35 |
36 |
37 | 
42 |
43 |
44 |
38 |
40 |
41 | bolt is a work in progress, consider alpha status. Details are subject to change.
39 |
42 |
43 | TODO: Display user id here
5 |TODO: Display user name and email here
6 |TODO: Display user gravatar in navbar
7 |TODO: Logout
8 |bolt is a work in progress, consider alpha status. Details are subject to change.
39 |
42 |
43 | bolt
Copyright © 2015, LTD.
\s*
" "") 137 | (str/replace #"(bolt)(?![-/])" "bolt") 138 | )) 139 | 140 | (defn body [{:keys [*router templater] :as user-guide} doc {:keys [prefix]}] 141 | (render-template 142 | templater 143 | "templates/page.html.mustache" 144 | {:content 145 | (-> (with-out-str (emit-element doc)) 146 | (post-process-body prefix) 147 | ) 148 | :scripts []})) 149 | 150 | (defrecord UserGuide [*router templater prefix ext-prefix] 151 | Lifecycle 152 | (start [component] 153 | (infof "Starting user-guide") 154 | (assert prefix) 155 | (let [xbody (get-source)] 156 | (assoc 157 | component 158 | :start-time (java.util.Date.) 159 | :xbody xbody))) 160 | (stop [component] component) 161 | 162 | RouteProvider 163 | (routes [component] 164 | (let [xbody (:xbody component)] 165 | ["/user-guide" 166 | [[".html" 167 | (-> 168 | (yada 169 | :body {"text/html" 170 | (fn [ctx] 171 | (let [config {:prefix prefix :ext-prefix ext-prefix}] 172 | (body component (post-process-doc component xbody config) config)))}) 173 | (tag ::user-guide))] 174 | ]]))) 175 | 176 | (defn new-user-guide [& {:as opts}] 177 | (-> (->> opts 178 | (merge {}) 179 | map->UserGuide) 180 | (using [:templater]) 181 | (co-using [:router]))) 182 | -------------------------------------------------------------------------------- /src/bolt/user/reset_password.clj: -------------------------------------------------------------------------------- 1 | ; Copyright © 2014, JUXT LTD. All Rights Reserved. 2 | 3 | (ns bolt.user.reset-password 4 | (:require 5 | [clojure.tools.logging :refer :all] 6 | [com.stuartsierra.component :as component :refer (using)] 7 | [bolt.session.protocols :refer (session assoc-session-data! respond-with-new-session!)] 8 | [bolt.user.protocols :refer (LoginFormRenderer UserFormRenderer)] 9 | [bolt.user :refer (render-reset-password-request-form render-reset-password-email-message render-reset-password-link-sent-response render-password-reset-form render-password-changed-response hash-password)] 10 | [bolt.token-store :refer (create-token! get-token-by-id purge-token!)] 11 | [bolt.util :refer (absolute-uri absolute-prefix as-query-string wrap-schema-validation)] 12 | [hiccup.core :refer (html)] 13 | [bidi.bidi :refer (RouteProvider tag)] 14 | [modular.bidi :refer (path-for)] 15 | [ring.middleware.params :refer (params-request)] 16 | [ring.util.response :refer (response redirect)] 17 | [schema.core :as s] 18 | [plumbing.core :refer (<-)] 19 | [modular.email :refer (send-email!)] 20 | [modular.component.co-dependency :refer (co-using)] 21 | )) 22 | 23 | (defrecord ResetPassword [emailer renderer session-store user-store verification-code-store fields-reset fields-confirm-password password-verifier uri-context *router] 24 | RouteProvider 25 | (routes [this] 26 | [uri-context 27 | {"request-reset-password" 28 | { 29 | ;; GET: show the find by user form to reset the password 30 | :get 31 | (-> 32 | (fn [req] 33 | {:status 200 34 | :body (render-reset-password-request-form 35 | renderer req 36 | {:form {:method :post 37 | :action (path-for @*router ::process-reset-password-request) 38 | :fields fields-reset}})}) 39 | 40 | wrap-schema-validation 41 | (tag ::request-reset-password-form)) 42 | 43 | ;; POST: find a user by email and send email with reset-password-link 44 | :post 45 | (-> 46 | (fn [req] 47 | (let [form (-> req params-request :form-params) 48 | email (get form "email")] 49 | ;; TODO: We need to look up the user by email, rather than any 50 | ;; other id. This poses a challenge, because we don't have a 51 | ;; protocol for doing this yet 52 | (if-let [user (throw (ex-info "TODO" {})) #_(get-user-by-email user-store email)] 53 | (let [code (str (java.util.UUID/randomUUID))] 54 | (debugf "Found user: %s" user) 55 | (create-token! verification-code-store code user) 56 | (send-email! 57 | emailer (merge 58 | {:to email} 59 | (render-reset-password-email-message 60 | renderer 61 | {:link (str 62 | (absolute-prefix req) 63 | (path-for @*router ::reset-password-form) 64 | (as-query-string {"code" code}))}))) 65 | (->> 66 | (response 67 | (render-reset-password-link-sent-response 68 | renderer req {:email email})) 69 | (respond-with-new-session! session-store req {}))) 70 | 71 | (redirect (format "%s?unknown-email=%s" 72 | (path-for @*router ::request-reset-password-form) 73 | email))))) 74 | wrap-schema-validation 75 | (tag ::process-reset-password-request) 76 | )} 77 | 78 | "reset-password" 79 | {:get 80 | (-> 81 | (fn [req] 82 | (let [params (-> req params-request :params)] 83 | (let [code (get params "code") 84 | token (get-token-by-id (:verification-code-store this) code)] 85 | (if token 86 | {:status 200 87 | :body (render-password-reset-form 88 | renderer req 89 | (merge 90 | {:form {:method :post 91 | :action (path-for @*router ::process-password-reset) 92 | ;; add hidden field 93 | :fields (conj fields-confirm-password 94 | {:name "code" :type "hidden" :value code})}} 95 | token))} 96 | ;; TODO: This is unhelpful - render a 400 error message instead. 97 | {:status 404 :body "Not found"} 98 | )))) 99 | wrap-schema-validation 100 | (tag ::reset-password-form)) 101 | 102 | :post 103 | (-> 104 | (fn [req] 105 | (let [form (-> req params-request :form-params) 106 | token-id (get form "code") 107 | token (get-token-by-id (:verification-code-store this) token-id) 108 | pw (get form "new_pw")] 109 | 110 | (if token 111 | (do 112 | (infof "Reseting password for user %s" (:uid token)) 113 | ;; TODO How to update the user password here? 114 | (throw (ex-info "TODO")) 115 | #_(set-user-password-hash! 116 | user-store 117 | (:uid token) 118 | (hash-password user-password-hasher pw)) 119 | (purge-token! (:verification-code-store this) token-id) 120 | (response (render-password-changed-response renderer req {}))) 121 | 122 | ;; TODO: Here's where we must display an error, via calling a protocol 123 | {:status 400 :body (format "ERROR: no such token for code: %s" token-id)}))) 124 | wrap-schema-validation 125 | (tag ::process-password-reset) 126 | )}}])) 127 | 128 | (def new-reset-password-schema 129 | {:uri-context s/Str}) 130 | 131 | (defn new-reset-password [& {:as opts}] 132 | (->> opts 133 | (merge 134 | {:uri-context "/"}) 135 | (s/validate new-reset-password-schema) 136 | map->ResetPassword 137 | (<- (using [:user-store :session-store :renderer 138 | :verification-code-store :password-verifier :emailer])) 139 | (<- (co-using [:router])))) 140 | -------------------------------------------------------------------------------- /src/bolt/user.clj: -------------------------------------------------------------------------------- 1 | ;; Copyright © 2014, JUXT LTD. All Rights Reserved. 