Skip to content

Commit 72d8556

Browse files
terevterev
committed
feat(token_hook): pass associated oauth client data to token hook
1 parent 0b3ecfc commit 72d8556

12 files changed

+299
-20
lines changed

‎client/client.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -580,3 +580,11 @@ type IDer interface{ GetID() string }
580580
func CookieSuffix(client IDer) string {
581581
return strconv.Itoa(int(murmur3.Sum32([]byte(client.GetID()))))
582582
}
583+
584+
func GetSanitizedCopy(c *Client) *Client {
585+
cc := new(Client)
586+
// Remove the hashed secret here
587+
*cc = *c
588+
cc.Secret = ""
589+
return cc
590+
}

‎consent/handler.go‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ import (
99
"net/url"
1010
"time"
1111

12+
"github.com/ory/hydra/v2/client"
13+
1214
"github.com/ory/hydra/v2/flow"
1315
"github.com/ory/hydra/v2/oauth2/flowctx"
1416
"github.com/ory/hydra/v2/x/events"
@@ -212,7 +214,7 @@ func (h *Handler) listOAuth2ConsentSessions(w http.ResponseWriter, r *http.Reque
212214

213215
var a []flow.OAuth2ConsentSession
214216
for _, session := range s {
215-
session.ConsentRequest.Client = sanitizeClient(session.ConsentRequest.Client)
217+
session.ConsentRequest.Client = client.GetSanitizedCopy(session.ConsentRequest.Client)
216218
a = append(a, flow.OAuth2ConsentSession(session))
217219
}
218220

@@ -372,7 +374,7 @@ func (h *Handler) getOAuth2LoginRequest(w http.ResponseWriter, r *http.Request,
372374
request.RequestedAudience = []string{}
373375
}
374376

375-
request.Client = sanitizeClient(request.Client)
377+
request.Client = client.GetSanitizedCopy(request.Client)
376378
h.r.Writer().Write(w, r, request)
377379
}
378380

@@ -679,7 +681,7 @@ func (h *Handler) getOAuth2ConsentRequest(w http.ResponseWriter, r *http.Request
679681
request.RequestedAudience = []string{}
680682
}
681683

682-
request.Client = sanitizeClient(request.Client)
684+
request.Client = client.GetSanitizedCopy(request.Client)
683685
h.r.Writer().Write(w, r, request)
684686
}
685687

‎consent/helper.go‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10,15 +10,7 @@ import (
1010
)
1111

1212
func sanitizeClientFromRequest(ar fosite.AuthorizeRequester) *client.Client {
13-
return sanitizeClient(ar.GetClient().(*client.Client))
14-
}
15-
16-
func sanitizeClient(c *client.Client) *client.Client {
17-
cc := new(client.Client)
18-
// Remove the hashed secret here
19-
*cc = *c
20-
cc.Secret = ""
21-
return cc
13+
return client.GetSanitizedCopy(ar.GetClient().(*client.Client))
2214
}
2315

2416
func matchScopes(scopeStrategy fosite.ScopeStrategy, previousConsent []flow.AcceptOAuth2ConsentRequest, requestedScope []string) *flow.AcceptOAuth2ConsentRequest {

‎contrib/quickstart/5-min/hydra.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,5 @@ oidc:
2020
- public
2121
pairwise:
2222
salt: youReallyNeedToChangeThis
23+
oauth2:
24+
token_hook: http://localhost:8080

‎oauth2/.snapshots/TestAuthCodeWithMockStrategy-strategy=jwt-case=0-description=should_pass_request_if_strategy_passes-should_call_refresh_token_hook_if_configured-hook=new.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,49 @@
3535
},
3636
"request": {
3737
"client_id": "app-client",
38+
"client": {
39+
"client_id": "app-client",
40+
"client_name": "",
41+
"grant_types": [
42+
"implicit",
43+
"refresh_token",
44+
"authorization_code",
45+
"password",
46+
"client_credentials"
47+
],
48+
"response_types": [
49+
"id_token",
50+
"code",
51+
"token"
52+
],
53+
"scope": "hydra.* offline openid",
54+
"audience": [],
55+
"owner": "",
56+
"policy_uri": "",
57+
"allowed_cors_origins": [],
58+
"tos_uri": "",
59+
"client_uri": "",
60+
"logo_uri": "",
61+
"contacts": [],
62+
"client_secret_expires_at": 0,
63+
"subject_type": "",
64+
"jwks": {},
65+
"metadata": {
66+
"some-meta-key": "some-meta-value"
67+
},
68+
"skip_consent": false,
69+
"skip_logout_consent": false,
70+
"authorization_code_grant_access_token_lifespan": null,
71+
"authorization_code_grant_id_token_lifespan": null,
72+
"authorization_code_grant_refresh_token_lifespan": null,
73+
"client_credentials_grant_access_token_lifespan": null,
74+
"implicit_grant_access_token_lifespan": null,
75+
"implicit_grant_id_token_lifespan": null,
76+
"jwt_bearer_grant_access_token_lifespan": null,
77+
"refresh_token_grant_id_token_lifespan": null,
78+
"refresh_token_grant_access_token_lifespan": null,
79+
"refresh_token_grant_refresh_token_lifespan": null
80+
},
3881
"granted_scopes": [
3982
"offline",
4083
"openid",

