kych

handlers.rs (25318B)

---

 use axum::{
     Json,
     extract::{Path, Query, State},
     http::{StatusCode, header},
     response::IntoResponse,
     Form,
 };
 use chrono::Utc;
 use serde_json::json;
 
 use crate::{crypto, db::sessions::SessionStatus, models::*, state::AppState};
 
 // Health check endpoint
 pub async fn health_check() -> impl IntoResponse {
     tracing::info!("Received Health Request");
     Json(json!({
         "status": "healthy",
         "service": "oauth2-gateway",
     }))
 }
 
 // POST /setup/{clientId}
 pub async fn setup(
     State(state): State<AppState>,
     Path(client_id): Path<String>,
     headers: axum::http::HeaderMap,
 ) -> Result<impl IntoResponse, (StatusCode, Json<ErrorResponse>)> {
     tracing::info!("Setup request for client: {}", client_id);
 
     let auth_header = headers
         .get(header::AUTHORIZATION)
         .and_then(|h| h.to_str().ok());
 
     let bearer_token = match auth_header {
         Some(h) if h.starts_with("Bearer ") => &h[7..],
         _ => {
             tracing::warn!(
                 "Missing or malformed Authorization header for client: {}",
                 client_id
             );
             return Err((
                 StatusCode::UNAUTHORIZED,
                 Json(ErrorResponse::new("unauthorized")),
             ));
         }
     };
 
     let secret_hash = crate::db::clients::get_client_secret_hash(&state.pool, &client_id)
         .await
         .map_err(|e| {
             tracing::error!("DB error fetching client secret: {}", e);
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("internal_error")),
             )
         })?;
 
     let secret_hash = match secret_hash {
         Some(hash) => hash,
         None => {
             tracing::warn!("Client not found: {}", client_id);
             return Err((
                 StatusCode::UNAUTHORIZED,
                 Json(ErrorResponse::new("unauthorized")),
             ));
         }
     };
 
     let is_valid = bcrypt::verify(bearer_token, &secret_hash).map_err(|e| {
         tracing::error!("Bcrypt verification error: {}", e);
         (
             StatusCode::INTERNAL_SERVER_ERROR,
             Json(ErrorResponse::new("internal_error")),
         )
     })?;
 
     if !is_valid {
         tracing::warn!("Invalid bearer token for client: {}", client_id);
         return Err((
             StatusCode::UNAUTHORIZED,
             Json(ErrorResponse::new("unauthorized")),
         ));
     }
 
     let nonce = crypto::generate_nonce(state.config.crypto.nonce_bytes);
 
     tracing::debug!("Generated nonce: {}", nonce);
 
     let session = crate::db::sessions::create_session(&state.pool, &client_id, &nonce, 15)
         .await
         .map_err(|e| {
             tracing::error!("Failed to create session: {}", e);
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("internal_error")),
             )
         })?;
 
     let session = match session {
         Some(s) => s,
         None => {
             tracing::warn!("Client not found: {}", client_id);
             return Err((
                 StatusCode::NOT_FOUND,
                 Json(ErrorResponse::new("client_not_found")),
             ));
         }
     };
 
     tracing::info!(
         "Created session {} for client {} with nonce {}",
         session.id,
         client_id,
         nonce
     );
 
     Ok((StatusCode::OK, Json(SetupResponse { nonce })))
 }
 
 // GET /authorize/{nonce}?response_type=code&client_id={client_id}&redirect_uri={uri}&state={state}
 pub async fn authorize(
     State(state): State<AppState>,
     Path(nonce): Path<String>,
     Query(params): Query<AuthorizeQuery>,
 ) -> Result<impl IntoResponse, (StatusCode, Json<ErrorResponse>)> {
     tracing::info!(
         "Authorize request for client: {}, nonce: {}, state: {}, redirect_uri: {}, scope: {}",
         params.client_id,
         nonce,
         params.state,
         params.redirect_uri,
         params.scope
     );
 
     if params.response_type != "code" {
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new("invalid_request")),
         ));
     }
 
