Merge pull request #55 from NJUPT-SAST/dev-xun

fix: clientStore and tokenStore maybe have some problems.

api/v1/oauth_server.go

@@ -30,18 +30,16 @@ var (
 	srv            *server.Server
 	pgxConn, _     = pgx.Connect(context.Background(), config.Config.Sub("oauth.server").GetString("db_uri"))
 	adapter        = pgx4adapter.NewConn(pgxConn)
+	// FIXME: tokenStore, clientStore maybe have some problem
+	tokenStore, _  = pg.NewTokenStore(adapter, pg.WithTokenStoreGCInterval(time.Minute))
+	clientStore, _ = pg.NewClientStore(adapter)
 )
 
 func init() {
 	InitServer()
 }
 
 func InitServer() {
-	// use PostgreSQL token store with pgx.Connection adapter
-	tokenStore, _ := pg.NewTokenStore(adapter, pg.WithTokenStoreGCInterval(time.Minute))
-	defer tokenStore.Close()
-	clientStore, _ := pg.NewClientStore(adapter)
-
 	mg := manage.NewDefaultManager()
 	mg.MapTokenStorage(tokenStore)
 	mg.SetAuthorizeCodeTokenCfg(manage.DefaultAuthorizeCodeTokenCfg)
@@ -90,7 +88,6 @@ func CreateClient(c *gin.Context) {
 		return
 	}
 
-	clientStore, _ := pg.NewClientStore(adapter)
 	cErr := clientStore.Create(&models.Client{
 		ID:     clientID,
 		Secret: secret,

example/client.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"crypto/rand"
 	"crypto/sha256"
 	"encoding/base64"
 	"encoding/json"
@@ -33,6 +34,19 @@ var (
 	globalToken *oauth2.Token // Non-concurrent security
 )
 
+func GenerateVerifier() string {
+	// "RECOMMENDED that the output of a suitable random number generator be
+	// used to create a 32-octet sequence.  The octet sequence is then
+	// base64url-encoded to produce a 43-octet URL-safe string to use as the
+	// code verifier."
+	// https://datatracker.ietf.org/doc/html/rfc7636#section-4.1
+	data := make([]byte, 32)
+	if _, err := rand.Read(data); err != nil {
+		panic(err)
+	}
+	return base64.RawURLEncoding.EncodeToString(data)
+}
+
 func main() {
 	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
 		u := config.AuthCodeURL("xyz",
@@ -43,6 +57,7 @@ func main() {
 	})
 
 	http.HandleFunc("/api/auth/callback/sastlink", func(w http.ResponseWriter, r *http.Request) {
+
 		r.ParseForm()
 		println(r.URL.RawQuery)
 		// state := r.Form.Get("state")
@@ -61,7 +76,6 @@ func main() {
 	http.HandleFunc("/oauth2", func(w http.ResponseWriter, r *http.Request) {
 		r.ParseForm()
 		println(r.URL.RawQuery)
-		verifier := oauth2.GenerateVerifier()
 		// state := r.Form.Get("state")
 		// if state != "xyz" {
 		// 	http.Error(w, "State invalid", http.StatusBadRequest)
@@ -73,7 +87,7 @@ func main() {
 			return
 		}
 		fmt.Println("Code:" + code)
-		//token, err := config.Exchange(r.Context(), code, oauth2.SetAuthURLParam("code_verifier", "sast_forever"))
+		// token, err := config.Exchange(r.Context(), code, oauth2.SetAuthURLParam("code_verifier", "sast_forever"))
 		//if err != nil {
 		//	http.Error(w, err.Error(), http.StatusInternalServerError)
 		//	return