chore(cloud_federation_api): move jwks

Move from .well-known/jwks.json to the TokenController

Signed-off-by: Micke Nordin <kano@sunet.se>

Author: mickenordin

apps/cloud_federation_api/appinfo/routes.php

@@ -8,6 +8,11 @@
  */
 return [
 	'routes' => [
+		[
+			'name' => 'Token#jwks',
+			'url' => '/api/v1/jwks',
+			'verb' => 'GET',
+		],
 		[
 			'name' => 'RequestHandler#addShare',
 			'url' => '/shares',

apps/cloud_federation_api/lib/Controller/TokenController.php

@@ -18,6 +18,7 @@
 use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
 use OCP\AppFramework\Http\Attribute\PublicPage;
 use OCP\AppFramework\Http\DataResponse;
+use OCP\AppFramework\Http\JSONResponse;
 use OCP\AppFramework\Utility\ITimeFactory;
 use OCP\Authentication\Exceptions\ExpiredTokenException;
 use OCP\Authentication\Exceptions\InvalidTokenException;
@@ -135,6 +136,27 @@ private function resolveJwtSigningKey(string $privateKeyPem): array {
 		throw new \RuntimeException('Unsupported signatory key type for JWT access token');
 	}
 
+	/**
+	 * Serve the local JWK Set
+	 *
+	 * @return JSONResponse<Http::STATUS_OK, array{keys: list<array<string, string>>}, array{}>
+	 *
+	 * 200: JWK Set returned
+	 */
+	#[PublicPage]
+	#[NoCSRFRequired]
+	public function jwks(): JSONResponse {
+		$keys = [];
+		try {
+			foreach ($this->signatoryManager->getLocalJwks() as $jwk) {
+				$keys[] = $jwk;
+			}
+		} catch (\Throwable $e) {
+			$this->logger->warning('failed to build local JWKs', ['exception' => $e]);
+		}
+		return new JSONResponse(['keys' => $keys]);
+	}
+
 	/**
 	 * Exchange a refresh token for a short-lived access token
 	 *

apps/cloud_federation_api/openapi.json

@@ -323,13 +323,13 @@
         }
     },
     "tags": [
-        {
-            "name": "request_handler",
-            "description": "Open-Cloud-Mesh-API"
-        },
         {
             "name": "token",
             "description": "Controller for the /token endpoint Exchanges long-lived refresh tokens for short-lived access tokens"
+        },
+        {
+            "name": "request_handler",
+            "description": "Open-Cloud-Mesh-API"
         }
     ]
 }

core/AppInfo/Application.php

@@ -41,7 +41,6 @@
 use OC\DirectEditing\Listeners\UserDeletedTokenCleanupListener as UserDeletedDirectEditingTokenCleanupListener;
 use OC\DirectEditing\Listeners\UserDisabledTokenCleanupListener as UserDisabledDirectEditingTokenCleanupListener;
 use OC\OCM\OCMDiscoveryHandler;
-use OC\OCM\OCMJwksHandler;
 use OC\TagManager;
 use OCP\AppFramework\App;
 use OCP\AppFramework\Bootstrap\IBootContext;
@@ -113,7 +112,6 @@ public function register(IRegistrationContext $context): void {
 		$context->registerConfigLexicon(ConfigLexicon::class);
 
 		$context->registerWellKnownHandler(OCMDiscoveryHandler::class);
-		$context->registerWellKnownHandler(OCMJwksHandler::class);
 		$context->registerCapability(Capabilities::class);
 
 		$context->registerEventListener(RestrictInteractionEvent::class, RestrictInteractionListener::class);

lib/composer/composer/autoload_classmap.php

@@ -2056,7 +2056,6 @@
     'OC\\OCM\\Model\\OCMResource' => $baseDir . '/lib/private/OCM/Model/OCMResource.php',
     'OC\\OCM\\OCMDiscoveryHandler' => $baseDir . '/lib/private/OCM/OCMDiscoveryHandler.php',
     'OC\\OCM\\OCMDiscoveryService' => $baseDir . '/lib/private/OCM/OCMDiscoveryService.php',
-    'OC\\OCM\\OCMJwksHandler' => $baseDir . '/lib/private/OCM/OCMJwksHandler.php',
     'OC\\OCM\\OCMSignatoryManager' => $baseDir . '/lib/private/OCM/OCMSignatoryManager.php',
     'OC\\OCM\\Rfc9421SignatoryManager' => $baseDir . '/lib/private/OCM/Rfc9421SignatoryManager.php',
     'OC\\OCS\\ApiHelper' => $baseDir . '/lib/private/OCS/ApiHelper.php',