     let session_data = crate::db::sessions::get_session_for_authorize(
         &state.pool,
         &nonce,
         &params.client_id,
         &params.scope,
         &params.redirect_uri,
         &params.state,
     )
     .await
     .map_err(|e| {
         tracing::error!("DB error in authorize: {}", e);
         (
             StatusCode::INTERNAL_SERVER_ERROR,
             Json(ErrorResponse::new("internal_error")),
         )
     })?;
 
     let data = match session_data {
         Some(d) => d,
         None => {
             tracing::warn!("Session not found for nonce: {}", nonce);
             return Err((
                 StatusCode::NOT_FOUND,
                 Json(ErrorResponse::new("session_not_found")),
             ));
         }
     };
 
     // Backend validation
     if data.expires_at < Utc::now() {
         tracing::warn!("Session expired: {}", data.session_id);
         return Err((
             StatusCode::GONE,
             Json(ErrorResponse::new("session_expired")),
         ));
     }
 
     // Check status for idempotency
     match data.status {
         SessionStatus::Authorized => {
             tracing::info!(
                 "Session {} already authorized, returning cached response",
                 data.session_id
             );
 
             let verification_id = data
                 .request_id
                 .and_then(|id| uuid::Uuid::parse_str(&id).ok())
                 .unwrap_or(uuid::Uuid::nil());
 
             return Ok(PrettyJson(AuthorizeResponse {
                 verification_id,
                 verification_url: data.verification_url.clone().unwrap_or_default(),
                 verification_deeplink: data.verification_deeplink,
                 state: params.state.clone()
             }));
         }
 
         SessionStatus::Pending => {
             // Proceed with authorization
         }
 
         _ => {
             tracing::warn!(
                 "Session {} in invalid status: {:?}",
                 data.session_id,
                 data.status
             );
             return Err((
                 StatusCode::CONFLICT,
                 Json(ErrorResponse::new("invalid_session_status")),
             ));
         }
     }
 
     // Build presentation definition from scope
     let presentation_definition = build_presentation_definition(&data.scope);
 
     // Call Swiyu Verifier
     let verifier_url = format!("{}{}", data.verifier_url, data.verifier_management_api_path);
 
     let verifier_request = SwiyuCreateVerificationRequest {
         accepted_issuer_dids: default_accepted_issuer_dids(),
         trust_anchors: None,
         jwt_secured_authorization_request: Some(true),
         response_mode: ResponseMode::DirectPost,
         response_type: "vp_token".to_string(),
         presentation_definition,
         configuration_override: ConfigurationOverride::default(),
         dcql_query: None,
     };
 
     tracing::debug!(
         "Swiyu verifier request: {}",
         serde_json::to_string_pretty(&verifier_request).unwrap()
     );
     tracing::debug!("Calling Swiyu verifier at: {}", verifier_url);
 
     let verifier_response = state
         .http_client
         .post(&verifier_url)
         .json(&verifier_request)
         .send()
         .await
         .map_err(|e| {
             tracing::error!("Failed to call Swiyu verifier: {}", e);
             (
                 StatusCode::BAD_GATEWAY,
                 Json(ErrorResponse::new("verifier_unavailable")),
             )
         })?;
 
     if !verifier_response.status().is_success() {
         let status = verifier_response.status();
         let body = verifier_response.text().await.unwrap_or_default();
         tracing::error!("Swiyu verifier returned error {}: {}", status, body);
         return Err((
             StatusCode::BAD_GATEWAY,
             Json(ErrorResponse::new("verifier_error")),
         ));
     }
 
     let swiyu_response: SwiyuManagementResponse = verifier_response.json().await.map_err(|e| {
         tracing::error!("Failed to parse Swiyu response: {}", e);
         (
             StatusCode::BAD_GATEWAY,
             Json(ErrorResponse::new("verifier_invalid_response")),
         )
     })?;
 
