client: return client secret on POST and remove it from GET

closes #113

client/handler.go

@@ -65,12 +65,14 @@ func (h *Handler) Create(w http.ResponseWriter, r *http.Request, _ httprouter.Pa
 		}
 		c.Secret = []byte(string(secret))
 	}
+	secret := c.Secret
 
 	if err := h.Manager.CreateClient(&c); err != nil {
 		h.H.WriteError(ctx, w, r, err)
 		return
 	}
 
+	c.Secret = secret
 	h.H.WriteCreated(ctx, w, r, ClientsHandlerPath+"/"+c.GetID(), &c)
 }
 
@@ -91,6 +93,11 @@ func (h *Handler) GetAll(w http.ResponseWriter, r *http.Request, ps httprouter.P
 		return
 	}
 
+	for k, cc := range c {
+		cc.Secret = []byte{}
+		c[k] = cc
+	}
+
 	h.H.Write(ctx, w, r, c)
 }
 
@@ -115,6 +122,7 @@ func (h *Handler) Get(w http.ResponseWriter, r *http.Request, ps httprouter.Para
 		return
 	}
 
+	c.(*fosite.DefaultClient).Secret = []byte{}
 	h.H.Write(ctx, w, r, c)
 }
 

client/manager_memory.go

@@ -11,7 +11,7 @@ import (
 )
 
 type MemoryManager struct {
-	Clients map[string]*fosite.DefaultClient
+	Clients map[string]fosite.DefaultClient
 	Hasher  hash.Hasher
 	sync.RWMutex
 }
@@ -24,7 +24,8 @@ func (m *MemoryManager) GetClient(id string) (fosite.Client, error) {
 	if !ok {
 		return nil, errors.New(pkg.ErrNotFound)
 	}
-	return c, nil
+
+	return &c, nil
 }
 
 func (m *MemoryManager) Authenticate(id string, secret []byte) (*fosite.DefaultClient, error) {
@@ -40,7 +41,7 @@ func (m *MemoryManager) Authenticate(id string, secret []byte) (*fosite.DefaultC
 		return nil, errors.New(err)
 	}
 
-	return c, nil
+	return &c, nil
 }
 
 func (m *MemoryManager) CreateClient(c *fosite.DefaultClient) error {
@@ -57,7 +58,7 @@ func (m *MemoryManager) CreateClient(c *fosite.DefaultClient) error {
 	}
 	c.Secret = hash
 
-	m.Clients[c.GetID()] = c
+	m.Clients[c.GetID()] = *c
 	return nil
 }
 
@@ -69,9 +70,13 @@ func (m *MemoryManager) DeleteClient(id string) error {
 	return nil
 }
 
-func (m *MemoryManager) GetClients() (map[string]*fosite.DefaultClient, error) {
+func (m *MemoryManager) GetClients() (clients map[string]*fosite.DefaultClient, err error) {
 	m.Lock()
 	defer m.Unlock()
+	clients = make(map[string]*fosite.DefaultClient)
+	for _, c := range m.Clients {
+		clients[c.ID] = &c
+	}
 
-	return m.Clients, nil
+	return clients, nil
 }

client/manager_rethinkdb.go

@@ -19,7 +19,7 @@ type RethinkManager struct {
 	Table   r.Term
 	sync.RWMutex
 
-	Clients map[string]*fosite.DefaultClient
+	Clients map[string]fosite.DefaultClient
 	Hasher  hash.Hasher
 }
 
@@ -31,7 +31,7 @@ func (m *RethinkManager) GetClient(id string) (fosite.Client, error) {
 	if !ok {
 		return nil, errors.New(pkg.ErrNotFound)
 	}
-	return c, nil
+	return &c, nil
 }
 
 func (m *RethinkManager) Authenticate(id string, secret []byte) (*fosite.DefaultClient, error) {
@@ -47,7 +47,7 @@ func (m *RethinkManager) Authenticate(id string, secret []byte) (*fosite.Default
 		return nil, errors.New(err)
 	}
 
-	return c, nil
+	return &c, nil
 }
 
 func (m *RethinkManager) CreateClient(c *fosite.DefaultClient) error {
@@ -76,15 +76,19 @@ func (m *RethinkManager) DeleteClient(id string) error {
 	return nil
 }
 
-func (m *RethinkManager) GetClients() (map[string]*fosite.DefaultClient, error) {
+func (m *RethinkManager) GetClients() (clients map[string]*fosite.DefaultClient, err error) {
 	m.Lock()
 	defer m.Unlock()
+	clients = make(map[string]*fosite.DefaultClient)
+	for _, c := range m.Clients {
+		clients[c.ID] = &c
+	}
 
