Merge pull request #13 from jokk-itu/feature/get-subject

jokk-itu · web-flow · commit d5cb5187a33b · 2025-01-05T12:40:51.000+01:00
Feature/get subject
diff --git a/README.md b/README.md
@@ -10,8 +10,14 @@ The following grant types are supported:
 
 ## Pipeline runs
 
-TODO
+[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=jokk-itu_authserver-framework&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=jokk-itu_authserver-framework)
+[![Coverage](https://sonarcloud.io/api/project_badges/measure?project=jokk-itu_authserver-framework&metric=coverage)](https://sonarcloud.io/summary/new_code?id=jokk-itu_authserver-framework)
+[![CI](https://github.com/jokk-itu/authserver-framework/actions/workflows/build.yml/badge.svg)](https://github.com/jokk-itu/authserver-framework/actions/workflows/build.yml)
 
 ## Documentation
 
-Take a look at [authserver.dk](https://www.authserver.dk).
+Take a look at [authserver.dk](https://www.authserver.dk).
+
+## Demo
+
+Take a look at [authserver demo](https://github.com/jokk-itu/authserver-demo).
diff --git a/src/AuthServer.TestIdentityProvider/Pages/Consent.cshtml.cs b/src/AuthServer.TestIdentityProvider/Pages/Consent.cshtml.cs
@@ -11,14 +11,10 @@ namespace AuthServer.TestIdentityProvider.Pages;
 [ValidateAntiForgeryToken]
 public class ConsentModel : PageModel
 {
-    private readonly IAuthorizeUserAccessor _authorizeUserAccessor;
     private readonly IAuthorizeService _authorizeService;
 
-    public ConsentModel(
-        IAuthorizeUserAccessor authorizeUserAccessor,
-        IAuthorizeService authorizeService)
+    public ConsentModel(IAuthorizeService authorizeService)
     {
-        _authorizeUserAccessor = authorizeUserAccessor;
         _authorizeService = authorizeService;
     }
 
@@ -29,10 +25,10 @@ public ConsentModel(
 
     public class InputModel
     {
-        public required string ClientName { get; set; }
+        public string? ClientName { get; set; }
         public string? ClientUri { get; set; }
         public string? ClientLogoUri { get; set; }
-        public required string Username { get; set; }
+        public string? Username { get; set; }
         public List<string> RequestedScope { get; set; } = [];
         public List<ClaimDto> RequestedClaims { get; set; } = [];
         public List<string> ConsentedScope { get; set; } = [];
@@ -49,13 +45,15 @@ public async Task OnGet(string returnUrl, CancellationToken cancellationToken)
     {
         ReturnUrl = returnUrl ?? Url.Content("~/");
 
-        var user = _authorizeUserAccessor.GetUser();
         var query = HttpUtility.ParseQueryString(new Uri(ReturnUrl).Query);
         var requestUri = query.Get(Parameter.RequestUri)!;
         var clientId = query.Get(Parameter.ClientId)!;
-        var consentGrantDto = await _authorizeService.GetConsentGrantDto(user.SubjectIdentifier, clientId, cancellationToken);
 
         var request = (await _authorizeService.GetRequest(requestUri, clientId, cancellationToken))!;
+
+        var subject = await _authorizeService.GetSubject(request);
+        var consentGrantDto = await _authorizeService.GetConsentGrantDto(subject, clientId, cancellationToken);
+        
         var requestedScope = request.Scope.ToList();
 
         // Display requested claims, also if they are already consented. This makes sure the end-user can change their full consent.
@@ -82,11 +80,12 @@ public async Task<IActionResult> OnPostAccept(string returnUrl, CancellationToke
     {
         ReturnUrl = returnUrl ?? Url.Content("~/");
 