     // Update session with verifier data
     let result = crate::db::sessions::update_session_authorized(
         &state.pool,
         data.session_id,
         &swiyu_response.verification_url,
         swiyu_response.verification_deeplink.as_deref(),
         &swiyu_response.id.to_string(),
         swiyu_response.request_nonce.as_deref(),
     )
     .await
     .map_err(|e| {
         tracing::error!("Failed to update session: {}", e);
         (
             StatusCode::INTERNAL_SERVER_ERROR,
             Json(ErrorResponse::new("internal_error")),
         )
     })?;
 
     tracing::info!(
         "Session {} authorized, verification_id: {}",
         data.session_id,
         swiyu_response.id
     );
 
     Ok(PrettyJson(AuthorizeResponse {
         verification_id: swiyu_response.id,
         verification_url: result.verification_url,
         verification_deeplink: swiyu_response.verification_deeplink,
         state: params.state.clone()
     }))
 }
 
 /// Build a presentation definition from a space-delimited scope string
 ///
 /// Example: "age_over_18" or "first_name last_name"
 fn build_presentation_definition(scope: &str) -> PresentationDefinition {
     use std::collections::HashMap;
     use uuid::Uuid;
 
     let attributes: Vec<&str> = scope.split_whitespace().collect();
 
     tracing::debug!(
         "Building presentation definition for attributes: {:?}",
         attributes
     );
 
     // First field: $.vct with filter for credential type
     let vct_field = Field {
         path: vec!["$.vct".to_string()],
         id: None,
         name: None,
         purpose: None,
         filter: Some(Filter {
             filter_type: "string".to_string(),
             const_value: Some("betaid-sdjwt".to_string()),
         }),
     };
 
     // Attribute fields from scope
     let mut fields: Vec<Field> = vec![vct_field];
     for attr in &attributes {
         fields.push(Field {
             path: vec![format!("$.{}", attr)],
             id: None,
             name: None,
             purpose: None,
             filter: None,
         });
     }
 
     let mut format = HashMap::new();
     format.insert(
         "vc+sd-jwt".to_string(),
         FormatAlgorithm {
             sd_jwt_alg_values: vec!["ES256".to_string()],
             kb_jwt_alg_values: vec!["ES256".to_string()],
         },
     );
 
     let input_descriptor = InputDescriptor {
         id: Uuid::new_v4().to_string(),
         name: None,
         purpose: None,
         format: Some(format),
         constraints: Constraint { fields },
     };
 
     PresentationDefinition {
         id: Uuid::new_v4().to_string(),
         name: Some("Over 18 Verification".to_string()),
         purpose: Some("Verify age is over 18".to_string()),
         format: None, // No format at top level
         input_descriptors: vec![input_descriptor],
     }
 }
 
 // POST /token
 pub async fn token(
     State(state): State<AppState>,
     Form(request): Form<TokenRequest>,
 ) -> Result<impl IntoResponse, (StatusCode, Json<ErrorResponse>)> {
     tracing::info!("Token request for code: {}", request.code);
 
     // Validate grant_type
     if request.grant_type != "authorization_code" {
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new("unsupported_grant_type")),
         ));
     }
 
     // Authenticate client
     let client = crate::db::clients::authenticate_client(
         &state.pool,
         &request.client_id,
         &request.client_secret,
     )
     .await
     .map_err(|e| {
         tracing::error!("DB error during client authentication: {}", e);
         (
             StatusCode::INTERNAL_SERVER_ERROR,
             Json(ErrorResponse::new("internal_error")),
         )
     })?;
 
     let client = match client {
         Some(c) => c,
         None => {
             tracing::warn!("Client authentication failed for {}", request.client_id);
             return Err((
                 StatusCode::UNAUTHORIZED,
                 Json(ErrorResponse::new("invalid_client")),
             ));
         }
     };
 