2 | 3 | (ns bolt.user 4 | (:require 5 | [bolt.user.protocols :as p] 6 | [bolt.util :refer (Request)] 7 | [schema.core :as s] 8 | [modular.email :refer (EmailAddress EmailMessage)] 9 | )) 10 | 11 | ;; UserStore API 12 | 13 | (s/defschema User "A user" 14 | {s/Keyword s/Any}) 15 | 16 | (s/defn check-create-user 17 | [component :- (s/protocol p/UserStore) 18 | user :- User] 19 | (p/check-create-user component user)) 20 | 21 | (s/defn create-user! 22 | [component :- (s/protocol p/UserStore) 23 | user :- User] 24 | (p/create-user! component user)) 25 | 26 | (s/defn find-user :- (s/maybe User) 27 | [component :- (s/protocol p/UserStore) 28 | id :- s/Str] 29 | (p/find-user component id)) 30 | 31 | (s/defn update-user! :- nil 32 | [component :- (s/protocol p/UserStore) 33 | id :- s/Str 34 | user :- User] 35 | (p/update-user! component id user)) 36 | 37 | (s/defn delete-user! :- nil 38 | [component :- (s/protocol p/UserStore) 39 | id :- s/Str] 40 | (p/delete-user! component id)) 41 | 42 | (s/defn verify-email! :- nil 43 | [component :- (s/protocol p/UserStore) 44 | email :- s/Str] 45 | (p/verify-email! component email)) 46 | 47 | ;; UserAuthenticator API 48 | 49 | (s/defn authenticate-user :- s/Any 50 | [component :- (s/protocol p/UserAuthenticator) 51 | user :- User 52 | evidence :- {s/Keyword s/Str}] 53 | (p/authenticate-user component user evidence)) 54 | 55 | (s/defn hash-password :- s/Str 56 | [component :- (s/protocol p/UserPasswordHasher) 57 | password :- s/Str] 58 | (p/hash-password component password)) 59 | 60 | ;; Login form renderer API 61 | 62 | #_(s/defschema FormField 63 | {:name s/Str 64 | (s/optional-key :label) s/Str 65 | (s/optional-key :placeholder) s/Str 66 | (s/optional-key :type) s/Str 67 | (s/optional-key :value) s/Str}) 68 | 69 | (s/defschema Form 70 | {:method s/Keyword 71 | :action s/Str}) 72 | 73 | ;; TODO When schema validating requests, with {:headers s/Any} I get the following :- 74 | ;; 75 | ;; java.lang.ClassCastException: java.lang.Class cannot be cast to clojure.lang.IFn 76 | ;; at aleph.http.core.NettyRequest.entryAt(core.clj:146) 77 | ;; at clojure.lang.RT.find(RT.java:807) 78 | ;; at clojure.core$find.invoke(core.clj:1465) 79 | ;; at schema.core$map_walker$fn__10092$fn__10095.invoke(core.clj:741) 80 | ;; at schema.core$map_walker$fn__10092.invoke(core.clj:728) 81 | ;; at schema.core$eval10188$fn__10189$fn__10206.invoke(core.clj:840) 82 | ;; at clojure.core$comp$fn__4492.invoke(core.clj:2436) 83 | ;; at bolt.user$eval46172$render_login_form__46175.invoke(user.clj:81) 84 | ;; at bolt.user.login.Login$fn__47684.invoke(login.clj:69) 85 | ;; at bolt.util$wrap_schema_validation$fn__45964.invoke(util.clj:66) 86 | ;; at bidi.ring$eval11505$fn__11506.invoke(ring.clj:22) 87 | ;; at bidi.ring$eval11484$fn__11485$G__11475__11494.invoke(ring.clj:13) 88 | ;; at bidi.ring$make_handler$fn__11510.invoke(ring.clj:35) 89 | ;; at clojure.core$some_fn$sp2__6921.invoke(core.clj:7144) 90 | ;; at aleph.http.server$wrap_stream__GT_input_stream$fn__31772.invoke(server.clj:392) 91 | ;; at aleph.http.server$handle_request$fn__31696$f__12499__auto____31697.invoke(server.clj:153) 92 | ;; at clojure.lang.AFn.run(AFn.java:22) 93 | ;; at io.aleph.dirigiste.Executor$Worker$1.run(Executor.java:49) 94 | ;; at java.lang.Thread.run(Thread.java:745) 95 | ;; 96 | ;; NettyRequest is defined with potemkin/def-derived-map. Perhaps this is not compatible with how schema validates. 97 | ;; Workaround is to remove request validation. 98 | 99 | (s/defn render-login-form :- s/Str 100 | [component :- (s/protocol p/LoginFormRenderer) 101 | req ;; :- Request 102 | model :- {:form Form 103 | (s/optional-key :login-failed?) s/Bool 104 | (s/optional-key :post-login-redirect) s/Str}] 105 | (p/render-login-form component req model)) 106 | 107 | ;; User form renderer API 108 | 109 | (s/defn render-signup-form :- s/Str 110 | [component :- (s/protocol p/UserFormRenderer) 111 | req ;; :- Request 112 | model :- {:form Form}] 113 | (p/render-signup-form component req model)) 114 | 115 | (s/defn render-welcome :- s/Str 116 | [component :- (s/protocol p/UserFormRenderer) 117 | req ;; :- Request 118 | model :- {}] 119 | (p/render-welcome component req model)) 120 | 121 | (s/defn render-welcome-email-message :- EmailMessage 122 | [component :- (s/protocol p/UserFormRenderer) 123 | model :- {:email-verification-link s/Str}] 124 | (p/render-welcome-email-message component model)) 125 | 126 | (s/defn render-email-verified :- s/Str 127 | [component :- (s/protocol p/UserFormRenderer) 128 | req ;; :- Request 129 | model :- {:email EmailAddress 130 | s/Keyword s/Any}] 131 | (p/render-email-verified component req model)) 132 | 133 | (s/defn render-reset-password-request-form :- s/Str 134 | [component :- (s/protocol p/UserFormRenderer) 135 | req ;; :- Request 136 | model :- {:form Form 137 | (s/optional-key :email-failed?) s/Bool}] 138 | (p/render-reset-password-request-form component req model)) 139 | 140 | (s/defn render-reset-password-email-message :- EmailMessage 141 | [component :- (s/protocol p/UserFormRenderer) 142 | model :- {:link s/Str}] 143 | (p/render-reset-password-email-message component model)) 144 | 145 | (s/defn render-reset-password-link-sent-response :- s/Str 146 | [component :- (s/protocol p/UserFormRenderer) 147 | req ;; :- Request 148 | model :- {:email EmailAddress}] 149 | (p/render-reset-password-link-sent-response component req model)) 150 | 151 | (s/defn render-password-reset-form :- s/Str 152 | [component :- (s/protocol p/UserFormRenderer) 153 | req ;; :- Request 154 | model :- {:form Form 155 | s/Keyword s/Any}] 156 | (p/render-password-reset-form component req model)) 157 | 158 | (s/defn render-password-changed-response :- s/Str 159 | [component :- (s/protocol p/UserFormRenderer) 160 | req ;; :- Request 161 | model :- {}] 162 | (p/render-password-changed-response component req model)) 163 | 164 | ;; Error form renderer API 165 | 166 | (s/defn render-error :- s/Str 167 | [component :- (s/protocol p/ErrorRenderer) 168 | req ;; :- Request 169 | model :- {:error-type (s/enum :user-already-exists) 170 | s/Keyword s/Any}] 171 | (p/render-error-response component req model)) 172 | -------------------------------------------------------------------------------- /dev/resources/public/img/juxt-logo.