cgi-bin: Port Web Interface OAuth login to device authorization grant

Replace the single-session authorization-code (PKCE) flow in
do_login()/finish_login() with the device authorization grant flow,
following the pattern already used by ippeveprinter's OAuth support
in libcups.

Each browser session tracks its own device grant in a CUPS_DEVGRANT
cookie (the device code, polling interval, etc. as JSON). A request
to "/?LOGIN=Login":

  - with no CUPS_DEVGRANT cookie: requests a new device grant
    (cupsOAuthGetDeviceGrant()) and shows the user code and
    verification URL via a new oauth-login.tmpl template, with a
    meta-refresh timed to the server's requested polling interval.
  - with a pending CUPS_DEVGRANT cookie: makes a single, non-blocking
    cupsOAuthGetTokens() attempt. On success, stores the access token
    in CUPS_BEARER and clears the grant cookie. While still pending
    (authorization_pending/slow_down), the same page is shown again.
    On a hard failure, the grant is discarded so the next visit
    requests a fresh one.

A new grant is only requested on a POST (the existing Login button,
which is protected by the CSRF token), not on the GET requests used
for polling, so a stray GET can't silently start a new authorization
request against the OAuth server.

do_logout() now also clears the CUPS_DEVGRANT cookie and calls
cupsOAuthClearTokens() to clear the server-side token store, in
addition to clearing CUPS_BEARER as before.

Notes for reviewers:
- The old code's CUPS_REFERER/CUPS_REFERRER-based return-to-referrer
  redirect is dropped; the mismatched env var/cookie names meant it
  never actually worked, and login now always redirects to "/".
- cupsOAuthGetDeviceGrant() looks up the client ID under
  CUPS_OAUTH_REDIRECT_URI; a server previously configured only for
  the authorization-code Web Interface flow may need its client ID
  re-registered under that redirect URI.
- Not tested against a live OAuth provider: a local environment TLS
  trust issue (unrelated to this change) prevented HTTPS connections
  to an IdP during development. The device-grant call pattern mirrors
  tools/cups-oauth.c's existing, working usage; manual verification
  against a live IdP before merging is recommended.

Author: abubakarsabir924-cell

cgi-bin/home.c

@@ -21,7 +21,6 @@ static void	do_login(void);
 static void	do_logout(void);
 static void	do_redirect(const char *url);
 static void	do_search(char *query);
-static void	finish_login(void);
 static void	show_error(const char *title, const char *message, const char *error);
 
 
@@ -58,8 +57,6 @@ main(void)
     do_login();
   else if (cgiGetSize("LOGOUT"))
     do_logout();
-  else if (!cgiIsPOST() && (cgiGetSize("code") || cgiGetSize("error")))
-    finish_login();
   else
     do_dashboard();
 
@@ -88,27 +85,17 @@ do_dashboard(void)
 
 
 /*
- * 'do_login()' - Redirect to the OAuth server's authorization endpoint.
+ * 'do_login()' - Start or continue the OAuth device authorization flow.
  */
 
 static void
 do_login(void)
 {
-  const char	*oauth_uri = getenv("CUPS_OAUTH_SERVER"),
-					// OAuth authorization server URL
-		*referer = getenv("HTTP_REFERER"),
-					// Referer: header
-		*server_name = getenv("SERVER_NAME"),
-					// SERVER_NAME value
-		*server_port = getenv("SERVER_PORT"),
-					// SERVER_PORT value
-		*state = NULL;		// State string
-  char		*client_id = NULL,	// Client ID value
-		*code_verifier = NULL,	// Code verifier string
-		*nonce = NULL,		// Nonce string
-		redirect_uri[1024],	// redirect_uri value
-		*url = NULL;		// Authorization URL
-  cups_json_t	*metadata = NULL;	// OAuth metadata
+  const char    *oauth_uri = getenv("CUPS_OAUTH_SERVER");
+                                        // OAuth authorization server URL
+  cups_json_t   *metadata = NULL;      // OAuth metadata
+  const char    *devgrant_cookie;      // CUPS_DEVGRANT cookie value, if any
+  cups_json_t   *devgrant = NULL;      // Device grant JSON, if any
 
 
   fputs("DEBUG2: do_login()\n", stderr);
@@ -120,58 +107,102 @@ do_login(void)
     goto done;
   }
 
