Mastodon clients can sign in: OAuth with a persona per token

OpenIddict 7.7 (MongoDB stores, keys kept in Mongo so tokens survive
restarts) serves /oauth/authorize, /oauth/token, /oauth/revoke and the
discovery documents, including /.well-known/oauth-authorization-server:
- authorization code (PKCE optional) and client credentials, Mastodon's
  scopes including the granular ones, non-expiring reference tokens,
  `created_at` in the token response, and the urn:ietf:wg:oauth:2.0:oob
  page that shows the code;
- /oauth/login signs the private login into a fifteen-minute cookie that
  only /oauth sees (rate limited, antiforgery-protected); /oauth/authorize
  then asks which persona the application acts as. The token's subject
  is that persona's id and nothing else; no root id reaches a token, an
  authorization or a log line;
- the token exchange refuses a persona whose login is banned or deleted,
  and every API request checks the same.

/api/v1/apps registers applications dynamically, /api/v1/apps/
verify_credentials, /api/v1/instance (v1 and v2, "4.2.0 (compatible;
PrivaPub)") and verify_credentials answer in Mastodon's shapes: snake_case
with explicit nulls, Rails-style parameters from query, form or JSON,
{"error": ...} on failure, Link paging. CORS exposes Link.

/api goes to OpenIddict validation and everything else to the existing
JWT; the JWT failure handler no longer sends the exception and stack trace
to the client.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub/Api/Mastodon/Auth/MastodonScopes.cs

@@ -0,0 +1,37 @@
+namespace PrivaPub.Api.Mastodon.Auth
+{
+	public static class MastodonScopes
+	{
+		public static readonly string[] All =
+		{
+			"read", "write", "follow", "push", "profile",
+			"read:accounts", "read:blocks", "read:bookmarks", "read:favourites", "read:filters", "read:follows", "read:lists",
+			"read:mutes", "read:notifications", "read:search", "read:statuses",
+			"write:accounts", "write:blocks", "write:bookmarks", "write:conversations", "write:favourites", "write:filters",
+			"write:follows", "write:lists", "write:media", "write:mutes", "write:notifications", "write:reports", "write:statuses"
+		};
+
+		public static IReadOnlyList<string> Parse(string scopes)
+		{
+			var parsed = (scopes ?? string.Empty).Split(new[] { ' ', '+', ',' }, StringSplitOptions.RemoveEmptyEntries)
+				.Where(s => All.Contains(s))
+				.Distinct()
+				.ToList();
+			return parsed.Count == 0 ? new[] { "read" } : parsed;
+		}
+
+		public static bool Grants(IEnumerable<string> granted, string required)
+		{
+			var scopes = granted as ICollection<string> ?? granted.ToList();
+			if (scopes.Contains(required))
+				return true;
+			var colon = required.IndexOf(':');
+			if (colon > 0 && scopes.Contains(required[..colon]))
+				return true;
+			return required.StartsWith("read:follows") || required.StartsWith("write:follows") || required.StartsWith("write:blocks")
+				|| required.StartsWith("read:blocks") || required.StartsWith("write:mutes") || required.StartsWith("read:mutes")
+				? scopes.Contains("follow")
+				: false;
+		}
+	}
+}

