001/*
002 * oauth2-oidc-sdk
003 *
004 * Copyright 2012-2021, Connect2id Ltd and contributors.
005 *
006 * Licensed under the Apache License, Version 2.0 (the "License"); you may not use
007 * this file except in compliance with the License. You may obtain a copy of the
008 * License at
009 *
010 *    http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing, software distributed
013 * under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
014 * CONDITIONS OF ANY KIND, either express or implied. See the License for the
015 * specific language governing permissions and limitations under the License.
016 */
017
018package com.nimbusds.oauth2.sdk.ciba;
019
020
021import java.net.URI;
022
023import net.jcip.annotations.Immutable;
024import net.minidev.json.JSONObject;
025
026import com.nimbusds.common.contenttype.ContentType;
027import com.nimbusds.oauth2.sdk.ParseException;
028import com.nimbusds.oauth2.sdk.http.HTTPRequest;
029import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
030import com.nimbusds.oauth2.sdk.token.Tokens;
031import com.nimbusds.oauth2.sdk.util.JSONObjectUtils;
032import com.nimbusds.openid.connect.sdk.token.OIDCTokens;
033
034
035/**
036 * CIBA token push delivery to the client notification endpoint.
037 *
038 * <p>Example HTTP request:
039 *
040 * <pre>
041 * POST /cb HTTP/1.1
042 * Host: client.example.com
043 * Authorization: Bearer 8d67dc78-7faa-4d41-aabd-67707b374255
044 * Content-Type: application/json
045 *
046 * {
047 *   "auth_req_id": "1c266114-a1be-4252-8ad1-04986c5b9ac1",
048 *   "access_token": "G5kXH2wHvUra0sHlDy1iTkDJgsgUO1bN",
049 *   "token_type": "Bearer",
050 *   "refresh_token": "4bwc0ESC_IAhflf-ACC_vjD_ltc11ne-8gFPfA2Kx16",
051 *   "expires_in": 120,
052 *   "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjE2NzcyNiJ9.eyJpc3MiOiJ
053 *     odHRwczovL3NlcnZlci5leGFtcGxlLmNvbSIsInN1YiI6IjI0ODI4OTc2MTAwMS
054 *     IsImF1ZCI6InM2QmhkUmtxdDMiLCJlbWFpbCI6ImphbmVkb2VAZXhhbXBsZS5jb
055 *     20iLCJleHAiOjE1Mzc4MTk4MDMsImlhdCI6MTUzNzgxOTUwMywiYXRfaGFzaCI6
056 *     Ild0MGtWRlhNYWNxdm5IZXlVMDAwMXciLCJ1cm46b3BlbmlkOnBhcmFtczpqd3Q
057 *     6Y2xhaW06cnRfaGFzaCI6InNIYWhDdVNwWENSZzVta0REdnZyNHciLCJ1cm46b3
058 *     BlbmlkOnBhcmFtczpqd3Q6Y2xhaW06YXV0aF9yZXFfaWQiOiIxYzI2NjExNC1hM
059 *     WJlLTQyNTItOGFkMS0wNDk4NmM1YjlhYzEifQ.SGB5_a8E7GjwtoYrkFyqOhLK6
060 *     L8-Wh1nLeREwWj30gNYOZW_ZB2mOeQ5yiXqeKJeNpDPssGUrNo-3N-CqNrbmVCb
061 *     XYTwmNB7IvwE6ZPRcfxFV22oou-NS4-3rEa2ghG44Fi9D9fVURwxrRqgyezeD3H
062 *     HVIFUnCxHUou3OOpj6aOgDqKI4Xl2xJ0-kKAxNR8LljUp64OHgoS-UO3qyfOwIk
063 *     IAR7o4OTK_3Oy78rJNT0Y0RebAWyA81UDCSf_gWVBp-EUTI5CdZ1_odYhwB9OWD
064 *     W1A22Sf6rmjhMHGbQW4A9Z822yiZZveuT_AFZ2hi7yNp8iFPZ8fgPQJ5pPpjA7u
065 *     dg"
066 * }
067 * </pre>
068 *
069 * <p>Related specifications:
070 *
071 * <ul>
072 *      <li>OpenID Connect CIBA Flow - Core 1.0, section 10.3.1.
073 * </ul>
074 */
075@Immutable
076public class CIBATokenDelivery extends CIBAPushCallback {
077        
078        
079        /**
080         * The tokens.
081         */
082        private final Tokens tokens;
083        
084        
085        /**
086         * Creates a new CIBA push token delivery for OAuth 2.0.
