oauth_dpop.h

#ifndef SOURCEMETA_CORE_OAUTH_DPOP_H_
#define SOURCEMETA_CORE_OAUTH_DPOP_H_
 
#ifndef SOURCEMETA_CORE_OAUTH_EXPORT
#include <sourcemeta/core/oauth_export.h>
#endif
 
#include <sourcemeta/core/jose_algorithm.h>
#include <sourcemeta/core/jose_jwk_private.h>
 
#include <sourcemeta/core/json.h>
 
#include <array>       // std::array
#include <chrono>      // std::chrono::seconds, std::chrono::system_clock
#include <cstddef>     // std::size_t
#include <cstdint>     // std::uint8_t
#include <map>         // std::map
#include <mutex>       // std::mutex
#include <optional>    // std::optional
#include <span>        // std::span
#include <string>      // std::string
#include <string_view> // std::string_view
#include <vector>      // std::vector
 
namespace sourcemeta::core {

inline constexpr std::string_view OAUTH_TOKEN_TYPE_DPOP{"DPoP"};

class SOURCEMETA_CORE_OAUTH_EXPORT OAuthDPoPProofer {
public:
  OAuthDPoPProofer(JWKPrivate key, const JWSAlgorithm algorithm);

  OAuthDPoPProofer(const OAuthDPoPProofer &) = delete;
  auto operator=(const OAuthDPoPProofer &) -> OAuthDPoPProofer & = delete;
  OAuthDPoPProofer(OAuthDPoPProofer &&) = delete;
  auto operator=(OAuthDPoPProofer &&) -> OAuthDPoPProofer & = delete;
  ~OAuthDPoPProofer() = default;

  [[nodiscard]] auto
  proof(const std::string_view server, const std::string_view method,
        const std::string_view url, const std::string_view access_token,
        const std::chrono::system_clock::time_point now, std::string &sink)
      -> bool;

  auto observe(const std::string_view server, const std::string_view nonce)
      -> void;

  [[nodiscard]] auto thumbprint() const -> std::optional<std::string>;
 
private:
  JWKPrivate key_;
  JWSAlgorithm algorithm_;
#if defined(_MSC_VER)
#pragma warning(push)
#pragma warning(disable : 4251)
#endif
  mutable std::mutex mutex_;
  std::map<std::string, std::string, std::less<>> nonces_;
#if defined(_MSC_VER)
#pragma warning(pop)
#endif
};

[[nodiscard]] SOURCEMETA_CORE_OAUTH_EXPORT auto
oauth_dpop_confirmation(const std::string_view thumbprint) -> JSON;

[[nodiscard]] SOURCEMETA_CORE_OAUTH_EXPORT auto
oauth_dpop_proof_thumbprint(const std::string_view proof)
    -> std::optional<std::string>;

enum class OAuthDPoPError : std::uint8_t {
  ProofCount,
  Malformed,
  MissingClaim,
  UnexpectedType,
  UnsupportedAlgorithm,
  PrivateKey,
  Signature,
  MethodMismatch,
  TargetMismatch,
  MissingNonce,
  NonceMismatch,
  Expired,
  AccessTokenMismatch,
  KeyMismatch
};

struct OAuthDPoPVerifyOptions {
  std::size_t proof_count{1};
  std::span<const JWSAlgorithm> allowed_algorithms{};
  std::chrono::seconds past_window{std::chrono::seconds{300}};
  std::chrono::seconds future_window{std::chrono::seconds{5}};
  std::optional<std::string_view> expected_nonce{std::nullopt};
  std::optional<std::string_view> access_token{std::nullopt};
  std::optional<std::string_view> bound_thumbprint{std::nullopt};
};

[[nodiscard]] SOURCEMETA_CORE_OAUTH_EXPORT auto oauth_dpop_verify(
    const std::string_view proof, const std::string_view method,
    const std::string_view url, const std::chrono::system_clock::time_point now,
    const OAuthDPoPVerifyOptions &options) -> std::optional<OAuthDPoPError>;

class SOURCEMETA_CORE_OAUTH_EXPORT OAuthDPoPReplayStore {
public:
  static constexpr std::size_t DEFAULT_CAPACITY{131072};

  explicit OAuthDPoPReplayStore(
      const std::size_t capacity = DEFAULT_CAPACITY) noexcept
      : capacity_{capacity == 0 ? DEFAULT_CAPACITY : capacity} {}

  OAuthDPoPReplayStore(const OAuthDPoPReplayStore &) = delete;
  auto operator=(const OAuthDPoPReplayStore &)
      -> OAuthDPoPReplayStore & = delete;
  OAuthDPoPReplayStore(OAuthDPoPReplayStore &&) = delete;
  auto operator=(OAuthDPoPReplayStore &&) -> OAuthDPoPReplayStore & = delete;
  ~OAuthDPoPReplayStore() = default;

  [[nodiscard]] auto
  check_and_insert(const std::string_view identifier,
                   const std::string_view target,
                   const std::chrono::system_clock::time_point now,
                   const std::chrono::seconds window,
                   const bool normalize_target = true) -> bool;

  [[nodiscard]] auto size(const std::chrono::system_clock::time_point now) const
      -> std::size_t;
 
private:
  struct Entry {
    std::array<std::uint8_t, 32> digest;
    std::chrono::system_clock::time_point expiry;
  };
 
  std::size_t capacity_;
#if defined(_MSC_VER)
#pragma warning(push)
#pragma warning(disable : 4251)
#endif
  mutable std::mutex mutex_;
  std::vector<Entry> entries_;
#if defined(_MSC_VER)
#pragma warning(pop)
#endif
};

[[nodiscard]] SOURCEMETA_CORE_OAUTH_EXPORT auto
oauth_is_valid_dpop_nonce(const std::string_view value) noexcept -> bool;
 
} // namespace sourcemeta::core
 
#endif