1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
|
// Copyright 2025 OpenPubkey
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
// SPDX-License-Identifier: Apache-2.0
package providers
import (
"context"
"net/http"
"time"
"github.com/openpubkey/openpubkey/discover"
)
const helloIssuer = "https://issuer.hello.coop"
// HelloOptions is an options struct that configures how providers.HelloOp
// operates. See providers.GetDefaultGoogleOpOptions for the recommended default
// values to use when interacting with Google as the OpenIdProvider.
type HelloOptions struct {
// ClientID is the client ID of the OIDC application. It should be the
// expected "aud" claim in received ID tokens from the OP.
ClientID string
// Issuer is the OP's issuer URI for performing OIDC authorization and
// discovery.
Issuer string
// Scopes is the list of scopes to send to the OP in the initial
// authorization request.
Scopes []string
// PromptType is the type of prompt to use when requesting authorization from the user. Typically
// this is set to "consent".
PromptType string
// AccessType is the type of access to request from the OP. Typically this is set to "offline".
AccessType string
// RedirectURIs is the list of authorized redirect URIs that can be
// redirected to by the OP after the user completes the authorization code
// flow exchange. Ensure that your OIDC application is configured to accept
// these URIs otherwise an error may occur.
RedirectURIs []string
// GQSign denotes if the received ID token should be upgraded to a GQ token
// using GQ signatures.
GQSign bool
// OpenBrowser denotes if the client's default browser should be opened
// automatically when performing the OIDC authorization flow. This value
// should typically be set to true, unless performing some headless
// automation (e.g. integration tests) where you don't want the browser to
// open.
OpenBrowser bool
// HttpClient is the http.Client to use when making queries to the OP (OIDC
// code exchange, refresh, verification of ID token, fetch of JWKS endpoint,
// etc.). If nil, then http.DefaultClient is used.
HttpClient *http.Client
// IssuedAtOffset configures the offset to add when validating the "iss" and
// "exp" claims of received ID tokens from the OP.
IssuedAtOffset time.Duration
}
func GetDefaultHelloOpOptions() *HelloOptions {
return &HelloOptions{
Issuer: helloIssuer,
ClientID: "app_xejobTKEsDNSRd5vofKB2iay_2rN",
Scopes: []string{"openid profile email"},
PromptType: "consent",
AccessType: "offline",
RedirectURIs: []string{
"http://localhost:3000/login-callback",
"http://localhost:10001/login-callback",
"http://localhost:11110/login-callback",
},
GQSign: false,
OpenBrowser: true,
HttpClient: nil,
IssuedAtOffset: 1 * time.Minute,
}
}
// NewHelloOp creates a Google OP (OpenID Provider) using the
// default configurations options. It uses the OIDC Relying Party (Client)
// setup by the OpenPubkey project.
func NewHelloOp() BrowserOpenIdProvider {
options := GetDefaultHelloOpOptions()
return NewHelloOpWithOptions(options)
}
// NewHelloOpWithOptions creates a Hello OP with configuration specified
// using an options struct. This is useful if you want to use your own OIDC
// Client or override the configuration.
func NewHelloOpWithOptions(opts *HelloOptions) BrowserOpenIdProvider {
return &HelloOp{
clientID: opts.ClientID,
Scopes: opts.Scopes,
RedirectURIs: opts.RedirectURIs,
PromptType: opts.PromptType,
AccessType: opts.AccessType,
GQSign: opts.GQSign,
OpenBrowser: opts.OpenBrowser,
HttpClient: opts.HttpClient,
IssuedAtOffset: opts.IssuedAtOffset,
issuer: opts.Issuer,
requestTokensOverrideFunc: nil,
publicKeyFinder: discover.PublicKeyFinder{
JwksFunc: func(ctx context.Context, issuer string) ([]byte, error) {
return discover.GetJwksByIssuer(ctx, issuer, opts.HttpClient)
},
},
}
}
type HelloOp = StandardOp
var _ OpenIdProvider = (*HelloOp)(nil)
var _ BrowserOpenIdProvider = (*HelloOp)(nil)
|
