fix: use raw base64 url decoding

app/package.json

@@ -1,29 +1,29 @@
 {
-	"name": "app",
-	"version": "1.0.0",
-	"description": "",
-	"main": "index.js",
-	"scripts": {
-		"build": "rm -rf build && NODE_ENV=production node ./esbuild.config.js",
-		"start": "NODE_ENV=development node ./esbuild.config.js"
-	},
-	"keywords": [],
-	"author": "Lakhan Samani",
-	"license": "ISC",
-	"dependencies": {
-		"@authorizerdev/authorizer-react": "^0.24.0-beta.1",
-		"@types/react": "^17.0.15",
-		"@types/react-dom": "^17.0.9",
-		"esbuild": "^0.12.17",
-		"react": "^17.0.2",
-		"react-dom": "^17.0.2",
-		"react-is": "^17.0.2",
-		"react-router-dom": "^5.2.0",
-		"typescript": "^4.3.5",
-		"styled-components": "^5.3.0"
-	},
-	"devDependencies": {
-		"@types/react-router-dom": "^5.1.8",
-		"@types/styled-components": "^5.1.11"
-	}
+  "name": "app",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "build": "rm -rf build && NODE_ENV=production node ./esbuild.config.js",
+    "start": "NODE_ENV=development node ./esbuild.config.js"
+  },
+  "keywords": [],
+  "author": "Lakhan Samani",
+  "license": "ISC",
+  "dependencies": {
+    "@authorizerdev/authorizer-react": "^0.24.0-beta.2",
+    "@types/react": "^17.0.15",
+    "@types/react-dom": "^17.0.9",
+    "esbuild": "^0.12.17",
+    "react": "^17.0.2",
+    "react-dom": "^17.0.2",
+    "react-is": "^17.0.2",
+    "react-router-dom": "^5.2.0",
+    "typescript": "^4.3.5",
+    "styled-components": "^5.3.0"
+  },
+  "devDependencies": {
+    "@types/react-router-dom": "^5.1.8",
+    "@types/styled-components": "^5.1.11"
+  }
 }

server/handlers/oauth_callback.go

@@ -2,6 +2,7 @@ package handlers
 
 import (
 	"context"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
@@ -17,7 +18,6 @@ import (
 
 	"github.com/authorizerdev/authorizer/server/constants"
 	"github.com/authorizerdev/authorizer/server/cookie"
-	"github.com/authorizerdev/authorizer/server/crypto"
 	"github.com/authorizerdev/authorizer/server/db"
 	"github.com/authorizerdev/authorizer/server/db/models"
 	"github.com/authorizerdev/authorizer/server/memorystore"
@@ -225,7 +225,7 @@ func OAuthCallbackHandler() gin.HandlerFunc {
 			redirectURL = redirectURL + "?" + strings.TrimPrefix(params, "&")
 		}
 
-		c.Redirect(http.StatusTemporaryRedirect, redirectURL)
+		c.Redirect(http.StatusFound, redirectURL)
 	}
 }
 
@@ -456,13 +456,14 @@ func processLinkedInUserInfo(code string) (models.User, error) {
 
 func processAppleUserInfo(code string) (models.User, error) {
 	user := models.User{}
+	fmt.Println("=> code:", code)
 	oauth2Token, err := oauth.OAuthProviders.AppleConfig.Exchange(oauth2.NoContext, code)
 	if err != nil {
 		log.Debug("Failed to exchange code for token: ", err)
 		return user, fmt.Errorf("invalid apple exchange code: %s", err.Error())
 	}
 
-	fmt.Println("=> token", oauth2Token.AccessToken)
+	fmt.Println("=> oauth2Token:", oauth2Token)
 
 	// Extract the ID Token from OAuth2 token.
 	rawIDToken, ok := oauth2Token.Extra("id_token").(string)
@@ -471,25 +472,24 @@ func processAppleUserInfo(code string) (models.User, error) {
 		return user, fmt.Errorf("unable to extract id_token")
 	}
 
-	fmt.Println("=> rawIDToken", rawIDToken)
-
 	tokenSplit := strings.Split(rawIDToken, ".")
 	claimsData := tokenSplit[1]
-	decodedClaimsData, err := crypto.DecryptB64(claimsData)
+	decodedClaimsData, err := base64.RawURLEncoding.DecodeString(claimsData)
 	if err != nil {
-		log.Debug("Failed to decrypt claims data: ", err)
+		log.Debugf("Failed to decrypt claims %s: %s", claimsData, err.Error())
 		return user, fmt.Errorf("failed to decrypt claims data: %s", err.Error())
 	}
-	fmt.Println("=> decoded claims data", decodedClaimsData)
+
+	fmt.Println("=> decodedClaimsData:", string(decodedClaimsData))
 
 	claims := make(map[string]interface{})
-	err = json.Unmarshal([]byte(decodedClaimsData), &claims)
+	err = json.Unmarshal(decodedClaimsData, &claims)
 	if err != nil {
 		log.Debug("Failed to unmarshal claims data: ", err)
 		return user, fmt.Errorf("failed to unmarshal claims data: %s", err.Error())
 	}
 
-	fmt.Println("=> claims", claims)
+	fmt.Println("=> claims:", claims)
 
 	if val, ok := claims["email"]; !ok {
 		log.Debug("Failed to extract email from claims.")
@@ -500,10 +500,15 @@ func processAppleUserInfo(code string) (models.User, error) {
 
 	if val, ok := claims["name"]; ok {
 		nameData := val.(map[string]interface{})
-		givenName := nameData["firstName"].(string)
-		familyName := nameData["lastName"].(string)
-		user.GivenName = &givenName
-		user.FamilyName = &familyName
+		if nameVal, ok := nameData["firstName"]; ok {
+			givenName := nameVal.(string)
+			user.GivenName = &givenName
+		}
+
+		if nameVal, ok := nameData["lastName"]; ok {
+			familyName := nameVal.(string)
+			user.FamilyName = &familyName
+		}
 	}
 
 	return user, err

server/handlers/oauth_login.go

@@ -184,8 +184,9 @@ func OAuthLoginHandler() gin.HandlerFunc {
 				return
 			}
 			oauth.OAuthProviders.AppleConfig.RedirectURL = hostname + "/oauth_callback/" + constants.SignupMethodApple
-			// Scope from the root config was not passed for apple login
-			url := oauth.OAuthProviders.AppleConfig.AuthCodeURL(oauthStateString, oauth2.SetAuthURLParam("response_mode", "form_post"), oauth2.SetAuthURLParam("scope", "name email"))
+			// there is scope encoding issue with oauth2 and how apple expects, hence added scope manually
+			// check: https://github.com/golang/oauth2/issues/449
+			url := oauth.OAuthProviders.AppleConfig.AuthCodeURL(oauthStateString, oauth2.SetAuthURLParam("response_mode", "form_post")) + "&scope=name email"
 			c.Redirect(http.StatusTemporaryRedirect, url)
 		default:
 			log.Debug("Invalid oauth provider: ", provider)