Draft: OIDC native login

.github/workflows/docker-publish.yml

@@ -2,7 +2,7 @@ name: Container Image
 
 on:
   push:
-    branches: [ master ]
+    branches: [ master, sandhose/oidc-login ] # TODO: remove sandhose/oidc-login before merging
     tags: [ 'v*' ]
   pull_request:
     branches: [ master ]
@@ -26,6 +26,9 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+
       - name: Log into registry ${{ env.REGISTRY }}
         uses: docker/login-action@v2
         with:
@@ -38,6 +41,12 @@ jobs:
         uses: docker/metadata-action@v4
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: | # Override tags so that we can use the SHA versions
+            type=schedule
+            type=ref,event=branch
+            type=ref,event=tag
+            type=ref,event=pr
+            type=sha
 
       - name: Build and push Docker image
         uses: docker/build-push-action@v3

src/domain/LogoutViewModel.ts

@@ -52,7 +52,7 @@ export class LogoutViewModel extends ViewModel<SegmentType, Options> {
         this.emitChange("busy");
         try {
             const client = new Client(this.platform);
-            await client.startLogout(this._sessionId);
+            await client.startLogout(this._sessionId, this.urlRouter);
             this.navigation.push("session", true);
         } catch (err) {
             this._error = err;

src/domain/RootViewModel.js

@@ -41,6 +41,7 @@ export class RootViewModel extends ViewModel {
         this.track(this.navigation.observe("session").subscribe(() => this._applyNavigation()));
         this.track(this.navigation.observe("sso").subscribe(() => this._applyNavigation()));
         this.track(this.navigation.observe("logout").subscribe(() => this._applyNavigation()));
+        this.track(this.navigation.observe("oidc").subscribe(() => this._applyNavigation()));
         this._applyNavigation(true);
     }
 
@@ -50,6 +51,7 @@ export class RootViewModel extends ViewModel {
         const isForcedLogout = this.navigation.path.get("forced")?.value;
         const sessionId = this.navigation.path.get("session")?.value;
         const loginToken = this.navigation.path.get("sso")?.value;
+        const oidcCallback = this.navigation.path.get("oidc")?.value;
         if (isLogin) {
             if (this.activeSection !== "login") {
                 this._showLogin();
@@ -85,7 +87,14 @@ export class RootViewModel extends ViewModel {
         } else if (loginToken) {
             this.urlRouter.normalizeUrl();
             if (this.activeSection !== "login") {
-                this._showLogin(loginToken);
+                this._showLogin({loginToken});
+            }
+        } else if (oidcCallback) {
+            this.urlRouter.normalizeUrl();
+            if (this.activeSection !== "login") {
+                this._showLogin({
+                    oidc: oidcCallback,
+                });
             }
         }
         else {
@@ -117,7 +126,7 @@ export class RootViewModel extends ViewModel {
         }
     }
 
-    _showLogin(loginToken) {
+    _showLogin({loginToken, oidc} = {}) {
         this._setSection(() => {
             this._loginViewModel = new LoginViewModel(this.childOptions({
                 defaultHomeserver: this.platform.config["defaultHomeServer"],
@@ -133,7 +142,8 @@ export class RootViewModel extends ViewModel {
                     this._pendingClient = client;
                     this.navigation.push("session", client.sessionId);
                 },
-                loginToken
+                loginToken,
+                oidc,
             }));
         });
     }

src/domain/SessionLoadViewModel.js

@@ -154,7 +154,7 @@ export class SessionLoadViewModel extends ViewModel {
     }
 
     async logout() {
-        await this._client.startLogout(this.navigation.path.get("session").value);
+        await this._client.startLogout(this.navigation.path.get("session")?.value, this.urlRouter);
         this.navigation.push("session", true);
     }
 

