| | | 1 | | using Elsa.Abstractions; |
| | | 2 | | using Elsa.ExternalAuthentication.Constants; |
| | | 3 | | using Elsa.ExternalAuthentication.Models; |
| | | 4 | | using Elsa.ExternalAuthentication.Services; |
| | | 5 | | using FastEndpoints; |
| | | 6 | | using Microsoft.AspNetCore.Builder; |
| | | 7 | | using Microsoft.AspNetCore.RateLimiting; |
| | | 8 | | |
| | | 9 | | namespace Elsa.ExternalAuthentication.Endpoints.Broker; |
| | | 10 | | |
| | 7 | 11 | | internal sealed class ExchangeToken(IExternalAuthenticationBroker broker) : ElsaEndpoint<ExchangeTokenRequest> |
| | | 12 | | { |
| | | 13 | | public override void Configure() |
| | | 14 | | { |
| | 6 | 15 | | Post("/external-authentication/token"); |
| | 6 | 16 | | AllowAnonymous(); |
| | 6 | 17 | | AllowFormData(true); |
| | 12 | 18 | | Options(x => x.RequireRateLimiting(ExternalAuthenticationRateLimitPolicyNames.TokenExchange)); |
| | 6 | 19 | | } |
| | | 20 | | |
| | | 21 | | public override async Task HandleAsync(ExchangeTokenRequest request, CancellationToken cancellationToken) |
| | | 22 | | { |
| | 1 | 23 | | Uri? redirectUri = null; |
| | 1 | 24 | | if (!string.IsNullOrWhiteSpace(request.RedirectUri) && !Uri.TryCreate(request.RedirectUri, UriKind.Absolute, out |
| | | 25 | | { |
| | 0 | 26 | | await BrokerEndpointSupport.SendErrorAsync(Send, BrokerErrorFactory.Create(BrokerErrorCategory.InvalidReques |
| | 0 | 27 | | return; |
| | | 28 | | } |
| | | 29 | | |
| | 1 | 30 | | var basicCredentials = TryGetBasicCredentials(HttpContext.Request.Headers.Authorization); |
| | 1 | 31 | | var result = await broker.ExchangeAsync(new BrokerTokenRequest(request.GrantType ?? string.Empty, request.Client |
| | 1 | 32 | | if (result.Error is { } error) |
| | | 33 | | { |
| | 0 | 34 | | await BrokerEndpointSupport.SendErrorAsync(Send, error, cancellationToken); |
| | 0 | 35 | | return; |
| | | 36 | | } |
| | | 37 | | |
| | 1 | 38 | | await Send.OkAsync(result.Token!, cancellationToken); |
| | 1 | 39 | | } |
| | | 40 | | |
| | | 41 | | private static (string ClientId, string Secret)? TryGetBasicCredentials(string? authorization) |
| | | 42 | | { |
| | 1 | 43 | | if (string.IsNullOrWhiteSpace(authorization) || !authorization.StartsWith("Basic ", StringComparison.OrdinalIgno |
| | 1 | 44 | | return null; |
| | | 45 | | try |
| | | 46 | | { |
| | 0 | 47 | | var parts = System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(authorization[6..])).Split(':', 2); |
| | 0 | 48 | | return parts.Length == 2 ? (parts[0], parts[1]) : null; |
| | | 49 | | } |
| | 0 | 50 | | catch (FormatException) |
| | | 51 | | { |
| | 0 | 52 | | return null; |
| | | 53 | | } |
| | 0 | 54 | | } |
| | | 55 | | } |
| | | 56 | | |
| | | 57 | | internal sealed class ExchangeTokenRequest |
| | | 58 | | { |
| | | 59 | | public string? GrantType { get; set; } |
| | | 60 | | public string? ClientId { get; set; } |
| | | 61 | | public string? RedirectUri { get; set; } |
| | | 62 | | public string? Code { get; set; } |
| | | 63 | | public string? CodeVerifier { get; set; } |
| | | 64 | | public string? RefreshToken { get; set; } |
| | | 65 | | } |