${escapeHtml(params.detail)}
${escapeHtml(params.message)}
${detail} + Go back + + +`; + + return new Response(body, { + status: params.status, + headers: { + "content-type": "text/html; charset=utf-8", + // the failure belongs to this one attempt, by this one visitor + "cache-control": "no-store", + }, + }); +}; + +/** reads and immediately invalidates the pending authorization */ +const takePending = (cookies: AstroCookies): OAuthState | undefined => { + const cookie = cookies.get(GITHUB_COOKIE_OAUTH_HELLO); + cookies.delete(GITHUB_COOKIE_OAUTH_HELLO, { path: GITHUB_OAUTH_COOKIE_PATH }); + + if (typeof cookie === "undefined") { + return undefined; + } + + try { + const parsed = OAuthState.safeParse(cookie.json()); + return parsed.success ? parsed.data : undefined; + } catch { + return undefined; + } +}; + +/** exchanges authorization code for access / refresh token */ +export const GET: APIRoute = async ({ cookies, url }) => { + if (!GITHUB_OAUTH_CLIENT_ID || !GITHUB_OAUTH_CLIENT_SECRET) { + return errorPage({ + status: 503, + message: "GitHub sign-in is not configured for this site.", + }); + } + + const pending = takePending(cookies); + + if (typeof pending === "undefined") { + return errorPage({ + status: 400, + message: + "Sign-in did not start here, or it sat around for too long. Please try again.", + }); + } + + const fail = ( + status: number, + message: string, + code: string, + description?: string, + ): Response => + errorPage({ + status, + message, + detail: description ? `${code}: ${description}` : code, + returnTo: pending.returnTo, + }); + + // csrf state mismatch + if (url.searchParams.get("state") !== pending.state) { + return errorPage({ + status: 400, + message: + "This sign-in could not be verified as the one that started here. Please try again.", + returnTo: pending.returnTo, + }); + } + + // GitHub sends `error=access_denied` when the visitor declines + // fixed message, the url's `error_description` would let anyone put text on this page + if (url.searchParams.has("error")) { + return errorPage({ + status: 400, + message: "GitHub access was not granted.", + returnTo: pending.returnTo, + }); + } + + const code = url.searchParams.get("code"); + if (code === null) { + return errorPage({ + status: 400, + message: "GitHub sent no authorization code to sign in with.", + returnTo: pending.returnTo, + }); + } + + try { + const token = await GitHubOAuth.token.exchange({ + clientId: GITHUB_OAUTH_CLIENT_ID, + clientSecret: GITHUB_OAUTH_CLIENT_SECRET, + code, + redirectUri: new URL(GITHUB_CALLBACK_PATH, url).toString(), + }); + + const login = await GitHubOAuth.fetchLogin(token.accessToken); + + GitHubOAuth.session.write({ url, token, login }, cookies); + + return returnToRedirect(pending.returnTo); + } catch (error) { + const message = "The sign-in could not be completed."; + + return error instanceof OAuthError + ? fail(500, message, error.code, error.description) + : fail(500, message, "exchange_failed"); + } +}; diff --git a/src/pages/vendor/github/refresh.ts b/src/pages/vendor/github/refresh.ts new file mode 100644 index 0000000..3d415da --- /dev/null +++ b/src/pages/vendor/github/refresh.ts @@ -0,0 +1,63 @@ +import { + GITHUB_OAUTH_CLIENT_ID, + GITHUB_OAUTH_CLIENT_SECRET, +} from "astro:env/server"; +import type { APIRoute } from "astro"; + +import { SESSION_CHANGE_HEADERS } from "../../../io/oauth"; +import { + GITHUB_COOKIE_REFRESH, + GitHubOAuth, +} from "../../../io/vendor/github/oauth"; +import { GITHUB_COOKIE_USER } from "../../../io/vendor/github/session"; + +export const prerender = false; + +const status = (code: number, headers: Record