feat: userinfo, pkce and improved route handling (navikt#130)

* new endpoint `/userinfo` returning claims from token in Authorization header
* support for PKCE validation when included in auth and token request (fixes navikt#36)
* improved http route handling API using builder pattern
* support 405 method not allowed for routes (in place of always returning 404) (fixes navikt#98)
* refactoring due to new route handling API
* refactor `DebuggerRequestHandler` 
* **breaking**: removed `OAuth2HttpRouter` and `OAuth2HttpRouter.routes(vararg route: Route): OAuth2HttpRouter`:
  * Replaced by `fun routes(vararg route: Route): Route`  and `fun routes(config: Route.Builder.() -> Unit): Route`

Author: tommytroen

src/main/kotlin/no/nav/security/mock/oauth2/MockOAuth2Server.kt

@@ -11,30 +11,30 @@ import com.nimbusds.oauth2.sdk.TokenRequest
 import com.nimbusds.oauth2.sdk.auth.ClientSecretBasic
 import com.nimbusds.oauth2.sdk.auth.Secret
 import com.nimbusds.oauth2.sdk.id.ClientID
-import java.io.IOException
-import java.net.InetAddress
-import java.net.URI
-import java.time.Duration
-import java.util.UUID
-import java.util.concurrent.TimeUnit
 import mu.KotlinLogging
 import no.nav.security.mock.oauth2.extensions.toAuthorizationEndpointUrl
 import no.nav.security.mock.oauth2.extensions.toEndSessionEndpointUrl
 import no.nav.security.mock.oauth2.extensions.toJwksUrl
 import no.nav.security.mock.oauth2.extensions.toOAuth2AuthorizationServerMetadataUrl
 import no.nav.security.mock.oauth2.extensions.toTokenEndpointUrl
+import no.nav.security.mock.oauth2.extensions.toUserInfoUrl
 import no.nav.security.mock.oauth2.extensions.toWellKnownUrl
 import no.nav.security.mock.oauth2.http.MockWebServerWrapper
 import no.nav.security.mock.oauth2.http.OAuth2HttpRequestHandler
-import no.nav.security.mock.oauth2.http.OAuth2HttpRouter
-import no.nav.security.mock.oauth2.http.OAuth2HttpRouter.Companion.routes
+import no.nav.security.mock.oauth2.http.RequestHandler
 import no.nav.security.mock.oauth2.http.Route
-import no.nav.security.mock.oauth2.http.route
+import no.nav.security.mock.oauth2.http.routes
 import no.nav.security.mock.oauth2.token.DefaultOAuth2TokenCallback
 import no.nav.security.mock.oauth2.token.OAuth2TokenCallback
 import okhttp3.HttpUrl
 import okhttp3.mockwebserver.MockResponse
 import okhttp3.mockwebserver.RecordedRequest
+import java.io.IOException
+import java.net.InetAddress
+import java.net.URI
+import java.time.Duration
+import java.util.UUID
+import java.util.concurrent.TimeUnit
 
 private val log = KotlinLogging.logger { }
 
@@ -47,11 +47,9 @@ open class MockOAuth2Server(
 
     private val httpServer = config.httpServer
     private val defaultRequestHandler: OAuth2HttpRequestHandler = OAuth2HttpRequestHandler(config)
-    private val router: OAuth2HttpRouter = routes(
+    private val router: RequestHandler = routes(
         *additionalRoutes,
-        route("") {
-            defaultRequestHandler.handleRequest(it)
-        }
+        defaultRequestHandler.authorizationServer
     )
 
     @JvmOverloads
@@ -91,6 +89,7 @@ open class MockOAuth2Server(
     fun issuerUrl(issuerId: String): HttpUrl = url(issuerId)
     fun authorizationEndpointUrl(issuerId: String): HttpUrl = url(issuerId).toAuthorizationEndpointUrl()
     fun endSessionEndpointUrl(issuerId: String): HttpUrl = url(issuerId).toEndSessionEndpointUrl()
+    fun userInfoUrl(issuerId: String): HttpUrl = url(issuerId).toUserInfoUrl()
     fun baseUrl(): HttpUrl = url("")
 
     fun issueToken(issuerId: String, clientId: String, tokenCallback: OAuth2TokenCallback): SignedJWT {

src/main/kotlin/no/nav/security/mock/oauth2/OAuth2Exception.kt

@@ -13,7 +13,16 @@ class OAuth2Exception(val errorObject: ErrorObject?, msg: String, throwable: Thr
     constructor(errorObject: ErrorObject?, msg: String) : this(errorObject, msg, null)
 }
 