‎oauth2/.snapshots/TestAuthCodeWithMockStrategy-strategy=jwt-case=2-description=should_pass_because_prompt=none_and_max_age_is_less_than_auth_time-should_call_refresh_token_hook_if_configured-hook=new.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,49 @@
3535
},
3636
"request": {
3737
"client_id": "app-client",
38+
"client": {
39+
"client_id": "app-client",
40+
"client_name": "",
41+
"grant_types": [
42+
"implicit",
43+
"refresh_token",
44+
"authorization_code",
45+
"password",
46+
"client_credentials"
47+
],
48+
"response_types": [
49+
"id_token",
50+
"code",
51+
"token"
52+
],
53+
"scope": "hydra.* offline openid",
54+
"audience": [],
55+
"owner": "",
56+
"policy_uri": "",
57+
"allowed_cors_origins": [],
58+
"tos_uri": "",
59+
"client_uri": "",
60+
"logo_uri": "",
61+
"contacts": [],
62+
"client_secret_expires_at": 0,
63+
"subject_type": "",
64+
"jwks": {},
65+
"metadata": {
66+
"some-meta-key": "some-meta-value"
67+
},
68+
"skip_consent": false,
69+
"skip_logout_consent": false,
70+
"authorization_code_grant_access_token_lifespan": null,
71+
"authorization_code_grant_id_token_lifespan": null,
72+
"authorization_code_grant_refresh_token_lifespan": null,
73+
"client_credentials_grant_access_token_lifespan": null,
74+
"implicit_grant_access_token_lifespan": null,
75+
"implicit_grant_id_token_lifespan": null,
76+
"jwt_bearer_grant_access_token_lifespan": null,
77+
"refresh_token_grant_id_token_lifespan": null,
78+
"refresh_token_grant_access_token_lifespan": null,
79+
"refresh_token_grant_refresh_token_lifespan": null
80+
},
3881
"granted_scopes": [
3982
"offline",
4083
"openid",

‎oauth2/.snapshots/TestAuthCodeWithMockStrategy-strategy=jwt-case=5-description=should_pass_with_prompt=login_when_authentication_time_is_recent-should_call_refresh_token_hook_if_configured-hook=new.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,49 @@
3535
},
3636
"request": {
3737
"client_id": "app-client",
38+
"client": {
39+
"client_id": "app-client",
40+
"client_name": "",
41+
"grant_types": [
42+
"implicit",
43+
"refresh_token",
44+
"authorization_code",
45+
"password",
46+
"client_credentials"
47+
],
48+
"response_types": [
49+
"id_token",
50+
"code",
51+
"token"
52+
],
53+
"scope": "hydra.* offline openid",
54+
"audience": [],
55+
"owner": "",
56+
"policy_uri": "",
57+
"allowed_cors_origins": [],
58+
"tos_uri": "",
59+
"client_uri": "",
60+
"logo_uri": "",
61+
"contacts": [],
62+
"client_secret_expires_at": 0,
63+
"subject_type": "",
64+
"jwks": {},
65+
"metadata": {
66+
"some-meta-key": "some-meta-value"
67+
},
68+
"skip_consent": false,
69+
"skip_logout_consent": false,
70+
"authorization_code_grant_access_token_lifespan": null,
71+
"authorization_code_grant_id_token_lifespan": null,
72+
"authorization_code_grant_refresh_token_lifespan": null,
73+
"client_credentials_grant_access_token_lifespan": null,
74+
"implicit_grant_access_token_lifespan": null,
75+
"implicit_grant_id_token_lifespan": null,
76+
"jwt_bearer_grant_access_token_lifespan": null,
77+
"refresh_token_grant_id_token_lifespan": null,
78+
"refresh_token_grant_access_token_lifespan": null,
79+
"refresh_token_grant_refresh_token_lifespan": null
80+
},
3881
"granted_scopes": [
3982
"offline",
4083
"openid",