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 70 | -------------------------------------------------------------------------------- /dev/src/bolt/dev/system.clj: -------------------------------------------------------------------------------- 1 | ;; Copyright © 2015, JUXT LTD. 2 | 3 | (ns bolt.dev.system 4 | "Components and their dependency relationships" 5 | (:refer-clojure :exclude (read)) 6 | (:require 7 | [clojure.java.io :as io] 8 | [clojure.tools.reader :refer (read)] 9 | [clojure.string :as str] 10 | [clojure.tools.reader.reader-types :refer (indexing-push-back-reader)] 11 | [com.stuartsierra.component :refer (system-map system-using using)] 12 | 13 | [bolt.dev.website :refer (new-website)] 14 | [bolt.dev.user-guide :refer (new-user-guide)] 15 | [bolt.dev.database :refer (new-database)] 16 | [bolt.dev.example1 :refer (new-example)] 17 | [bolt.dev.login-form :refer (new-login-form)] 18 | 19 | [bolt.session.cookie-session-store :refer (new-cookie-session-store)] 20 | [bolt.token-store.atom-backed-store :refer (new-atom-backed-token-store)] 21 | [bolt.user.login :refer (new-login)] 22 | [bolt.user.email-user-store :refer (new-email-user-store)] 23 | [bolt.user.buddy-user-authenticator :refer (new-buddy-user-authenticator)] 24 | [bolt.storage.atom-storage :refer (new-atom-storage)] 25 | 26 | [modular.maker :refer (make)] 27 | [modular.bidi :refer (new-router new-web-resources new-archived-web-resources new-redirect)] 28 | [modular.clostache :refer (new-clostache-templater)] 29 | [modular.template :refer (new-aggregate-template-model)] 30 | [modular.aleph :refer (new-webserver)] 31 | [modular.component.co-dependency :refer (co-using system-co-using)])) 32 | 33 | (defn ^:private read-file 34 | [f] 35 | (read 36 | ;; This indexing-push-back-reader gives better information if the 37 | ;; file is misconfigured. 38 | (indexing-push-back-reader 39 | (java.io.PushbackReader. (io/reader f))))) 40 | 41 | (defn ^:private config-from 42 | [f] 43 | (if (.exists f) 44 | (read-file f) 45 | {})) 46 | 47 | (defn ^:private user-config 48 | [] 49 | (config-from (io/file (System/getProperty "user.home") ".bolt.edn"))) 50 | 51 | (defn ^:private config-from-classpath 52 | [] 53 | (if-let [res (io/resource "bolt.edn")] 54 | (config-from (io/file res)) 55 | {})) 56 | 57 | (defn config 58 | "Return a map of the static configuration used in the component 59 | constructors." 60 | [] 61 | (merge (config-from-classpath) 62 | (user-config))) 63 | 64 | (defn database-components [system config] 65 | (assoc system 66 | :database 67 | (-> 68 | (make new-database config) 69 | (using [])))) 70 | 71 | (defn website-components [system config] 72 | (assoc 73 | system 74 | :clostache-templater (make new-clostache-templater config) 75 | :user-guide (make new-user-guide config 76 | :prefix "http://localhost:8084") 77 | :website (make new-website config) 78 | :jquery (make new-web-resources config 79 | :key :jquery 80 | :uri-context "/jquery" 81 | :resource-prefix "META-INF/resources/webjars/jquery/2.1.3") 82 | :bootstrap (make new-web-resources config 83 | :key :bootstrap 84 | :uri-context "/bootstrap" 85 | :resource-prefix "META-INF/resources/webjars/bootstrap/3.3.2") 86 | :web-resources (make new-web-resources config 87 | :uri-context "/static" 88 | :resource-prefix "public") 89 | :highlight-js-resources 90 | (make new-archived-web-resources config :archive (io/resource "highlight.zip") :uri-context "/hljs/") 91 | )) 92 | 93 | (defn router-components [system config] 94 | (assoc system 95 | :router 96 | (make new-router config))) 97 | 98 | (defn http-server-components [system config] 99 | (assoc system 100 | :http-server 101 | (make new-webserver config 102 | :port 8084))) 103 | 104 | (defn example1-components [system config] 105 | (let [uri-context "/example1"] 106 | (assoc 107 | system 108 | :example1 (bolt.dev.example1/new-example :uri-context uri-context) 109 | :example1#session-store (new-cookie-session-store) 110 | :example1#token-store (new-atom-backed-token-store) 111 | :example1#login (new-login :uri-context uri-context) 112 | :example1#email-user-store (new-email-user-store) 113 | :example1#buddy-user-authenticator (new-buddy-user-authenticator) 114 | :example1#atom-storage (new-atom-storage) 115 | :example1#login-form (new-login-form) 116 | :example1#template-model (new-aggregate-template-model) 117 | ))) 118 | 119 | (defn new-system-map 120 | [config] 121 | (apply system-map 122 | (apply concat 123 | (-> {} 124 | (database-components config) 125 | (website-components config) 126 | (router-components config) 127 | (http-server-components config) 128 | (example1-components config) 129 | (assoc :redirect (new-redirect :from "/" :to :bolt.dev.website/index)) 130 | )))) 131 | 132 | (defn new-dependency-map 133 | [] 134 | {:http-server {:request-handler :router} 135 | :router [:user-guide 136 | :website 137 | :jquery :bootstrap 138 | :web-resources 139 | :highlight-js-resources 140 | :redirect 141 | :example1 142 | :example1#login] 143 | :user-guide {:templater :clostache-templater} 144 | :website {:templater :clostache-templater} 145 | 146 | :example1 {:templater :clostache-templater 147 | :session-store :example1#session-store 148 | :user-store :example1#email-user-store 149 | :password-hasher :example1#buddy-user-authenticator} 150 | :example1#template-model [:example1] 151 | 152 | ;; These are the components to support security (login, etc.) 153 | :example1#session-store {:token-store :example1#token-store} 154 | 155 | :example1#login {:user-store :example1#email-user-store 156 | :user-authenticator :example1#buddy-user-authenticator 157 | :session-store :example1#session-store 158 | :renderer :example1#login-form} 159 | 160 | :example1#login-form {:templater :clostache-templater} 161 | 162 | :example1#email-user-store {:storage :example1#atom-storage}}) 163 | 164 | (defn new-co-dependency-map 165 | [] 166 | {:website {:router :router} 167 | :user-guide {:router :router} 168 | :example1 {:router :router 169 | :template-model :example1#template-model} 170 | :example1#login-form {:template-model :example1#template-model 171 | :router :router} 172 | }) 173 | 174 | (defn new-production-system 175 | "Create the production system" 176 | [] 177 | (-> (new-system-map (config)) 178 | (system-using (new-dependency-map)) 179 | (system-co-using (new-co-dependency-map)))) 180 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # bolt 2 | 3 | > “Building secure Clojure web applications needs to be easier, and 4 | > requires integrated security frameworks - not standalone libraries!” – 5 | > John P. Hackworth, [Clojure web security is worse than you think](https://hackworth.be/2014/03/26/clojure-web-security-is-worse-than-you-think/) 6 | 7 | An integrated security system for Clojure applications based on a set of 8 | components written to the specifications of Stuart Sierra's 9 | [component](https://github.com/stuartsierra/component). 10 | 11 | Bolt has an ambitious goal: to separate all security-related concerns 12 | from Clojure-based applications so that they can be implemented as 13 | pluggable components. 