AbstractClientFactory.h

#ifndef TENDUKE_SE_ABSTRACTCLIENTFACTORY_H
#define TENDUKE_SE_ABSTRACTCLIENTFACTORY_H
 
#include "createDefaultTendukeServices.h"
#include "createTendukeClient.h"
#include "TendukeClientWithOIDCSession.h"
#include "config/BackendConfiguration.h"
#include "config/ClientProperties.h"
#include "log/log.h"
#include "oidc/idtoken/IdTokenSession.h"
#include "oidc/session/OIDCLogin.h"
#include "oidc/session/SerializedOIDCSession.h"
#include "state/ClientState.h"
#include "state/DeserializeStateFromJSON.h"
 
namespace tenduke { namespace se {

template<class P>
class AbstractClientFactory
{
public:
    virtual ~AbstractClientFactory() = default;

    AbstractClientFactory(
            const std::string &clientId,
            const ::tenduke::ServiceConfiguration &serviceConfiguration
    )
    : services(::tenduke::createDefaultTendukeServices(clientId, serviceConfiguration))
    {}

    explicit AbstractClientFactory(const ::tenduke::TendukeServices &services)
    : services(services)
    {}
 
public:
    virtual std::unique_ptr<::tenduke::se::TendukeClientWithOIDCSession> createClient(
            const ::tenduke::se::ClientProperties &clientProperties,
            const ::tenduke::se::BackendConfiguration &backendConfiguration,
            const ::tenduke::oauth::OAuthBackendConfiguration &oauthBackendConfiguration,
            const ::tenduke::oidc::OIDCConfiguration &oidcConfiguration,
            const P &authenticationConfiguration,
            const std::string &initialStateAsJSON = {}
    ) const
    {
        auto oauthConfiguration = mkOAuthConfiguration(oauthBackendConfiguration, authenticationConfiguration);
        auto oidcConfig = std::make_shared<::tenduke::oidc::OIDCConfiguration>(oidcConfiguration);
        auto initialState = deserializeInitialState(initialStateAsJSON);
 
        return ::tenduke::se::createClient(
                services,
                clientProperties,
                backendConfiguration,
                oauthConfiguration,
                oidcConfig,
                initialState,
                createOIDCSessionService(
                    oauthConfiguration,
                    oidcConfig,
                    authenticationConfiguration,
                    createUniqueOIDCState(initialState.oidcState)
                )
        );
    }

    std::unique_ptr<::tenduke::se::TendukeClientWithOIDCSession> createClientUsingAutodiscovery(
        const ::tenduke::se::ClientProperties &clientProperties,
        const ::tenduke::se::BackendConfiguration &backendConfiguration,
        const std::string &oidcAutodiscoveryURL,
        const P &authenticationConfiguration,
        const std::string &initialStateAsJSON = {}
    ) const
    {
        const auto initialState = deserializeInitialState(initialStateAsJSON);
        std::shared_ptr<const ::tenduke::oauth::OAuthConfiguration> oauthConfiguration;
        std::shared_ptr<const ::tenduke::oidc::OIDCConfiguration> oidcConfiguration;
        if (canUseState(initialState)) {
            ::tenduke::log::info("Bootstrapping OIDC configuration from provided state");
            oauthConfiguration = initialState.oauthConfiguration;
            oidcConfiguration = initialState.oidcConfiguration;
        }
        else {
            ::tenduke::log::info("Bootstrapping OIDC configuration with auto discovery...");
            auto discoveryResult = services.oidcBackendConfiguration->discover(oidcAutodiscoveryURL);
            oidcConfiguration = services.oidcBackendConfiguration->toOIDCConfiguration(discoveryResult);
            oauthConfiguration = mkOAuthConfiguration(
               *discoveryResult.getOAuthConfiguration(),
               authenticationConfiguration
            );
 
            dumpAutodiscoveryResult(*services.oidcBackendConfiguration, discoveryResult);
        }
 
        return ::tenduke::se::createClient(
                services,
                clientProperties,
                backendConfiguration,
                oauthConfiguration,
                oidcConfiguration,
                initialState,
                createOIDCSessionService(
                    oauthConfiguration,
                    oidcConfiguration,
                    authenticationConfiguration,
                    createUniqueOIDCState(initialState.oidcState)
                )
        );
    }
 
protected:
    struct OIDCServices
    {
        std::shared_ptr<const ::tenduke::oidc::OIDCClient> client;
        std::shared_ptr<const ::tenduke::oidc::OIDCLogin> login;
    };