‎oauth2/.snapshots/TestAuthCodeWithMockStrategy-strategy=opaque-case=0-description=should_pass_request_if_strategy_passes-should_call_refresh_token_hook_if_configured-hook=new.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,49 @@
3535
},
3636
"request": {
3737
"client_id": "app-client",
38+
"client": {
39+
"client_id": "app-client",
40+
"client_name": "",
41+
"grant_types": [
42+
"implicit",
43+
"refresh_token",
44+
"authorization_code",
45+
"password",
46+
"client_credentials"
47+
],
48+
"response_types": [
49+
"id_token",
50+
"code",
51+
"token"
52+
],
53+
"scope": "hydra.* offline openid",
54+
"audience": [],
55+
"owner": "",
56+
"policy_uri": "",
57+
"allowed_cors_origins": [],
58+
"tos_uri": "",
59+
"client_uri": "",
60+
"logo_uri": "",
61+
"contacts": [],
62+
"client_secret_expires_at": 0,
63+
"subject_type": "",
64+
"jwks": {},
65+
"metadata": {
66+
"some-meta-key": "some-meta-value"
67+
},
68+
"skip_consent": false,
69+
"skip_logout_consent": false,
70+
"authorization_code_grant_access_token_lifespan": null,
71+
"authorization_code_grant_id_token_lifespan": null,
72+
"authorization_code_grant_refresh_token_lifespan": null,
73+
"client_credentials_grant_access_token_lifespan": null,
74+
"implicit_grant_access_token_lifespan": null,
75+
"implicit_grant_id_token_lifespan": null,
76+
"jwt_bearer_grant_access_token_lifespan": null,
77+
"refresh_token_grant_id_token_lifespan": null,
78+
"refresh_token_grant_access_token_lifespan": null,
79+
"refresh_token_grant_refresh_token_lifespan": null
80+
},
3881
"granted_scopes": [
3982
"offline",
4083
"openid",

‎oauth2/.snapshots/TestAuthCodeWithMockStrategy-strategy=opaque-case=2-description=should_pass_because_prompt=none_and_max_age_is_less_than_auth_time-should_call_refresh_token_hook_if_configured-hook=new.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,49 @@
3535
},
3636
"request": {
3737
"client_id": "app-client",
38+
"client": {
39+
"client_id": "app-client",
40+
"client_name": "",
41+
"grant_types": [
42+
"implicit",
43+
"refresh_token",
44+
"authorization_code",
45+
"password",
46+
"client_credentials"
47+
],
48+
"response_types": [
49+
"id_token",
50+
"code",
51+
"token"
52+
],
53+
"scope": "hydra.* offline openid",
54+
"audience": [],
55+
"owner": "",
56+
"policy_uri": "",
57+
"allowed_cors_origins": [],
58+
"tos_uri": "",
59+
"client_uri": "",
60+
"logo_uri": "",
61+
"contacts": [],
62+
"client_secret_expires_at": 0,
63+
"subject_type": "",
64+
"jwks": {},
65+
"metadata": {
66+
"some-meta-key": "some-meta-value"
67+
},
68+
"skip_consent": false,
69+
"skip_logout_consent": false,
70+
"authorization_code_grant_access_token_lifespan": null,
71+
"authorization_code_grant_id_token_lifespan": null,
72+
"authorization_code_grant_refresh_token_lifespan": null,
73+
"client_credentials_grant_access_token_lifespan": null,
74+
"implicit_grant_access_token_lifespan": null,
75+
"implicit_grant_id_token_lifespan": null,
76+
"jwt_bearer_grant_access_token_lifespan": null,
77+
"refresh_token_grant_id_token_lifespan": null,
78+
"refresh_token_grant_access_token_lifespan": null,
79+
"refresh_token_grant_refresh_token_lifespan": null
80+
},
3881
"granted_scopes": [
3982
"offline",
4083
"openid",

‎oauth2/.snapshots/TestAuthCodeWithMockStrategy-strategy=opaque-case=5-description=should_pass_with_prompt=login_when_authentication_time_is_recent-should_call_refresh_token_hook_if_configured-hook=new.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,49 @@
3535
},
3636
"request": {
3737
"client_id": "app-client",
38+
"client": {
39+
"client_id": "app-client",
40+
"client_name": "",
41+
"grant_types": [
42+
"implicit",
43+
"refresh_token",
44+
"authorization_code",
45+
"password",
46+
"client_credentials"
47+
],
48+
"response_types": [
49+
"id_token",
50+
"code",
51+
"token"
52+
],
53+
"scope": "hydra.* offline openid",
54+
"audience": [],
55+
"owner": "",
56+
"policy_uri": "",
57+
"allowed_cors_origins": [],
58+
"tos_uri": "",
59+
"client_uri": "",
60+
"logo_uri": "",
61+
"contacts": [],
62+
"client_secret_expires_at": 0,
63+
"subject_type": "",
64+
"jwks": {},
65+
"metadata": {
66+
"some-meta-key": "some-meta-value"
67+
},
68+
"skip_consent": false,
69+
"skip_logout_consent": false,
70+
"authorization_code_grant_access_token_lifespan": null,
71+
"authorization_code_grant_id_token_lifespan": null,
72+
"authorization_code_grant_refresh_token_lifespan": null,
73+
"client_credentials_grant_access_token_lifespan": null,
74+
"implicit_grant_access_token_lifespan": null,
75+
"implicit_grant_id_token_lifespan": null,
76+
"jwt_bearer_grant_access_token_lifespan": null,
77+
"refresh_token_grant_id_token_lifespan": null,
78+
"refresh_token_grant_access_token_lifespan": null,
79+
"refresh_token_grant_refresh_token_lifespan": null
80+
},
3881
"granted_scopes": [
3982
"offline",
4083
"openid",

0 commit comments

Comments
 (0)