core/Zotlabs/Module/Magic.php

<?php
namespace Zotlabs\Module;

use App;
use Zotlabs\Web\Controller;
use Zotlabs\Web\HTTPSig;
use Zotlabs\Lib\Libzot;
use Zotlabs\Lib\SConfig;
use GuzzleHttp\Psr7\Request;
use HttpSignature\HttpMessageSigner;

class Magic extends Controller {

	function init() {

		logger('mod_magic: invoked', LOGGER_DEBUG);

		if ($_SERVER['REQUEST_METHOD'] === 'POST') {
			$data = $_POST;
		} elseif ($_SERVER['REQUEST_METHOD'] === 'GET') {
			$data = $_GET;
		} else {
			http_status_exit(405, 'Method Not Allowed');
		}

		logger('request method: ' . print_r($_SERVER['REQUEST_METHOD'], true), LOGGER_DATA);
		logger('args: ' . print_r($data, true), LOGGER_DATA);

		$bdest    = $data['bdest'] ?? '';
		$owa      = $data['owa'] ?? 0;
		$delegate = $data['delegate'] ?? '';

		// bdest is preferred as it is hex-encoded and can survive url rewrite and argument parsing

		if (!$bdest) {
			http_status_exit(400, 'Bad Request');
		}

		$dest = hex2bin($bdest);
		$parsed = parse_url($dest);

		if (!$parsed) {
			http_status_exit(400, 'Bad Request');
		}

		$basepath = unparse_url($parsed, ['scheme', 'host', 'port']);

		$owapath = SConfig::get($basepath, 'system', 'openwebauth', $basepath . '/owa');

		// This is ready-made for a plugin that provides a blacklist or "ask me" before blindly authenticating.
		// By default, we'll proceed without asking.

		$arr = [
			'channel_id'  => local_channel(),
			'destination' => $dest,
			'proceed'     => true
		];

		call_hooks('magic_auth',$arr);

		$dest = $arr['destination'];

		if (!$arr['proceed']) {
			goaway($dest);
		}

		if (get_observer_hash() && str_starts_with($dest, z_root())) {

			// We are already authenticated on this site and a registered observer.
			// First check if this is a delegate request on the local system and process accordingly.
			// Otherwise redirect.

			if ($delegate) {

				$r = q("select * from channel left join hubloc on channel_hash = hubloc_hash where hubloc_addr = '%s' limit 1",
					dbesc($delegate)
				);

				if ($r) {
					$c = array_shift($r);
					if (perm_is_allowed($c['channel_id'],get_observer_hash(),'delegate')) {
						$tmp = $_SESSION;
						$_SESSION['delegate_push']    = $tmp;
						$_SESSION['delegate_channel'] = $c['channel_id'];
						$_SESSION['delegate']         = get_observer_hash();
						$_SESSION['account_id']       = intval($c['channel_account_id']);

						change_channel($c['channel_id']);
					}
				}
			}

			goaway($dest);
		}

		if (local_channel()) {
			$channel = App::get_channel();

			// OpenWebAuth

			if ($owa) {

				$dest = strip_zids($dest);
				$dest = strip_query_param($dest,'f');

				// try RFC9421 first

				$request = new Request(
					'GET',
					$owapath,
					[
						'Host' => $parsed['host'],
						'Date' => gmdate('D, d M Y H:i:s T'),
						'Accept' => 'application/x-zot+json',
						'X-Open-Web-Auth' => random_string(),
					],
				);

				$signer = new HttpMessageSigner();

				$signer->setPrivateKey($channel['channel_prvkey']);
				$signer->setAlgorithm('rsa-v1_5-sha256');
				$signer->setKeyId(channel_url($channel));
				$signer->setCreated(time());
				$signer->setExpires(time() + 3600);

				$coveredFields = '("@method" "@target-uri" "host" "date" "accept" "x-open-web-auth")';
				$request = $signer->signRequest($coveredFields, $request);
				$signedHeaders = $signer->getHeaders($request);

				$curlHeaders = [];
				foreach ($signedHeaders as $key => $value) {
					$curlHeaders[] = $key . ': ' . $value;
				}

				$redirects = 0;
				$x = z_fetch_url($owapath, false, $redirects,  ['headers' => $curlHeaders]);
				logger('owa RFC9421 fetch returned: ' . print_r($x,true),LOGGER_DATA);

				$rfc9421 = false;

				if ($x['success']) {
					$rfc9421_result = json_decode($x['body'], true);
					$rfc9421 = $rfc9421_result['success'];
				}

				if (!$rfc9421 || ($x['return_code'] >= 400 && $x['return_code'] != 404)) {
					$headers = [];
					$headers['Accept'] = 'application/x-zot+json' ;
					$headers['Content-Type'] = 'application/x-zot+json' ;
					$headers['X-Open-Web-Auth'] = random_string();
					$headers['Host'] = $parsed['host'];
					$headers['(request-target)'] = 'get /owa';

					$headers = HTTPSig::create_sig($headers,$channel['channel_prvkey'], channel_url($channel),true,'sha512');
					$redirects = 0;

					$x = z_fetch_url($owapath, false, $redirects, ['headers' => $headers]);
					logger('owa fetch returned: ' . print_r($x,true),LOGGER_DATA);
				}

				if ($x['success']) {
					$j = json_decode($x['body'],true);

					if ($j['success'] && $j['encrypted_token']) {
						// decrypt the token using our private key
						$token = '';
						openssl_private_decrypt(base64url_decode($j['encrypted_token']), $token, $channel['channel_prvkey']);
						$x = strpbrk($dest,'?&');
						// redirect using the encrypted token which will be exchanged for an authenticated session
						$args = (($x) ? '&owt=' . $token : '?owt=' . $token) . (($delegate) ? '&delegate=1' : '');
						goaway($dest . $args);
					}
					else {
						$o = '<h1>OWA ERROR</h1>';
						if (!empty($j['message'])) {
							$o .= '<h2>' . $j['message'] . '</h2>';
						}
						$o .= '<a href=' . $dest . '>' . $dest . '</a>';

						echo $o;
						killme();
					}
				}
			}
		}

		goaway($dest);

	}

}