-  fprintf(stderr, "DEBUG2: do_login: oauth_uri=\"%s\"\n", oauth_uri);
+  // See if we have a pending device grant...
+  if ((devgrant_cookie = cgiGetCookie("CUPS_DEVGRANT")) != NULL && devgrant_cookie[0])
+    devgrant = cupsJSONImportString(devgrant_cookie);
 
-  // Get the redirect URL...
-  if (!strcmp(server_name, "localhost"))
-    snprintf(redirect_uri, sizeof(redirect_uri), "http://127.0.0.1:%s/", server_port);
-  else
-    snprintf(redirect_uri, sizeof(redirect_uri), "%s://%s:%s/", getenv("HTTPS") ? "https" : "http", server_name, server_port);
+  if (devgrant)
+  {
+    const char  *device_code;          // Device code
 
-  fprintf(stderr, "DEBUG2: do_login: redirect_uri=\"%s\"\n", redirect_uri);
+    if ((device_code = cupsJSONGetString(cupsJSONFind(devgrant, CUPS_ODEVGRANT_DEVICE_CODE))) != NULL)
+    {
+      char      *bearer;                // Access token
+      time_t    access_expires;        // Expiration date
+
+      bearer = cupsOAuthGetTokens(oauth_uri, metadata, NULL, device_code, CUPS_OGRANT_DEVICE_CODE, NULL, &access_expires);
+
+      if (bearer)
+      {
+        // Got a token - save it, clear the grant cookie, and go home...
+        cgiSetCookie("CUPS_DEVGRANT", "", NULL, NULL, time(NULL) - 1, 0);
+        cgiSetCookie("CUPS_BEARER", bearer, NULL, NULL, access_expires, getenv("HTTPS") ? 1 : 0);
+
+        free(bearer);
+
+        do_redirect("/");
+        goto done;
+      }
+      else if (access_expires == 0)
+      {
+        // Hard failure - discard this grant, fall through to request a new one...
+        cupsJSONDelete(devgrant);
+        devgrant = NULL;
+      }
+      // else: still pending ("authorization_pending"/"slow_down") - fall
+      // through to show the same grant again...
+    }
+    else
+    {
+      // Malformed grant JSON - discard and fall through...
+      cupsJSONDelete(devgrant);
+      devgrant = NULL;
+    }
+  }
 
-  // Get the client ID...
-  if ((client_id = cupsOAuthCopyClientId(oauth_uri, redirect_uri)) == NULL)
+  if (!devgrant)
   {
-    // Nothing saved, try to dynamically register one...
-    if ((client_id = cupsOAuthGetClientId(oauth_uri, metadata, redirect_uri, /*logo_uri*/NULL, /*tos_uri*/NULL)) == NULL)
+    char        *temp;                  // JSON string
+
+    if (!cgiIsPOST())
     {
-      // Nope, show an error...
-      show_error(cgiText(_("OAuth Login")), cgiText(_("Unable to get authorization URL")), cgiText(_("No client ID configured for this server.")));
+      // No pending grant, and this wasn't a POST (e.g. a stray GET to
+      // "/?LOGIN=...") - don't silently start a new authorization request
+      // against the OAuth server, just show the dashboard...
+      do_dashboard();
       goto done;
     }
-  }
 
-  fprintf(stderr, "DEBUG2: do_login: client_id=\"%s\"\n", client_id);
+    // Request a new device grant...
+    if ((devgrant = cupsOAuthGetDeviceGrant(oauth_uri, metadata, NULL, getenv("CUPS_OAUTH_SCOPES"))) == NULL)
+    {
+      show_error(cgiText(_("OAuth Login")), cgiText(_("Unable to get authorization URL")), cupsGetErrorString());
+      goto done;
+    }
 
-  // Make state and code verification strings...
-  code_verifier = cupsOAuthMakeBase64Random(128);
-  nonce         = cupsOAuthMakeBase64Random(16);
-  state         = cgiGetCookie(CUPS_SID);
+    if ((temp = cupsJSONExportString(devgrant)) != NULL)
+    {
+      cgiSetCookie("CUPS_DEVGRANT", temp, NULL, NULL, time(NULL) + (time_t)cupsJSONGetNumber(cupsJSONFind(devgrant, CUPS_ODEVGRANT_EXPIRES_IN)), 0);
+      free(temp);
+    }
+  }
 