-        var user = _authorizeUserAccessor.GetUser();
         var query = HttpUtility.ParseQueryString(new Uri(ReturnUrl).Query);
         var clientId = query.Get(Parameter.ClientId)!;
-
-        await _authorizeService.CreateOrUpdateConsentGrant(user.SubjectIdentifier, clientId, Input.ConsentedScope, Input.ConsentedClaims, cancellationToken);
+        var requestUri = query.Get(Parameter.RequestUri)!;
+        var request = (await _authorizeService.GetRequest(requestUri, clientId, cancellationToken))!;
+        var subject = await _authorizeService.GetSubject(request);
+        await _authorizeService.CreateOrUpdateConsentGrant(subject, clientId, Input.ConsentedScope, Input.ConsentedClaims, cancellationToken);
 
         return Redirect(ReturnUrl);
     }
diff --git a/src/AuthServer/AuthServer.csproj b/src/AuthServer/AuthServer.csproj
@@ -32,6 +32,7 @@
 
 	<ItemGroup>
 		<FrameworkReference Include="Microsoft.AspNetCore.App" />
+		<None Include="README.md" Pack="true" PackagePath="\" />
 	</ItemGroup>
 
 	<ItemGroup>
@@ -42,8 +43,4 @@
 		<InternalsVisibleTo Include="DynamicProxyGenAssembly2" />
 	</ItemGroup>
 
-	<ItemGroup>
-		<None Include="README.md" Pack="true" PackagePath="\" />
-	</ItemGroup>
-
 </Project>
diff --git a/src/AuthServer/Authentication/Abstractions/IUserClaimService.cs b/src/AuthServer/Authentication/Abstractions/IUserClaimService.cs
@@ -17,5 +17,5 @@ public interface IUserClaimService
     /// <param name="subjectIdentifier"></param>
     /// <param name="cancellationToken"></param>
     /// <returns></returns>
-    Task<string> GetUserName(string subjectIdentifier, CancellationToken cancellationToken);
+    Task<string> GetUsername(string subjectIdentifier, CancellationToken cancellationToken);
 }
diff --git a/src/AuthServer/Authentication/OAuthToken/OAuthTokenAuthenticationHandler.cs b/src/AuthServer/Authentication/OAuthToken/OAuthTokenAuthenticationHandler.cs
@@ -99,7 +99,7 @@ protected override async Task HandleChallengeAsync(AuthenticationProperties prop
         }
         else
         {
-            throw new InvalidOperationException("Challenge must happened from failure or none");
+            throw new InvalidOperationException("Challenge must happen from failure or none");
         }
 
         Response.StatusCode = 401;
diff --git a/src/AuthServer/Authorize/Abstractions/IAuthorizeService.cs b/src/AuthServer/Authorize/Abstractions/IAuthorizeService.cs
@@ -61,4 +61,10 @@ public interface IAuthorizeService
     /// <param name="cancellationToken"></param>
     /// <returns></returns>
     Task<IActionResult> GetErrorResult(string requestUri, string clientId, OAuthError oauthError, HttpContext httpContext, CancellationToken cancellationToken);
+
+    /// <summary>
+    /// Get the subject from AuthorizeUser, IdTokenHint or AuthenticatedUser.
+    /// </summary>
+    /// <returns></returns>
+    Task<string> GetSubject(AuthorizeRequestDto authorizeRequestDto);
 }
diff --git a/src/AuthServer/Authorize/AuthorizeService.cs b/src/AuthServer/Authorize/AuthorizeService.cs
@@ -7,6 +7,8 @@
 using AuthServer.Endpoints.Responses;
 using AuthServer.Repositories.Abstractions;
 using AuthServer.RequestAccessors.Authorize;
+using AuthServer.TokenDecoders;
+using AuthServer.TokenDecoders.Abstractions;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 
@@ -20,6 +22,9 @@ internal class AuthorizeService : IAuthorizeService
     private readonly IAuthenticationContextReferenceResolver _authenticationContextResolver;
     private readonly ISecureRequestService _secureRequestService;
     private readonly IAuthorizeResponseBuilder _authorizeResponseBuilder;
+    private readonly IAuthenticatedUserAccessor _authenticatedUserAccessor;
+    private readonly IAuthorizeUserAccessor _authorizeUserAccessor;
+    private readonly ITokenDecoder<ServerIssuedTokenDecodeArguments> _tokenDecoder;
 
