actually store PARs

Author: DavidBuchanan314

src/millipds/auth_oauth.py

@@ -321,18 +321,34 @@ async def dpop_handler(request: web.Request):
 @dpop_protected
 async def oauth_pushed_authorization_request(request: web.Request):
 	# NOTE: rfc9126 says this is posted as form data, but this is atproto-flavoured oauth
-	data = await request.json()
-	logging.info(data)
+	request_json = await request.json()
+	logging.info(request_json)
 
-	assert data["client_id"] == request["dpop_iss"]  # idk if this is required
+	# idk if this is required
+	assert request_json["client_id"] == request["dpop_iss"]
 
-	# TODO: request client metadata???
+	now = int(time.time())
+	par_uri = "urn:ietf:params:oauth:request_uri:req-" + secrets.token_hex()
 
-	# TODO: we need to store the request somewhere, and associate it with the URI we return (and also the DPoP key)
+	# NOTE: we don't do any verification of the auth request itself, we just associate it with a URI for later retreival.
+	get_db(request).con.execute(
+		"""
+			INSERT INTO oauth_par (
+				uri, dpop_jwk, value, created_at, expires_at
+			) VALUES (?, ?, ?, ?, ?)
+		""",
+		(
+			par_uri,
+			request["dpop_jwk"],
+			cbrrr.encode_dag_cbor(request_json),
+			now,
+			now + static_config.OAUTH_PAR_EXP,
+		),
+	)
 
 	return web.json_response(
 		{
-			"request_uri": "urn:ietf:params:oauth:request_uri:req-064ed63e9fbf10815fd5f402f4f3e92a",  # XXX hardcoded test
-			"expires_in": 299,
+			"request_uri": par_uri,
+			"expires_in": static_config.OAUTH_PAR_EXP,
 		}
 	)

src/millipds/database.py

@@ -275,6 +275,20 @@ def _init_tables(self):
 			"""
 		)
 
+		# TODO: unsure if we need to track dpop jwk here?
+		# (if we do, it could just be a hash of the key)
+		self.con.execute(
+			"""
+			CREATE TABLE oauth_par(
+				uri TEXT PRIMARY KEY NOT NULL,
+				dpop_jwk BLOB NOT NULL,
+				value BLOB NOT NULL,
+				created_at INTEGER NOT NULL,
+				expires_at INTEGER NOT NULL
+			) STRICT, WITHOUT ROWID
+			"""
+		)
+
 		# has user granted a particular scope to a particular app?
 		self.con.execute(
 			"""

src/millipds/static_config.py

@@ -34,3 +34,4 @@
 REFRESH_EXP = 60 * 60 * 24 * 90  # 90 days
 
 OAUTH_COOKIE_EXP = 60 * 60 * 24 * 90  # 90 days
+OAUTH_PAR_EXP = 300