-  // Get the authorization URL
-  if ((url = cupsOAuthMakeAuthorizationURL(oauth_uri, metadata, /*resource_uri*/NULL, getenv("CUPS_OAUTH_SCOPES"), client_id, code_verifier, nonce, redirect_uri, state)) == NULL)
+  // Show the authorization page...
   {
-    show_error(cgiText(_("OAuth Login")), cgiText(_("Unable to get authorization URL")), cupsGetErrorString());
-    goto done;
-  }
+    const char  *user_code = cupsJSONGetString(cupsJSONFind(devgrant, CUPS_ODEVGRANT_USER_CODE));
+    const char  *verification_uri = cupsJSONGetString(cupsJSONFind(devgrant, CUPS_ODEVGRANT_VERIFICATION_URI));
+    double      interval = cupsJSONGetNumber(cupsJSONFind(devgrant, CUPS_ODEVGRANT_INTERVAL));
+    char        refresh[32];            // Refresh value
+
+    snprintf(refresh, sizeof(refresh), "%d;URL=/?LOGIN=Login", interval > 0.0 ? (int)interval : 5);
+    cgiSetVariable("REFRESH_PAGE", refresh);
 
-  // Redirect...
-  cgiSetCookie("CUPS_OAUTH_STATE", state, /*path*/NULL, /*domain*/NULL, time(NULL) + 300, /*secure*/0);
+    cgiSetVariable("USER_CODE", user_code ? user_code : "");
 
-  if (referer)
-    cgiSetCookie("CUPS_REFERRER", referer, /*path*/NULL, /*domain*/NULL, time(NULL) + 300, /*secure*/0);
+    if (verification_uri && (!strncmp(verification_uri, "http://", 7) || !strncmp(verification_uri, "https://", 8)))
+      cgiSetVariable("VERIFICATION_URI", verification_uri);
+    else
+      cgiSetVariable("VERIFICATION_URI", "");
 
-  do_redirect(url);
+    cgiStartHTML(cgiText(_("Authorize Access")));
+    cgiCopyTemplateLang("oauth-login.tmpl");
+    cgiEndHTML();
+  }
 
   done:
 
-  // Free memory...
-  free(client_id);
-  free(code_verifier);
+  cupsJSONDelete(devgrant);
   cupsJSONDelete(metadata);
-  free(nonce);
-  free(url);
 }
 
 
@@ -182,10 +213,19 @@ do_login(void)
 static void
 do_logout(void)
 {
+  const char    *oauth_uri = getenv("CUPS_OAUTH_SERVER");
+                                        // OAuth authorization server URL
+
   // Clear the CUPS_BEARER cookie...
-  cgiSetCookie("CUPS_BEARER", "", /*path*/NULL, /*domain*/NULL, time(NULL) - 1, /*secure*/0);
+  cgiSetCookie("CUPS_BEARER", "", NULL, NULL, time(NULL) - 1, 0);
 
-  // Redirect back to the referrer...
+  // Clear any pending device grant cookie...
+  cgiSetCookie("CUPS_DEVGRANT", "", NULL, NULL, time(NULL) - 1, 0);
+
+  // Clear the stored OAuth tokens server-side as well...
+  cupsOAuthClearTokens(oauth_uri, NULL);
+
+  // Redirect back to the dashboard...
   do_redirect("/");
 }
 
