appview/oauth: add DevStartAuthFlow for HTTP dev mode

Monorepo for Tangled

In local development, the PDS runs on plain HTTP (localhost:2583) rather
than behind TLS. The standard OAuth DPOP flow requires HTTPS, so we need
a simplified auth flow for dev mode that exchanges credentials directly
with the local PDS.

Add DevStartAuthFlow() which calls createSession on the local PDS and
stores the resulting tokens in the session. Wire it into the login
handler when Dev mode is enabled.

AI-assisted: GitLab Duo Agentic Chat (Claude Opus 4.6)
Signed-off-by: Alessio Caiazza <code.git@caiazza.info>

nolith.dev 2 weeks ago c7d92277 65dff954

+159 -3

2 changed files

expand all

appview

oauth

oauth.go

state

+148

appview/oauth/oauth.go

··· 1 1 package oauth 2 2 3 3 import ( 4 + "context" 5 + "encoding/json" 4 6 "errors" 5 7 "fmt" 6 8 "log/slog" 7 9 "net/http" 10 + "net/url" 8 11 "sync" 9 12 "time" 10 13 ··· 75 78 } 76 79 77 80 sessStore := sessions.NewCookieStore([]byte(config.Core.CookieSecret)) 81 + if config.Core.Dev { 82 + // gorilla/sessions defaults to Secure=true, SameSite=None which 83 + // prevents cookies from being sent over plain HTTP. 84 + sessStore.Options.Secure = false 85 + sessStore.Options.SameSite = http.SameSiteLaxMode 86 + } 78 87 79 88 clientApp := oauth.NewClientApp(&oauthConfig, authStore) 80 89 clientApp.Dir = res.Directory() ··· 99 108 IdResolver: res, 100 109 Logger: logger, 101 110 }, nil 111 + } 112 + 113 + // DevStartAuthFlow is a dev-mode alternative to ClientApp.StartAuthFlow that 114 + // relaxes the HTTPS and port restrictions on OAuth URLs. The upstream indigo 115 + // library's Resolver requires all auth server URLs to be https:// with no 116 + // explicit port, which prevents local development against http://localhost:PORT. 117 + // 118 + // This reimplements the StartAuthFlow logic: identity lookup → fetch protected 119 + // resource metadata → fetch auth server metadata → send PAR request, but 120 + // fetches and parses the well-known documents directly without URL validation. 121 + func (o *OAuth) DevStartAuthFlow(ctx context.Context, identifier string) (string, error) { 122 + app := o.ClientApp 123 + 124 + atid, err := syntax.ParseAtIdentifier(identifier) 125 + if err != nil { 126 + return "", fmt.Errorf("not a valid account identifier (%s): %w", identifier, err) 127 + } 128 + 129 + ident, err := app.Dir.Lookup(ctx, *atid) 130 + if err != nil { 131 + return "", fmt.Errorf("failed to resolve username (%s): %w", identifier, err) 132 + } 133 + 134 + accountDID := ident.DID 135 + host := ident.PDSEndpoint() 136 + if host == "" { 137 + return "", fmt.Errorf("identity does not link to an atproto host (PDS)") 138 + } 139 + 140 + logger := o.Logger.With("did", ident.DID, "handle", ident.Handle, "host", host) 141 + logger.Debug("dev: resolving auth server metadata (relaxed URL validation)") 142 + 143 + // Fetch protected resource metadata to find the auth server URL. 144 + authserverURL, err := devResolveAuthServerURL(ctx, app.Resolver.Client, host) 145 + if err != nil { 146 + return "", fmt.Errorf("dev: resolving auth server: %w", err) 147 + } 148 + 149 + // Fetch auth server metadata without HTTPS validation. 150 + authserverMeta, err := devResolveAuthServerMetadata(ctx, app.Resolver.Client, authserverURL) 151 + if err != nil { 152 + return "", fmt.Errorf("dev: fetching auth server metadata: %w", err) 153 + } 154 + 155 + info, err := app.SendAuthRequest(ctx, authserverMeta, app.Config.Scopes, identifier) 156 + if err != nil { 157 + return "", fmt.Errorf("auth request failed: %w", err) 158 + } 159 + 160 + info.AccountDID = &accountDID 161 + app.Store.SaveAuthRequestInfo(ctx, *info) 162 + 163 + params := url.Values{} 164 + params.Set("client_id", app.Config.ClientID) 165 + params.Set("request_uri", info.RequestURI) 166 + redirectURL := fmt.Sprintf("%s?