feat: add token request hooks for all grant types (ory#3427)

Added a generic token hook that is called for all grant types and includes `payload` with a single allowed value - `assertion` to cover the `jwt-bearer` grant type customization. The existing `refresh token hook` is left unchanged and is considered to be deprecated in favor of the new hook logic. The `refresh token hook` will at some point be removed. Closes ory#3244 Closes ory/fosite#729
Wikia · Apr 12, 2023 · 5865a8f · 5865a8f
1 parent eae78c9
commit 5865a8f
Show file tree

Hide file tree

Showing 20 changed files with 1,284 additions and 231 deletions.
diff --git a/driver/config/provider.go b/driver/config/provider.go
@@ -93,6 +93,7 @@ const (
 	KeyOAuth2GrantJWTIssuedDateOptional          = "oauth2.grant.jwt.iat_optional"
 	KeyOAuth2GrantJWTMaxDuration                 = "oauth2.grant.jwt.max_ttl"
 	KeyRefreshTokenHookURL                       = "oauth2.refresh_token_hook" // #nosec G101
+	KeyTokenHookURL                              = "oauth2.token_hook"         // #nosec G101
 	KeyDevelopmentMode                           = "dev"
 )
 
@@ -420,11 +421,11 @@ func (p *DefaultProvider) AccessTokenStrategy(ctx context.Context, additionalSou
 	return s
 }
 
-func (p *DefaultProvider) TokenRefreshHookURL(ctx context.Context) *url.URL {
-	if len(p.getProvider(ctx).String(KeyRefreshTokenHookURL)) == 0 {
-		return nil
-	}
+func (p *DefaultProvider) TokenHookURL(ctx context.Context) *url.URL {
+	return p.getProvider(ctx).RequestURIF(KeyTokenHookURL, nil)
+}
 
+func (p *DefaultProvider) TokenRefreshHookURL(ctx context.Context) *url.URL {
 	return p.getProvider(ctx).RequestURIF(KeyRefreshTokenHookURL, nil)
 }
 

diff --git a/driver/registry_base.go b/driver/registry_base.go
@@ -513,6 +513,7 @@ func (m *RegistryBase) AccessRequestHooks() []oauth2.AccessRequestHook {
 	if m.arhs == nil {
 		m.arhs = []oauth2.AccessRequestHook{
 			oauth2.RefreshTokenHook(m),
+			oauth2.TokenHook(m),
 		}
 	}
 	return m.arhs

