientId = parameters.ClientId,
+        RedirectUri = parameters.RedirectUri,
+        State = parameters.State,
+        CodeChallenge = parameters.CodeChallenge,
+        CodeChallengeMethod = parameters.CodeChallengeMethod,
+    };
+}

Source/Vinder.Federation.Application/Mappers/JsonWebKeysMapper.cs

@@ -1,6 +1,3 @@
-using Microsoft.IdentityModel.Tokens;
-using Vinder.Federation.Application.Payloads.Connect;
-
 namespace Vinder.Federation.Application.Mappers;
 
 public static class JsonWebKeysMapper
@@ -25,4 +22,4 @@ public static JsonWebKeySetScheme AsJsonWebKeySetScheme(Secret secret)
             Keys = [JsonWebKeysMapper.AsJsonWebKeys(secret)]
         };
     }
-}
+}

Source/Vinder.Federation.Application/Mappers/RedirectUriMapper.cs

@@ -0,0 +1,7 @@
+namespace Vinder.Federation.Application.Mappers;
+
+public static class RedirectUriMapper
+{
+    public static RedirectUri AsUri(this string uri) =>
+        new(uri);
+}

Source/Vinder.Federation.Application/Payloads/Authorization/AuthorizationParameters.cs

@@ -0,0 +1,15 @@
+namespace Vinder.Federation.Application.Payloads.Authorization;
+
+public sealed record AuthorizationParameters : IMessage<Result<AuthorizationScheme>>
+{
+    public string ResponseType { get; init; } = default!;
+    public string RedirectUri { get; init; } = default!;
+
+    public string ClientId { get; init; } = default!;
+
+    public string CodeChallenge { get; init; } = default!;
+    public string CodeChallengeMethod { get; init; } = default!;
+
+    public string? Scope { get; init; } = default!;
+    public string? State { get; init; } = default!;
+}

Source/Vinder.Federation.Application/Payloads/Authorization/AuthorizationScheme.cs

@@ -0,0 +1,10 @@
+namespace Vinder.Federation.Application.Payloads.Authorization;
+
+public sealed record AuthorizationScheme
+{
+    public string ClientId { get; init; } = default!;
+    public string RedirectUri { get; init; } = default!;
+    public string CodeChallenge { get; init; } = default!;
+    public string CodeChallengeMethod { get; init; } = default!;
+    public string? State { get; init; } = default;
+}

Source/Vinder.Federation.Application/Payloads/Identity/ClientAuthenticationCredentials.cs

@@ -3,6 +3,12 @@ namespace Vinder.Federation.Application.Payloads.Identity;
 public sealed record ClientAuthenticationCredentials : IMessage<Result<ClientAuthenticationResult>>
 {
     public string GrantType { get; init; } = default!;
+
+    // for client_credentials grant type
     public string ClientId { get; init; } = default!;
     public string ClientSecret { get; init; } = default!;
-}
+
+    // for authorization_code grant type
+    public string Code { get; init; } = default!;
+    public string CodeVerifier { get; init; } = default!;
+}

Source/Vinder.Federation.Application/Policies/RedirectUriPolicy.cs

@@ -0,0 +1,17 @@
+namespace Vinder.Federation.Application.Policies;
+
+public sealed class RedirectUriPolicy : IRedirectUriPolicy
+{
+    public async Task<Result> EnsureRedirectUriIsAllowedAsync(
+        Tenant tenant, RedirectUri redirectUri, CancellationToken cancellation = default)
+    {
+        // according to oauth 2.0 spec (RFC 6749, section 3.1.2.3):
+        // https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2.3
+
+        var isAllowed = tenant.RedirectUris.Contains(redirectUri);
+
+        return isAllowed ?
+            Result.Success() :
+            Result.Failure(AuthorizationErrors.RedirectUriNotAllowed);
+    }
+}

Source/Vinder.Federation.Application/Usings.cs

@@ -1,9 +1,12 @@
 global using System.Text.Json.Serialization;
+global using System.Security.Cryptography;
 
 global using Vinder.Internal.Essentials.Patterns;
 global using Vinder.Internal.Essentials.Filtering;
 
 global using Vinder.Federation.Domain.Errors;
+global using Vinder.Federation.Domain.Policies;
+global using Vinder.Federation.Domain.Concepts;
 global using Vinder.Federation.Common.Constants;
 
 global using Vinder.Federation.Domain.Aggregates;
@@ -13,6 +16,7 @@
 
 global using Vinder.Federation.Application.Payloads.Common;
 global using Vinder.Federation.Application.Payloads.Identity;
+global using Vinder.Federation.Application.Payloads.Authorization;
 global using Vinder.Federation.Application.Payloads.Group;
 global using Vinder.Federation.Application.Payloads.Permission;
 global using Vinder.Federation.Application.Payloads.Tenant;
@@ -22,8 +26,11 @@
 global using Vinder.Federation.Application.Payloads.Connect;
 
 global using Vinder.Federation.Application.Services;
+global using Vinder.Federation.Application.Contracts;
 global using Vinder.Federation.Application.Providers;
 global using Vinder.Federation.Application.Mappers;
+global using Vinder.Federation.Application.Utilities;
+global using Vinder.Federation.Application.Handlers.Authorization;
 
 global using FluentValidation;
 global using Vinder.Dispatcher.Contracts;

Source/Vinder.Federation.Application/Utilities/PkceCodeVerifier.cs

@@ -0,0 +1,31 @@
+namespace Vinder.Federation.Application.Utilities;
+
+public static class PkceCodeVerifier
+{
+    public static bool Validate(string codeVerifier, string codeChallenge, string method)
+    {
+        if (string.IsNullOrWhiteSpace(codeVerifier) || string.IsNullOrWhiteSpace(codeChallenge))
+        {
+            return false;
+        }
+
+        // according to pkce spec (RFC 7636, section 4.6):
+        // https://datatracker.ietf.org/doc/html/rfc7636#section-4.6
+
+        return method switch
+        {
+            SupportedPkceMethods.PkceS256 => PkceCodeVerifier.ValidateS256(codeVerifier, codeChallenge),
+            SupportedPkceMethods.PkcePlain => codeVerifier == codeChallenge,
+
+            _ => false
+        };
+    }
+
+    private static bool ValidateS256(string codeVerifier, string codeChallenge)
+    {
+        var bytes = SHA256.HashData(System.Text.Encoding.ASCII.GetBytes(codeVerifier));
+        var hashed = Base64UrlEncoder.Encode(bytes);
+
+        return hashed == codeChallenge;
+    }
+}