14 | 15 | ## Terms 16 | 17 | The precise meanings of the terms component, system-map and system are 18 | those in [component](https://github.com/stuartsierra/component). In 19 | summary, a _component_ is a map of data, usually implemented as a record 20 | with associated protocols specifying functions for start/stop and 21 | others. A _system_ is a set of these components, with the inclusion of 22 | declared dependency references into each component. 23 | 24 | In addition, bolt uses the following terms :- 25 | 26 | * username - a user's short identifier, for example: __bob__ 27 | * email - a user's email address 28 | * user - a map, containing entries that distinguish and describe a user 29 | 30 | ## Discussion 31 | 32 | Bolt provides an _integrated system_ of components, rather than requiring developers 33 | to roll their own from smaller libraries. 34 | 35 | Functionality can be customised by interchanging components, providing 36 | necessary flexibility for bespoke Clojure applications. 37 | 38 | Nevertheless, 'out-of-the-box' defaults should provide good security, on 39 | par with other languages and frameworks. That is what is currently 40 | missing in the Clojure landscape and the gap that bolt aims to fill. 41 | 42 | ### Differences with Friend 43 | 44 | The key difference between bolt and Friend is that bolt is designed 45 | for use with [Component](https://github.com/stuartsierra/component) 46 | based applications. 47 | 48 | Bolt is designed specifically for modular applications, where 49 | functionality can be added through the addition of extra components. 50 | 51 | Stuart Sierra's component library provides a balanced, elegant and 52 | "essential" foundation for bringing all these parts together into a 53 | single system, so it's a natural fit for this problem. It is also 54 | straight-forward to decompose (and therefore reason about) the system 55 | (by understanding the role that each component plays). This is an 56 | important property of any security system - if the design is difficult 57 | to comprehend but 'just works' or works 'like magic' then it limits the 58 | number of people who can understand it and point out potential 59 | weaknesses. 60 | 61 | To provide flexibility, bolt fully embraces and consistently adopts 62 | _protocol polymorphism_ within Clojure, enabled by Stuart's 63 | approach. This will not to everyone's taste. Alternatives, such as the 64 | use of dynamic vars, are wholly avoided. Functional programming is a 65 | beautiful thing in the small, but presents practical challenges at 66 | scale. Polymorphism is one of the cornerstones of object orientation 67 | worth stealing. 68 | 69 | ### Should you use bolt? 70 | 71 | Ultimately, whether bolt is right for you will depend on how you build 72 | your Clojure web applications. For smaller applications with a single 73 | set of Compojure routes, Friend is a better choice. 74 | 75 | For larger applications, especially those with multiple modules and 76 | using [Liberator](http://clojure-liberator.github.io/liberator/) or 77 | [yada](https://github.com/juxt/yada) to provide a fuller REST API, bolt 78 | should be a good fit. 79 | 80 | ## Name change 81 | 82 | Bolt was formerly named Cylon. 83 | 84 | ## Limitations 85 | 86 | Bolt is not suitable for production systems until it reaches 87 | version 1.0, which will indicate that bolt has been deployed into 88 | production elsewhere and has undergone thorough peer review. 89 | 90 | ## Join in the conversation 91 | 92 | Join our Google group bolt-discuss@googlegroups.com for discussion 93 | about how to improve bolt. 94 | 95 | ## References 96 | 97 | https://hackworth.be/2014/03/26/clojure-web-security-is-worse-than-you-think/ 98 | https://github.com/dhruvchandna/ring-secure-headers 99 | https://github.com/weavejester/ring-anti-forgery 100 | 101 | ## Acknowledgements 102 | 103 | Aaron Bedra's seminal ClojureWest talk in 2014 – 104 | http://www.youtube.com/watch?v=CBL59w7fXw4 - this was the inspiration 105 | behind bolt. 106 | 107 | [Mastodon C](http://www.mastodonc.com/) for sponsoring the development 108 | on bolt, and using it in their kixi projects 109 | [kixi.hecuba](https://github.com/MastodonC/kixi.hecuba) and 110 | [kixi.stentor](https://github.com/MastodonC/kixi.stentor) 111 | 112 | Also, to Neale Swinnerton [@sw1nn](https://twitter.com/sw1nn) for the 113 | original work in adopting Stuart's component library and showing how to 114 | migrate [Jig](https://github.com/juxt/jig) components to it. 115 | 116 | [Yodit Stanton](https://github.com/yods) and the rest of the 117 | [opensensors.io](https://opensensors.io) team for putting up with the 118 | original Cylon updates (Cylon being the former name of bolt) and being 119 | the first adopters of the OAuth2 features. 120 | 121 | [Juan Antonio Ruz](https://github.com/tangrammar) for designing and 122 | developing the TOTP two-factor authentication support. Additionally Juan 123 | conducted the background research and co-authored the OAuth2 support, 124 | and many other aspects of the project. Also for providing a public 125 | example of how to use bolt. 126 | 127 | [Martin Trojer](https://github.com/martintrojer) and others from 128 | [JUXT](https://github.com/juxt) for a continual stream of 129 | thought-provoking ideas and good advice. 130 | 131 | [Andrey Antukh](https://github.com/niwibe) for suggestions about 132 | integration with [Buddy](https://github.com/niwibe/buddy). 133 | 134 | ## Copyright & License 135 | 136 | The MIT License (MIT) 137 | 138 | Copyright © 2014 JUXT LTD. 139 | 140 | Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: 141 | 142 | The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. 143 | 144 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 145 | -------------------------------------------------------------------------------- /src/bolt/user/signup.clj: -------------------------------------------------------------------------------- 1 | ;; Copyright © 2014, JUXT LTD. All Rights Reserved. 2 | 3 | (ns bolt.user.signup 4 | (:require 5 | [bidi.bidi :refer (RouteProvider tag)] 6 | [modular.email :refer (send-email!)] 