diff --git a/...all_refresh_token_hook_if_configured.json → ...token_hook_if_configured-hook=legacy.json b/...all_refresh_token_hook_if_configured.json → ...token_hook_if_configured-hook=legacy.json
diff --git a/...ass_request_if_strategy_passes-should_call_refresh_token_hook_if_configured-hook=new.json b/...ass_request_if_strategy_passes-should_call_refresh_token_hook_if_configured-hook=new.json
@@ -0,0 +1,48 @@
+{
+  "session": {
+    "id_token": {
+      "id_token_claims": {
+        "jti": "",
+        "iss": "http://localhost:4444/",
+        "sub": "foo",
+        "aud": [
+          "app-client"
+        ],
+        "nonce": "",
+        "at_hash": "",
+        "acr": "1",
+        "amr": null,
+        "c_hash": "",
+        "ext": {
+          "hooked": "legacy"
+        }
+      },
+      "headers": {
+        "extra": {
+        }
+      },
+      "username": "",
+      "subject": "foo"
+    },
+    "extra": {
+      "hooked": "legacy"
+    },
+    "client_id": "app-client",
+    "consent_challenge": "",
+    "exclude_not_before_claim": false,
+    "allowed_top_level_claims": []
+  },
+  "request": {
+    "client_id": "app-client",
+    "granted_scopes": [
+      "offline",
+      "openid",
+      "hydra.*"
+    ],
+    "granted_audience": [],
+    "grant_types": [
+      "refresh_token"
+    ],
+    "payload": {}
+  }
+}
diff --git a/...all_refresh_token_hook_if_configured.json → ...token_hook_if_configured-hook=legacy.json b/...all_refresh_token_hook_if_configured.json → ...token_hook_if_configured-hook=legacy.json
diff --git a/...max_age_is_less_than_auth_time-should_call_refresh_token_hook_if_configured-hook=new.json b/...max_age_is_less_than_auth_time-should_call_refresh_token_hook_if_configured-hook=new.json
@@ -0,0 +1,48 @@
+{
+  "session": {
+    "id_token": {
+      "id_token_claims": {
+        "jti": "",
+        "iss": "http://localhost:4444/",
+        "sub": "foo",
+        "aud": [
+          "app-client"
+        ],
+        "nonce": "",
+        "at_hash": "",
+        "acr": "1",
+        "amr": null,
+        "c_hash": "",
+        "ext": {
+          "hooked": "legacy"
+        }
+      },
+      "headers": {
+        "extra": {
+        }
+      },
+      "username": "",
+      "subject": "foo"
+    },
+    "extra": {
+      "hooked": "legacy"
+    },
+    "client_id": "app-client",
+    "consent_challenge": "",
+    "exclude_not_before_claim": false,
+    "allowed_top_level_claims": []
+  },
+  "request": {
+    "client_id": "app-client",
+    "granted_scopes": [
+      "offline",
+      "openid",
+      "hydra.*"
+    ],
+    "granted_audience": [],
+    "grant_types": [
+      "refresh_token"
+    ],
+    "payload": {}
+  }
+}
diff --git a/...all_refresh_token_hook_if_configured.json → ...token_hook_if_configured-hook=legacy.json b/...all_refresh_token_hook_if_configured.json → ...token_hook_if_configured-hook=legacy.json
diff --git a/..._authentication_time_is_recent-should_call_refresh_token_hook_if_configured-hook=new.json b/..._authentication_time_is_recent-should_call_refresh_token_hook_if_configured-hook=new.json
@@ -0,0 +1,48 @@
+{
+  "session": {
+    "id_token": {
+      "id_token_claims": {
+        "jti": "",
+        "iss": "http://localhost:4444/",
+        "sub": "foo",
+        "aud": [
+          "app-client"
+        ],
+        "nonce": "",
+        "at_hash": "",
+        "acr": "1",
+        "amr": null,
+        "c_hash": "",
+        "ext": {
+          "hooked": "legacy"
+        }
+      },
+      "headers": {
+        "extra": {
+        }
+      },
+      "username": "",
+      "subject": "foo"
+    },
+    "extra": {
+      "hooked": "legacy"
+    },
+    "client_id": "app-client",
+    "consent_challenge": "",
+    "exclude_not_before_claim": false,
+    "allowed_top_level_claims": []
+  },
+  "request": {
+    "client_id": "app-client",
+    "granted_scopes": [
+      "offline",
+      "openid",
+      "hydra.*"
+    ],
+    "granted_audience": [],
+    "grant_types": [
+      "refresh_token"
+    ],
+    "payload": {}
+  }
+}
