Skip to content

Commit ef3e950

Browse files
kevgokevgo
authored
chore: format using Make (#703)
1 parent aa73376 commit ef3e950

22 files changed

+209
-155
lines changed

‎.github/workflows/format.yml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: Format
2+
3+
on:
4+
pull_request:
5+
push:
6+
7+
jobs:
8+
format:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- uses: actions/checkout@v3
12+
- uses: actions/setup-go@v3
13+
with:
14+
go-version: 1.19
15+
- run: make format
16+
- name: Indicate formatting issues
17+
run: git diff HEAD --exit-code --color

‎.github/workflows/test.yml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
name: Unit tests
2+
3+
on:
4+
pull_request:
5+
push:
6+
7+
jobs:
8+
test:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- uses: actions/checkout@v3
12+
- uses: actions/setup-go@v3
13+
with:
14+
go-version: 1.19
15+
- run: make test

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
.bin
12
.idea
23
*.iml
34
.cover

‎.prettierignore

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
.github/ISSUE_TEMPLATE/BUG-REPORT.yml
2+
.github/ISSUE_TEMPLATE/DESIGN-DOC.yml
3+
.github/ISSUE_TEMPLATE/FEATURE-REQUEST.yml
4+
.github/ISSUE_TEMPLATE/config.yml
5+
.github/pull_request_template.md
6+
CHANGELOG.md
7+
CONTRIBUTING.md

‎.travis.yml

+3-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,9 @@ go:
88
install:
99
- go install github.com/mattn/goveralls
1010
- go install github.com/ory/go-acc
11-
- curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.24.0
11+
- curl -sSfL
12+
https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh |
13+
sh -s -- -b $(go env GOPATH)/bin v1.24.0
1214

1315
script:
1416
- golangci-lint run

‎Makefile

+16-4
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,18 @@
1-
format:
2-
goreturns -w -local github.com/ory $$(listx .)
1+
format: .bin/goimports node_modules # formats the source code
2+
.bin/goimports -w .
3+
npm exec -- prettier --write .
34

4-
test:
5-
go test ./...
5+
help:
6+
@cat Makefile | grep '^[^ ]*:' | grep -v '^\.bin/' | grep -v '.SILENT:' | grep -v '^node_modules:' | grep -v help | sed 's/:.*#/#/' | column -s "#" -t
67

8+
test: # runs all tests
9+
go test ./...
10+
11+
.bin/goimports: Makefile
12+
GOBIN=$(shell pwd)/.bin go install golang.org/x/tools/cmd/goimports@latest
13+
14+
node_modules: package-lock.json
15+
npm ci
16+
touch node_modules
17+
18+
.DEFAULT_GOAL := help

‎README.md

+20-14
Original file line numberDiff line numberDiff line change
@@ -246,29 +246,35 @@ looking at some examples:
246246

247247
### Globalization
248248

249-
Fosite does not natively carry translations for error messages and hints, but offers an interface that allows the
250-
consumer to define catalog bundles and an implementation to translate. This is available through
251-
the [MessageCatalog](i18n/i18n.go) interface. The functions defined are self-explanatory. The `DefaultMessageCatalog`
252-
illustrates this. Compose config has been extended to take in an instance of the `MessageCatalog`.
249+
Fosite does not natively carry translations for error messages and hints, but
250+
offers an interface that allows the consumer to define catalog bundles and an
251+
implementation to translate. This is available through the
252+
[MessageCatalog](i18n/i18n.go) interface. The functions defined are
253+
self-explanatory. The `DefaultMessageCatalog` illustrates this. Compose config
254+
has been extended to take in an instance of the `MessageCatalog`.
253255

