Skip to content

Commit 328222f

Browse files
patatoidpatatoid
committed
manage id token generation failure
1 parent 55e3298 commit 328222f

File tree

3 files changed

+71
-36
lines changed

3 files changed

+71
-36
lines changed

‎lib/boruta/oauth/authorization.ex

Lines changed: 46 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -238,6 +238,7 @@ defimpl Boruta.Oauth.Authorization, for: Boruta.Oauth.AuthorizationCodeRequest d
238238
alias Boruta.Oauth.AuthorizationCodeRequest
239239
alias Boruta.Oauth.AuthorizationSuccess
240240
alias Boruta.Oauth.Client
241+
alias Boruta.Oauth.Error
241242
alias Boruta.Oauth.IdToken
242243
alias Boruta.Oauth.ResourceOwner
243244
alias Boruta.Oauth.Scope
@@ -315,9 +316,16 @@ defimpl Boruta.Oauth.Authorization, for: Boruta.Oauth.AuthorizationCodeRequest d
315316
{:ok, %{token: access_token}}
316317

317318
{_, true} ->
318-
id_token = IdToken.generate(%{token: access_token}, nonce)
319-
320-
{:ok, %{token: access_token, id_token: id_token}}
319+
case IdToken.generate(%{token: access_token}, nonce) do
320+
{:ok, id_token} ->
321+
{:ok, %{token: access_token, id_token: id_token}}
322+
{:error, error} ->
323+
{:error, %Error{
324+
status: :internal_server_error,
325+
error: :unknown_error,
326+
error_description: error
327+
}}
328+
end
321329

322330
{_, false} ->
323331
{:ok, %{token: access_token}}
@@ -434,6 +442,7 @@ end
434442

435443
defimpl Boruta.Oauth.Authorization, for: Boruta.Oauth.PreauthorizationCodeRequest do
436444
alias Boruta.Oauth.Client
445+
alias Boruta.Oauth.Error
437446
alias Boruta.AccessTokensAdapter
438447
alias Boruta.CodesAdapter
439448
alias Boruta.Oauth.Authorization
@@ -501,9 +510,16 @@ defimpl Boruta.Oauth.Authorization, for: Boruta.Oauth.PreauthorizationCodeReques
501510
{:ok, _code} <- CodesAdapter.revoke(code) do
502511
case String.match?(scope, ~r/#{Scope.openid().name}/) do
503512
true ->
504-
id_token = IdToken.generate(%{token: access_token}, nonce)
505-
506-
{:ok, %{preauthorized_token: access_token, id_token: id_token}}
513+
case IdToken.generate(%{token: access_token}, nonce) do
514+
{:ok, id_token} ->
515+
{:ok, %{preauthorized_token: access_token, id_token: id_token}}
516+
{:error, error} ->
517+
{:error, %Error{
518+
status: :internal_server_error,
519+
error: :unknown_error,
520+
error_description: error
521+
}}
522+
end
507523

508524
false ->
509525
{:ok, %{preauthorized_token: access_token}}
@@ -536,6 +552,7 @@ defimpl Boruta.Oauth.Authorization, for: Boruta.Oauth.TokenRequest do
536552
alias Boruta.AccessTokensAdapter
537553
alias Boruta.Oauth.Authorization
538554
alias Boruta.Oauth.AuthorizationSuccess
555+
alias Boruta.Oauth.Error
539556
alias Boruta.Oauth.IdToken
540557
alias Boruta.Oauth.ResourceOwner
541558
alias Boruta.Oauth.Scope
@@ -612,8 +629,9 @@ defimpl Boruta.Oauth.Authorization, for: Boruta.Oauth.TokenRequest do
612629
inserted_at: DateTime.utc_now()
613630
}
614631

615-
id_token = IdToken.generate(%{base_token: base_token}, nonce)
616-
{:ok, %{id_token: id_token}}
632+
with {:ok, id_token} <- IdToken.generate(%{base_token: base_token}, nonce) do
633+
{:ok, %{id_token: id_token}}
634+
end
617635

618636
false ->
619637
{:ok, %{}}
@@ -622,8 +640,16 @@ defimpl Boruta.Oauth.Authorization, for: Boruta.Oauth.TokenRequest do
622640
"id_token", {:ok, tokens} ->
623641
case String.match?(scope, ~r/#{Scope.openid().name}/) do
624642
true ->
625-
id_token = IdToken.generate(tokens, nonce)
626-
{:ok, Map.put(tokens, :id_token, id_token)}
643+
case IdToken.generate(tokens, nonce) do
644+
{:ok, id_token} ->
645+
{:ok, Map.put(tokens, :id_token, id_token)}
646+
{:error, error} ->
647+
{:error, %Error{
648+
status: :internal_server_error,
649+
error: :unknown_error,
650+
error_description: error
651+
}}
652+
end
627653