diff --git a/...all_refresh_token_hook_if_configured.json → ...token_hook_if_configured-hook=legacy.json b/...all_refresh_token_hook_if_configured.json → ...token_hook_if_configured-hook=legacy.json
diff --git a/...ass_request_if_strategy_passes-should_call_refresh_token_hook_if_configured-hook=new.json b/...ass_request_if_strategy_passes-should_call_refresh_token_hook_if_configured-hook=new.json
@@ -0,0 +1,48 @@
+{
+  "session": {
+    "id_token": {
+      "id_token_claims": {
+        "jti": "",
+        "iss": "http://localhost:4444/",
+        "sub": "foo",
+        "aud": [
+          "app-client"
+        ],
+        "nonce": "",
+        "at_hash": "",
+        "acr": "1",
+        "amr": null,
+        "c_hash": "",
+        "ext": {
+          "hooked": "legacy"
+        }
+      },
+      "headers": {
+        "extra": {
+        }
+      },
+      "username": "",
+      "subject": "foo"
+    },
+    "extra": {
+      "hooked": "legacy"
+    },
+    "client_id": "app-client",
+    "consent_challenge": "",
+    "exclude_not_before_claim": false,
+    "allowed_top_level_claims": []
+  },
+  "request": {
+    "client_id": "app-client",
+    "granted_scopes": [
+      "offline",
+      "openid",
+      "hydra.*"
+    ],
+    "granted_audience": [],
+    "grant_types": [
+      "refresh_token"
+    ],
+    "payload": {}
+  }
+}
diff --git a/...all_refresh_token_hook_if_configured.json → ...token_hook_if_configured-hook=legacy.json b/...all_refresh_token_hook_if_configured.json → ...token_hook_if_configured-hook=legacy.json
diff --git a/...max_age_is_less_than_auth_time-should_call_refresh_token_hook_if_configured-hook=new.json b/...max_age_is_less_than_auth_time-should_call_refresh_token_hook_if_configured-hook=new.json
@@ -0,0 +1,48 @@
+{
+  "session": {
+    "id_token": {
+      "id_token_claims": {
+        "jti": "",
+        "iss": "http://localhost:4444/",
+        "sub": "foo",
+        "aud": [
+          "app-client"
+        ],
+        "nonce": "",
+        "at_hash": "",
+        "acr": "1",
+        "amr": null,
+        "c_hash": "",
+        "ext": {
+          "hooked": "legacy"
+        }
+      },
+      "headers": {
+        "extra": {
+        }
+      },
+      "username": "",
+      "subject": "foo"
+    },
+    "extra": {
+      "hooked": "legacy"
+    },
+    "client_id": "app-client",
+    "consent_challenge": "",
+    "exclude_not_before_claim": false,
+    "allowed_top_level_claims": []
+  },
+  "request": {
+    "client_id": "app-client",
+    "granted_scopes": [
+      "offline",
+      "openid",
+      "hydra.*"
+    ],
+    "granted_audience": [],
+    "grant_types": [
+      "refresh_token"
+    ],
+    "payload": {}
+  }
+}
diff --git a/...all_refresh_token_hook_if_configured.json → ...token_hook_if_configured-hook=legacy.json b/...all_refresh_token_hook_if_configured.json → ...token_hook_if_configured-hook=legacy.json
diff --git a/..._authentication_time_is_recent-should_call_refresh_token_hook_if_configured-hook=new.json b/..._authentication_time_is_recent-should_call_refresh_token_hook_if_configured-hook=new.json
@@ -0,0 +1,48 @@
+{
+  "session": {
+    "id_token": {
+      "id_token_claims": {
+        "jti": "",
+        "iss": "http://localhost:4444/",
+        "sub": "foo",
+        "aud": [
+          "app-client"
+        ],
+        "nonce": "",
+        "at_hash": "",
+        "acr": "1",
+        "amr": null,
+        "c_hash": "",
+        "ext": {
+          "hooked": "legacy"
+        }
+      },
+      "headers": {
+        "extra": {
+        }
+      },
+      "username": "",
+      "subject": "foo"
+    },
+    "extra": {
+      "hooked": "legacy"
+    },
+    "client_id": "app-client",
+    "consent_challenge": "",
+    "exclude_not_before_claim": false,
+    "allowed_top_level_claims": []
+  },
+  "request": {
+    "client_id": "app-client",
+    "granted_scopes": [
+      "offline",
+      "openid",
+      "hydra.*"
+    ],
+    "granted_audience": [],
+    "grant_types": [
+      "refresh_token"
+    ],
+    "payload": {}
+  }
+}