254256
#### Building translated files
255257

256258
There are three possible "message key" types:
257259

258-
1. Value of `RFC6749Error.ErrorField`: This is a string like `invalid_request` and correlates to most errors produced by
259-
Fosite.
260-
2. Hint identifier passed into `RFC6749Error.WithHintIDOrDefaultf`: This func is not used extensively in Fosite but, in
261-
time, most `WithHint` and `WithHintf` will be replaced with this function.
262-
3. Free text string format passed into `RFC6749Error.WithHint` and `RFC6749Error.WithHintf`: This function is used in
263-
Fosite and Hydra extensively and any message catalog implementation can use the format string parameter as the
264-
message key.
260+
1. Value of `RFC6749Error.ErrorField`: This is a string like `invalid_request`
261+
and correlates to most errors produced by Fosite.
262+
2. Hint identifier passed into `RFC6749Error.WithHintIDOrDefaultf`: This func is
263+
not used extensively in Fosite but, in time, most `WithHint` and `WithHintf`
264+
will be replaced with this function.
265+
3. Free text string format passed into `RFC6749Error.WithHint` and
266+
`RFC6749Error.WithHintf`: This function is used in Fosite and Hydra
267+
extensively and any message catalog implementation can use the format string
268+
parameter as the message key.
265269

266-
An example of a message catalog can be seen in the [i18n_test.go](i18n/i18n_test.go).
270+
An example of a message catalog can be seen in the
271+
[i18n_test.go](i18n/i18n_test.go).
267272

268273
#### Generating the `en` messages file
269274

270-
This is a WIP at the moment, but effectively any scripting language can be used to generate this. It would need to
271-
traverse all files in the source code and extract the possible message identifiers based on the different message key
275+
This is a WIP at the moment, but effectively any scripting language can be used
276+
to generate this. It would need to traverse all files in the source code and
277+
extract the possible message identifiers based on the different message key
272278
types.
273279

274280
### Quickstart

‎access_request_handler.go

+22-22
Original file line numberDiff line numberDiff line change
@@ -33,30 +33,30 @@ import (
3333
)
3434

3535
// Implements
36-
// * https://tools.ietf.org/html/rfc6749#section-2.3.1
37-
// Clients in possession of a client password MAY use the HTTP Basic
38-
// authentication scheme as defined in [RFC2617] to authenticate with
39-
// the authorization server. The client identifier is encoded using the
40-
// "application/x-www-form-urlencoded" encoding algorithm per
41-
// Appendix B, and the encoded value is used as the username; the client
42-
// password is encoded using the same algorithm and used as the
43-
// password. The authorization server MUST support the HTTP Basic
44-
// authentication scheme for authenticating clients that were issued a
45-
// client password.
46-
// Including the client credentials in the request-body using the two
47-
// parameters is NOT RECOMMENDED and SHOULD be limited to clients unable
48-
// to directly utilize the HTTP Basic authentication scheme (or other
49-
// password-based HTTP authentication schemes). The parameters can only
50-
// be transmitted in the request-body and MUST NOT be included in the
51-
// request URI.
52-
// * https://tools.ietf.org/html/rfc6749#section-3.2.1
36+
// - https://tools.ietf.org/html/rfc6749#section-2.3.1
37+
// Clients in possession of a client password MAY use the HTTP Basic
38+
// authentication scheme as defined in [RFC2617] to authenticate with
39+
// the authorization server. The client identifier is encoded using the
40+
// "application/x-www-form-urlencoded" encoding algorithm per
41+
// Appendix B, and the encoded value is used as the username; the client
42+
// password is encoded using the same algorithm and used as the
43+
// password. The authorization server MUST support the HTTP Basic
44+
// authentication scheme for authenticating clients that were issued a
45+
// client password.
46+
// Including the client credentials in the request-body using the two
47+
// parameters is NOT RECOMMENDED and SHOULD be limited to clients unable
48+
// to directly utilize the HTTP Basic authentication scheme (or other
49+
// password-based HTTP authentication schemes). The parameters can only
50+
// be transmitted in the request-body and MUST NOT be included in the
51+
// request URI.
52+
// - https://tools.ietf.org/html/rfc6749#section-3.2.1
5353
// - Confidential clients or other clients issued client credentials MUST
54-
// authenticate with the authorization server as described in
55-
// Section 2.3 when making requests to the token endpoint.
54+
// authenticate with the authorization server as described in
55+
// Section 2.3 when making requests to the token endpoint.
5656
// - If the client type is confidential or the client was issued client
57-
// credentials (or assigned other authentication requirements), the
58-
// client MUST authenticate with the authorization server as described
59-
// in Section 3.2.1.
57+
// credentials (or assigned other authentication requirements), the
58+
// client MUST authenticate with the authorization server as described
59+
// in Section 3.2.1.
6060
func (f *Fosite) NewAccessRequest(ctx context.Context, r *http.Request, session Session) (AccessRequester, error) {
6161
accessRequest := NewAccessRequest(session)
6262
accessRequest.Request.Lang = i18n.GetLangFromRequest(f.Config.GetMessageCatalog(ctx), r)