628654
false ->
629655
{:ok, tokens}
@@ -644,6 +670,13 @@ defimpl Boruta.Oauth.Authorization, for: Boruta.Oauth.TokenRequest do
644670
) do
645671
{:ok, Map.put(tokens, :token, access_token)}
646672
end
673+
_, {:error, error} ->
674+
{:error,
675+
%Error{
676+
status: :internal_server_error,
677+
error: :unknown_error,
678+
error_description: "An error occurred during token creation: #{inspect(error)}."
679+
}}
647680
end)
648681
end
649682
end
@@ -1139,9 +1172,9 @@ defimpl Boruta.Oauth.Authorization, for: Boruta.Oauth.HybridRequest do
11391172
"id_token", {:ok, tokens} ->
11401173
case String.match?(scope, ~r/#{Scope.openid().name}/) do
11411174
true ->
1142-
id_token = IdToken.generate(tokens, nonce)
1143-
1144-
{:ok, Map.put(tokens, :id_token, id_token)}
1175+
with {:ok, id_token} <- IdToken.generate(tokens, nonce) do
1176+
{:ok, Map.put(tokens, :id_token, id_token)}
1177+
end
11451178

11461179
false ->
11471180
{:ok, tokens}

‎lib/boruta/oauth/schemas/id_token.ex

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,12 +40,14 @@ defmodule Boruta.Oauth.IdToken do
4040
}
4141
}
4242

43-
@spec generate(tokens :: tokens(), nonce :: String.t()) :: id_token :: Oauth.Token.t()
43+
@spec generate(tokens :: tokens(), nonce :: String.t()) ::
44+
{:ok, id_token :: Oauth.Token.t()} | {:error, reason :: String.t()}
4445
def generate(tokens, nonce) do
4546
{base_token, payload} = payload(tokens, nonce, %{})
4647

47-
value = Client.Crypto.id_token_sign(payload, base_token.client)
48-
%{base_token | type: "id_token", value: value}
48+
with "" <> value <- Client.Crypto.id_token_sign(payload, base_token.client) do
49+
{:ok, %{base_token | type: "id_token", value: value}}
50+
end
4951
end
5052

5153
defp payload(%{code: code} = tokens, nonce, acc) do

‎test/boruta/oauth/schemas/id_token_test.exs

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -44,14 +44,14 @@ defmodule Boruta.Oauth.IdTokenTest do
4444

4545
nonce = "nonce"
4646

47-
assert %{
47+
assert {:ok, %{
4848
sub: "sub",
4949
client: ^client,
5050
inserted_at: ^inserted_at,
5151
scope: "scope",
5252
value: value,
5353
type: "id_token"
54-
} = IdToken.generate(%{code: code}, nonce)
54+
}} = IdToken.generate(%{code: code}, nonce)
5555

5656
signer = Joken.Signer.create("RS512", %{"pem" => client.private_key, "aud" => client.id})
5757

@@ -92,14 +92,14 @@ defmodule Boruta.Oauth.IdTokenTest do
9292

9393
nonce = "nonce"
9494

95-
assert %{
95+
assert {:ok, %{
9696
sub: "sub",
9797
client: ^client,
9898
inserted_at: ^inserted_at,
9999
scope: "scope",
100100
value: value,
101101
type: "id_token"
102-
} = IdToken.generate(%{token: token}, nonce)
102+
}} = IdToken.generate(%{token: token}, nonce)
103103

104104
signer = Joken.Signer.create("RS512", %{"pem" => client.private_key, "aud" => client.id})
105105

@@ -150,14 +150,14 @@ defmodule Boruta.Oauth.IdTokenTest do
150150

151151
nonce = "nonce"
152152

153-
assert %{
153+
assert {:ok, %{
154154
sub: "sub",
155155
client: ^client,
156156
inserted_at: ^inserted_at,
157157
scope: "scope",
158158
value: value,
159159
type: "id_token"
160-
} = IdToken.generate(%{token: token, code: code}, nonce)
160+
}} = IdToken.generate(%{token: token, code: code}, nonce)
161161

162162
signer = Joken.Signer.create("RS512", %{"pem" => client.private_key, "aud" => client.id})
163163