     public AuthorizeService(
         IConsentGrantRepository consentGrantRepository,
@@ -28,7 +33,10 @@ public AuthorizeService(
         IUserClaimService userClaimService,
         IAuthenticationContextReferenceResolver authenticationContextResolver,
         ISecureRequestService secureRequestService,
-        IAuthorizeResponseBuilder authorizeResponseBuilder)
+        IAuthorizeResponseBuilder authorizeResponseBuilder,
+        IAuthenticatedUserAccessor authenticatedUserAccessor,
+        IAuthorizeUserAccessor authorizeUserAccessor,
+        ITokenDecoder<ServerIssuedTokenDecodeArguments> tokenDecoder)
     {
         _consentGrantRepository = consentGrantRepository;
         _authorizationGrantRepository = authorizationGrantRepository;
@@ -37,6 +45,9 @@ public AuthorizeService(
         _authenticationContextResolver = authenticationContextResolver;
         _secureRequestService = secureRequestService;
         _authorizeResponseBuilder = authorizeResponseBuilder;
+        _authenticatedUserAccessor = authenticatedUserAccessor;
+        _authorizeUserAccessor = authorizeUserAccessor;
+        _tokenDecoder = tokenDecoder;
     }
 
     /// <inheritdoc/>
@@ -59,7 +70,7 @@ public async Task<ConsentGrantDto> GetConsentGrantDto(string subjectIdentifier,
     {
         var consentGrant = await _consentGrantRepository.GetConsentGrant(subjectIdentifier, clientId, cancellationToken);
         var cachedClient = await _cachedClientStore.Get(clientId, cancellationToken);
-        var username = await _userClaimService.GetUserName(subjectIdentifier, cancellationToken);
+        var username = await _userClaimService.GetUsername(subjectIdentifier, cancellationToken);
 
         return new ConsentGrantDto
         {
@@ -95,4 +106,23 @@ public async Task<IActionResult> GetErrorResult(string requestUri, string client
         };
         return await _authorizeResponseBuilder.BuildResponse(request, errorParameters, cancellationToken);
     }
+
+    /// <inheritdoc/>
+    public async Task<string> GetSubject(AuthorizeRequestDto authorizeRequestDto)
+    {
+        var authorizeUser = _authorizeUserAccessor.TryGetUser();
+        if (authorizeUser is not null)
+        {
+            return authorizeUser.SubjectIdentifier;
+        }
+
+        if (authorizeRequestDto.IdTokenHint is not null)
+        {
+            var idToken = await _tokenDecoder.Read(authorizeRequestDto.IdTokenHint);
+            return idToken.Subject;
+        }
+
+        var authenticatedUser = await _authenticatedUserAccessor.GetAuthenticatedUser();
+        return authenticatedUser?.SubjectIdentifier ?? throw new InvalidOperationException("subject cannot be deduced");
+    }
 }
diff --git a/src/AuthServer/Introspection/IntrospectionEndpointHandler.cs b/src/AuthServer/Introspection/IntrospectionEndpointHandler.cs
@@ -1,5 +1,4 @@
 ﻿using AuthServer.Core.Abstractions;
-using AuthServer.Core.Request;
 using AuthServer.Endpoints.Responses;
 using AuthServer.Extensions;
 using AuthServer.RequestAccessors.Introspection;
diff --git a/src/AuthServer/Introspection/IntrospectionRequestProcessor.cs b/src/AuthServer/Introspection/IntrospectionRequestProcessor.cs
@@ -62,7 +62,7 @@ public async Task<IntrospectionResponse> Process(IntrospectionValidatedRequest r
         string? username = null;
         if (query.SubjectIdentifier is not null)
         {
-            username = await _userClaimService.GetUserName(query.SubjectIdentifier, cancellationToken);
+            username = await _userClaimService.GetUsername(query.SubjectIdentifier, cancellationToken);
         }
 
         var subject = query.SubjectFromGrantToken ?? query.SubjectFromClientToken;
diff --git a/tests/AuthServer.Tests.Core/UserClaimService.cs b/tests/AuthServer.Tests.Core/UserClaimService.cs
@@ -33,7 +33,7 @@ public Task<IEnumerable<Claim>> GetClaims(string subjectIdentifier, Cancellation
         ]);
     }
 