‎arguments.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,8 @@ type Arguments []string
2828
// Matches performs an case-insensitive, out-of-order check that the items
2929
// provided exist and equal all of the args in arguments.
3030
// Note:
31-
// - Providing a list that includes duplicate string-case items will return not
32-
// matched.
31+
// - Providing a list that includes duplicate string-case items will return not
32+
// matched.
3333
func (r Arguments) Matches(items ...string) bool {
3434
if len(r) != len(items) {
3535
return false

‎authorize_error_test.go

+13-13
Original file line numberDiff line numberDiff line change
@@ -36,19 +36,19 @@ import (
3636
)
3737

3838
// Test for
39-
// * https://tools.ietf.org/html/rfc6749#section-4.1.2.1
40-
// If the request fails due to a missing, invalid, or mismatching
41-
// redirection URI, or if the client identifier is missing or invalid,
42-
// the authorization server SHOULD inform the resource owner of the
43-
// error and MUST NOT automatically redirect the user-agent to the
44-
// invalid redirection URI.
45-
// * https://tools.ietf.org/html/rfc6749#section-3.1.2
46-
// The redirection endpoint URI MUST be an absolute URI as defined by
47-
// [RFC3986] Section 4.3. The endpoint URI MAY include an
48-
// "application/x-www-form-urlencoded" formatted (per Appendix B) query
49-
// component ([RFC3986] Section 3.4), which MUST be retained when adding
50-
// additional query parameters. The endpoint URI MUST NOT include a
51-
// fragment component.
39+
// - https://tools.ietf.org/html/rfc6749#section-4.1.2.1
40+
// If the request fails due to a missing, invalid, or mismatching
41+
// redirection URI, or if the client identifier is missing or invalid,
42+
// the authorization server SHOULD inform the resource owner of the
43+
// error and MUST NOT automatically redirect the user-agent to the
44+
// invalid redirection URI.
45+
// - https://tools.ietf.org/html/rfc6749#section-3.1.2
46+
// The redirection endpoint URI MUST be an absolute URI as defined by
47+
// [RFC3986] Section 4.3. The endpoint URI MAY include an
48+
// "application/x-www-form-urlencoded" formatted (per Appendix B) query
49+
// component ([RFC3986] Section 3.4), which MUST be retained when adding
50+
// additional query parameters. The endpoint URI MUST NOT include a
51+
// fragment component.
5252
func TestWriteAuthorizeError(t *testing.T) {
5353
var urls = []string{
5454
"https://foobar.com/",