@@ -198,14 +198,14 @@ defmodule Boruta.Oauth.IdTokenTest do
198198

199199
nonce = "nonce"
200200

201-
assert %{
201+
assert {:ok, %{
202202
sub: "sub",
203203
client: ^client,
204204
inserted_at: ^inserted_at,
205205
scope: "scope",
206206
value: value,
207207
type: "id_token"
208-
} = IdToken.generate(%{base_token: base_token}, nonce)
208+
}} = IdToken.generate(%{base_token: base_token}, nonce)
209209

210210
signer = Joken.Signer.create("RS512", %{"pem" => client.private_key, "aud" => client.id})
211211

@@ -244,14 +244,14 @@ defmodule Boruta.Oauth.IdTokenTest do
244244

245245
nonce = "nonce"
246246

247-
assert %{
247+
assert {:ok, %{
248248
sub: "sub",
249249
client: ^client,
250250
inserted_at: ^inserted_at,
251251
scope: "scope",
252252
value: value,
253253
type: "id_token"
254-
} = IdToken.generate(%{base_token: base_token}, nonce)
254+
}} = IdToken.generate(%{base_token: base_token}, nonce)
255255

256256
signer = Joken.Signer.create("RS512", %{"pem" => client.private_key, "aud" => client.id})
257257

@@ -300,14 +300,14 @@ defmodule Boruta.Oauth.IdTokenTest do
300300

301301
nonce = "nonce"
302302

303-
assert %{
303+
assert {:ok, %{
304304
sub: "sub",
305305
client: ^client,
306306
inserted_at: ^inserted_at,
307307
scope: "scope",
308308
value: value,
309309
type: "id_token"
310-
} = IdToken.generate(%{token: token, code: code}, nonce)
310+
}} = IdToken.generate(%{token: token, code: code}, nonce)
311311

312312
signer = Joken.Signer.create("RS256", %{"pem" => client.private_key, "aud" => client.id})
313313

@@ -362,14 +362,14 @@ defmodule Boruta.Oauth.IdTokenTest do
362362

363363
nonce = "nonce"
364364

365-
assert %{
365+
assert {:ok, %{
366366
sub: "sub",
367367
client: ^client,
368368
inserted_at: ^inserted_at,
369369
scope: "scope",
370370
value: value,
371371
type: "id_token"
372-
} = IdToken.generate(%{token: token, code: code}, nonce)
372+
}} = IdToken.generate(%{token: token, code: code}, nonce)
373373

374374
signer = Joken.Signer.create("RS384", %{"pem" => client.private_key, "aud" => client.id})
375375

@@ -424,14 +424,14 @@ defmodule Boruta.Oauth.IdTokenTest do
424424

425425
nonce = "nonce"
426426

427-
assert %{
427+
assert {:ok, %{
428428
sub: "sub",
429429
client: ^client,
430430
inserted_at: ^inserted_at,
431431
scope: "scope",
432432
value: value,
433433
type: "id_token"
434-
} = IdToken.generate(%{token: token, code: code}, nonce)
434+
}} = IdToken.generate(%{token: token, code: code}, nonce)
435435

436436
signer = Joken.Signer.create("HS256", client.secret)
437437

@@ -485,14 +485,14 @@ defmodule Boruta.Oauth.IdTokenTest do
485485

486486
nonce = "nonce"
487487

488-
assert %{
488+
assert {:ok, %{
489489
sub: "sub",
490490
client: ^client,
491491
inserted_at: ^inserted_at,
492492
scope: "scope",
493493
value: value,
494494
type: "id_token"
495-
} = IdToken.generate(%{token: token, code: code}, nonce)
495+
}} = IdToken.generate(%{token: token, code: code}, nonce)
496496

497497
signer = Joken.Signer.create("HS384", client.secret)
498498

@@ -554,14 +554,14 @@ defmodule Boruta.Oauth.IdTokenTest do
554554

555555
nonce = "nonce"
556556

557-
assert %{
557+
assert {:ok, %{
558558
sub: "sub",
559559
client: ^client,
560560
inserted_at: ^inserted_at,
561561
scope: "scope",
562562
value: value,
563563
type: "id_token"
564-
} = IdToken.generate(%{token: token, code: code}, nonce)
564+
}} = IdToken.generate(%{token: token, code: code}, nonce)
565565

566566
signer = Joken.Signer.create("HS512", client.secret)
567567

0 commit comments

Comments
 (0)