view release on metacpan or  search on metacpan

lib/Catalyst/Plugin/OAuth2/AuthorizationServer/Server.pm  view on Meta::CPAN

        my $scheme = lc( $parsed->scheme // '' );
        my $ok_scheme =
              $scheme eq 'https' ? 1
            : $scheme eq 'http'
                && $parsed->can('host')
                && ( $parsed->host // '' )
                    =~ m{\A(?:localhost|127\.\d+\.\d+\.\d+|::1)\z} ? 1
            : 0;
        $self->_invalid_metadata('redirect_uri scheme not allowed')
            unless $ok_scheme;
        $self->_invalid_metadata('redirect_uri must not contain a fragment')
            if $parsed->can('fragment') && defined $parsed->fragment;
    }

    $self->_validate_client_metadata($metadata);

    my $json = JSON::MaybeXS->new( utf8 => 1, canonical => 1 );
    $self->_invalid_metadata('client metadata too large')
        if length( $json->encode($metadata) ) > $self->metadata_max_bytes;

    my $client = { %$metadata, client_id => $self->_random_token(16) };
    return $self->store->create_client($client);

lib/Catalyst/Plugin/OAuth2/AuthorizationServer/Server.pm  view on Meta::CPAN

=head2 mint_access_token( \%claims, $aud )

Mint a signed JWT access token. The engine stamps C<iss>, C<aud>, C<iat>,
C<exp> and C<jti>, and they are stamped after C<\%claims>, so a caller cannot
override them. C<$aud> defaults to the configured C<resource> list. Returns the
encoded JWT string.

=head2 register_client( \%metadata )

Dynamic Client Registration (RFC 7591). Validates C<redirect_uris> (must be
present; each must be HTTPS or loopback HTTP; no fragments; within length
limits). Generates a C<client_id>, calls C<Store::create_client>, and returns
the stored client hashref.

Per RFC 7591 3.2.1, registration also rejects metadata asking for anything
this AS does not support, with C<invalid_client_metadata>. The allow-lists are
taken from L</metadata_document>, so registration can never accept a value the
discovery document does not advertise:

=over

t/server-dcr.t  view on Meta::CPAN

}
# plain http (non-loopback) rejected; loopback http allowed
{
    my $e = exception {
        engine->register_client({ redirect_uris => ['http://evil.example/cb'] });
    };
    is( $e->error, 'invalid_client_metadata', 'non-loopback http rejected' );
    my $ok = engine->register_client({ redirect_uris => ['http://127.0.0.1/cb'] });
    like( $ok->{client_id}, qr/\A[A-Za-z0-9_-]+\z/, 'loopback http allowed' );
}
# fragment rejected
{
    my $e = exception {
        engine->register_client({ redirect_uris => ['https://app/cb#frag'] });
    };
    is( $e->error, 'invalid_client_metadata', 'redirect_uri with fragment rejected' );
}

# --- RFC 7591 3.2.1: metadata values this AS does not advertise are rejected ---

# token_endpoint_auth_method: metadata advertises 'none' only
{
    my $e = exception {
        engine->register_client({
            redirect_uris              => ['https://app.example/cb'],
            token_endpoint_auth_method => 'client_secret_basic',