update_validation.c (5146B)
1 /* 2 This file is part of Challenger 3 Copyright (C) 2023 Taler Systems SA 4 5 Challenger is free software; you can redistribute it and/or modify it under the 6 terms of the GNU General Public License as published by the Free Software 7 Foundation; either version 3, or (at your option) any later version. 8 9 Challenger is distributed in the hope that it will be useful, but WITHOUT ANY 10 WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR 11 A PARTICULAR PURPOSE. See the GNU General Public License for more details. 12 13 You should have received a copy of the GNU General Public License along with 14 Challenger; see the file COPYING. If not, see <http://www.gnu.org/licenses/> 15 */ 16 /** 17 * @file src/challengerdb/update_validation.c 18 * @brief Implementation of the update_validation function for Postgres 19 * @author Christian Grothoff 20 * @author Bohdan Potuzhnyi 21 * @author Vlada Svirsh 22 */ 23 #include "platform.h" 24 #include <taler/taler_error_codes.h> 25 #include <taler/taler_dbevents.h> 26 #include <taler/taler_pq_lib.h> 27 #include "update_validation.h" 28 #include "pg_helper.h" 29 30 31 enum GNUNET_DB_QueryStatus 32 CHALLENGERDB_update_validation ( 33 struct CHALLENGERDB_PostgresContext *ctx, 34 const struct CHALLENGER_ValidationNonceP *nonce, 35 uint64_t client_id, 36 const char *client_scope, 37 const char *client_state, 38 const char *client_redirect_uri, 39 const char *code_challenge, 40 uint32_t code_challenge_method, 41 json_t **last_address, 42 uint32_t *address_attempts_left, 43 uint32_t *pin_transmissions_left, 44 uint32_t *auth_attempts_left, 45 bool *solved, 46 struct GNUNET_TIME_Absolute *last_tx_time) 47 { 48 struct GNUNET_TIME_Absolute now 49 = GNUNET_TIME_absolute_get (); 50 struct GNUNET_PQ_QueryParam params[] = { 51 GNUNET_PQ_query_param_auto_from_type (nonce), 52 GNUNET_PQ_query_param_uint64 (&client_id), 53 NULL != client_scope 54 ? GNUNET_PQ_query_param_string (client_scope) 55 : GNUNET_PQ_query_param_null (), 56 NULL != client_state 57 ? GNUNET_PQ_query_param_string (client_state) 58 : GNUNET_PQ_query_param_null (), 59 NULL != client_redirect_uri 60 ? GNUNET_PQ_query_param_string (client_redirect_uri) 61 : GNUNET_PQ_query_param_null (), 62 NULL != code_challenge 63 ? GNUNET_PQ_query_param_string (code_challenge) 64 : GNUNET_PQ_query_param_null (), 65 GNUNET_PQ_query_param_uint32 (&code_challenge_method), 66 GNUNET_PQ_query_param_absolute_time (&now), 67 GNUNET_PQ_query_param_end 68 }; 69 struct GNUNET_PQ_ResultSpec rs[] = { 70 GNUNET_PQ_result_spec_allow_null ( 71 TALER_PQ_result_spec_json ("address", 72 last_address), 73 NULL), 74 GNUNET_PQ_result_spec_uint32 ("address_attempts_left", 75 address_attempts_left), 76 GNUNET_PQ_result_spec_uint32 ("pin_transmissions_left", 77 pin_transmissions_left), 78 GNUNET_PQ_result_spec_uint32 ("auth_attempts_left", 79 auth_attempts_left), 80 GNUNET_PQ_result_spec_bool ("solved", 81 solved), 82 GNUNET_PQ_result_spec_absolute_time ("last_tx_time", 83 last_tx_time), 84 GNUNET_PQ_result_spec_end 85 }; 86 87 *last_address = NULL; 88 /* A repeated /authorize must never *weaken* an existing PKCE binding 89 (RFC 7636): /authorize authenticates nobody (the client_id is a plain 90 query argument) and the nonce is recoverable from an issued code, so 91 replaying /authorize without a code_challenge would otherwise strip the 92 binding from a validation that already had one. Hence COALESCE, just 93 like for client_redirect_uri above. code_challenge_method must move 94 with the challenge it describes: the column is NOT NULL DEFAULT 0, so 95 writing it unconditionally would leave a retained challenge with the 96 method of the request that tried to drop it. */ 97 PREPARE (ctx, 98 "update_validation", 99 "UPDATE validations SET" 100 " client_scope=$3" 101 " ,client_state=$4" 102 " ,client_redirect_uri=COALESCE($5::VARCHAR,client_redirect_uri)" 103 " ,code_challenge=COALESCE($6::VARCHAR,code_challenge)" 104 " ,code_challenge_method=CASE" 105 " WHEN $6::VARCHAR IS NULL" 106 " THEN code_challenge_method" 107 " ELSE $7" 108 " END" 109 " WHERE nonce=$1" 110 " AND client_serial_id=$2" 111 " AND expiration_time > $8" 112 " AND ( ($5::VARCHAR=client_redirect_uri)" 113 " OR ( ($5::VARCHAR IS NULL)" 114 " AND (client_redirect_uri IS NOT NULL) ) )" 115 " RETURNING" 116 " address" 117 " ,address_attempts_left" 118 " ,pin_transmissions_left" 119 " ,GREATEST(0, auth_attempts_left) AS auth_attempts_left" 120 " ,auth_attempts_left = -1 AS solved" 121 " ,last_tx_time;"); 122 return GNUNET_PQ_eval_prepared_singleton_select (ctx->conn, 123 "update_validation", 124 params, 125 rs); 126 }