7 | [modular.email.protocols :refer (Emailer)] 8 | [clojure.tools.logging :refer :all] 9 | [bolt.util :refer (absolute-prefix as-query-string wrap-schema-validation keywordize-form)] 10 | [bolt.session :refer (session respond-with-new-session! assoc-session-data!)] 11 | [bolt.session.protocols :refer (SessionStore)] 12 | [bolt.token-store :refer (create-token! get-token-by-id)] 13 | [bolt.token-store.protocols :refer (TokenStore)] 14 | [com.stuartsierra.component :as component :refer (Lifecycle using)] 15 | [modular.bidi :refer (path-for)] 16 | [hiccup.core :refer (html)] 17 | [ring.middleware.params :refer (params-request)] 18 | [ring.middleware.cookies :refer (cookies-response wrap-cookies)] 19 | [ring.util.response :refer (response redirect redirect-after-post)] 20 | [bolt.user :refer (create-user! verify-email! render-signup-form render-welcome-email-message render-email-verified render-error hash-password)] 21 | [bolt.user.protocols :refer (UserStore UserPasswordHasher UserAuthenticator UserFormRenderer ErrorRenderer)] 22 | [schema.core :as s] 23 | [plumbing.core :refer (<-)] 24 | [modular.component.co-dependency :refer (co-using)] 25 | [yada.yada :refer (yada)] 26 | ) 27 | (:import (clojure.lang ExceptionInfo))) 28 | 29 | (defn make-verification-link [req code email *router] 30 | (let [values ((juxt (comp name :scheme) :server-name :server-port) req) 31 | verify-user-email-path (path-for @*router ::verify-user-email)] 32 | (apply format "%s://%s:%d%s?code=%s&email=%s" (conj values verify-user-email-path code email)))) 33 | 34 | (def new-signup-schema 35 | {:uri-context s/Str 36 | ;; TODO: Ensure this can't be hijacked, see section on 'Preventing 37 | ;; redirect attacks' here: 38 | ;; http://rundis.github.io/blog/2015/buddy_auth_part2.html 39 | (s/optional-key :post-signup-redirect) s/Str}) 40 | 41 | (defrecord Signup [user-store user-password-hasher session-store verification-code-store renderer emailer uri-context *router] 42 | Lifecycle 43 | (start [component] 44 | (s/validate (merge 45 | new-signup-schema 46 | {:user-store (s/protocol UserStore) 47 | :user-password-hasher (s/protocol UserPasswordHasher) 48 | :session-store (s/protocol SessionStore) 49 | :verification-code-store (s/protocol TokenStore) 50 | :renderer (s/protocol UserFormRenderer) 51 | :emailer (s/protocol Emailer) 52 | :*router s/Any ;; you can't get specific protocol of a codependency in start time 53 | }) 54 | component)) 55 | (stop [component] component) 56 | 57 | RouteProvider 58 | (routes [component] 59 | [uri-context 60 | {"signup" 61 | {:get 62 | (-> 63 | (fn [req] 64 | (let [resp (response (render-signup-form 65 | renderer req 66 | {:title "Sign up" 67 | :form {:method :post 68 | :action (path-for @*router ::POST-signup-form)}}))] 69 | 70 | (if-not (session session-store req) 71 | ;; We create an empty session. This is because the POST 72 | ;; handler requires that a session exists within which it can 73 | ;; store the identity on a successful login 74 | ;; (revisit: the comment above is wrong, the POST handler can 75 | ;; create the session) 76 | (respond-with-new-session! session-store req {} resp) 77 | resp))) 78 | (tag ::GET-signup-form)) 79 | 80 | :post 81 | (-> 82 | (fn [req] 83 | 84 | (let [form (-> req params-request :form-params) 85 | ;;uid (get form "user-id") 86 | password (get form "password") 87 | 88 | ;;name (get form "name") 89 | 90 | ;; We remove the plain-text password to avoid sending it 91 | ;; through the API 92 | user (-> form (dissoc "password") keywordize-form) 93 | 94 | ;; Create the user 95 | ;; TODO: Watch out, create-user! can return a manifold deferred 96 | user (create-user! user-store 97 | (assoc user :password-hash (hash-password user-password-hasher password))) 98 | ] 99 | 100 | (when (:error user) (throw (ex-info "Failed to create user" user))) 101 | 102 | 103 | ;; TODO: Check the password meets policy constraints (length, etc.) 104 | 105 | ;; Check the user can be created. E.g. uid and/or email 106 | ;; doesn't already exist, otherwise render an error page, 107 | ;; all required fields in correct format, etc. 108 | ;; (create-user-error? user-store user) 109 | 110 | ;; Send the email to the user now! 111 | (when emailer 112 | (let [code (str (java.util.UUID/randomUUID))] 113 | (create-token! 114 | verification-code-store code 115 | {:bolt/user user}) 116 | 117 | (when-let [email (:email user)] 118 | (send-email! 119 | emailer 120 | (merge {:to email} 121 | (render-welcome-email-message 122 | renderer 123 | {:email-verification-link 124 | (str 125 | (absolute-prefix req) 126 | (path-for @*router ::verify-user-email) 127 | (as-query-string {"code" code}))})))))) 128 | 129 | ;; Create a session that contains the secret-key 130 | ;; (assoc-session-data! session-store req {:bolt/subject-identifier uid :name name}) 131 | 132 | (respond-with-new-session! 133 | session-store req 134 | user ; keep logged in after signup 135 | (if-let [loc (or (get form "post_signup_redirect") 136 | (:post-signup-redirect component))] 137 | (redirect-after-post loc) 138 | (response (format "Thank you, %s, for signing up" user)))))) 139 | 140 | wrap-schema-validation 141 | (tag ::POST-signup-form) 142 | )} 143 | 144 | "verify-email" 145 | {:get 146 | (-> 147 | (fn [req] 148 | (let [params (-> req params-request :params)] 149 | (let [token-id (get params "code") 150 | token (get-token-by-id (:verification-code-store component) token-id)] 151 | (if-let [uid (:bolt/subject-identifier token)] 152 | (do 153 | (verify-email! user-store uid) 154 | (response (render-email-verified renderer req token))) 155 | {:status 400 :body (format "No known verification code: %s" token-id)})))) 156 | wrap-schema-validation 157 | (tag ::verify-user-email))} 158 | }])) 159 | 160 | (defn new-signup [& {:as opts}] 161 | (->> opts 162 | (merge {:uri-context "/"}) 163 | (s/validate new-signup-schema) 164 | map->Signup 165 | (<- (using [:user-store 166 | :user-password-hasher 167 | :session-store 168 | :verification-code-store 169 | :renderer 170 | :emailer])) 171 | (<- (co-using [:router])))) 172 | -------------------------------------------------------------------------------- /src/bolt/oauth/client/web_client.clj: -------------------------------------------------------------------------------- 1 | ;; Copyright © 2014, JUXT LTD. All Rights Reserved. 2 | 3 | (ns bolt.oauth.client.web-client 4 | (:require 5 | [bidi.bidi :refer (RouteProvider tag)] 6 | [cheshire.core :refer (encode decode-stream)] 7 | [clj-jwt.core :refer (to-str jwt sign str->jwt verify encoded-claims)] 8 | [clojure.java.io :as io] 9 | [clojure.set :refer (union)] 10 | [clojure.tools.logging :refer :all] 11 | [com.stuartsierra.component :as component] 12 | [bolt.authentication.protocols :refer (RequestAuthenticator)] 13 | [bolt.oauth.client :refer (AccessTokenGrantee solicit-access-token expired?)] 14 | [bolt.oauth.registry :refer (register-client)] 15 | [bolt.oauth.registry.protocols :refer (ClientRegistry)] 16 | [bolt.oauth.encoding :refer (encode-scope decode-scope)] 17 | [bolt.session :refer (session respond-with-new-session! assoc-session-data! respond-close-session!)] 18 | [bolt.token-store :refer (create-token! get-token-by-id purge-token!)] 