-fun missingParameter(name: String): Nothing = throw OAuth2Exception(OAuth2Error.INVALID_REQUEST, "missing required parameter $name")
-fun invalidGrant(grantType: GrantType): Nothing = throw OAuth2Exception(OAuth2Error.INVALID_GRANT, "grant_type $grantType not supported.")
-fun invalidRequest(message: String): Nothing = throw OAuth2Exception(OAuth2Error.INVALID_REQUEST, message)
+fun missingParameter(name: String): Nothing = "missing required parameter $name".let {
+    throw OAuth2Exception(OAuth2Error.INVALID_REQUEST.setDescription(it), it)
+}
+
+fun invalidGrant(grantType: GrantType): Nothing = "grant_type $grantType not supported.".let {
+    throw OAuth2Exception(OAuth2Error.INVALID_GRANT, it)
+}
+
+fun invalidRequest(message: String): Nothing = message.let {
+    throw OAuth2Exception(OAuth2Error.INVALID_REQUEST, message)
+}
+
 fun notFound(message: String): Nothing = throw OAuth2Exception(ErrorObject("not_found", "Resource not found", HTTPResponse.SC_NOT_FOUND), message)

src/main/kotlin/no/nav/security/mock/oauth2/debugger/Client.kt

@@ -0,0 +1,80 @@
+package no.nav.security.mock.oauth2.debugger
+
+import com.nimbusds.oauth2.sdk.OAuth2Error
+import no.nav.security.mock.oauth2.OAuth2Exception
+import okhttp3.Credentials
+import okhttp3.Headers
+import okhttp3.HttpUrl
+import okhttp3.MediaType.Companion.toMediaType
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.RequestBody.Companion.toRequestBody
+import okhttp3.internal.toHostHeader
+import java.net.URLEncoder
+import java.nio.charset.StandardCharsets
+
+internal class TokenRequest(
+    val url: HttpUrl,
+    clientAuthentication: ClientAuthentication,
+    parameters: Map<String, String>
+) {
+    val headers = when (clientAuthentication.clientAuthMethod) {
+        ClientAuthentication.Method.CLIENT_SECRET_BASIC -> Headers.headersOf("Authorization", clientAuthentication.basic())
+        else -> Headers.headersOf()
+    }
+
+    val body: String = if (clientAuthentication.clientAuthMethod == ClientAuthentication.Method.CLIENT_SECRET_POST) {
+        parameters.toKeyValueString("&").plus("&${clientAuthentication.form()}")
+    } else {
+        parameters.toKeyValueString("&")
+    }
+
+    override fun toString(): String = "POST ${url.encodedPath} HTTP/1.1\n" +
+        "Host: ${url.toHostHeader(true)}\n" +
+        "Content-Type: application/x-www-form-urlencoded\n" +
+        headers.joinToString("\n") {
+            "${it.first}: ${it.second}"
+        } +
+        "\n\n$body"
+
+    private fun Map<String, String>.toKeyValueString(entrySeparator: String): String =
+        this.map { "${it.key}=${it.value}" }
+            .toList().joinToString(entrySeparator)
+}
+
+internal data class ClientAuthentication(
+    val clientId: String,
+    val clientSecret: String,
+    val clientAuthMethod: Method
+) {
+    fun form(): String = "client_id=${clientId.urlEncode()}&client_secret=${clientSecret.urlEncode()}"
+    fun basic(): String = Credentials.basic(clientId, clientSecret, StandardCharsets.UTF_8)
+
+    companion object {
+        fun fromMap(map: Map<String, String>): ClientAuthentication =
+            ClientAuthentication(
+                map.require("client_id"),
+                map.require("client_secret"),
+                Method.valueOf(map.require("client_auth_method"))
+            )
+
+        private fun Map<String, String>.require(key: String): String =
+            this[key] ?: throw OAuth2Exception(OAuth2Error.INVALID_REQUEST, "missing required parameter $key")
+    }
+
+    enum class Method {
+        CLIENT_SECRET_POST,
+        CLIENT_SECRET_BASIC
+    }
+}
+
+internal fun String.urlEncode(): String = URLEncoder.encode(this, StandardCharsets.UTF_8)
+
+internal fun OkHttpClient.post(tokenRequest: TokenRequest): String =
+    this.newCall(
+        Request.Builder()
+            .headers(tokenRequest.headers)
+            .url(tokenRequest.url)
+            .post(tokenRequest.body.toRequestBody("application/x-www-form-urlencoded".toMediaType()))
+            .build()
+    ).execute().body?.string() ?: throw RuntimeException("could not get responsebody from url=${tokenRequest.url}")