Authentication

import base64
import hashlib
import secrets

verifier = base64.urlsafe_b64encode(secrets.token_bytes(32)).rstrip(b"=").decode()  # (1)!
challenge = (
    base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest())
    .rstrip(b"=")
    .decode()
)  # (2)!

library(openssl)
library(base64enc)

b64url <- function(x) {
  enc <- base64enc::base64encode(x)
  gsub("=+$", "", chartr("+/", "-_", enc))  # (1)!
}

verifier <- b64url(openssl::rand_bytes(32))  # (2)!
challenge <- b64url(openssl::sha256(charToRaw(verifier), raw = TRUE))  # (3)!

import http.server
import socket
import urllib.parse

# (1)!

sock = socket.socket()
sock.bind(("127.0.0.1", 0))
port = sock.getsockname()[1]
sock.close()

result = {}

class Handler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        qs = urllib.parse.parse_qs(urllib.parse.urlparse(self.path).query)
        result["code"] = qs.get("code", [None])[0]
        result["state"] = qs.get("state", [None])[0]
        result["error"] = qs.get("error", [None])[0]
        self.send_response(200)
        self.end_headers()
        self.wfile.write(b"You may close this tab.")

    def log_message(self, *args):
        pass

server = http.server.HTTPServer(("127.0.0.1", port), Handler)
print(f"Listening on http://127.0.0.1:{port}/callback")

# (2)!

server.handle_request()

library(httpuv)

# (1)!

result <- new.env()

server <- startServer("127.0.0.1", 0, list(
  call = function(req) {
    qs <- parseQueryString(req$QUERY_STRING)
    result$code  <- qs$code
    result$state <- qs$state
    result$error <- qs$error
    list(status = 200L, body = "You may close this tab.")
  }
))
port <- server$getPort()
cat(sprintf("Listening on http://127.0.0.1:%d/callback\n", port))

# (2)!
while (is.null(result$code) && is.null(result$error)) {
  service()
  Sys.sleep(0.1)
}
stopServer(server)

curl -X POST "https://yesterdays.maprva.org/oauth/token/" \
  -d grant_type=authorization_code \
  -d code="$CODE" \
  -d redirect_uri="http://127.0.0.1:$PORT/callback" \
  -d client_id="$CLIENT_ID" \
  -d code_verifier="$VERIFIER"

import requests

resp = requests.post(
    "https://yesterdays.maprva.org/oauth/token/",
    data={
        "grant_type": "authorization_code",
        "code": code,
        "redirect_uri": f"http://127.0.0.1:{port}/callback",
        "client_id": client_id,
        "code_verifier": verifier,
    },
)
tokens = resp.json()

library(httr2)

resp <- request("https://yesterdays.maprva.org/oauth/token/") |>
  req_body_form(
    grant_type    = "authorization_code",
    code          = code,
    redirect_uri  = sprintf("http://127.0.0.1:%d/callback", port),
    client_id     = client_id,
    code_verifier = verifier
  ) |>
  req_perform()
tokens <- resp_body_json(resp)

curl "https://yesterdays.maprva.org/api/v2/auth/me/" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

import requests

resp = requests.get(
    "https://yesterdays.maprva.org/api/v2/auth/me/",
    headers={"Authorization": f"Bearer {access_token}"},
)
me = resp.json()

library(httr2)

resp <- request("https://yesterdays.maprva.org/api/v2/auth/me/") |>
  req_headers(Authorization = paste("Bearer", access_token)) |>
  req_perform()
me <- resp_body_json(resp)

import base64
import hashlib
import http.server
import secrets
import socket
import urllib.parse
import webbrowser

import requests

INSTANCE = "https://yesterdays.maprva.org"
CLIENT_ID = "your-public-client-id"

# 1. PKCE
verifier = base64.urlsafe_b64encode(secrets.token_bytes(32)).rstrip(b"=").decode()  # (1)!
challenge = base64.urlsafe_b64encode(
    hashlib.sha256(verifier.encode()).digest()
).rstrip(b"=").decode()  # (2)!
state = secrets.token_urlsafe(16)  # (3)!