@@ -231,107 +271,6 @@ do_search(char *query)			/* I - Search string */
 }
 
 
-//
-// 'finish_login()' - Finish OAuth login and then redirect back to the original page.
-//
-
-static void
-finish_login(void)
-{
-  const char	*oauth_uri = getenv("CUPS_OAUTH_SERVER"),
-					// OAuth authorization server URL
-		*referer = getenv("CUPS_REFERER"),
-					// Referring URL
-		*server_name = getenv("SERVER_NAME"),
-					// SERVER_NAME value
-		*server_port = getenv("SERVER_PORT");
-					// SERVER_PORT value
-  char		*bearer = NULL,		// Bearer token
-		*client_id = NULL,	// Client ID value
-		*error,			// Error string
-		redirect_uri[1024];	// redirect_uri value
-  const char	*code;			// Authorization code
-  cups_json_t	*metadata = NULL;	// OAuth metadata
-  time_t	access_expires;		// When the bearer token expires
-  char		scheme[32],		// Referer scheme
-		userpass[256],		// Referer username:password
-		host[256],		// Referer host
-		resource[1024];		// Referer resource
-  int		port;			// Referer port
-
-
-  // Show any error from authorization...
-  if ((error = cgiGetVariable("error_description")) == NULL)
-    error = cgiGetVariable("error");
-
-  if (error)
-  {
-    show_error(cgiText(_("OAuth Login")), cgiText(_("Unable to authorize access")), error);
-    return;
-  }
-
-  // Get the metadata...
-  if ((metadata = cupsOAuthGetMetadata(oauth_uri)) == NULL)
-  {
-    show_error(cgiText(_("OAuth Login")), cgiText(_("Unable to get authorization server information")), cupsGetErrorString());
-    goto done;
-  }
-
-  // Get the redirect URL...
-  if (!server_name || !strcmp(server_name, "localhost"))
-    snprintf(redirect_uri, sizeof(redirect_uri), "http://127.0.0.1%s%s/", server_port ? ":" : "", server_port ? server_port : "");
-  else
-    snprintf(redirect_uri, sizeof(redirect_uri), "%s://%s%s%s/", getenv("HTTPS") ? "https" : "http", server_name, server_port ? ":" : "", server_port ? server_port : "");
-
-  fprintf(stderr, "DEBUG2: finish_login: redirect_uri=\"%s\"\n", redirect_uri);
-
-  // Get the client ID...
-  if ((client_id = cupsOAuthCopyClientId(oauth_uri, redirect_uri)) == NULL)
-  {
-    // Nope, show an error...
-    show_error(cgiText(_("OAuth Login")), cgiText(_("Unable to authorize access")), cgiText(_("No client ID configured for this server.")));
-    goto done;
-  }
-
-  fprintf(stderr, "DEBUG2: finish_login: client_id=\"%s\"\n", client_id);
-
-  // Get the code string...
-  code = cgiGetVariable("code");
-
-  // Get the access token...
-  if ((bearer = cupsOAuthGetTokens(oauth_uri, metadata, /*resource_uri*/NULL, code, CUPS_OGRANT_AUTHORIZATION_CODE, redirect_uri, &access_expires)) == NULL)
-  {
-    show_error(cgiText(_("OAuth Login")), cgiText(_("Unable to authorize access")), cupsGetErrorString());
-    goto done;
-  }
-
-  fprintf(stderr, "DEBUG2: finish_login: access_token=\"%s\", access_expires=%ld\n", bearer, (long)access_expires);
-
-  // Save it as a cookie...
-  cgiSetCookie("CUPS_BEARER", bearer, /*path*/NULL, /*domain*/NULL, access_expires, /*secure*/0);
-
-  // Redirect...
-  if (referer && server_name && server_port)
-  {
-    // Validate refererring URL value - must be http: or https:, use the server
-    // name or localhost addresses, and use the same port...
-    if (httpSeparateURI(HTTP_URI_CODING_ALL, referer, scheme, sizeof(scheme), userpass, sizeof(userpass), host, sizeof(host), &port, resource, sizeof(resource)) < HTTP_URI_STATUS_OK || (strcmp(scheme, "http") && strcmp(scheme, "https")) || (strcasecmp(host, server_name) && strcmp(host, "127.0.0.1") && strcmp(host, "[::1]")) || port != atoi(server_port))
-      referer = NULL;
-  }
-
-  do_redirect(referer ? referer : "/");
-
-  fputs("DEBUG2: finish_login: After redirect.\n", stderr);
-
-  done:
-
-  // Free memory...
-  free(bearer);
-  free(client_id);
-  cupsJSONDelete(metadata);
-}
-
-
 //
 // 'show_error()' - Show an error message.
 //

templates/Makefile

@@ -51,6 +51,7 @@ FILES	=	\
 		modify-class.tmpl \
 		modify-printer.tmpl \
 		norestart.tmpl \
+		oauth-login.tmpl \
 		option-boolean.tmpl \
 		option-conflict.tmpl \
 		option-header.tmpl \

templates/oauth-login.tmpl

@@ -0,0 +1,7 @@
+<H1 CLASS="title">{?title}</H1>
+
+<P>This printer requires authorization for access.</P>
+
+<P>Copy the following code: <STRONG>{?USER_CODE}</STRONG></P>
+
+{?VERIFICATION_URI?<P>Then go to the following URL to authorize access: <A HREF="{VERIFICATION_URI}" TARGET="_blank">{VERIFICATION_URI}</A></P>:<P>Unable to display the authorization URL.</P>}