feat(revoke-token): encrypt login id token in session db row

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

Author: julien-nc

lib/Db/SessionMapper.php

@@ -16,12 +16,16 @@
 use OCP\DB\QueryBuilder\IQueryBuilder;
 
 use OCP\IDBConnection;
+use OCP\Security\ICrypto;
 
 /**
  * @extends QBMapper<Session>
  */
 class SessionMapper extends QBMapper {
-	public function __construct(IDBConnection $db) {
+	public function __construct(
+		IDBConnection $db,
+		private ICrypto $crypto,
+	) {
 		parent::__construct($db, 'user_oidc_sessions', Session::class);
 	}
 
@@ -154,7 +158,7 @@ public function createSession(
 		$session->setAuthtokenId($authtokenId);
 		$session->setNcSessionId($ncSessionid);
 		$session->setCreatedAt($createdAt);
-		$session->setIdToken($idToken);
+		$session->setIdToken($this->crypto->encrypt($idToken));
 		$session->setUserId($userId);
 		$session->setProviderId($providerId);
 		$session->setIdpSessionClosed($idpSessionClosed ? 1 : 0);

lib/Listener/TokenInvalidatedListener.php

@@ -20,6 +20,7 @@
 use OCP\EventDispatcher\Event;
 use OCP\EventDispatcher\IEventListener;
 use OCP\IURLGenerator;
+use OCP\Security\ICrypto;
 use Psr\Log\LoggerInterface;
 
 /**
@@ -34,6 +35,7 @@ public function __construct(
 		private DiscoveryService $discoveryService,
 		private IURLGenerator $urlGenerator,
 		private HttpClientHelper $httpClientHelper,
+		private ICrypto $crypto,
 	) {
 	}
 
@@ -98,9 +100,15 @@ public function handle(Event $event): void {
 			return;
 		}
 
+		try {
+			$decryptedIdToken = $this->crypto->decrypt($oidcSession->getIdToken());
+		} catch (\Exception $e) {
+			$this->logger->warning('[TokenInvalidatedListener] Could not decrpyt the login id token of a session related with an invalidated token', ['exception' => $e]);
+			return;
+		}
 		$endSessionEndpoint .= '?post_logout_redirect_uri=' . $this->urlGenerator->getAbsoluteURL('/');
 		$endSessionEndpoint .= '&client_id=' . $provider->getClientId();
-		$endSessionEndpoint .= '&id_token_hint=' . $oidcSession->getIdToken();
+		$endSessionEndpoint .= '&id_token_hint=' . $decryptedIdToken;
 
 		$this->logger->warning('[TokenInvalidatedListener] requesting ' . $endSessionEndpoint);
 		try {