‎authorize_helper.go

+20-19
Original file line numberDiff line numberDiff line change
@@ -54,26 +54,27 @@ var DefaultFormPostTemplate = template.Must(template.New("form_post").Parse(`<ht
5454
// uri validation.
5555
//
5656
// Considered specifications
57-
// * https://tools.ietf.org/html/rfc6749#section-3.1.2.3
58-
// If multiple redirection URIs have been registered, if only part of
59-
// the redirection URI has been registered, or if no redirection URI has
60-
// been registered, the client MUST include a redirection URI with the
61-
// authorization request using the "redirect_uri" request parameter.
6257
//
63-
// When a redirection URI is included in an authorization request, the
64-
// authorization server MUST compare and match the value received
65-
// against at least one of the registered redirection URIs (or URI
66-
// components) as defined in [RFC3986] Section 6, if any redirection
67-
// URIs were registered. If the client registration included the full
68-
// redirection URI, the authorization server MUST compare the two URIs
69-
// using simple string comparison as defined in [RFC3986] Section 6.2.1.
58+
// - https://tools.ietf.org/html/rfc6749#section-3.1.2.3
59+
// If multiple redirection URIs have been registered, if only part of
60+
// the redirection URI has been registered, or if no redirection URI has
61+
// been registered, the client MUST include a redirection URI with the
62+
// authorization request using the "redirect_uri" request parameter.
63+
//
64+
// When a redirection URI is included in an authorization request, the
65+
// authorization server MUST compare and match the value received
66+
// against at least one of the registered redirection URIs (or URI
67+
// components) as defined in [RFC3986] Section 6, if any redirection
68+
// URIs were registered. If the client registration included the full
69+
// redirection URI, the authorization server MUST compare the two URIs
70+
// using simple string comparison as defined in [RFC3986] Section 6.2.1.
7071
//
7172
// * https://tools.ietf.org/html/rfc6819#section-4.4.1.7
72-
// * The authorization server may also enforce the usage and validation
73+
// - The authorization server may also enforce the usage and validation
7374
// of pre-registered redirect URIs (see Section 5.2.3.5). This will
7475
// allow for early recognition of authorization "code" disclosure to
7576
// counterfeit clients.
76-
// * The attacker will need to use another redirect URI for its
77+
// - The attacker will need to use another redirect URI for its
7778
// authorization process rather than the target web site because it
7879
// needs to intercept the flow. So, if the authorization server
7980
// associates the authorization "code" with the redirect URI of a
@@ -168,11 +169,11 @@ func isLoopbackAddress(address string) bool {
168169
// IsValidRedirectURI validates a redirect_uri as specified in:
169170
//
170171
// * https://tools.ietf.org/html/rfc6749#section-3.1.2
171-
// * The redirection endpoint URI MUST be an absolute URI as defined by [RFC3986] Section 4.3.
172-
// * The endpoint URI MUST NOT include a fragment component.
173-
// * https://tools.ietf.org/html/rfc3986#section-4.3
174-
// absolute-URI = scheme ":" hier-part [ "?" query ]
175-
// * https://tools.ietf.org/html/rfc6819#section-5.1.1
172+
// - The redirection endpoint URI MUST be an absolute URI as defined by [RFC3986] Section 4.3.
173+
// - The endpoint URI MUST NOT include a fragment component.
174+
// - https://tools.ietf.org/html/rfc3986#section-4.3
175+
// absolute-URI = scheme ":" hier-part [ "?" query ]
176+
// - https://tools.ietf.org/html/rfc6819#section-5.1.1
176177
func IsValidRedirectURI(redirectURI *url.URL) bool {
177178
// We need to explicitly check for a scheme
178179
if !govalidator.IsRequestURL(redirectURI.String()) {

‎authorize_request_handler_test.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -39,10 +39,10 @@ import (
3939

4040
// Should pass
4141
//
42-
// * https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#Terminology
43-
// The OAuth 2.0 specification allows for registration of space-separated response_type parameter values.
44-
// If a Response Type contains one of more space characters (%20), it is compared as a space-delimited list of
45-
// values in which the order of values does not matter.
42+
// - https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#Terminology
43+
// The OAuth 2.0 specification allows for registration of space-separated response_type parameter values.
44+
// If a Response Type contains one of more space characters (%20), it is compared as a space-delimited list of
45+
// values in which the order of values does not matter.
4646
func TestNewAuthorizeRequest(t *testing.T) {
4747
var store *MockStorage
4848

‎client_authentication.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ import (
4242
// ClientAuthenticationStrategy provides a method signature for authenticating a client request
4343
type ClientAuthenticationStrategy func(context.Context, *http.Request, url.Values) (Client, error)
4444

45-
//#nosec:gosec G101 - False Positive
45+
// #nosec:gosec G101 - False Positive
4646
const clientAssertionJWTBearerType = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
4747

4848
func (f *Fosite) findClientPublicJWK(ctx context.Context, oidcClient OpenIDConnectClient, t *jwt.Token, expectsRSAKey bool) (interface{}, error) {