19 | [bolt.util :refer (as-set absolute-uri as-www-form-urlencoded as-query-string)] 20 | [aleph.http :as http] 21 | [ring.middleware.cookies :refer (wrap-cookies cookies-request cookies-response)] 22 | [ring.middleware.params :refer (wrap-params)] 23 | [ring.util.response :refer (redirect)] 24 | [schema.core :as s] 25 | )) 26 | 27 | (defrecord WebClient [access-token-uri 28 | end-session-endpoint post-logout-redirect-uri 29 | session-store state-store 30 | client-registry 31 | uri-context] 32 | component/Lifecycle 33 | (start [this] 34 | ;; If there's an :client-registry dependency, use it to 35 | ;; register this app. 36 | (debugf "Starting web client and registering with the client-registry: %s" client-registry) 37 | 38 | (if client-registry 39 | (let [{:keys [client-id client-secret]} 40 | (s/with-fn-validation 41 | (register-client 42 | client-registry 43 | (select-keys 44 | this 45 | [:client-id 46 | :client-secret 47 | :application-name 48 | :homepage-uri 49 | :description 50 | :redirection-uri 51 | :required-scopes 52 | :requires-user-acceptance? 53 | ])))] 54 | ;; In case these are generated 55 | (assoc this :client-id client-id :client-secret client-secret)) 56 | 57 | ;; If no app registry, make sure we can standalone as an app. 58 | (s/validate {:client-id s/Str 59 | :client-secret s/Str 60 | s/Keyword s/Any} this))) 61 | (stop [this] this) 62 | 63 | RouteProvider 64 | (routes [this] 65 | [uri-context 66 | {"grant" 67 | {:get 68 | (-> 69 | ;; Used by the authorization server to return responses containing 70 | ;; authorization credentials to the client via the resource owner 71 | ;; user-agent. 72 | (fn [req] 73 | (let [params (:query-params req) 74 | state (get params "state") 75 | tok (get-token-by-id state-store state)] 76 | 77 | (if (nil? tok) 78 | (let [session (session session-store req) 79 | original-uri (:bolt/original-uri session)] 80 | (if original-uri 81 | (redirect original-uri) 82 | {:status 400 :body "Unexpected user state"})) 83 | 84 | (let [code (get params "code") 85 | 86 | _ (infof "Exchanging code (%s) for access token via %s" code access-token-uri) 87 | 88 | ;; Exchange the code for an access token 89 | ;; This is a blocking operation. We elect to wait for 90 | ;; the response. In a future version we might go fully 91 | ;; async. 92 | at-resp 93 | @(http/post access-token-uri 94 | {:headers {"content-type" "application/x-www-form-urlencoded"} 95 | ;; Exchange the code for an access token - application/x-www-form-urlencoded format 96 | ;; 2.3.1: "Including the client credentials in the 97 | ;; request-body using the two parameters is NOT 98 | ;; RECOMMENDED and SHOULD be limited to clients 99 | ;; unable to directly utilize the HTTP Basic 100 | ;; authentication scheme (or other password-based 101 | ;; HTTP authentication schemes)." 102 | 103 | ;; TODO Support Basic Authentication in preference 104 | ;; to client secrets. 105 | 106 | ;; 4.1.3. Access Token Request redirect_uri 107 | ;; REQUIRED, if the "redirect_uri" parameter was 108 | ;; included in the authorization request as 109 | ;; described in Section 4.1.1, and their values 110 | ;; MUST be identical. 111 | 112 | ;; TODO: Better if we could construct this string 113 | ;; with the help of some utility function. 114 | 115 | :body (as-www-form-urlencoded 116 | {"grant_type" "authorization_code" 117 | "code" code 118 | "client_id" (:client-id this) 119 | "client_secret" (:client-secret this)})} 120 | 121 | ;; TODO Arguably we need better error handling here 122 | #(if (:error %) 123 | (do 124 | (errorf "Failed to get token from %s, response was %s" access-token-uri %) 125 | %) 126 | (update-in % [:body] (if-let [decode-fn (:decode-server-response-fn this)] 127 | decode-fn 128 | ;; add default decode to bolt oauth server response 129 | (comp decode-stream io/reader)))))] 130 | 131 | (purge-token! state-store state) 132 | 133 | (if-let [error (:error at-resp)] 134 | {:status 403 135 | :body (format "Something went wrong: status of underlying request, error was %s" error)} 136 | 137 | (if (not= (:status at-resp) 200) 138 | {:status 403 139 | :body (format "Something went wrong: status of underlying request %s" (:status at-resp))} 140 | 141 | 142 | (let [original-uri (:bolt/original-uri (session session-store req)) 143 | access-token (get (:body at-resp) "access_token") 144 | 145 | ;; TODO If scope not there it is the same as 146 | ;; requested (see 5.1) 147 | scope (decode-scope (get (:body at-resp) "scope") (keyword? (first (:required-scopes this)))) 148 | 149 | id-token (-> (get (:body at-resp) "id_token") str->jwt)] 150 | (if (verify id-token "secret") 151 | (do 152 | (assert original-uri (str "Failed to get original-uri from session " (session session-store req))) 153 | 154 | (infof "Verified id_token: %s" id-token) 155 | (infof "Scope is %s" scope) 156 | (infof "Claims are %s" (:claims id-token)) 157 | 158 | (assoc-session-data! 159 | session-store req {:bolt/access-token access-token 160 | :bolt/scopes scope 161 | :bolt/open-id (-> id-token :claims) 162 | :bolt/subject-identifier (-> id-token :claims :sub)}) 163 | (redirect original-uri)))))))))) 164 | wrap-params 165 | (tag ::redirection-endpoint))} 166 | 167 | "logout" 168 | {:get 169 | (-> 170 | (fn [req] 171 | ;; http://openid.net/specs/openid-connect-session-1_0.html - chapter 5 172 | 173 | ;; "An RP can notify the OP that the End-User has logged 174 | ;; out of the site, and might want to log out of the OP 175 | ;; as well. In this case, the RP, after having logged 176 | ;; the End-User out of the RP, redirects the End-User's 177 | ;; User Agent to the OP's logout endpoint URL. This URL 178 | ;; is normally obtained via the end_session_endpoint 179 | ;; element of the OP's Discovery response, or may be 180 | ;; learned via other mechanisms." 181 | 182 | ;; post_logout_redirect_uri 183 | ;; OPTIONAL. URL to which the RP is requesting that the 184 | ;; End-User's User 185 | ;; Agent be redirected after a logout has been performed. The value MUST 186 | ;; have been previously registered with the OP, either using the 187 | ;; post_logout_redirect_uris Registration parameter or via another 188 | ;; mechanism. If supplied, the OP SHOULD honor this request following 189 | ;; the logout. 190 | 191 | ;; TODO Perhaps we need to redirect to a logout on the auth-server side, with a original-uri of location-after-logout 192 | 193 | (respond-close-session! 194 | session-store req 195 | (cond 196 | end-session-endpoint 197 | ;; "An RP can notify the OP that the End-User has logged out of the site" 198 | ;; If specified, add the OPTIONAL post_logout_redirect_uri query parameter 199 | (redirect (str end-session-endpoint (when post-logout-redirect-uri (str "?post_logout_redirect_uri=" post-logout-redirect-uri)))) 200 | 201 | ;; If there's only a post-logout-redirect-uri, then redirect to it 202 | post-logout-redirect-uri (redirect post-logout-redirect-uri) 203 | :otherwise {:status 200 :body "Logged out"} 204 | ))) 205 | (tag ::logout))}}]) 206 | 207 | AccessTokenGrantee 208 | (solicit-access-token [this req target-uri] 209 | (solicit-access-token this req target-uri [])) 210 | 211 | ;; RFC 6749 4.1. Authorization Code Grant (A) 212 | (solicit-access-token [this req target-uri scopes] 213 | (let [ 214 | state (str (java.util.UUID/randomUUID)) 215 | 216 | ;; 4.1.1. Authorization Request 217 | loc (str 218 | (:authorize-uri this) 219 | (as-query-string 220 | {"response_type" "code" ; REQUIRED 221 | "client_id" (:client-id this) ; REQUIRED 222 | ;; "redirect_uri" nil ; OPTIONAL (TODO) 223 | "scope" (encode-scope 224 | (union (as-set scopes) ; OPTIONAL 225 | (:required-scopes this))) 226 | "state" state ; RECOMMENDED to prevent CSRF 227 | }))] 228 | 229 | (create-token! state-store state {}) 230 | ;; We create a session 231 | (debugf "Creating session to store original uri of %s" target-uri) 232 | ;; We redirect to the (authorization) uri send the redirect response, but first 233 | 234 | ;; We need a session to store the original uri 235 | (respond-with-new-session! 