    virtual std::shared_ptr<::tenduke::oauth::OAuthConfiguration> mkOAuthConfiguration(
            const ::tenduke::oauth::OAuthBackendConfiguration &oauthBackendConfig,
            const P &authenticationConfig
    ) const = 0;

    virtual void dumpAutodiscoveryResult(
            const ::tenduke::oidc::AutoDiscovery &service,
            const ::tenduke::oidc::AutoDiscoveryResult &result
    ) const
    {
        ::tenduke::log::debug("AbstractClientFactory::dumpAutodiscoveryResult() Auto discovered properties:");
        ::tenduke::log::debug("AbstractClientFactory::dumpAutodiscoveryResult() - authorization endpoint: " + result.getOAuthConfiguration()->authorizationEndpointUrl);
        ::tenduke::log::debug("AbstractClientFactory::dumpAutodiscoveryResult() - token endpoint:         " + result.getOAuthConfiguration()->tokenEndpointUrl);
        ::tenduke::log::debug("AbstractClientFactory::dumpAutodiscoveryResult() - userinfo endpoint:      " + result.getOOIDCConfiguration()->userinfoEndpoint);
        ::tenduke::log::debug("AbstractClientFactory::dumpAutodiscoveryResult() - issuer:                 " + result.getOOIDCConfiguration()->issuer);
        ::tenduke::log::debug("AbstractClientFactory::dumpAutodiscoveryResult() - verification key:");
 
        auto jwk = service.getDefaultVerificationKey(result);
 
        ::tenduke::log::debug(jwk->key->toPEM());
    }
 
    virtual std::unique_ptr<::tenduke::oidc::OIDCState> createUniqueOIDCState(const std::shared_ptr<const ::tenduke::oidc::OIDCState> &state)
    const
    {
        if (state == nullptr) {
            return nullptr;
        }
        return std::unique_ptr<::tenduke::oidc::OIDCState>(new ::tenduke::oidc::OIDCState(*state));
    }
 
 
    virtual ::tenduke::se::ClientState deserializeInitialState(const std::string &initialStateAsJson) const
    {
        return ::tenduke::se::DeserializeStateFromJSON(
                services.jwtParser,
                services.jsonParser,
                services.keyFactory
        ).from(initialStateAsJson);
    }
 
    virtual OIDCServices createOIDCLoginService(
        const std::shared_ptr<const ::tenduke::oauth::OAuthConfiguration> &oauthConfiguration,
        const std::shared_ptr<const ::tenduke::oidc::OIDCConfiguration> &oidcConfiguration,
        const P &authenticationConfiguration
    ) const = 0;
 
    virtual std::shared_ptr<::tenduke::oidc::OIDCSession> createOIDCSessionService(
        const std::shared_ptr<const ::tenduke::oauth::OAuthConfiguration> &oauthConfiguration ,
        const std::shared_ptr<const ::tenduke::oidc::OIDCConfiguration> &oidcConfiguration,
        const P &authenticationConfiguration,
        std::unique_ptr<::tenduke::oidc::OIDCState> initialState
    ) const
    {
        auto oidcLoginServices = createOIDCLoginService(
           oauthConfiguration,
           oidcConfiguration,
           authenticationConfiguration
        );
        auto oidcSessionImpl = std::make_shared<::tenduke::oidc::IdTokenSession>(
                std::move(initialState),
                oidcLoginServices.login,
                oidcLoginServices.client,
                services.clock,
                authenticationConfiguration.oidcSessionConfiguration.sessionEventListener,
                ::tenduke::oidc::IdTokenSession::DEFAULT_SAFETY_MARGIN_S,
               authenticationConfiguration.oidcSessionConfiguration.loginTimeout
        );
 
        return std::make_shared<::tenduke::oidc::SerializedOIDCSession>(
                oidcSessionImpl,
                authenticationConfiguration.oidcSessionConfiguration.concurrencyTimeout
        );
    }

    virtual bool canUseState(const ::tenduke::se::ClientState &state)
    const
    {
        // OAuthConfiguration is required
        if (state.oauthConfiguration == nullptr) {
            return false;
        }
        // OAuth client ID is required
        if (state.oauthConfiguration->clientId.empty()) {
            return false;
        }
        // OIDC configuration is required
        if (state.oidcConfiguration == nullptr) {
            return false;
        }
        return true;
    };
 
    virtual std::string getScope(const P &authenticationConfiguration)
    const
    {
        if (authenticationConfiguration.scopes.empty()) {
            return "profile email";
        }
        return authenticationConfiguration.scopes;
    }
 
protected:
    ::tenduke::TendukeServices services;
};
 
}}
 
#endif //TENDUKE_SE_ABSTRACTCLIENTFACTORY_H