Permify / permify

import (

	"context"

	"encoding/json"

	"errors"

	"fmt"

	"io"

	"net/http"

	"strings"

	"time"

	"github.com/MicahParks/keyfunc"

	"github.com/golang-jwt/jwt/v4"

	grpcauth "github.com/grpc-ecosystem/go-grpc-middleware/auth"

	"github.com/hashicorp/go-retryablehttp"

	"github.com/Permify/permify/internal/config"

	base "github.com/Permify/permify/pkg/pb/base/v1"

)

// Authenticator - Interface for oidc authenticator

type Authenticator interface {

	Authenticate(ctx context.Context) error

}

// Authn holds configuration for OIDC authentication, including issuer, audience, and key details.

type Authn struct {

	// IssuerURL is the URL of the OIDC issuer.

	IssuerURL string

	// Audience is the intended audience of the tokens, typically the client ID.

	Audience string

	// JwksURI is the URL to fetch the JSON Web Key Set (JWKS) from.

	JwksURI string

	// JWKs holds the JWKS fetched from JwksURI for validating tokens.

	JWKs *keyfunc.JWKS

	// httpClient is used to make HTTP requests, e.g., to fetch the JWKS.

	httpClient *http.Client

}

// NewOidcAuthn creates a new instance of Authn configured for OIDC authentication.

// It initializes the HTTP client with retry capabilities, sets up the OIDC issuer and audience,

// and attempts to fetch the JWKS keys from the issuer's JWKsURI.

func NewOidcAuthn(_ context.Context, audience config.Oidc) (*Authn, error) {

	// Initialize a new retryable HTTP client to handle transient network errors

	// by retrying failed HTTP requests. The logger is disabled for cleaner output.

	client := retryablehttp.NewClient()

	client.Logger = nil // Disabling logging for the HTTP client

	// Create a new instance of Authn with the provided issuer URL and audience.

	// The httpClient is set to the standard net/http client wrapped with retry logic.

	oidc := &Authn{

		IssuerURL:  audience.Issuer,

		Audience:   audience.Audience,

		httpClient: client.StandardClient(), // Wrap retryable client as a standard http.Client

	}

	// Attempt to fetch the JWKS keys from the OIDC provider.

	// This is crucial for setting up OIDC authentication as it enables token validation.

	err := oidc.fetchKeys()

	if err != nil {

		// If fetching keys fails, return an error to prevent initialization of a non-functional Authn instance.

		return nil, err

	}

	// Return the initialized Authn instance, ready for use in OIDC authentication.

	return oidc, nil

}

// Authenticate validates the authentication token from the request context.

func (oidc *Authn) Authenticate(requestContext context.Context) error {

	// Extract the authentication header from the metadata in the request context.

	authHeader, err := grpcauth.AuthFromMD(requestContext, "Bearer")

	if err != nil {

		// Return an error if the bearer token is missing from the authentication header.

		return errors.New(base.ErrorCode_ERROR_CODE_MISSING_BEARER_TOKEN.String())

	}

	// Initialize a new JWT parser with the RS256 signing method.

	jwtParser := jwt.NewParser(jwt.WithValidMethods([]string{"RS256"}))

	// Parse and validate the JWT from the authentication header.

	token, err := jwtParser.Parse(authHeader, func(token *jwt.Token) (any, error) {

		// Use the JWKS from oidc to validate the JWT's signature.

		return oidc.JWKs.Keyfunc(token)

	})

	if err != nil {

		// Return an error if the token is invalid (e.g., expired, wrong signature).

		return errors.New(base.ErrorCode_ERROR_CODE_INVALID_BEARER_TOKEN.String())

	}

	// Check if the parsed token is valid.

	if !token.Valid {

		// Return an error if the token is not valid.

		return errors.New(base.ErrorCode_ERROR_CODE_INVALID_BEARER_TOKEN.String())

	}

	// Extract the claims from the token.

	claims, ok := token.Claims.(jwt.MapClaims)

	if !ok {

		// Return an error if the claims in the token are in an invalid format.

		return errors.New(base.ErrorCode_ERROR_CODE_INVALID_CLAIMS.String())

	}

	// Verify the issuer of the token matches the expected issuer.

	if ok := claims.VerifyIssuer(oidc.IssuerURL, true); !ok {

		// Return an error if the token's issuer is invalid.

		return errors.New(base.ErrorCode_ERROR_CODE_INVALID_ISSUER.String())