236 | session-store req 237 | {:bolt/original-uri target-uri} 238 | (redirect loc)))) 239 | 240 | (expired? [_ req access-token] false) 241 | 242 | RequestAuthenticator 243 | (authenticate [component request] 244 | (session session-store request))) 245 | 246 | (defn new-web-client 247 | "Represents an OAuth2 client. This component provides all the web 248 | routes necessary to provide signup, login and password resets. It also 249 | acts as a RequestAuthorizer, which returns an OAuth2 access token from a 250 | call to authorized?" 251 | [& {:as opts}] 252 | (component/using 253 | (->> opts 254 | (merge {:requires-user-acceptance? true 255 | :uri-context "/"}) 256 | (s/validate {(s/optional-key :client-id) s/Str 257 | (s/optional-key :client-secret) s/Str 258 | :application-name s/Str 259 | :homepage-uri s/Str 260 | :redirection-uri s/Str 261 | (s/optional-key :post-logout-redirect-uri) s/Str 262 | 263 | :required-scopes (s/either #{s/Keyword} #{s/Str}) 264 | 265 | :authorize-uri s/Str 266 | :access-token-uri s/Str 267 | (s/optional-key :end-session-endpoint) s/Str 268 | 269 | :requires-user-acceptance? s/Bool 270 | :uri-context s/Str 271 | (s/optional-key :decode-server-response-fn) s/Any 272 | }) 273 | map->WebClient) 274 | [:session-store :state-store])) 275 | -------------------------------------------------------------------------------- /src/bolt/oauth/server/server.clj: -------------------------------------------------------------------------------- 1 | ;; Copyright © 2014, JUXT LTD. All Rights Reserved. 2 | 3 | (ns bolt.oauth.server.server 4 | (require 5 | [clojure.set :as set] 6 | [clojure.string :as str] 7 | [clojure.tools.logging :refer :all] 8 | [bidi.bidi :refer (RouteProvider tag)] 9 | [modular.bidi :refer (path-for)] 10 | [cheshire.core :refer (encode)] 11 | [clj-jwt.core :refer (to-str sign jwt)] 12 | [clj-time.core :refer (now plus days)] 13 | [com.stuartsierra.component :as component :refer (Lifecycle)] 14 | [bolt.authentication :refer (authenticate initiate-authentication-handshake)] 15 | [bolt.authentication.protocols :refer (RequestAuthenticator AuthenticationHandshake)] 16 | [bolt.oauth.registry.protocols :refer (ClientRegistry)] 17 | [bolt.oauth.registry :refer (lookup-client)] 18 | [bolt.oauth.encoding :refer (decode-scope encode-scope)] 19 | [bolt.session :refer (session respond-with-new-session! assoc-session-data! respond-close-session!)] 20 | [bolt.session.protocols :refer (SessionStore)] 21 | [bolt.token-store :refer (create-token! get-token-by-id)] 22 | [bolt.token-store.protocols :refer (TokenStore)] 23 | [bolt.util :refer (as-query-string wrap-schema-validation md5)] 24 | [hiccup.core :refer (html h)] 25 | [plumbing.core :refer (<-)] 26 | [ring.middleware.cookies :refer (cookies-request)] 27 | [ring.middleware.cookies :refer (wrap-cookies cookies-request cookies-response)] 28 | [ring.middleware.params :refer (params-request)] 29 | [ring.util.response :refer (redirect)] 30 | [schema.core :as s] 31 | [modular.component.co-dependency :refer (co-using)])) 32 | 33 | (def new-authorization-server-schema 34 | {:scopes {s/Keyword {:description s/Str}} 35 | :store s/Any 36 | :iss s/Str ; uri actually, see openid-connect ch 2. 37 | :uri-context s/Str 38 | }) 39 | 40 | (defrecord AuthorizationServer [store scopes iss 41 | session-store 42 | access-token-store 43 | authentication-handshake 44 | client-registry 45 | uri-context 46 | *router] 47 | Lifecycle 48 | (start [component] 49 | ;; It is essential that the authentication-handshake has the same 50 | ;; session store as this component, otherwise we won't be 51 | ;; able to access the authentication when this handler is called again. 52 | (assert (= (:session-store authentication-handshake) session-store)) 53 | 54 | (s/validate 55 | (merge new-authorization-server-schema 56 | {:session-store (s/protocol SessionStore) 57 | :access-token-store (s/protocol TokenStore) 58 | :authentication-handshake (s/protocol AuthenticationHandshake) 59 | :client-registry (s/protocol ClientRegistry) 60 | :*router s/Any ; should be a promise 61 | }) 62 | component)) 63 | (stop [component] component) 64 | 65 | RouteProvider 66 | ;; TODO Implement RFC 6749 4.1.2.1 Error Response 67 | (routes [component] 68 | [uri-context 69 | {"authorize" 70 | {:get 71 | (-> 72 | (fn [req] 73 | 74 | ;; TODO We should validate the incoming response_type 75 | 76 | (let [authentication (authenticate authentication-handshake req)] 77 | (debugf "OAuth2 authorization server: Authorizing request. User authentication is %s" authentication) 78 | ;; Establish whether the user-agent is already authenticated. 79 | 80 | 81 | ;; If we aren't authenticated, we hand off to the 82 | ;; authentication process, which will honor an existing 83 | ;; session or create a new one if one doesn't already 84 | ;; exist. Since we want to remember certain details of this 85 | ;; authorization request, we elect to create the session 86 | ;; here. The authentication will return to this same handler. 87 | 88 | ;; We initiate an authentication, which will ALWAYS 89 | ;; create a new session, so we store important details 90 | ;; about this request for the return. We 91 | 92 | (if-not (:bolt/subject-identifier authentication) 93 | (initiate-authentication-handshake authentication-handshake req) 94 | 95 | ;; Else... The user is AUTHENTICATED (now), so we AUTHORIZE the CLIENT 96 | (let [{response-type "response_type" 97 | client-id "client_id" 98 | scopes-param "scope" 99 | state "state"} (-> req params-request :query-params) 100 | requested-scopes (decode-scope scopes-param (keyword? (first scopes)))] 101 | 102 | (case response-type 103 | "code" 104 | (let [code (str (java.util.UUID/randomUUID)) 105 | 106 | {:keys [redirection-uri application-name description 107 | requires-user-acceptance? required-scopes] :as client} 108 | (lookup-client (:client-registry component) client-id)] 109 | 110 | ;; Why do we do this? 111 | ;; you need to associate the user-data, scopes, redirect-uri with params... with the code 112 | ;; (assoc-session-data! session-store req {:code code}) 113 | 114 | ;; Remember the code for the possible exchange - TODO expire these 115 | (swap! store assoc 116 | code 117 | (merge 118 | {:created (java.util.Date.)