Method verifyConsent

consent/strategy_default.go:619–664

(ctx context.Context, _ http.ResponseWriter, r *http.Request, verifier string)

}

func (s *defaultStrategy) verifyConsent(ctx context.Context, _ http.ResponseWriter, r *http.Request, verifier string) (_ *flow.Flow, err error) {
	ctx, span := trace.SpanFromContext(ctx).TracerProvider().Tracer("").Start(ctx, "DefaultStrategy.verifyConsent")
	defer otelx.End(span, &err)

	f, err := flow.DecodeAndInvalidateConsentVerifier(ctx, s.r, verifier)
	if errors.Is(err, sqlcon.ErrNoRows) {
		return nil, errors.WithStack(fosite.ErrAccessDenied.WithHint("The consent verifier has already been used, has not been granted, or is invalid."))
	} else if err != nil {
		return nil, err
	} else if f.Client.GetID() != r.URL.Query().Get("client_id") {
		return nil, errors.WithStack(fosite.ErrInvalidClient.WithHint("The flow client id does not match the authorize request client id."))
	}

	if f.ConsentError.IsError() {
		f.ConsentError.SetDefaults(flow.ConsentRequestDeniedErrorName)
		return nil, errors.WithStack(f.ConsentError.ToRFCError())
	}

	if err := s.r.ConsentManager().CreateConsentSession(ctx, f); errors.Is(err, sqlcon.ErrUniqueViolation) {
		return nil, errors.WithStack(fosite.ErrAccessDenied.WithHint("The consent verifier has already been used."))
	} else if errors.Is(err, sqlcon.ErrNoRows) {
		return nil, errors.WithStack(fosite.ErrAccessDenied.WithHint("The consent verifier has already been used, has not been granted, or is invalid."))
	} else if err != nil {
		return nil, err
	}

	store, err := s.r.CookieStore(ctx)
	if err != nil {
		return nil, err
	}

	clientSpecificCookieNameConsentCSRF := fmt.Sprintf("%s_%s", s.r.Config().CookieNameConsentCSRF(ctx), f.Client.CookieSuffix())
	if err := validateCSRFCookie(ctx, r, s.r.Config(), store, clientSpecificCookieNameConsentCSRF, f.ConsentCSRF.String()); err != nil {
		return nil, err
	}

	if f.SessionAccessToken == nil {
		f.SessionAccessToken = map[string]interface{}{}
	}

	if f.SessionIDToken == nil {
		f.SessionIDToken = map[string]interface{}{}
	}

	return f, nil
}

func (s *defaultStrategy) generateFrontChannelLogoutURLs(ctx context.Context, subject, sid string) ([]string, error) {
	clients, err := s.r.ConsentManager().ListUserAuthenticatedClientsWithFrontChannelLogout(ctx, subject, sid)