# 2. Loopback callback
sock = socket.socket()
sock.bind(("127.0.0.1", 0))  # (4)!
port = sock.getsockname()[1]  # (5)!
sock.close()  # (6)!
redirect_uri = f"http://127.0.0.1:{port}/callback"

result = {}

class Handler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        qs = urllib.parse.parse_qs(urllib.parse.urlparse(self.path).query)  # (7)!
        result.update({k: v[0] for k, v in qs.items()})  # (8)!
        self.send_response(200)
        self.end_headers()
        self.wfile.write(b"You may close this tab.")

    def log_message(self, *args):  # (9)!
        pass

# 3. Open browser to /authorize
auth_url = f"{INSTANCE}/oauth/authorize/?" + urllib.parse.urlencode({  # (10)!
    "response_type": "code",
    "client_id": CLIENT_ID,
    "redirect_uri": redirect_uri,
    "scope": "read import",
    "state": state,
    "code_challenge": challenge,
    "code_challenge_method": "S256",
})
print(f"Opening {auth_url}")
webbrowser.open(auth_url)  # (11)!

# 4. Wait for the redirect
http.server.HTTPServer(("127.0.0.1", port), Handler).handle_request()  # (12)!

if result.get("state") != state:  # (13)!
    raise SystemExit("State mismatch — possible CSRF.")
if "error" in result:
    raise SystemExit(f"Authorization failed: {result['error']}")

# 5. Exchange code for tokens
resp = requests.post(f"{INSTANCE}/oauth/token/", data={  # (14)!
    "grant_type": "authorization_code",
    "code": result["code"],
    "redirect_uri": redirect_uri,
    "client_id": CLIENT_ID,
    "code_verifier": verifier,
})
resp.raise_for_status()  # (15)!
tokens = resp.json()

# 6. Use the access token
me = requests.get(  # (16)!
    f"{INSTANCE}/api/v2/auth/me/",
    headers={"Authorization": f"Bearer {tokens['access_token']}"},
).json()
print(f"Logged in as {me['username']} (scopes: {me['scopes']})")

library(openssl)
library(base64enc)
library(httpuv)
library(httr2)

INSTANCE  <- "https://yesterdays.maprva.org"
CLIENT_ID <- "your-public-client-id"

b64url <- function(x) {
  enc <- base64enc::base64encode(x)
  gsub("=+$", "", chartr("+/", "-_", enc))  # (1)!
}

# 1. PKCE
verifier  <- b64url(openssl::rand_bytes(32))  # (2)!
challenge <- b64url(openssl::sha256(charToRaw(verifier), raw = TRUE))  # (3)!
state     <- b64url(openssl::rand_bytes(16))  # (4)!

# 2. Loopback callback
result <- new.env()  # (5)!
server <- startServer("127.0.0.1", 0, list(  # (6)!
  call = function(req) {
    qs <- parseQueryString(req$QUERY_STRING)  # (7)!
    result$code  <- qs$code
    result$state <- qs$state
    result$error <- qs$error
    list(status = 200L, body = "You may close this tab.")
  }
))
port <- server$getPort()  # (8)!
redirect_uri <- sprintf("http://127.0.0.1:%d/callback", port)

# 3. Open browser to /authorize
auth_url <- paste0(  # (9)!
  INSTANCE, "/oauth/authorize/?",
  paste(
    paste0("response_type=", "code"),
    paste0("client_id=",     URLencode(CLIENT_ID, reserved = TRUE)),
    paste0("redirect_uri=",  URLencode(redirect_uri, reserved = TRUE)),
    paste0("scope=",         URLencode("read import", reserved = TRUE)),
    paste0("state=",         state),
    paste0("code_challenge=", challenge),
    paste0("code_challenge_method=", "S256"),
    sep = "&"
  )
)
cat("Opening", auth_url, "\n")
browseURL(auth_url)  # (10)!

# 4. Wait for the redirect
while (is.null(result$code) && is.null(result$error)) {  # (11)!
  service()
  Sys.sleep(0.1)
}
stopServer(server)

if (!identical(result$state, state)) {  # (12)!
  stop("State mismatch — possible CSRF.")
}
if (!is.null(result$error)) {
  stop("Authorization failed: ", result$error)
}

# 5. Exchange code for tokens
resp <- request(paste0(INSTANCE, "/oauth/token/")) |>  # (13)!
  req_body_form(
    grant_type    = "authorization_code",
    code          = result$code,
    redirect_uri  = redirect_uri,
    client_id     = CLIENT_ID,
    code_verifier = verifier
  ) |>
  req_perform()
tokens <- resp_body_json(resp)

# 6. Use the access token
me <- request(paste0(INSTANCE, "/api/v2/auth/me/")) |>  # (14)!
  req_headers(Authorization = paste("Bearer", tokens$access_token)) |>
  req_perform() |>
  resp_body_json()

cat(sprintf("Logged in as %s (scopes: %s)\n",
            me$username, paste(me$scopes, collapse = ", ")))