File Coverage

blib/lib/Plack/Middleware/Zitadel.pm

Criterion	Covered	Total	%
statement	70	71	98.5
branch	29	32	90.6
condition	11	16	68.7
subroutine	13	13	100.0
pod	2	2	100.0
total	125	134	93.2

package Plack::Middleware::Zitadel;

# ABSTRACT: Verify Bearer tokens via ZITADEL OIDC in Plack apps

use strict;
use warnings;

use parent 'Plack::Middleware';
use Plack::Util::Accessor qw(issuer audience required_scopes claims_env_key realm oidc);
use JSON::MaybeXS qw(encode_json);
use WWW::Zitadel::OIDC;

our $VERSION = '0.010';

sub prepare_app {
    my ($self) = @_;

    $self->claims_env_key('zitadel.claims')
        unless defined $self->claims_env_key;
    $self->realm('api')
        unless defined $self->realm;

    my $oidc = $self->oidc;
    if (!$oidc) {
        die "issuer required\n" unless $self->issuer;
        $oidc = WWW::Zitadel::OIDC->new(issuer => $self->issuer);
    }

    die "oidc object must implement verify_token\n"
        unless $oidc->can('verify_token');

    $self->{_oidc} = $oidc;
}

sub call {
    my ($self, $env) = @_;

    my ($ok, $token_or_error) = $self->_extract_bearer($env->{HTTP_AUTHORIZATION});
    return $self->_unauthorized('invalid_request', $token_or_error)
        unless $ok;

    my %verify_args;
    if (defined $self->audience && length $self->audience) {
        $verify_args{audience} = $self->audience;
    }

    my $claims = eval {
        $self->{_oidc}->verify_token($token_or_error, %verify_args);
    };
    if (my $err = $@) {
        $err =~ s/\s+\z//;
        return $self->_unauthorized('invalid_token', $err || 'token verification failed');
    }

    my @required = $self->_required_scope_list;
    if (@required && !$self->_has_required_scopes($claims, \@required)) {
        return $self->_forbidden('insufficient_scope', 'required scopes are missing');
    }

    $env->{ $self->claims_env_key } = $claims;
    $env->{'zitadel.token'} = $token_or_error;

    return $self->app->($env);
}

sub _extract_bearer {
    my ($self, $header_value) = @_;

    return (0, 'missing Authorization header')
        unless defined $header_value && length $header_value;

    return (0, 'Authorization must use Bearer token')
        unless $header_value =~ /^Bearer\s+(.+)\z/i;

    my $token = $1;
    return (0, 'empty bearer token') unless defined $token && length $token;

    return (1, $token);
}

sub _required_scope_list {
    my ($self) = @_;
    my $scopes = $self->required_scopes;

    return () unless defined $scopes;

    if (ref($scopes) eq 'ARRAY') {
        return grep { defined $_ && length $_ } @$scopes;
    }

    return grep { length $_ } split /\s+/, "$scopes";
}

sub _has_required_scopes {
    my ($self, $claims, $required) = @_;

    my $scope_str = $claims->{scope} // '';
    my %have = map { $_ => 1 } grep { length $_ } split /\s+/, $scope_str;

    for my $need (@$required) {
        return 0 unless $have{$need};
    }

    return 1;
}

sub _unauthorized {
    my ($self, $error, $description) = @_;
    my $header = sprintf(
        'Bearer realm="%s", error="%s", error_description="%s"',
        $self->realm,
        $error,
        $description,
    );

    return [
        401,
        [
            'Content-Type' => 'application/json',
            'WWW-Authenticate' => $header,
        ],
        [ encode_json({ error => $error, error_description => $description }) ],
    ];
}

sub _forbidden {
    my ($self, $error, $description) = @_;

    return [
        403,
        [ 'Content-Type' => 'application/json' ],
        [ encode_json({ error => $error, error_description => $description }) ],
    ];
}

1;

__END__