	}

	// Verify the audience of the token matches the expected audience.

	if ok := claims.VerifyAudience(oidc.Audience, true); !ok {

		// Return an error if the token's audience is invalid.

		return errors.New(base.ErrorCode_ERROR_CODE_INVALID_AUDIENCE.String())

	}

	// If all checks pass, the token is considered valid, and the function returns nil.

	return nil

}

func (oidc *Authn) fetchKeys() error {

	oidcConfig, err := oidc.fetchOIDCConfiguration()

	if err != nil {

	}

	oidc.JwksURI = oidcConfig.JWKsURI

	jwks, err := oidc.GetKeys()

	if err != nil {

	}

	oidc.JWKs = jwks

	return nil

}

// GetKeys fetches the JSON Web Key Set (JWKS) from the configured JWKS URI.

// Config holds OpenID Connect (OIDC) configuration details.

type Config struct {

	// Issuer is the OIDC provider's unique identifier URL.

	Issuer string `json:"issuer"`

	// JWKsURI is the URL to the JSON Web Key Set (JWKS) provided by the OIDC issuer.

	JWKsURI string `json:"jwks_uri"`

}

// Fetches OIDC configuration using the well-known endpoint.

func (oidc *Authn) fetchOIDCConfiguration() (*Config, error) {

	wellKnownURL := oidc.getWellKnownURL()

	body, err := oidc.doHTTPRequest(wellKnownURL)

	if err != nil {

		return nil, err

	}

	oidcConfig, err := parseOIDCConfiguration(body)

	if err != nil {

		return nil, err

	}

	return oidcConfig, nil

}

// Constructs the well-known URL for fetching OIDC configuration.

func (oidc *Authn) getWellKnownURL() string {

	return strings.TrimSuffix(oidc.IssuerURL, "/") + "/.well-known/openid-configuration"

}

// doHTTPRequest makes an HTTP GET request to the specified URL and returns the response body.

func (oidc *Authn) doHTTPRequest(url string) ([]byte, error) {

	// Create a new HTTP GET request.

	req, err := http.NewRequest("GET", url, nil)

	if err != nil {

		// Return an error if there's an issue creating the HTTP request.

		return nil, fmt.Errorf("failed to create HTTP request for OIDC configuration: %s", err)

	}

	// Send the request using the configured HTTP client.

	res, err := oidc.httpClient.Do(req)

	if err != nil {

		// Return an error if the request fails to execute.

		return nil, fmt.Errorf("failed to execute HTTP request for OIDC configuration: %s", err)

	}

	// Ensure the response body is closed after reading.

	defer res.Body.Close()

	// Check if the HTTP status code indicates success.

	if res.StatusCode != http.StatusOK {

		// Return an error if the status code is not 200 OK.

		return nil, fmt.Errorf("received unexpected status code (%d) while fetching OIDC configuration", res.StatusCode)

	}

	// Read the response body.

	body, err := io.ReadAll(res.Body)

	if err != nil {

		// Return an error if reading the response body fails.

		return nil, fmt.Errorf("failed to read response body from OIDC configuration request: %s", err)

	}

	// Return the response body.

	return body, nil

}

// parseOIDCConfiguration decodes the OIDC configuration from the given JSON body.

func parseOIDCConfiguration(body []byte) (*Config, error) {

	var oidcConfig Config

	// Attempt to unmarshal the JSON body into the oidcConfig struct.

	if err := json.Unmarshal(body, &oidcConfig); err != nil {

		// Provide a specific error message indicating failure in JSON parsing.

		return nil, fmt.Errorf("failed to decode OIDC configuration: %s", err)

	}

	// Validate that the Issuer field is not empty.

	if oidcConfig.Issuer == "" {

		// Return an error highlighting the absence of the issuer in the configuration.

		return nil, errors.New("issuer value is required but missing in OIDC configuration")

	}

	// Validate that the JWKsURI field is not empty.

	if oidcConfig.JWKsURI == "" {

		// Return an error highlighting the absence of the jwks_uri in the configuration.

		return nil, errors.New("jwks_uri value is required but missing in OIDC configuration")

	}

	// Return the successfully parsed configuration.

	return &oidcConfig, nil

}

// Close gracefully shuts down the Authn instance by terminating background processes.

func (oidc *Authn) Close() {

	// EndBackground stops the background refresh process for the JWKS keys,

	// ensuring no more go routines are left running for key refresh.

	oidc.JWKs.EndBackground()

}