‎compose/compose.go

+15-15
Original file line numberDiff line numberDiff line change
@@ -32,24 +32,24 @@ type Factory func(config fosite.Configurator, storage interface{}, strategy inte
3232

3333
// Compose takes a config, a storage, a strategy and handlers to instantiate an OAuth2Provider:
3434
//
35-
// import "github.com/ory/fosite/compose"
35+
// import "github.com/ory/fosite/compose"
3636
//
37-
// // var storage = new(MyFositeStorage)
38-
// var config = Config {
39-
// AccessTokenLifespan: time.Minute * 30,
40-
// // check Config for further configuration options
41-
// }
37+
// // var storage = new(MyFositeStorage)
38+
// var config = Config {
39+
// AccessTokenLifespan: time.Minute * 30,
40+
// // check Config for further configuration options
41+
// }
4242
//
43-
// var strategy = NewOAuth2HMACStrategy(config)
43+
// var strategy = NewOAuth2HMACStrategy(config)
4444
//
45-
// var oauth2Provider = Compose(
46-
// config,
47-
// storage,
48-
// strategy,
49-
// NewOAuth2AuthorizeExplicitHandler,
50-
// OAuth2ClientCredentialsGrantFactory,
51-
// // for a complete list refer to the docs of this package
52-
// )
45+
// var oauth2Provider = Compose(
46+
// config,
47+
// storage,
48+
// strategy,
49+
// NewOAuth2AuthorizeExplicitHandler,
50+
// OAuth2ClientCredentialsGrantFactory,
51+
// // for a complete list refer to the docs of this package
52+
// )
5353
//
5454
// Compose makes use of interface{} types in order to be able to handle a all types of stores, strategies and handlers.
5555
func Compose(config *fosite.Config, storage interface{}, strategy interface{}, factories ...Factory) fosite.OAuth2Provider {

‎docs/how-tos/client_credentials_grant.md

+15-4
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,24 @@
11
# Client Credentials Grant
22

3-
The following example configures a _fosite_ _OAuth2 Provider_ for issuing _JWT_ _access tokens_ using the _Client Credentials Grant_. This grant allows a client to request access tokens using only its client credentials at the _Token Endpoint_(see [rfc6749 Section 4.4](https://tools.ietf.org/html/rfc6749#section-4.4). For this aim, this _how-to_ configures:
3+
The following example configures a _fosite_ _OAuth2 Provider_ for issuing _JWT_
4+
_access tokens_ using the _Client Credentials Grant_. This grant allows a client
5+
to request access tokens using only its client credentials at the _Token
6+
Endpoint_(see
7+
[rfc6749 Section 4.4](https://tools.ietf.org/html/rfc6749#section-4.4). For this
8+
aim, this _how-to_ configures:
49

510
- RSA _JWT Strategy_ to sign JWT _access tokens_
611
- _Token Endpoint_ http handler
712
- A `fosite.OAuth2Provider` that provides the following services:
8-
- Create and validate [_OAuth2 Access Token Requests_](https://tools.ietf.org/html/rfc6749#section-4.1.3) with _Client Credentials Grant_
9-
- Create an [_Access Token Response_](https://tools.ietf.org/html/rfc6749#section-4.1.4) and
10-
- Sends a [successful](https://tools.ietf.org/html/rfc6749#section-5.1) or [error](https://tools.ietf.org/html/rfc6749#section-5.2) HTTP response to client
13+
- Create and validate
14+
[_OAuth2 Access Token Requests_](https://tools.ietf.org/html/rfc6749#section-4.1.3)
15+
with _Client Credentials Grant_
16+
- Create an
17+
[_Access Token Response_](https://tools.ietf.org/html/rfc6749#section-4.1.4)
18+
and
19+
- Sends a [successful](https://tools.ietf.org/html/rfc6749#section-5.1) or
20+
[error](https://tools.ietf.org/html/rfc6749#section-5.2) HTTP response to
21+
client
1122

1223
## Code Example
1324

0 commit comments

Comments
 (0)