PrivaPub/Api/Mastodon/Auth/OAuthSetup.cs

@@ -0,0 +1,111 @@
+using Microsoft.AspNetCore;
+using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.Tokens;
+
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using OpenIddict.Abstractions;
+using OpenIddict.Server;
+using OpenIddict.Server.AspNetCore;
+
+using PrivaPub.Models;
+
+using System.Net;
+
+using static OpenIddict.Server.OpenIddictServerEvents;
+
+namespace PrivaPub.Api.Mastodon.Auth
+{
+	public static class OAuthSetup
+	{
+		public const string LoginScheme = "PrivaPub.OAuth";
+		public const string OutOfBand = "urn:ietf:wg:oauth:2.0:oob";
+
+		public static IServiceCollection PrivaPubOAuth(this IServiceCollection services, IWebHostEnvironment environment)
+		{
+			services.AddSingleton<IMongoDatabase>(_ => DB.Default.Database());
+
+			services.AddAuthentication()
+				.AddCookie(LoginScheme, options =>
+				{
+					options.Cookie.Name = "privapub.oauth";
+					options.Cookie.Path = "/oauth";
+					options.Cookie.HttpOnly = true;
+					options.Cookie.SameSite = SameSiteMode.Lax;
+					options.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest;
+					options.ExpireTimeSpan = TimeSpan.FromMinutes(15);
+					options.SlidingExpiration = false;
+					options.LoginPath = "/oauth/login";
+				});
+
+			services.AddOpenIddict()
+				.AddCore(options => options.UseMongoDb())
+				.AddServer(options =>
+				{
+					options.SetAuthorizationEndpointUris("/oauth/authorize")
+						.SetTokenEndpointUris("/oauth/token")
+						.SetRevocationEndpointUris("/oauth/revoke")
+						.SetConfigurationEndpointUris("/.well-known/openid-configuration", "/.well-known/oauth-authorization-server");
+					options.AllowAuthorizationCodeFlow().AllowClientCredentialsFlow();
+					options.RegisterScopes(MastodonScopes.All);
+					options.UseReferenceAccessTokens();
+					options.SetAccessTokenLifetime(null);
+					options.SetAuthorizationCodeLifetime(TimeSpan.FromMinutes(10));
+					options.DisableAccessTokenEncryption();
+
+					var aspNetCore = options.UseAspNetCore()
+						.EnableAuthorizationEndpointPassthrough()
+						.EnableTokenEndpointPassthrough();
+					if (!environment.IsProduction())
+						aspNetCore.DisableTransportSecurityRequirement();
+
+					options.AddEventHandler<ApplyAuthorizationResponseContext>(builder => builder.UseInlineHandler(OutOfBandCode)
+						.SetOrder(OpenIddictServerAspNetCoreHandlers.Authentication.ProcessFormPostResponse.Descriptor.Order - 1_000)
+						.SetType(OpenIddictServerHandlerType.Custom));
+					options.AddEventHandler<ApplyTokenResponseContext>(builder => builder.UseInlineHandler(context =>
+					{
+						if (context.Response.AccessToken != default)
+							context.Response["created_at"] = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+						return default;
+					}));
+				})
+				.AddValidation(options =>
+				{
+					options.UseLocalServer();
+					options.UseAspNetCore();
+				});
+
+			services.AddOptions<OpenIddictServerOptions>().Configure<IOptionsMonitor<AppConfiguration>>((options, app) =>
+			{
+				options.Issuer = new Uri(app.CurrentValue.BackendBaseAddress.TrimEnd('/') + "/");
+				options.SigningCredentials.Add(new SigningCredentials(OidcKey.Load(OidcKey.Signing), SecurityAlgorithms.RsaSha256));
+				options.EncryptionCredentials.Add(new EncryptingCredentials(OidcKey.Load(OidcKey.Encryption),
+					SecurityAlgorithms.RsaOAEP, SecurityAlgorithms.Aes256CbcHmacSha512));
+			});
+			return services;
+		}
+
+		static async ValueTask OutOfBandCode(ApplyAuthorizationResponseContext context)
+		{
+			if (context.RedirectUri != OutOfBand || context.Response.Code == default)
+				return;
+			var http = context.Transaction.GetHttpRequest()?.HttpContext;
+			if (http == default)
+				return;
+			var code = WebUtility.HtmlEncode(context.Response.Code);
+			http.Response.StatusCode = StatusCodes.Status200OK;
+			http.Response.ContentType = "text/html; charset=utf-8";
+			http.Response.Headers["Content-Security-Policy"] = "default-src 'none'; style-src 'unsafe-inline'";
+			http.Response.Headers["Cache-Control"] = "no-store";
+			await http.Response.WriteAsync($$"""
+				<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+				<title>Authorization code</title><style>body{font:16px/1.5 system-ui,sans-serif;max-width:480px;margin:48px auto;padding:0 16px}
+				code{display:block;font-size:1.1rem;padding:12px;border:1px solid #ccc;word-break:break-all}</style></head>
+				<body><h1>Authorization code</h1><p>Copy this code into the application:</p><code>{{code}}</code></body></html>
+				""");
+			context.HandleRequest();
+		}
+	}
+}