src/domain/login/CompleteOIDCLoginViewModel.js

@@ -0,0 +1,89 @@
+/*
+Copyright 2021 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import {OidcApi} from "../../matrix/net/OidcApi";
+import {ViewModel} from "../ViewModel";
+import {OIDCLoginMethod} from "../../matrix/login/OIDCLoginMethod";
+import {LoginFailure} from "../../matrix/Client";
+
+export class CompleteOIDCLoginViewModel extends ViewModel {
+    constructor(options) {
+        super(options);
+        const {
+            state,
+            code,
+            attemptLogin,
+        } = options;
+        this._request = options.platform.request;
+        this._encoding = options.platform.encoding;
+        this._crypto = options.platform.crypto;
+        this._state = state;
+        this._code = code;
+        this._attemptLogin = attemptLogin;
+        this._errorMessage = "";
+        this.performOIDCLoginCompletion();
+    }
+
+    get errorMessage() { return this._errorMessage; }
+
+    _showError(message) {
+        this._errorMessage = message;
+        this.emitChange("errorMessage");
+    }
+
+    async performOIDCLoginCompletion() {
+        if (!this._state || !this._code) {
+            return;
+        }
+        const code = this._code;
+        // TODO: cleanup settings storage
+        const [startedAt, nonce, codeVerifier, redirectUri, homeserver, issuer, clientId, accountManagementUrl] = await Promise.all([
+            this.platform.settingsStorage.getInt(`oidc_${this._state}_started_at`),
+            this.platform.settingsStorage.getString(`oidc_${this._state}_nonce`),
+            this.platform.settingsStorage.getString(`oidc_${this._state}_code_verifier`),
+            this.platform.settingsStorage.getString(`oidc_${this._state}_redirect_uri`),
+            this.platform.settingsStorage.getString(`oidc_${this._state}_homeserver`),
+            this.platform.settingsStorage.getString(`oidc_${this._state}_issuer`),
+            this.platform.settingsStorage.getString(`oidc_${this._state}_client_id`),
+            this.platform.settingsStorage.getString(`oidc_${this._state}_account_management_url`),
+        ]);
+
+        const oidcApi = new OidcApi({
+            issuer,
+            clientId,
+            request: this._request,
+            encoding: this._encoding,
+            crypto: this._crypto,
+        });
+        const method = new OIDCLoginMethod({oidcApi, nonce, codeVerifier, code, homeserver, startedAt, redirectUri, accountManagementUrl});
+        const status = await this._attemptLogin(method);
+        let error = "";
+        switch (status) {
+            case LoginFailure.Credentials:
+                error = this.i18n`Your login token is invalid.`;
+                break;
+            case LoginFailure.Connection:
+                error = this.i18n`Can't connect to ${homeserver}.`;
+                break;
+            case LoginFailure.Unknown:
+                error = this.i18n`Something went wrong while checking your login token.`;
+                break;
+        }
+        if (error) {
+            this._showError(error);
+        }
+    }
+}

src/domain/login/LoginViewModel.ts

@@ -15,30 +15,39 @@ limitations under the License.
 */
 
 import {Client} from "../../matrix/Client.js";
+import {OidcApi} from "../../matrix/net/OidcApi.js";
 import {Options as BaseOptions, ViewModel} from "../ViewModel";
 import {PasswordLoginViewModel} from "./PasswordLoginViewModel";
 import {StartSSOLoginViewModel} from "./StartSSOLoginViewModel";
 import {CompleteSSOLoginViewModel} from "./CompleteSSOLoginViewModel";
+import {StartOIDCLoginViewModel} from "./StartOIDCLoginViewModel.js";
+import {CompleteOIDCLoginViewModel} from "./CompleteOIDCLoginViewModel.js";
 import {LoadStatus} from "../../matrix/Client.js";
 import {SessionLoadViewModel} from "../SessionLoadViewModel.js";
 import {SegmentType} from "../navigation/index";
 
 import type {PasswordLoginMethod, SSOLoginHelper, TokenLoginMethod, ILoginMethod} from "../../matrix/login";
+import { OIDCLoginMethod } from "../../matrix/login/OIDCLoginMethod.js";
 
 type Options = {
     defaultHomeserver: string;
     ready: ReadyFn;
+    oidc?: SegmentType["oidc"];
     loginToken?: string;
 } & BaseOptions;
 
 export class LoginViewModel extends ViewModel<SegmentType, Options> {
     private _ready: ReadyFn;
     private _loginToken?: string;
     private _client: Client;
+    private _oidc?: SegmentType["oidc"];
     private _loginOptions?: LoginOptions;
     private _passwordLoginViewModel?: PasswordLoginViewModel;
     private _startSSOLoginViewModel?: StartSSOLoginViewModel;
     private _completeSSOLoginViewModel?: CompleteSSOLoginViewModel;
+    private _startOIDCLoginViewModel?: StartOIDCLoginViewModel;
+    private _startOIDCGuestLoginViewModel?: StartOIDCLoginViewModel;
+    private _completeOIDCLoginViewModel?: CompleteOIDCLoginViewModel;
     private _loadViewModel?: SessionLoadViewModel;
     private _loadViewModelSubscription?: () => void;
     private _homeserver: string;
@@ -52,10 +61,11 @@ export class LoginViewModel extends ViewModel<SegmentType, Options> {
 
     constructor(options: Readonly<Options>) {
         super(options);
-        const {ready, defaultHomeserver, loginToken} = options;
+        const {ready, defaultHomeserver, loginToken, oidc} = options;
         this._ready = ready;
         this._loginToken = loginToken;
         this._client = new Client(this.platform, this.features);
+        this._oidc = oidc;
         this._homeserver = defaultHomeserver;
         this._initViewModels();
     }
@@ -72,6 +82,18 @@ export class LoginViewModel extends ViewModel<SegmentType, Options> {
         return this._completeSSOLoginViewModel;
     }
 
