| 38 | ) |
| 39 | |
| 40 | func verifyToken(ctx context.Context, token string, _ *http.Request) (*auth.TokenInfo, error) { |
| 41 | data := url.Values{} |
| 42 | data.Set("token", token) |
| 43 | data.Set("token_type_hint", "access_token") |
| 44 | |
| 45 | req, err := http.NewRequestWithContext(ctx, "POST", introspectionEndpoint, strings.NewReader(data.Encode())) |
| 46 | if err != nil { |
| 47 | return nil, err |
| 48 | } |
| 49 | req.Header.Set("Content-Type", "application/x-www-form-urlencoded") |
| 50 | req.Header.Set("Accept", "application/json") |
| 51 | req.SetBasicAuth(clientID, clientSecret) |
| 52 | |
| 53 | resp, err := http.DefaultClient.Do(req) |
| 54 | if err != nil { |
| 55 | return nil, err |
| 56 | } |
| 57 | defer resp.Body.Close() |
| 58 | |
| 59 | if resp.StatusCode != http.StatusOK { |
| 60 | dump, _ := httputil.DumpResponse(resp, true) |
| 61 | log.Printf("Introspection failed: %s", dump) |
| 62 | return nil, fmt.Errorf("introspection failed with status %d", resp.StatusCode) |
| 63 | } |
| 64 | |
| 65 | var result struct { |
| 66 | Active bool `json:"active"` |
| 67 | Scope string `json:"scope"` |
| 68 | Exp int64 `json:"exp"` |
| 69 | Sub string `json:"sub"` |
| 70 | } |
| 71 | if err := json.NewDecoder(resp.Body).Decode(&result); err != nil { |
| 72 | return nil, err |
| 73 | } |
| 74 | |
| 75 | if !result.Active { |
| 76 | return nil, auth.ErrInvalidToken |
| 77 | } |
| 78 | |
| 79 | return &auth.TokenInfo{ |
| 80 | Scopes: strings.Fields(result.Scope), |
| 81 | Expiration: time.Unix(result.Exp, 0), |
| 82 | UserID: result.Sub, |
| 83 | }, nil |
| 84 | } |
| 85 | |
| 86 | type args struct { |
| 87 | Input string `json:"input"` |