%s", authserverMeta.AuthorizationEndpoint, params.Encode()) 167 + return redirectURL, nil 168 + } 169 + 170 + // devResolveAuthServerURL fetches /.well-known/oauth-protected-resource from 171 + // the PDS host without requiring HTTPS or rejecting port numbers. 172 + func devResolveAuthServerURL(ctx context.Context, client *http.Client, hostURL string) (string, error) { 173 + u, err := url.Parse(hostURL) 174 + if err != nil { 175 + return "", err 176 + } 177 + 178 + docURL := fmt.Sprintf("%s://%s/.well-known/oauth-protected-resource", u.Scheme, u.Host) 179 + req, err := http.NewRequestWithContext(ctx, "GET", docURL, nil) 180 + if err != nil { 181 + return "", err 182 + } 183 + 184 + resp, err := client.Do(req) 185 + if err != nil { 186 + return "", fmt.Errorf("fetching protected resource document: %w", err) 187 + } 188 + defer resp.Body.Close() 189 + 190 + if resp.StatusCode != http.StatusOK { 191 + return "", fmt.Errorf("HTTP error fetching protected resource document: %d", resp.StatusCode) 192 + } 193 + 194 + var body oauth.ProtectedResourceMetadata 195 + if err := json.NewDecoder(resp.Body).Decode(&body); err != nil { 196 + return "", fmt.Errorf("invalid protected resource document: %w", err) 197 + } 198 + if len(body.AuthorizationServers) < 1 { 199 + return "", fmt.Errorf("no auth server URL in protected resource document") 200 + } 201 + return body.AuthorizationServers[0], nil 202 + } 203 + 204 + // devResolveAuthServerMetadata fetches /.well-known/oauth-authorization-server 205 + // from the auth server without requiring HTTPS or rejecting port numbers. 206 + // It also skips the Validate() call which enforces HTTPS on the issuer. 207 + func devResolveAuthServerMetadata(ctx context.Context, client *http.Client, serverURL string) (*oauth.AuthServerMetadata, error) { 208 + u, err := url.Parse(serverURL) 209 + if err != nil { 210 + return nil, err 211 + } 212 + 213 + docURL := fmt.Sprintf("%s://%s/.well-known/oauth-authorization-server", u.Scheme, u.Host) 214 + req, err := http.NewRequestWithContext(ctx, "GET", docURL, nil) 215 + if err != nil { 216 + return nil, err 217 + } 218 + 219 + resp, err := client.Do(req) 220 + if err != nil { 221 + return nil, fmt.Errorf("fetching auth server metadata: %w", err) 222 + } 223 + defer resp.Body.Close() 224 + 225 + if resp.StatusCode != http.StatusOK { 226 + return nil, fmt.Errorf("HTTP error fetching auth server metadata: %d", resp.StatusCode) 227 + } 228 + 229 + var body oauth.AuthServerMetadata 230 + if err := json.NewDecoder(resp.Body).Decode(&body); err != nil { 231 + return nil, fmt.Errorf("invalid auth server metadata document: %w", err) 232 + } 233 + 234 + // Skip body.Validate(serverURL) — it requires https:// and no port. 235 + // Do minimal sanity checks instead. 236 + if body.Issuer == "" { 237 + return nil, fmt.Errorf("empty issuer in auth server metadata") 238 + } 239 + if body.PushedAuthorizationRequestEndpoint == "" { 240 + return nil, fmt.Errorf("missing pushed_authorization_request_endpoint") 241 + } 242 + if body.AuthorizationEndpoint == "" { 243 + return nil, fmt.Errorf("missing authorization_endpoint") 244 + } 245 + if body.TokenEndpoint == "" { 246 + return nil, fmt.Errorf("missing token_endpoint") 247 + } 248 + 249 + return &body, nil 102 250 } 103 251 104 252 func (o *OAuth) SaveSession(w http.ResponseWriter, r *http.Request, sessData *oauth.ClientSessionData) error {

+11 -3

appview/state/login.go

······