     // Fetch code (idempotent)
     let code_data =
         crate::db::authorization_codes::get_code_for_token_exchange(&state.pool, &request.code)
             .await
             .map_err(|e| {
                 tracing::error!("DB error in token exchange: {}", e);
                 (
                     StatusCode::INTERNAL_SERVER_ERROR,
                     Json(ErrorResponse::new("internal_error")),
                 )
             })?;
 
     let data = match code_data {
         Some(d) => d,
         None => {
             tracing::warn!("Authorization code not found or expired: {}", request.code);
             return Err((
                 StatusCode::BAD_REQUEST,
                 Json(ErrorResponse::new("invalid_grant")),
             ));
         }
     };
 
     // Verify the authorization code belongs to the client
     if data.client_id != client.id {
         tracing::warn!(
             "Authorization code {} does not belong to the client {}",
             request.code,
             request.client_id
         );
 
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new("invalid_grant")),
         ));
     }
 
     // Check for existing token
     if let Some(existing_token) = data.existing_token {
         tracing::info!(
             "Token already exists for session {}, returning cached response",
             data.session_id
         );
         return Ok((
             StatusCode::OK,
             Json(TokenResponse {
                 access_token: existing_token,
                 token_type: "Bearer".to_string(),
                 expires_in: 3600,
             }),
         ));
     }
 
     // Check if code was already used
     if data.was_already_used {
         tracing::warn!("Authorization code {} was already used", request.code);
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new("invalid_grant")),
         ));
     }
 
     // Validate session status
     if data.session_status != SessionStatus::Verified {
         tracing::warn!(
             "Session {} not in verified status: {:?}",
             data.session_id,
             data.session_status
         );
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new("invalid_grant")),
         ));
     }
 
     // Generate new token and complete session
     let access_token = crypto::generate_token(state.config.crypto.token_bytes);
     let token = crate::db::tokens::create_token_and_complete_session(
         &state.pool,
         data.session_id,
         &access_token,
         3600, // 1 hour
     )
     .await
     .map_err(|e| {
         tracing::error!("Failed to create token: {}", e);
         (
             StatusCode::INTERNAL_SERVER_ERROR,
             Json(ErrorResponse::new("internal_error")),
         )
     })?;
 
     tracing::info!("Token created for session {}", data.session_id);
 
     Ok((
         StatusCode::OK,
         Json(TokenResponse {
             access_token: token.token,
             token_type: "Bearer".to_string(),
             expires_in: 3600,
         }),
     ))
 }
 
 // GET /info
 pub async fn info(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
 ) -> Result<impl IntoResponse, (StatusCode, Json<ErrorResponse>)> {
     tracing::info!("Info request received");
 
     // Extract token from Authorization header
     let auth_header = headers
         .get(header::AUTHORIZATION)
         .and_then(|h| h.to_str().ok());
 
     let token = match auth_header {
         Some(h) if h.starts_with("Bearer ") => &h[7..],
         _ => {
             tracing::warn!("Missing or malformed Authorization header");
             return Err((
                 StatusCode::UNAUTHORIZED,
                 Json(ErrorResponse::new("invalid_token")),
             ));
         }
     };
 
     // Fetch token with session data (idempotent)
     let token_data = crate::db::tokens::get_token_with_session(&state.pool, token)
         .await
         .map_err(|e| {
             tracing::error!("DB error in info: {}", e);
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("internal_error")),
             )
         })?;
 
     let data = match token_data {
         Some(d) => d,
         None => {
             tracing::warn!("Token not found or expired");
             return Err((
                 StatusCode::UNAUTHORIZED,
                 Json(ErrorResponse::new("invalid_token")),
             ));
         }
     };
 
     // Validate token
     if data.revoked {
         tracing::warn!("Token {} is revoked", data.token_id);
         return Err((
             StatusCode::UNAUTHORIZED,
             Json(ErrorResponse::new("invalid_token")),
         ));
     }
 
     if data.session_status != SessionStatus::Completed {
         tracing::warn!("Session not completed: {:?}", data.session_status);
         return Err((
             StatusCode::UNAUTHORIZED,
             Json(ErrorResponse::new("invalid_token")),
         ));
     }
 