-    public Task<string> GetUserName(string subjectIdentifier, CancellationToken cancellationToken)
+    public Task<string> GetUsername(string subjectIdentifier, CancellationToken cancellationToken)
     {
         return Task.FromResult(UserConstants.Username);
     }
diff --git a/tests/AuthServer.Tests.UnitTest/Introspection/IntrospectionRequestProcessorTest.cs b/tests/AuthServer.Tests.UnitTest/Introspection/IntrospectionRequestProcessorTest.cs
@@ -151,7 +151,7 @@ public async Task Process_ActiveToken_ExpectIsActiveIsTrue()
         var subjectIdentifier = new SubjectIdentifier();
         const string username = "JohnDoe";
         userClaimServiceMock
-            .Setup(x => x.GetUserName(subjectIdentifier.Id, CancellationToken.None))
+            .Setup(x => x.GetUsername(subjectIdentifier.Id, CancellationToken.None))
             .ReturnsAsync(username)
             .Verifiable();
 
diff --git a/tools/NuGetPush.ps1 b/tools/NuGetPush.ps1
@@ -0,0 +1 @@
+dotnet nuget push "*.nupkg" -s "https://nuget.pkg.github.com/jokk-itu/index.json" -k $Env:GithubToken

Original file line number	Diff line number	Diff line change
`@@ -17,5 +17,5 @@ public interface IUserClaimService`
`17`	`17`	`/// <param name="subjectIdentifier"></param>`
`18`	`18`	`/// <param name="cancellationToken"></param>`
`19`	`19`	`/// <returns></returns>`
`20`		`- Task<string> GetUserName(string subjectIdentifier, CancellationToken cancellationToken);`
	`20`	`+ Task<string> GetUsername(string subjectIdentifier, CancellationToken cancellationToken);`
`21`	`21`	`}`
Original file line number	Diff line number	Diff line change
`@@ -99,7 +99,7 @@ protected override async Task HandleChallengeAsync(AuthenticationProperties prop`
`99`	`99`	`}`
`100`	`100`	`else`
`101`	`101`	`{`
`102`		`- throw new InvalidOperationException("Challenge must happened from failure or none");`
	`102`	`+ throw new InvalidOperationException("Challenge must happen from failure or none");`
`103`	`103`	`}`
`104`	`104`
`105`	`105`	`Response.StatusCode = 401;`
Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,4 @@`
`1`	`1`	`using AuthServer.Core.Abstractions;`
`2`		`-using AuthServer.Core.Request;`
`3`	`2`	`using AuthServer.Endpoints.Responses;`
`4`	`3`	`using AuthServer.Extensions;`
`5`	`4`	`using AuthServer.RequestAccessors.Introspection;`
Original file line number	Diff line number	Diff line change
`@@ -62,7 +62,7 @@ public async Task<IntrospectionResponse> Process(IntrospectionValidatedRequest r`
`62`	`62`	`string? username = null;`
`63`	`63`	`if (query.SubjectIdentifier is not null)`
`64`	`64`	`{`
`65`		`- username = await _userClaimService.GetUserName(query.SubjectIdentifier, cancellationToken);`
	`65`	`+ username = await _userClaimService.GetUsername(query.SubjectIdentifier, cancellationToken);`
`66`	`66`	`}`
`67`	`67`
`68`	`68`	`var subject = query.SubjectFromGrantToken ?? query.SubjectFromClientToken;`
Original file line number	Diff line number	Diff line change
`@@ -33,7 +33,7 @@ public Task<IEnumerable<Claim>> GetClaims(string subjectIdentifier, Cancellation`
`33`	`33`	`]);`
`34`	`34`	`}`
`35`	`35`
`36`		`- public Task<string> GetUserName(string subjectIdentifier, CancellationToken cancellationToken)`
	`36`	`+ public Task<string> GetUsername(string subjectIdentifier, CancellationToken cancellationToken)`
`37`	`37`	`{`
`38`	`38`	`return Task.FromResult(UserConstants.Username);`
`39`	`39`	`}`