lib/composer/composer/autoload_static.php

@@ -2097,7 +2097,6 @@ class ComposerStaticInit749170dad3f5e7f9ca158f5a9f04f6a2
         'OC\\OCM\\Model\\OCMResource' => __DIR__ . '/../../..' . '/lib/private/OCM/Model/OCMResource.php',
         'OC\\OCM\\OCMDiscoveryHandler' => __DIR__ . '/../../..' . '/lib/private/OCM/OCMDiscoveryHandler.php',
         'OC\\OCM\\OCMDiscoveryService' => __DIR__ . '/../../..' . '/lib/private/OCM/OCMDiscoveryService.php',
-        'OC\\OCM\\OCMJwksHandler' => __DIR__ . '/../../..' . '/lib/private/OCM/OCMJwksHandler.php',
         'OC\\OCM\\OCMSignatoryManager' => __DIR__ . '/../../..' . '/lib/private/OCM/OCMSignatoryManager.php',
         'OC\\OCM\\Rfc9421SignatoryManager' => __DIR__ . '/../../..' . '/lib/private/OCM/Rfc9421SignatoryManager.php',
         'OC\\OCS\\ApiHelper' => __DIR__ . '/../../..' . '/lib/private/OCS/ApiHelper.php',

lib/private/OCM/OCMJwksHandler.php

@@ -375,14 +375,9 @@ private function signatoryFromPool(int $poolId): ?Signatory {
 		return $signatory;
 	}
 
-	/**
-	 * Absolute URL of the local JWK Set, advertised as `jwksUri` in the
-	 * discovery response.
-	 *
-	 * @throws IdentityNotFoundException
-	 */
+	/** Absolute URL of the local JWK Set, advertised as `jwksUri`. */
 	public function getLocalJwksUri(): string {
-		return $this->buildLocalUrl('/.well-known/jwks.json');
+		return $this->urlGenerator->linkToRouteAbsolute('cloud_federation_api.Token.jwks');
 	}
 
 	/**

lib/private/OCM/OCMSignatoryManager.php

@@ -47,7 +47,7 @@ class Rfc9421IncomingSignedRequest extends SignedRequest implements
 	 * The `Date` header is deliberately not part of the required set:
 	 * freshness is anchored on the `created` signature parameter.
 	 */
-	private const DEFAULT_REQUIRED_COMPONENTS = [
+	public const REQUIRED_COMPONENTS = [
 		'@method',
 		'@target-uri',
 		'content-digest',
@@ -244,7 +244,7 @@ public function verify(): void {
 	/** @throws IncomingRequestException if the signature doesn't cover the OCM-required components */
 	private function verifyRequiredComponents(): void {
 		/** @var list<string> $required */
-		$required = $this->options['rfc9421.requiredComponents'] ?? self::DEFAULT_REQUIRED_COMPONENTS;
+		$required = $this->options['rfc9421.requiredComponents'] ?? self::REQUIRED_COMPONENTS;
 		$missing = array_values(array_diff($required, $this->components));
 		if ($missing !== []) {
 			throw new IncomingRequestException(

lib/private/Security/Signature/Model/Rfc9421IncomingSignedRequest.php

@@ -35,12 +35,6 @@
 class Rfc9421OutgoingSignedRequest extends SignedRequest implements
 	IOutgoingSignedRequest,
 	JsonSerializable {
-	/**
-	 * Covered components mandated by the OCM spec. The `Date` header is
-	 * deliberately not covered: intermediaries may rewrite it, and freshness
-	 * is anchored on the `created` signature parameter.
-	 */
-	private const DEFAULT_COMPONENTS = ['@method', '@target-uri', 'content-digest', 'content-length'];
 
 	private string $host = '';
 	private array $headers = [];
@@ -70,7 +64,7 @@ public function __construct(
 		$this->signingAlgorithm = (string)($options['rfc9421.signingAlgorithm'] ?? 'ecdsa-p256-sha256');
 		$contentDigestAlgorithm = (string)($options['rfc9421.contentDigestAlgorithm'] ?? ContentDigest::ALGO_SHA256);
 		/** @var list<string> $components */
-		$components = $options['rfc9421.coveredComponents'] ?? self::DEFAULT_COMPONENTS;
+		$components = $options['rfc9421.coveredComponents'] ?? Rfc9421IncomingSignedRequest::REQUIRED_COMPONENTS;
 		$includeAlg = (bool)($options['rfc9421.includeAlgParameter'] ?? false);
 		$dateHeaderFormat = (string)($options['dateHeader'] ?? SignatureManager::DATE_HEADER);