+    get startOIDCLoginViewModel(): StartOIDCLoginViewModel {
+        return this._startOIDCLoginViewModel;
+    }
+
+    get startOIDCGuestLoginViewModel(): StartOIDCLoginViewModel {
+        return this._startOIDCGuestLoginViewModel;
+    }
+
+    get completeOIDCLoginViewModel(): CompleteOIDCLoginViewModel {
+        return this._completeOIDCLoginViewModel;
+    }
+
     get homeserver(): string {
         return this._homeserver;
     }
@@ -116,6 +138,22 @@ export class LoginViewModel extends ViewModel<SegmentType, Options> {
                     })));
             this.emitChange("completeSSOLoginViewModel");
         }
+        else if (this._oidc?.success === true) {
+            this._hideHomeserver = true;
+            this._completeOIDCLoginViewModel = this.track(new CompleteOIDCLoginViewModel(
+                this.childOptions(
+                    {
+                        client: this._client,
+                        attemptLogin: (loginMethod: OIDCLoginMethod) => this.attemptLogin(loginMethod),
+                        state: this._oidc.state,
+                        code: this._oidc.code,
+                    })));
+            this.emitChange("completeOIDCLoginViewModel");
+        }
+        else if (this._oidc?.success === false) {
+            this._hideHomeserver = false;
+            this._showError(`Sign in failed: ${this._oidc.errorDescription ?? this._oidc.error} `);
+        }
         else {
             void this.queryHomeserver();
         }
@@ -137,6 +175,32 @@ export class LoginViewModel extends ViewModel<SegmentType, Options> {
         this.emitChange("startSSOLoginViewModel");
     }
 
+    private async _showOIDCLogin(): Promise<void> {
+        this._startOIDCLoginViewModel = this.track(
+            new StartOIDCLoginViewModel(this.childOptions({loginOptions: this._loginOptions, asGuest: false}))
+        );
+        this.emitChange("startOIDCLoginViewModel");
+        try {
+            await this._startOIDCLoginViewModel.discover();
+        } catch (err) {
+            this._showError(err.message);
+            this._disposeViewModels();
+        }
+    }
+
+    private async _showOIDCGuestLogin(): Promise<void> {
+        this._startOIDCGuestLoginViewModel = this.track(
+            new StartOIDCLoginViewModel(this.childOptions({loginOptions: this._loginOptions, asGuest: true}))
+        );
+        this.emitChange("startOIDCGuestLoginViewModel");
+        try {
+            await this._startOIDCLoginViewModel.discover();
+        } catch (err) {
+            this._showError(err.message);
+            this._disposeViewModels();
+        }
+    }
+
     private _showError(message: string): void {
         this._errorMessage = message;
         this.emitChange("errorMessage");
@@ -146,6 +210,8 @@ export class LoginViewModel extends ViewModel<SegmentType, Options> {
         this._isBusy = status;
         this._passwordLoginViewModel?.setBusy(status);
         this._startSSOLoginViewModel?.setBusy(status);
+        this._startOIDCLoginViewModel?.setBusy(status);
+        this._startOIDCGuestLoginViewModel?.setBusy(status);
         this.emitChange("isBusy");
     }
 
@@ -199,6 +265,8 @@ export class LoginViewModel extends ViewModel<SegmentType, Options> {
         this._startSSOLoginViewModel = this.disposeTracked(this._startSSOLoginViewModel);
         this._passwordLoginViewModel = this.disposeTracked(this._passwordLoginViewModel);
         this._completeSSOLoginViewModel = this.disposeTracked(this._completeSSOLoginViewModel);
+        this._startOIDCLoginViewModel = this.disposeTracked(this._startOIDCLoginViewModel);
+        this._startOIDCGuestLoginViewModel = this.disposeTracked(this._startOIDCGuestLoginViewModel);
         this.emitChange("disposeViewModels");
     }
 
@@ -263,9 +331,11 @@ export class LoginViewModel extends ViewModel<SegmentType, Options> {
         if (this._loginOptions) {
             if (this._loginOptions.sso) { this._showSSOLogin(); }
             if (this._loginOptions.password) { this._showPasswordLogin(); }
-            if (!this._loginOptions.sso && !this._loginOptions.password) {
-                this._showError("This homeserver supports neither SSO nor password based login flows");
-            }
+            if (this._loginOptions.oidc) { this._showOIDCLogin(); }
+            if (this._loginOptions.oidc?.guestAvailable) { this._showOIDCGuestLogin(); }
+            if (!this._loginOptions.sso && !this._loginOptions.password && !this._loginOptions.oidc) {
+                this._showError("This homeserver supports neither SSO nor password based login flows or has a usable OIDC Provider");
+            } 
         }
         else {
             this._showError(`Could not query login methods supported by ${this.homeserver}`);
@@ -289,5 +359,6 @@ export type LoginOptions = {
     homeserver: string;
     password?: (username: string, password: string) => PasswordLoginMethod;
     sso?: SSOLoginHelper;
+    oidc?: { issuer: string, guestAvailable: boolean };
     token?: (loginToken: string) => TokenLoginMethod;
 };