From 85aab4e0eab2f87cb77292bcb94562084ad937cb Mon Sep 17 00:00:00 2001
From: "jonathan.kerr" <jonathan.kerr@digital.cabinet-office.gov.uk>
Date: Wed, 19 Jun 2024 09:49:18 +0100
Subject: [PATCH 1/4] Correct return type

---
 jinja_helper.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/jinja_helper.py b/jinja_helper.py
index 735f6c5..7e67016 100644
--- a/jinja_helper.py
+++ b/jinja_helper.py
@@ -84,7 +84,7 @@ def main_css_hash():
     return _main_css_hash
 
 
-def renderTemplate(filename: str, params: dict = {}, status_code: int = 200) -> str:
+def renderTemplate(filename: str, params: dict = {}, status_code: int = 200) -> tuple[str, int]:
     params.update({"url_prefix": env_var("URL_PREFIX", "http://localhost:5001")})
 
     pbe = env_var("PHASE_BANNER", "PRIVATE-ALPHA")

From 5cb9c34fee4f192cd433c8ecbc6881180ead508e Mon Sep 17 00:00:00 2001
From: "jonathan.kerr" <jonathan.kerr@digital.cabinet-office.gov.uk>
Date: Wed, 19 Jun 2024 10:58:22 +0100
Subject: [PATCH 2/4] Create page for creating new clients

Off the back of a request for five clients (!!), I've decided to semi-automate the process by creating a custom route. Which users can access it will come later
---
 templates/new-client.html | 63 +++++++++++++++++++++++++++++++++++++++
 wsgi.py                   | 14 ++++++++-
 2 files changed, 76 insertions(+), 1 deletion(-)
 create mode 100644 templates/new-client.html

diff --git a/templates/new-client.html b/templates/new-client.html
new file mode 100644
index 0000000..311afb6
--- /dev/null
+++ b/templates/new-client.html
@@ -0,0 +1,63 @@
+{% extends "_primary.html" %}
+
+{% block content %}
+<div class="govuk-breadcrumbs">
+  <ol class="govuk-breadcrumbs__list">
+    <li class="govuk-breadcrumbs__list-item">
+      <a class="govuk-breadcrumbs__link" href="/">Single Sign-On</a>
+    </li>
+    <li class="govuk-breadcrumbs__list-item" aria-current="page">Create new client</li>
+  </ol>
+</div>
+
+<main class="govuk-main-wrapper " id="main-content" role="main">
+    <form action="{{ form_url }}" method="post">
+<fieldset class="govuk-fieldset">
+  <legend class="govuk-fieldset__legend govuk-fieldset__legend--l">
+    <h1 class="govuk-fieldset__heading">
+      Please provide details for the new client
+    </h1>
+  </legend>
+    <div class="govuk-form-group">
+        <label class="govuk-label" for="name">
+            The name of the app
+        </label>
+        <input class="govuk-input" id="name" name="name" type="text">
+    </div>
+    <div class="govuk-form-group">
+        <label class="govuk-label" for="description">
+            A brief description of the app
+        </label>
+        <textarea class="govuk-textarea" id="description" name="description" type="text"></textarea>
+    </div>
+  <div class="govuk-form-group">
+    <label class="govuk-label" for="app-url">
+      The usual URL for the app
+    </label>
+    <input class="govuk-input" id="app-url" name="app_url" type="text">
+  </div>
+  <div class="govuk-form-group">
+    <label class="govuk-label" for="redirect-urls">
+      Redirect url(s). If more than one, please separate them with commas
+    </label>
+    <input class="govuk-input" id="redirect-urls" name="redirect_urls" type="text">
+  </div>
+  <div class="govuk-form-group">
+    <label class="govuk-label" for="sign-in-url">
+      Sign-in URL for the new app
+    </label>
+    <input class="govuk-input govuk-!-width-two-thirds" id="sign-in-url" name="sign_in_url" type="text">
+  </div>
+  <div class="govuk-form-group">
+    <label class="govuk-label" for="owners">
+      Owner(s). On the next page, you'll be able to add more owners.
+    </label>
+    <input class="govuk-input govuk-input--width-10" id="owners" name="owners" type="text">
+  </div>
+</fieldset>
+        <div class="govuk-button-group">
+      <input type="submit" value="Continue" class="govuk-button" data-module="govuk-button">
+    </div>
+</form>
+</main>
+{% endblock %}
\ No newline at end of file
diff --git a/wsgi.py b/wsgi.py
index 783ef17..31e1b57 100644
--- a/wsgi.py
+++ b/wsgi.py
@@ -96,7 +96,7 @@
 except Exception as e:
     jprint({"MicrosoftAuth": {"error": e, "in_use": False}})
 