} 119 | ;; This is for the OpenID-Connect JWT token that we will send with the access-token 120 | (select-keys authentication [:bolt/subject-identifier :bolt/user]))) 121 | 122 | ;; When a user permits a client, the client's scopes that they have accepted, are stored in the user preferences database 123 | ;; why? 124 | ;; because next time, we don't have to ask the user for their permission everytime they login 125 | ;; ok, i understand 126 | ;; however 127 | 128 | (debugf (if requires-user-acceptance? 129 | "App requires user acceptance" 130 | "App does not require user acceptance")) 131 | ;; Lookup the application - do we have at-least the client id? 132 | (if requires-user-acceptance? 133 | {:status 200 134 | :body (html [:body 135 | [:form {:method :post :action (path-for @*router ::permit)} 136 | [:h1 "Authorize application?"] 137 | [:p (format "An application (%s) is requesting to use your credentials" application-name)] 138 | [:h2 "Application description"] 139 | [:p description] 140 | [:h2 "Scope"] 141 | (for [s requested-scopes] 142 | (let [s (apply str (interpose "/" (remove nil? ((juxt namespace name) s))))] 143 | [:p [:label {:for s} s] [:input {:type "checkbox" :id s :name s :value s :checked true}]])) 144 | [:input {:type "submit"}]] 145 | ])} 146 | 147 | (do 148 | (debugf (format "App doesn't require user acceptance, granting scopes as required: [%s]" required-scopes)) 149 | (swap! store update-in [code] assoc :granted-scopes required-scopes) 150 | ;; 4.1.2: "If the resource owner grants the 151 | ;; access request, the authorization server 152 | ;; issues an authorization code and delivers it 153 | ;; to the client by adding the following 154 | ;; parameters to the query component of the 155 | ;; redirection URI" 156 | (debugf "Redirecting to redirection uri: %s" redirection-uri) 157 | 158 | (redirect 159 | (str redirection-uri 160 | (as-query-string 161 | {"code" code 162 | "state" state})))))) 163 | 164 | ;; Unknown response_type 165 | {:status 400 166 | :body (format "Bad response_type parameter: '%s'" response-type)}))))) 167 | 168 | wrap-schema-validation 169 | (tag ::authorization-endpoint))} 170 | 171 | ;; ::permit is called by ::authorization-endpoint above, and it assumes 172 | ;; various things are placed in the current session. It hasn't been 173 | ;; properly tested (and we know it won't work as currently written) 174 | ;; so treat as a stub for now. 175 | "permit-client" 176 | {:post 177 | (-> 178 | (fn [req] 179 | ;; TODO I'm worred about the fact we must ensure that the session 180 | ;; represents a true authenticated user 181 | (let [session (session session-store req) 182 | form-params (-> req params-request :form-params) 183 | ] 184 | (if (:bolt/subject-identifier session) 185 | (let [permitted-scopes (set (map 186 | (fn [x] (apply keyword (str/split x #"/"))) 187 | (keys form-params))) 188 | _ (debugf "permitted-scopes is %s" permitted-scopes) 189 | requested-scopes (:requested-scopes session) 190 | _ (debugf "requested-scopes is %s" requested-scopes) 191 | 192 | granted-scopes (set/intersection permitted-scopes requested-scopes) 193 | code (:code session) 194 | client-id (:client-id session) 195 | {:keys [redirection-uri] :as client} (lookup-client (:client-registry component) client-id) 196 | ] 197 | 198 | (debugf "Granting scopes: %s" granted-scopes) 199 | (swap! store update-in [code] assoc :granted-scopes granted-scopes) 200 | 201 | (redirect 202 | (format "%s?code=%s&state=%s" 203 | redirection-uri code (:state session))))))) 204 | (tag ::permit))} 205 | 206 | "access-token" 207 | {:post 208 | ;; RFC 6749 4.1 (D) - and this is the Token endpoint as described 209 | ;; in section 3 (Protocol Endpoints) 210 | 211 | ;; This is initiated by the client 212 | (-> 213 | (fn [req] 214 | (let [params (-> req params-request :form-params) 215 | code (get params "code") 216 | client-id (get params "client_id") 217 | client (lookup-client (:client-registry component) client-id)] 218 | 219 | ;; "When making the request, the client authenticates with 220 | ;; the authorization server." 221 | (if (not= (get params "client_secret") (:client-secret client)) 222 | {:status 403 :body "Client could not be authenticated"} 223 | 224 | (if-let [{sub :bolt/subject-identifier 225 | user :bolt/user 226 | granted-scopes :granted-scopes} 227 | (get @store code)] 228 | 229 | (let [access-token (str (java.util.UUID/randomUUID)) 230 | ;; See http://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken 231 | claim (merge {:iss iss 232 | :sub sub 233 | :aud client-id 234 | :exp (plus (now) (days 1)) ; expiry ; TODO unhardcode 235 | :iat (now)} 236 | (when-let [name (:name user)] {:name name}) 237 | (when-let [email (:email user)] 238 | {:email email 239 | :picture (str "https://www.gravatar.com/avatar/" (md5 email)) 240 | }))] 241 | 242 | (create-token! access-token-store 243 | access-token 244 | {:client-id client-id 245 | :bolt/subject-identifier sub 246 | :bolt/scopes granted-scopes}) 247 | 248 | ;; Store the access token 249 | (assoc-session-data! session-store req {:bolt/access-token access-token}) 250 | (infof "Claim is %s" claim) 251 | 252 | ;; 5.1 Successful Response 253 | 254 | ;; " The authorization server issues an access token 255 | ;; and optional refresh token, and constructs the 256 | ;; response by adding the following parameters to the 257 | ;; entity-body of the HTTP response with a 200 (OK) 258 | ;; status code:" 259 | 260 | (debugf "About to OK, granted scopes is %s (type is %s)" granted-scopes (type granted-scopes)) 261 | (respond-close-session! 262 | session-store req 263 | {:status 200 264 | :body (encode 265 | {"access_token" access-token 266 | "token_type" "Bearer" 267 | "expires_in" 3600 268 | ;; TODO Refresh token (optional) 269 | 270 | ;; 5.1 scope OPTIONAL only if 271 | ;; identical to scope requested by 272 | ;; client, otherwise required. In 273 | ;; this way, we pass back the scope 274 | ;; to the client. 275 | "scope" (encode-scope granted-scopes) 276 | 277 | ;; OpenID Connect ID Token 278 | "id_token" 279 | (-> claim 280 | jwt 281 | (sign :HS256 "secret") to-str) 282 | })})) 283 | {:status 400 284 | :body (format "Invalid request - unrecognized code: %s" code)})))) 285 | (tag ::token-endpoint))}}])) 286 | 287 | (defn new-authorization-server [& {:as opts}] 288 | (->> opts 289 | (merge {:store (atom {}) 290 | :uri-context "/login/oauth/"}) 291 | (s/validate new-authorization-server-schema) 292 | map->AuthorizationServer 293 | (<- (component/using 294 | [:access-token-store 295 | :session-store 296 | :client-registry 297 | :authentication-handshake])) 298 | (<- (co-using [:router])))) 299 | --------------------------------------------------------------------------------