Merge pull request #5179 from indeewari/feature/application-revocation

Revoke application artifacts through administration flows

Author: ThaminduDilshan

backend/.mockery.public.yml

@@ -404,13 +404,16 @@ packages:
       pkgname: flowmgtmock
       filename: "{{.InterfaceName}}_mock.go"
 
+  # Only the registry is mocked outside this package. The rest of the executor interfaces are internal
+  # seams, and one of them names an unexported type, which a mock in another package cannot reference.
   github.com/thunder-id/thunderid/internal/flow/executor:
     config:
-      all: true
       dir: tests/mocks/flow/executormock
       structname: '{{.InterfaceName}}Mock'
       pkgname: executormock
       filename: "{{.InterfaceName}}_mock.go"
+    interfaces:
+      ExecutorRegistryInterface:
 
   github.com/thunder-id/thunderid/internal/flow/interceptor:
     config:

backend/cmd/server/bootstrap/01-default-resources.yaml

@@ -1991,6 +1991,168 @@ nodes:
       x: 1740
       y: 200
 ---
+resource_type: flow
+id: 01900000-0000-7000-8000-000000000079
+name: Default Application Deletion Flow
+handle: default-application-deletion-flow
+flowType: ADMINISTRATION
+nodes:
+- id: start
+  type: START
+  onSuccess: permission_validator
+  layout:
+    size:
+      width: 101
+      height: 34
+    position:
+      x: 100
+      y: 200
+- id: permission_validator
+  type: TASK_EXECUTION
+  executor:
+    name: PermissionValidator
+  onSuccess: validate_application_deletion
+  layout:
+    size:
+      width: 206
+      height: 113
+    position:
+      x: 300
+      y: 175
+- id: validate_application_deletion
+  type: TASK_EXECUTION
+  executor:
+    name: ApplicationActionValidator
+    mode: revoke_all
+  onSuccess: revoke_tokens
+  layout:
+    size:
+      width: 240
+      height: 113
+    position:
+      x: 580
+      y: 175
+- id: revoke_tokens
+  type: TASK_EXECUTION
+  executor:
+    name: CriteriaRevocationExecutor
+  onSuccess: revoke_sessions
+  layout:
+    size:
+      width: 206
+      height: 113
+    position:
+      x: 900
+      y: 175
+- id: revoke_sessions
+  type: TASK_EXECUTION
+  executor:
+    name: SessionRevocationExecutor
+  onSuccess: delete_application
+  layout:
+    size:
+      width: 206
+      height: 113
+    position:
+      x: 1180
+      y: 175
+- id: delete_application
+  type: TASK_EXECUTION
+  executor:
+    name: ApplicationDeleteExecutor
+  onSuccess: end
+  layout:
+    size:
+      width: 220
+      height: 113
+    position:
+      x: 1460
+      y: 175
+- id: end
+  type: END
+  layout:
+    size:
+      width: 85
+      height: 34
+    position:
+      x: 1760
+      y: 200
+---
+resource_type: flow
+id: 01900000-0000-7000-8000-00000000007a
+name: Default Secret Regeneration Flow
+handle: default-secret-regeneration-flow
+flowType: ADMINISTRATION
+nodes:
+- id: start
+  type: START
+  onSuccess: permission_validator
+  layout:
+    size:
+      width: 101
+      height: 34
+    position:
+      x: 100
+      y: 200
+- id: permission_validator
+  type: TASK_EXECUTION
+  executor:
+    name: PermissionValidator
+  onSuccess: validate_secret_regeneration
+  layout:
+    size:
+      width: 206
+      height: 113
+    position:
+      x: 300
+      y: 175
+- id: validate_secret_regeneration
+  type: TASK_EXECUTION
+  executor:
+    name: ApplicationActionValidator
+    mode: revoke_before_action
+  onSuccess: revoke_tokens
+  layout:
+    size:
+      width: 250
+      height: 113
+    position:
+      x: 580
+      y: 175
+- id: revoke_tokens
+  type: TASK_EXECUTION
+  executor:
+    name: CriteriaRevocationExecutor
+  onSuccess: regenerate_secret
+  layout:
+    size:
+      width: 206
+      height: 113
+    position:
+      x: 920
+      y: 175
+- id: regenerate_secret
+  type: TASK_EXECUTION
+  executor:
+    name: ClientSecretExecutor
+  onSuccess: end
+  layout:
+    size:
+      width: 250
+      height: 113
+    position:
+      x: 1200
+      y: 175
+- id: end
+  type: END
+  layout:
+    size:
+      width: 85
+      height: 34
+    position:
+      x: 1520
+      y: 200
+---
 resource_type: theme
 id: 01900000-0000-7000-8000-000000000071
 handle: acrylic-orange