     // Return verifiable credential
     let credential = VerifiableCredential {
         data: data.verifiable_credential.unwrap_or(json!({})),
     };
 
     tracing::info!("Returning credential for token {}", data.token_id);
 
     Ok((StatusCode::OK, Json(credential)))
 }
 
 // POST /notification
 // Always returns 200 OK to Swiyu - errors are logged internally
 pub async fn notification_webhook(
     State(state): State<AppState>,
     Json(webhook): Json<NotificationRequest>,
 ) -> impl IntoResponse {
     tracing::info!(
         "Webhook received from Swiyu: verification_id={}, timestamp={}",
         webhook.verification_id,
         webhook.timestamp
     );
 
     // Lookup session by request_id (verification_id)
     let session_data = match crate::db::sessions::get_session_for_notification(
         &state.pool,
         &webhook.verification_id.to_string(),
     )
     .await
     {
         Ok(Some(data)) => data,
         Ok(None) => {
             tracing::warn!(
                 "Session not found for verification_id: {}",
                 webhook.verification_id
             );
             return StatusCode::OK;
         }
         Err(e) => {
             tracing::error!("DB error looking up session: {}", e);
             return StatusCode::OK;
         }
     };
 
     // Validate session status
     if session_data.status != SessionStatus::Authorized {
         tracing::warn!(
             "Session {} not in authorized status: {:?}",
             session_data.session_id,
             session_data.status
         );
         return StatusCode::OK;
     }
 
     // Call Swiyu verifier to get verification result
     let verifier_url = format!(
         "{}{}/{}",
         session_data.verifier_url,
         session_data.verifier_management_api_path,
         webhook.verification_id
     );
 
     tracing::debug!("Fetching verification result from: {}", verifier_url);
 
     let verifier_response = match state.http_client.get(&verifier_url).send().await {
         Ok(resp) => resp,
         Err(e) => {
             tracing::error!("Failed to call Swiyu verifier: {}", e);
             return StatusCode::OK;
         }
     };
 
     if !verifier_response.status().is_success() {
         let status = verifier_response.status();
         tracing::error!("Swiyu verifier returned error: {}", status);
         return StatusCode::OK;
     }
 
     let swiyu_result: SwiyuManagementResponse = match verifier_response.json().await {
         Ok(r) => r,
         Err(e) => {
             tracing::error!("Failed to parse Swiyu response: {}", e);
             return StatusCode::OK;
         }
     };
 
     // Determine status based on verification result
     let (new_status, status_str) = match swiyu_result.state {
         SwiyuVerificationStatus::Success => (SessionStatus::Verified, "verified"),
         SwiyuVerificationStatus::Failed => (SessionStatus::Failed, "failed"),
         SwiyuVerificationStatus::Pending => {
             tracing::info!(
                 "Verification {} still pending, ignoring webhook",
                 webhook.verification_id
             );
             return StatusCode::OK;
         }
     };
 
     // Generate authorization code
     let authorization_code = crypto::generate_authorization_code(state.config.crypto.authorization_code_bytes);
 
     // Construct GET request URL: redirect_uri?code=XXX&state=YYY
     let redirect_uri = session_data.redirect_uri.as_ref()
         .unwrap_or(&session_data.webhook_url);
     let oauth_state = session_data.state.as_deref().unwrap_or("");
 
     let webhook_url = format!(
         "{}?code={}&state={}",
         redirect_uri,
         authorization_code,
         oauth_state
     );
 
     // Update session, create auth code, and queue webhook (GET request, empty body)
     match crate::db::sessions::verify_session_and_queue_notification(
         &state.pool,
         session_data.session_id,
         new_status,
         &authorization_code,
         10, // 10 minutes for auth code expiry
         session_data.client_id,
         &webhook_url,
         "",  // Empty body for GET request
         swiyu_result.wallet_response.as_ref(),
     )
     .await
     {
         Ok(code) => {
             tracing::info!(
                 "Session {} updated to {}, auth code created, webhook queued",
                 session_data.session_id,
                 status_str
             );
             tracing::debug!("Generated authorization code: {}", code);
         }
         Err(e) => {
             tracing::error!("Failed to update session and queue notification: {}", e);
         }
     }
 