-	return m.Clients, nil
+	return clients, nil
 }
 
 func (m *RethinkManager) ColdStart() error {
-	m.Clients = map[string]*fosite.DefaultClient{}
+	m.Clients = map[string]fosite.DefaultClient{}
 	clients, err := m.Table.Run(m.Session)
 	if err != nil {
 		return errors.New(err)
@@ -94,7 +98,7 @@ func (m *RethinkManager) ColdStart() error {
 	m.Lock()
 	defer m.Unlock()
 	for clients.Next(&client) {
-		m.Clients[client.ID] = &client
+		m.Clients[client.ID] = client
 	}
 
 	return nil
@@ -131,9 +135,9 @@ func (m *RethinkManager) Watch(ctx context.Context) {
 				delete(m.Clients, oldVal.GetID())
 			} else if newVal != nil && oldVal != nil {
 				delete(m.Clients, oldVal.GetID())
-				m.Clients[newVal.GetID()] = newVal
+				m.Clients[newVal.GetID()] = *newVal
 			} else {
-				m.Clients[newVal.GetID()] = newVal
+				m.Clients[newVal.GetID()] = *newVal
 			}
 			m.Unlock()
 		}

client/manager_test.go

@@ -31,7 +31,7 @@ var ts *httptest.Server
 
 func init() {
 	clientManagers["memory"] = &MemoryManager{
-		Clients: map[string]*fosite.DefaultClient{},
+		Clients: map[string]fosite.DefaultClient{},
 		Hasher:  &hash.BCrypt{},
 	}
 
@@ -45,7 +45,7 @@ func init() {
 
 	s := &Handler{
 		Manager: &MemoryManager{
-			Clients: map[string]*fosite.DefaultClient{},
+			Clients: map[string]fosite.DefaultClient{},
 			Hasher:  &hash.BCrypt{},
 		},
 		H: &herodot.JSON{},
@@ -83,7 +83,7 @@ func TestMain(m *testing.M) {
 		rethinkManager = &RethinkManager{
 			Session: session,
 			Table:   r.Table("hydra_clients"),
-			Clients: make(map[string]*fosite.DefaultClient),
+			Clients: make(map[string]fosite.DefaultClient),
 			Hasher: &hash.BCrypt{
 				// Low workfactor reduces test time
 				WorkFactor: 4,
@@ -108,7 +108,7 @@ func TestMain(m *testing.M) {
 
 func TestAuthenticateClient(t *testing.T) {
 	var mem = &MemoryManager{
-		Clients: map[string]*fosite.DefaultClient{},
+		Clients: map[string]fosite.DefaultClient{},
 		Hasher:  &hash.BCrypt{},
 	}
 	mem.CreateClient(&fosite.DefaultClient{
@@ -187,15 +187,15 @@ func TestColdStartRethinkManager(t *testing.T) {
 	_, err = rethinkManager.GetClient("2341234")
 	assert.Nil(t, err)
 
-	rethinkManager.Clients = make(map[string]*fosite.DefaultClient)
+	rethinkManager.Clients = make(map[string]fosite.DefaultClient)
 	_, err = rethinkManager.GetClient("2341234")
 	assert.NotNil(t, err)
 
 	rethinkManager.ColdStart()
 	_, err = rethinkManager.GetClient("2341234")
 	assert.Nil(t, err)
 
-	rethinkManager.Clients = make(map[string]*fosite.DefaultClient)
+	rethinkManager.Clients = make(map[string]fosite.DefaultClient)
 }
 
 func TestCreateGetDeleteClient(t *testing.T) {

cmd/server/handler_client_factory.go

@@ -17,7 +17,7 @@ func newClientManager(c *config.Config) client.Manager {
 	switch con := ctx.Connection.(type) {
 	case *config.MemoryConnection:
 		return &client.MemoryManager{
-			Clients: map[string]*fosite.DefaultClient{},
+			Clients: map[string]fosite.DefaultClient{},
 			Hasher:  ctx.Hasher,
 		}
 	case *config.RethinkDBConnection:

cmd/token_self.go

@@ -39,7 +39,7 @@ var tokenSelfCmd = &cobra.Command{
 
 		t, err := oauthConfig.Token(ctx)
 		pkg.Must(err, "Could not authenticate, because: %s\n", err)
-		fmt.Printf("%s", t.AccessToken)
+		fmt.Printf("%s\n", t.AccessToken)
 	},
 }
 

oauth2/consent_strategy.go

@@ -6,13 +6,13 @@ import (
 
 	"crypto/rsa"
 
-	"gopkg.in/dgrijalva/jwt-go.v2"
 	"github.com/go-errors/errors"
 	"github.com/ory-am/fosite"
 	"github.com/ory-am/fosite/handler/oidc/strategy"
 	ejwt "github.com/ory-am/fosite/token/jwt"
 	"github.com/ory-am/hydra/jwk"
 	"github.com/pborman/uuid"
+	"gopkg.in/dgrijalva/jwt-go.v2"
 )
 
 const (

oauth2/oauth2_auth_code_test.go

@@ -6,7 +6,6 @@ import (
 	"testing"
 	"time"
 
-	"gopkg.in/dgrijalva/jwt-go.v2"
 	"github.com/go-errors/errors"
 	"github.com/julienschmidt/httprouter"
 	ejwt "github.com/ory-am/fosite/token/jwt"
@@ -16,6 +15,7 @@ import (
 	"github.com/pborman/uuid"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/oauth2"
+	"gopkg.in/dgrijalva/jwt-go.v2"
 )
 
 func TestAuthCode(t *testing.T) {

oauth2/oauth2_test.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"net/url"
 
-	"gopkg.in/dgrijalva/jwt-go.v2"
 	"github.com/go-errors/errors"
 	"github.com/julienschmidt/httprouter"
 	"github.com/ory-am/fosite"
@@ -22,6 +21,7 @@ import (
 	"github.com/ory-am/hydra/pkg"
 	"golang.org/x/oauth2"
 	"golang.org/x/oauth2/clientcredentials"
+	"gopkg.in/dgrijalva/jwt-go.v2"
 )
 
 var store = pkg.FositeStore()