initial commit

pkg/op/config.go

@@ -0,0 +1,54 @@
+package op
+
+import (
+	"errors"
+	"net/url"
+	"os"
+	"strings"
+)
+
+type Configuration interface {
+	Issuer() string
+	AuthorizationEndpoint() Endpoint
+	TokenEndpoint() Endpoint
+	UserinfoEndpoint() Endpoint
+	KeysEndpoint() Endpoint
+
+	AuthMethodPostSupported() bool
+
+	Port() string
+}
+
+func ValidateIssuer(issuer string) error {
+	if issuer == "" {
+		return errors.New("missing issuer")
+	}
+	u, err := url.Parse(issuer)
+	if err != nil {
+		return errors.New("invalid url for issuer")
+	}
+	if u.Host == "" {
+		return errors.New("host for issuer missing")
+	}
+	if u.Scheme != "https" {
+		if !devLocalAllowed(u) {
+			return errors.New("scheme for issuer must be `https`")
+		}
+	}
+	if u.Fragment != "" || len(u.Query()) > 0 {
+		return errors.New("no fragments or query allowed for issuer")
+	}
+	return nil
+}
+
+func devLocalAllowed(url *url.URL) bool {
+	_, b := os.LookupEnv("CAOS_OIDC_DEV")
+	if !b {
+		return b
+	}
+	return url.Scheme == "http" &&
+		url.Host == "localhost" ||
+		url.Host == "127.0.0.1" ||
+		url.Host == "::1" ||
+		strings.HasPrefix(url.Host, "localhost:")
+}