thepraandClaude Opus 5.5
4d9be37c1c
OpenIddict 7.7 (MongoDB stores, keys kept in Mongo so tokens survive
restarts) serves /oauth/authorize, /oauth/token, /oauth/revoke and the
discovery documents, including /.well-known/oauth-authorization-server:
- authorization code (PKCE optional) and client credentials, Mastodon's
scopes including the granular ones, non-expiring reference tokens,
`created_at` in the token response, and the urn:ietf:wg:oauth:2.0:oob
page that shows the code;
- /oauth/login signs the private login into a fifteen-minute cookie that
only /oauth sees (rate limited, antiforgery-protected); /oauth/authorize
then asks which persona the application acts as. The token's subject
is that persona's id and nothing else; no root id reaches a token, an
authorization or a log line;
- the token exchange refuses a persona whose login is banned or deleted,
and every API request checks the same.
/api/v1/apps registers applications dynamically, /api/v1/apps/
verify_credentials, /api/v1/instance (v1 and v2, "4.2.0 (compatible;
PrivaPub)") and verify_credentials answer in Mastodon's shapes: snake_case
with explicit nulls, Rails-style parameters from query, form or JSON,
{"error": ...} on failure, Link paging. CORS exposes Link.
/api goes to OpenIddict validation and everything else to the existing
JWT; the JWT failure handler no longer sends the exception and stack trace
to the client.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB
34 lines
1.1 KiB
C#
34 lines
1.1 KiB
C#
using Microsoft.IdentityModel.Tokens;
|
|
|
|
using MongoDB.Entities;
|
|
|
|
using System.Security.Cryptography;
|
|
|
|
namespace PrivaPub.Api.Mastodon.Auth
|
|
{
|
|
public class OidcKey : Entity
|
|
{
|
|
public string Use { get; set; }
|
|
public string PrivateKeyPem { get; set; }
|
|
public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
|
|
|
|
public const string Signing = "signing";
|
|
public const string Encryption = "encryption";
|
|
|
|
public static RsaSecurityKey Load(string use)
|
|
{
|
|
var key = DB.Default.Find<OidcKey>().Match(k => k.Use == use).Sort(k => k.CreatedAt, Order.Ascending).ExecuteFirstAsync().GetAwaiter().GetResult();
|
|
if (key == default)
|
|
{
|
|
using var created = RSA.Create(2048);
|
|
key = new OidcKey { Use = use, PrivateKeyPem = created.ExportRSAPrivateKeyPem() };
|
|
DB.Default.SaveAsync(key).GetAwaiter().GetResult();
|
|
key = DB.Default.Find<OidcKey>().Match(k => k.Use == use).Sort(k => k.CreatedAt, Order.Ascending).ExecuteFirstAsync().GetAwaiter().GetResult();
|
|
}
|
|
var rsa = RSA.Create();
|
|
rsa.ImportFromPem(key.PrivateKeyPem);
|
|
return new RsaSecurityKey(rsa) { KeyId = key.ID };
|
|
}
|
|
}
|
|
}
|