     StatusCode::OK
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
     #[test]
     fn test_build_presentation_definition_single_attribute() {
         let scope = "age_over_18";
         let pd = build_presentation_definition(scope);
 
         // Verify structure
         assert!(!pd.id.is_empty());
         assert_eq!(pd.name, Some("Over 18 Verification".to_string()));
         assert_eq!(pd.input_descriptors.len(), 1);
 
         // Verify fields: vct filter + requested attribute
         let fields = &pd.input_descriptors[0].constraints.fields;
         assert_eq!(fields.len(), 2);
 
         // First field is vct with filter
         assert_eq!(fields[0].path, vec!["$.vct"]);
         assert!(fields[0].filter.is_some());
         let filter = fields[0].filter.as_ref().unwrap();
         assert_eq!(filter.filter_type, "string");
         assert_eq!(filter.const_value, Some("betaid-sdjwt".to_string()));
 
         // Second field is the requested attribute
         assert_eq!(fields[1].path, vec!["$.age_over_18"]);
         assert!(fields[1].filter.is_none());
     }
 
     #[test]
     fn test_build_presentation_definition_multiple_attributes() {
         let scope = "first_name last_name date_of_birth";
         let pd = build_presentation_definition(scope);
 
         let fields = &pd.input_descriptors[0].constraints.fields;
         // vct + 3 attributes = 4 fields
         assert_eq!(fields.len(), 4);
 
         assert_eq!(fields[0].path, vec!["$.vct"]); // vct first
         assert_eq!(fields[1].path, vec!["$.first_name"]);
         assert_eq!(fields[2].path, vec!["$.last_name"]);
         assert_eq!(fields[3].path, vec!["$.date_of_birth"]);
     }
 
     #[test]
     fn test_build_presentation_definition_extra_whitespace() {
         let scope = "first_name  last_name";
         let pd = build_presentation_definition(scope);
 
         let fields = &pd.input_descriptors[0].constraints.fields;
         // split_whitespace handles multiple spaces correctly
         // vct + 2 attributes = 3 fields
         assert_eq!(fields.len(), 3);
         assert_eq!(fields[0].path, vec!["$.vct"]);
         assert_eq!(fields[1].path, vec!["$.first_name"]);
         assert_eq!(fields[2].path, vec!["$.last_name"]);
     }
 
     #[test]
     fn test_build_presentation_definition_empty_scope() {
         let scope = "";
         let pd = build_presentation_definition(scope);
 
         let fields = &pd.input_descriptors[0].constraints.fields;
         // Only vct field when scope is empty
         assert_eq!(fields.len(), 1);
         assert_eq!(fields[0].path, vec!["$.vct"]);
     }
 
     #[test]
     fn test_build_presentation_definition_no_top_level_format() {
         let scope = "age_over_18";
         let pd = build_presentation_definition(scope);
 
         // No format at top level
         assert!(pd.format.is_none());
     }
 
     #[test]
     fn test_build_presentation_definition_input_descriptor_structure() {
         let scope = "age_over_18";
         let pd = build_presentation_definition(scope);
 
         let descriptor = &pd.input_descriptors[0];
 
         // Verify descriptor has valid UUID
         assert!(!descriptor.id.is_empty());
 
         // Verify no name/purpose at descriptor level
         assert!(descriptor.name.is_none());
         assert!(descriptor.purpose.is_none());
 
         // Verify format is specified at descriptor level
         assert!(descriptor.format.is_some());
         let format = descriptor.format.as_ref().unwrap();
         assert!(format.contains_key("vc+sd-jwt"));
         let alg = &format["vc+sd-jwt"];
         assert_eq!(alg.sd_jwt_alg_values, vec!["ES256"]);
         assert_eq!(alg.kb_jwt_alg_values, vec!["ES256"]);
     }
 }