087         *
088         * @param endpoint      The client notification endpoint. Must not be
089         *                      {@code null}.
090         * @param accessToken   The client notification token. Must not be
091         *                      {@code null}.
092         * @param authRequestID The CIBA request ID. Must not be {@code null}.
093         * @param tokens        The OAuth 2.0 tokens to deliver. Must not be
094         *                      {@code null}.
095         */
096        public CIBATokenDelivery(final URI endpoint,
097                                 final BearerAccessToken accessToken,
098                                 final AuthRequestID authRequestID,
099                                 final Tokens tokens) {
100                
101                super(endpoint, accessToken, authRequestID);
102                
103                if (tokens == null) {
104                        throw new IllegalArgumentException("The tokens must not be null");
105                }
106                this.tokens = tokens;
107        }
108        
109        
110        /**
111         * Creates a new CIBA push token delivery for OpenID Connect.
112         *
113         * @param endpoint      The client notification endpoint. Must not be
114         *                      {@code null}.
115         * @param accessToken   The client notification token. Must not be
116         *                      {@code null}.
117         * @param authRequestID The CIBA request ID. Must not be {@code null}.
118         * @param oidcTokens    The OpenID Connect tokens to deliver. Must not
119         *                      be {@code null}.
120         */
121        public CIBATokenDelivery(final URI endpoint,
122                                 final BearerAccessToken accessToken,
123                                 final AuthRequestID authRequestID,
124                                 final OIDCTokens oidcTokens) {
125                
126                super(endpoint, accessToken, authRequestID);
127                
128                if (oidcTokens == null) {
129                        throw new IllegalArgumentException("The OpenID Connect tokens must not be null");
130                }
131                this.tokens = oidcTokens;
132        }
133        
134        
135        @Override
136        public boolean indicatesSuccess() {
137                
138                return true;
139        }
140        
141        
142        /**
143         * Returns the OAuth 2.0 tokens.
144         *
145         * @return The tokens.
146         */
147        public Tokens getTokens() {
148                
149                return tokens;
150        }
151        
152        
153        /**
154         * Returns the OpenID Connect tokens if present.
155         *
156         * @return The OpenID Connect tokens, {@code null} if none.
157         */
158        public OIDCTokens getOIDCTokens() {
159                
160                return getTokens() instanceof OIDCTokens ? getTokens().toOIDCTokens() : null;
161        }
162        
163        
164        @Override
165        public HTTPRequest toHTTPRequest() {
166                
167                HTTPRequest httpRequest = new HTTPRequest(HTTPRequest.Method.POST, getEndpointURI());
168                httpRequest.setAuthorization(getAccessToken().toAuthorizationHeader());
169                httpRequest.setEntityContentType(ContentType.APPLICATION_JSON);
170                JSONObject jsonObject = new JSONObject();
171                jsonObject.put("auth_req_id", getAuthRequestID().getValue());
172                jsonObject.putAll(getTokens().toJSONObject());
173                httpRequest.setQuery(jsonObject.toJSONString());
174                return httpRequest;
175        }
176        
177        
178        /**
179         * Parses a CIBA push token delivery from the specified HTTP request.
180         *
181         * @param httpRequest The HTTP request. Must not be {@code null}.
182         *
183         * @return The CIBA push token delivery.
184         *
185         * @throws ParseException If parsing failed.
186         */
187        public static CIBATokenDelivery parse(final HTTPRequest httpRequest)
188                throws ParseException {
189                
190                URI uri = httpRequest.getURI();
191                httpRequest.ensureMethod(HTTPRequest.Method.POST);
192                httpRequest.ensureEntityContentType(ContentType.APPLICATION_JSON);
193                
194                BearerAccessToken clientNotificationToken = BearerAccessToken.parse(httpRequest);
195                
196                AuthRequestID authRequestID = new AuthRequestID(
197                        JSONObjectUtils.getString(
198                                httpRequest.getQueryAsJSONObject(),
199                                "auth_req_id"));
200                
201                JSONObject jsonObject = httpRequest.getQueryAsJSONObject();
202                
203                if (jsonObject.get("id_token") != null) {
204                        return new CIBATokenDelivery(
205                                uri,
206                                clientNotificationToken,
207                                authRequestID,
208                                OIDCTokens.parse(jsonObject));
209                } else {
210                        return new CIBATokenDelivery(
211                                uri,
212                                clientNotificationToken,
213                                authRequestID,
214                                Tokens.parse(jsonObject));
215                }
216        }
217}