authorizer/server/handlers/verify_email.go

package handlers

import (
	"net/http"
	"strconv"
	"strings"
	"time"

	"github.com/gin-gonic/gin"
	"github.com/google/uuid"
	log "github.com/sirupsen/logrus"

	"github.com/authorizerdev/authorizer/server/constants"
	"github.com/authorizerdev/authorizer/server/cookie"
	"github.com/authorizerdev/authorizer/server/db"
	"github.com/authorizerdev/authorizer/server/db/models"
	"github.com/authorizerdev/authorizer/server/memorystore"
	"github.com/authorizerdev/authorizer/server/parsers"
	"github.com/authorizerdev/authorizer/server/token"
	"github.com/authorizerdev/authorizer/server/utils"
)

// VerifyEmailHandler handles the verify email route.
// It verifies email based on JWT token in query string
func VerifyEmailHandler() gin.HandlerFunc {
	return func(c *gin.Context) {
		redirectURL := strings.TrimSpace(c.Query("redirect_uri"))
		errorRes := gin.H{
			"error": "token is required",
		}
		tokenInQuery := c.Query("token")
		if tokenInQuery == "" {
			log.Debug("Token is empty")
			utils.HandleRedirectORJsonResponse(c, http.StatusBadRequest, errorRes, generateRedirectURL(redirectURL, errorRes))
			return
		}

		verificationRequest, err := db.Provider.GetVerificationRequestByToken(c, tokenInQuery)
		if err != nil {
			log.Debug("Error getting verification request: ", err)
			errorRes["error"] = err.Error()
			utils.HandleRedirectORJsonResponse(c, http.StatusBadRequest, errorRes, generateRedirectURL(redirectURL, errorRes))
			return
		}

		// verify if token exists in db
		hostname := parsers.GetHost(c)
		claim, err := token.ParseJWTToken(tokenInQuery)
		if err != nil {
			log.Debug("Error parsing token: ", err)
			errorRes["error"] = err.Error()
			utils.HandleRedirectORJsonResponse(c, http.StatusBadRequest, errorRes, generateRedirectURL(redirectURL, errorRes))
			return
		}

		if ok, err := token.ValidateJWTClaims(claim, hostname, verificationRequest.Nonce, verificationRequest.Email); !ok || err != nil {
			log.Debug("Error validating jwt claims: ", err)
			errorRes["error"] = err.Error()
			utils.HandleRedirectORJsonResponse(c, http.StatusBadRequest, errorRes, generateRedirectURL(redirectURL, errorRes))
			return
		}

		user, err := db.Provider.GetUserByEmail(c, verificationRequest.Email)
		if err != nil {
			log.Debug("Error getting user: ", err)
			errorRes["error"] = err.Error()
			utils.HandleRedirectORJsonResponse(c, http.StatusBadRequest, errorRes, generateRedirectURL(redirectURL, errorRes))
			return
		}

		isSignUp := false
		// update email_verified_at in users table
		if user.EmailVerifiedAt == nil {
			now := time.Now().Unix()
			user.EmailVerifiedAt = &now
			isSignUp = true
			db.Provider.UpdateUser(c, user)
		}
		// delete from verification table
		db.Provider.DeleteVerificationRequest(c, verificationRequest)

		state := strings.TrimSpace(c.Query("state"))
		rolesString := strings.TrimSpace(c.Query("roles"))
		var roles []string
		if rolesString == "" {
			roles = strings.Split(user.Roles, ",")
		} else {
			roles = strings.Split(rolesString, ",")
		}

		scopeString := strings.TrimSpace(c.Query("scope"))
		var scope []string
		if scopeString == "" {
			scope = []string{"openid", "email", "profile"}
		} else {
			scope = strings.Split(scopeString, " ")
		}
		loginMethod := constants.AuthRecipeMethodBasicAuth
		if verificationRequest.Identifier == constants.VerificationTypeMagicLinkLogin {
			loginMethod = constants.AuthRecipeMethodMagicLinkLogin
		}