-FLASK_SECRET_KEY = env_var("FLASK_SECRET_KEY")
+FLASK_SECRET_KEY = env_var("FLASK_SECRET_KEY", secrets.token_urlsafe(24))
 app = Flask(__name__)
 
 if IS_PROD:
@@ -1403,6 +1403,18 @@ def route_manage():
     )
 
 
+@app.route("/new-client", methods=["GET", "POST"])
+# @UserShouldBeSignedIn
+@SetBrowserCookie
+@CheckCSRFSession
+def new_client():
+    if request.method == "GET":
+        return renderTemplate("new-client.html")
+    else:
+        print(request.data)
+        return "Posted"
+
+
 @app.route("/dashboard", methods=["GET"])
 @UserShouldBeSignedIn
 @SetBrowserCookie

From fa0c47bda8054da196a5853d2fa564c7f05b425f Mon Sep 17 00:00:00 2001
From: "jonathan.kerr" <jonathan.kerr@digital.cabinet-office.gov.uk>
Date: Wed, 19 Jun 2024 14:18:46 +0100
Subject: [PATCH 3/4] Correct return type

---
 sso_oidc.py                   | 2 +-
 sso_oidc_client_generation.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/sso_oidc.py b/sso_oidc.py
index 9033799..1a075a9 100644
--- a/sso_oidc.py
+++ b/sso_oidc.py
@@ -27,7 +27,7 @@
 _individual_clients = {}
 
 
-def save_client(filename: str, client: dict, client_id: str) -> dict:
+def save_client(filename: str, client: dict, client_id: str) -> bool:
     has_secret = False
     saved = False
 
diff --git a/sso_oidc_client_generation.py b/sso_oidc_client_generation.py
index a3b2ec1..910f642 100644
--- a/sso_oidc_client_generation.py
+++ b/sso_oidc_client_generation.py
@@ -5,7 +5,7 @@
 from sso_utils import random_string
 
 
-def generate_client_auth_pair():
+def generate_client_auth_pair() -> dict[str, str]:
     """
     Returns a valid client ID and secret
 

From ce915f6aee8af8feb4e2220f626735d377bd72d4 Mon Sep 17 00:00:00 2001
From: "jonathan.kerr" <jonathan.kerr@digital.cabinet-office.gov.uk>
Date: Wed, 19 Jun 2024 14:50:25 +0100
Subject: [PATCH 4/4] Create very basic view and route for creating a new
 client

At the moment this won't be advertised, but will hopefully make my life a little easier
---
 wsgi.py | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/wsgi.py b/wsgi.py
index 31e1b57..a5941f7 100644
--- a/wsgi.py
+++ b/wsgi.py
@@ -1,13 +1,11 @@
 import json
 import base64
 import time
-import hashlib
-import boto3
-import botocore
+import uuid
+
 import traceback
 import re
 import os
-import html
 import jwt_signing
 import sso_oidc
 import werkzeug
@@ -18,7 +16,6 @@
     Flask,
     jsonify,
     send_from_directory,
-    render_template,
     request,
     session,
     redirect,
@@ -1404,15 +1401,22 @@ def route_manage():
 
 
 @app.route("/new-client", methods=["GET", "POST"])
-# @UserShouldBeSignedIn
+@UserShouldBeSignedIn
 @SetBrowserCookie
 @CheckCSRFSession
 def new_client():
     if request.method == "GET":
-        return renderTemplate("new-client.html")
+        return renderTemplate("new-client.html", {"form_url": "/new-client"})
     else:
-        print(request.data)
-        return "Posted"
+        client_secret_dict = generate_client_auth_pair()
+        client_id = client_secret_dict.get("client_id")
+        client_secret = client_secret_dict.get("client_secret")
+        sso_oidc.save_client(
+            filename=uuid.uuid4().hex,
+            client={"secret": client_secret, **request.form.to_dict()},
+            client_id=client_id
+        )
+        return redirect(f"/view?client_id={client_id}")
 
 
 @app.route("/dashboard", methods=["GET"])