File Coverage

blib/lib/Net/OpenID/Connect/IDToken.pm

Criterion	Covered	Total	%
statement	66	66	100.0
branch	19	20	95.0
condition	6	8	75.0
subroutine	17	17	100.0
pod	0	4	0.0
total	108	115	93.9

package Net::OpenID::Connect::IDToken;
use 5.008005;
use strict;
use warnings;

our $VERSION = "0.03";

use parent qw/Exporter/;

use MIME::Base64 qw/encode_base64url/;
use Digest::SHA;
use JSON::WebToken qw//;

use Net::OpenID::Connect::IDToken::Exception;
use Net::OpenID::Connect::IDToken::Constants;

our @EXPORT = qw/encode_id_token decode_id_token/;


our $JWT_ENCODE = sub {
    my ($claims, $key, $alg, $extra_headers) = @_;
    JSON::WebToken->encode($claims, $key, $alg, $extra_headers);
};

our $JWT_DECODE = sub {
    my ($id_token, $key, $to_be_verified) = @_;
    JSON::WebToken->decode($id_token, $key, $to_be_verified);
};

sub encode_id_token {
    __PACKAGE__->encode(@_);
}

sub decode_id_token {
    __PACKAGE__->decode(@_);
}

sub encode {
    my ($class, $claims, $key, $alg, $opts, $extra_headers) = @_;
    $alg ||= "HS256";
    my $id_token_claims = +{};

    if ( my $token = $opts->{token} ) {
        $id_token_claims->{at_hash} = $class->_generate_token_hash($token, $alg);
    }
    if ( my $code = $opts->{code} ) {
        $id_token_claims->{c_hash} = $class->_generate_token_hash($code, $alg);
    }

    return $JWT_ENCODE->(+{ %$claims, %$id_token_claims }, $key, $alg, $extra_headers);
}

sub _generate_token_hash {
    my ($class, $token, $alg) = @_;
    my $bits = substr($alg, 2); # 'HS256' -> '256'

    my $sha  = Digest::SHA->new($bits);
    unless ( $sha ) {
        Net::OpenID::Connect::IDToken::Exception->throw(
            code    => ERROR_IDTOKEN_INVALID_ALGORITHM,
            message => sprintf("%s is not supported as SHA-xxx algorithm.", $bits),
        );
    }
    $sha->add($token);

    return encode_base64url(substr($sha->digest, 0, $bits / 16));
}

sub decode {
    my ($class, $id_token, $key, $tokens) = @_;

    if ( $key ) {
        my $tokens_verify_code = sub {
            my ($header, $claims) = @_;

            if ( $tokens && $tokens->{token} ) {
                $class->_verify_at_hash($tokens->{token}, $header->{alg}, $claims->{at_hash});
            }
            if ( $tokens && $tokens->{code} ) {
                $class->_verify_c_hash($tokens->{code}, $header->{alg}, $claims->{c_hash});
            }

            return $key;
        };
        return $JWT_DECODE->($id_token, $tokens_verify_code, 1);
    }
    else {
        return $JWT_DECODE->($id_token, $key, 0);
    }
}

sub _verify_at_hash {
    my ($class, $access_token, $alg, $at_hash) = @_;
    unless ( $at_hash ) {
        Net::OpenID::Connect::IDToken::Exception->throw(
            code    => ERROR_IDTOKEN_TOKEN_HASH_NOT_FOUND,
            message => "at_hash not found in given JWT's claims",
        );
    }
    my $expected_hash = $class->_generate_token_hash($access_token, $alg);
    if ( $at_hash ne $expected_hash ) {
        Net::OpenID::Connect::IDToken::Exception->throw(
            code    => ERROR_IDTOKEN_TOKEN_HASH_INVALID,
            message => sprintf("at_hash is invalid: got = %s, expected = %s", $at_hash, $expected_hash),
        );
    }
}

sub _verify_c_hash {
    my ($class, $authorization_code, $alg, $c_hash) = @_;
    unless ( $c_hash ) {
        Net::OpenID::Connect::IDToken::Exception->throw(
            code    => ERROR_IDTOKEN_CODE_HASH_NOT_FOUND,
            message => "c_hash not found in given JWT's claims",
        );
    }
    my $expected_hash = $class->_generate_token_hash($authorization_code, $alg);
    if ( $c_hash ne $expected_hash ) {
        Net::OpenID::Connect::IDToken::Exception->throw(
            code    => ERROR_IDTOKEN_CODE_HASH_INVALID,
            message => sprintf("c_hash is invalid: got = %s, expected = %s", $c_hash, $expected_hash),
        );
    }
}

1;
__END__