PrivaPub/Api/Mastodon/Auth/OidcKey.cs

@@ -0,0 +1,33 @@
+using Microsoft.IdentityModel.Tokens;
+
+using MongoDB.Entities;
+
+using System.Security.Cryptography;
+
+namespace PrivaPub.Api.Mastodon.Auth
+{
+	public class OidcKey : Entity
+	{
+		public string Use { get; set; }
+		public string PrivateKeyPem { get; set; }
+		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+
+		public const string Signing = "signing";
+		public const string Encryption = "encryption";
+
+		public static RsaSecurityKey Load(string use)
+		{
+			var key = DB.Default.Find<OidcKey>().Match(k => k.Use == use).Sort(k => k.CreatedAt, Order.Ascending).ExecuteFirstAsync().GetAwaiter().GetResult();
+			if (key == default)
+			{
+				using var created = RSA.Create(2048);
+				key = new OidcKey { Use = use, PrivateKeyPem = created.ExportRSAPrivateKeyPem() };
+				DB.Default.SaveAsync(key).GetAwaiter().GetResult();
+				key = DB.Default.Find<OidcKey>().Match(k => k.Use == use).Sort(k => k.CreatedAt, Order.Ascending).ExecuteFirstAsync().GetAwaiter().GetResult();
+			}
+			var rsa = RSA.Create();
+			rsa.ImportFromPem(key.PrivateKeyPem);
+			return new RsaSecurityKey(rsa) { KeyId = key.ID };
+		}
+	}
+}

PrivaPub/Api/Mastodon/Auth/TokenController.cs

@@ -0,0 +1,70 @@
+using Microsoft.AspNetCore;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.IdentityModel.Tokens;
+
+using OpenIddict.Abstractions;
+using OpenIddict.Server.AspNetCore;
+
+using PrivaPub.StaticServices;
+
+using System.Security.Claims;
+
+using static OpenIddict.Abstractions.OpenIddictConstants;
+
+namespace PrivaPub.Api.Mastodon.Auth
+{
+	[ApiController]
+	public class TokenController : ControllerBase
+	{
+		readonly DbEntities _dbEntities;
+
+		public TokenController(DbEntities dbEntities)
+		{
+			_dbEntities = dbEntities;
+		}
+
+		[HttpPost("/oauth/token"), IgnoreAntiforgeryToken, Produces("application/json")]
+		public async Task<IActionResult> Exchange(CancellationToken token)
+		{
+			var request = HttpContext.GetOpenIddictServerRequest();
+			if (request == default)
+				return BadRequest();
+
+			if (request.IsAuthorizationCodeGrantType())
+			{
+				var principal = (await HttpContext.AuthenticateAsync(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme)).Principal;
+				if (principal == default || !await Usable(principal.GetClaim(Claims.Subject), token))
+					return Refuse(Errors.InvalidGrant, "The persona can no longer be used.");
+				return SignIn(principal, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
+			}
+
+			if (request.IsClientCredentialsGrantType())
+			{
+				var identity = new ClaimsIdentity(TokenValidationParameters.DefaultAuthenticationType, Claims.Name, Claims.Role);
+				identity.SetClaim(Claims.Subject, "app:" + request.ClientId);
+				identity.SetScopes(MastodonScopes.Parse(request.Scope));
+				identity.SetDestinations(_ => new[] { Destinations.AccessToken });
+				return SignIn(new ClaimsPrincipal(identity), OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
+			}
+
+			return Refuse(Errors.UnsupportedGrantType, "The grant type is not supported.");
+		}
+
+		async Task<bool> Usable(string avatarId, CancellationToken token)
+		{
+			if (string.IsNullOrEmpty(avatarId))
+				return false;
+			var link = await _dbEntities.RootToAvatars.Match(r => r.AvatarId == avatarId).ExecuteFirstAsync(token);
+			var root = link == default ? default : await _dbEntities.RootUsers.MatchID(link.RootId).ExecuteFirstAsync(token);
+			var avatar = await _dbEntities.Avatars.MatchID(avatarId).ExecuteFirstAsync(token);
+			return root is { IsBanned: false, DeletedAt: null } && avatar is { DeletionAt: null };
+		}
+
+		ForbidResult Refuse(string error, string description) => Forbid(new AuthenticationProperties(new Dictionary<string, string>
+		{
+			[OpenIddictServerAspNetCoreConstants.Properties.Error] = error,
+			[OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] = description
+		}), OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
+	}
+}