		code := ""
		// Not required as /oauth/token cannot be resumed from other tab
		// codeChallenge := ""
		nonce := ""
		if state != "" {
			// Get state from store
			authorizeState, _ := memorystore.Provider.GetState(state)
			if authorizeState != "" {
				authorizeStateSplit := strings.Split(authorizeState, "@@")
				if len(authorizeStateSplit) > 1 {
					code = authorizeStateSplit[0]
					// Not required as /oauth/token cannot be resumed from other tab
					// codeChallenge = authorizeStateSplit[1]
				} else {
					nonce = authorizeState
				}
				go memorystore.Provider.RemoveState(state)
			}
		}
		if nonce == "" {
			nonce = uuid.New().String()
		}
		authToken, err := token.CreateAuthToken(c, user, roles, scope, loginMethod, nonce, code)
		if err != nil {
			log.Debug("Error creating auth token: ", err)
			errorRes["error"] = err.Error()
			utils.HandleRedirectORJsonResponse(c, http.StatusInternalServerError, errorRes, generateRedirectURL(redirectURL, errorRes))
			return
		}

		// Code challenge could be optional if PKCE flow is not used
		// Not required as /oauth/token cannot be resumed from other tab
		// if code != "" {
		// 	if err := memorystore.Provider.SetState(code, codeChallenge+"@@"+authToken.FingerPrintHash); err != nil {
		// 		log.Debug("Error setting code state ", err)
		// 		errorRes["error"] = err.Error()
		// 		c.JSON(500, errorRes)
		// 		return
		// 	}
		// }

		expiresIn := authToken.AccessToken.ExpiresAt - time.Now().Unix()
		if expiresIn <= 0 {
			expiresIn = 1
		}

		params := "access_token=" + authToken.AccessToken.Token + "&token_type=bearer&expires_in=" + strconv.FormatInt(expiresIn, 10) + "&state=" + state + "&id_token=" + authToken.IDToken.Token + "&nonce=" + nonce

		if code != "" {
			params += "&code=" + code
		}

		sessionKey := loginMethod + ":" + user.ID
		cookie.SetSession(c, authToken.FingerPrintHash)
		memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeSessionToken+"_"+authToken.FingerPrint, authToken.FingerPrintHash, authToken.SessionTokenExpiresAt)
		memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeAccessToken+"_"+authToken.FingerPrint, authToken.AccessToken.Token, authToken.AccessToken.ExpiresAt)

		if authToken.RefreshToken != nil {
			params = params + `&refresh_token=` + authToken.RefreshToken.Token
			memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeRefreshToken+"_"+authToken.FingerPrint, authToken.RefreshToken.Token, authToken.RefreshToken.ExpiresAt)
		}

		if redirectURL == "" {
			redirectURL = claim["redirect_uri"].(string)
		}

		if strings.Contains(redirectURL, "?") {
			redirectURL = redirectURL + "&" + params
		} else {
			redirectURL = redirectURL + "?" + strings.TrimPrefix(params, "&")
		}

		go func() {
			if isSignUp {
				utils.RegisterEvent(c, constants.UserSignUpWebhookEvent, loginMethod, user)
			} else {
				utils.RegisterEvent(c, constants.UserLoginWebhookEvent, loginMethod, user)
			}

			db.Provider.AddSession(c, models.Session{
				UserID:    user.ID,
				UserAgent: utils.GetUserAgent(c.Request),
				IP:        utils.GetIP(c.Request),
			})
		}()

		c.Redirect(http.StatusTemporaryRedirect, redirectURL)
	}
}

func generateRedirectURL(url string, res map[string]interface{}) string {
	redirectURL := url
	if redirectURL == "" {
		return ""
	}
	var paramsArr []string
	for key, value := range res {
		paramsArr = append(paramsArr, key+"="+value.(string))
	}
	params := strings.Join(paramsArr, "&")
	if strings.Contains(redirectURL, "?") {
		redirectURL = redirectURL + "&" + params
	} else {
		redirectURL = redirectURL + "?" + strings.TrimPrefix(params, "&")
	}
	return redirectURL
}