backend/cmd/server/bootstrap/02-server-configurations.yaml

@@ -16,3 +16,7 @@ value:
     expirySeconds: 86400
   userDeletionFlow:
     defaultHandle: default-user-deletion-flow
+  applicationDeletionFlow:
+    defaultHandle: default-application-deletion-flow
+  secretRegenerationFlow:
+    defaultHandle: default-secret-regeneration-flow

backend/cmd/server/servicemanager.go

@@ -64,6 +64,7 @@ import (
 	"github.com/thunder-id/thunderid/internal/oauth/oauth2/dpop"
 	"github.com/thunder-id/thunderid/internal/oauth/oauth2/jti"
 	"github.com/thunder-id/thunderid/internal/oauth/oauth2/revocation"
+	"github.com/thunder-id/thunderid/internal/oauth/oauth2/tokenservice"
 	"github.com/thunder-id/thunderid/internal/openid4vci"
 	"github.com/thunder-id/thunderid/internal/ou"
 	"github.com/thunder-id/thunderid/internal/resource"
@@ -417,8 +418,14 @@ func registerServices(mux *http.ServeMux, cacheManager cache.CacheManagerInterfa
 
 	applicationService, applicationExporter, err := application.Initialize(
 		mux, mcpServer, entityService, inboundClientService, ouService, i18nService,
-		runtimeCryptoSvc, serverConfigService)
+		runtimeCryptoSvc, serverConfigService,
+		func(client *providers.OAuthClient) time.Duration {
+			return tokenservice.ArtifactLifetime(oauthCfg, client)
+		})
 	fatalOnError(ctx, logger, err, "Failed to initialize ApplicationService")
+	// Two-phase initialization: inject the application service into the executors that act on it.
+	fatalOnError(ctx, logger, executor.SetApplicationProvider(execRegistry, applicationService),
+		"Failed to inject the application provider into the flow executors")
 	exporters = append(exporters, applicationExporter)
 
 	agentService, agentExporter, err := agent.Initialize(mux, entityService, inboundClientService, ouService,

backend/dbscripts/runtime_persistent/postgres.sql

@@ -95,6 +95,10 @@ CREATE TABLE "SSO_SESSION_PARTICIPANT" (
     PRIMARY KEY (SESSION_ID, DEPLOYMENT_ID, APP_ID)
 );
 
+-- Index for participation lookups by application, used when an application is deleted and its
+-- participation must be detached from every session it joined.
+CREATE INDEX idx_sso_session_participant_app ON "SSO_SESSION_PARTICIPANT" (DEPLOYMENT_ID, APP_ID);
+
 -- Table to store consent records.
 CREATE TABLE "CONSENT" (
     DEPLOYMENT_ID VARCHAR(255) NOT NULL,

backend/dbscripts/runtime_persistent/sqlite.sql

@@ -95,6 +95,10 @@ CREATE TABLE "SSO_SESSION_PARTICIPANT" (
     PRIMARY KEY (SESSION_ID, DEPLOYMENT_ID, APP_ID)
 );
 
+-- Index for participation lookups by application, used when an application is deleted and its
+-- participation must be detached from every session it joined.
+CREATE INDEX idx_sso_session_participant_app ON "SSO_SESSION_PARTICIPANT" (DEPLOYMENT_ID, APP_ID);
+
 -- Table to store consent records.
 CREATE TABLE "CONSENT" (
     DEPLOYMENT_ID VARCHAR(255) NOT NULL,