File Coverage

blib/lib/WWW/Zitadel/OIDC.pm

Criterion	Covered	Total	%
statement	91	94	96.8
branch	25	28	89.2
condition	38	52	73.0
subroutine	24	25	96.0
pod	9	15	60.0
total	187	214	87.3

package WWW::Zitadel::OIDC;

# ABSTRACT: OIDC client for Zitadel - token verification, JWKS, discovery

use Moo;
use Crypt::JWT qw(decode_jwt);
use JSON::MaybeXS qw(decode_json);
use LWP::UserAgent;
use URI;
use WWW::Zitadel::Error;
use namespace::clean;

our $VERSION = '0.001';

has issuer => (
    is       => 'ro',
    required => 1,
);

sub BUILD {
    my $self = shift;
    die WWW::Zitadel::Error::Validation->new(
        message => 'issuer must not be empty',
    ) unless length $self->issuer;
}

has ua => (
    is      => 'lazy',
    builder => sub { LWP::UserAgent->new(timeout => 10) },
);

has _discovery => (
    is      => 'lazy',
    builder => sub {
        my $self = shift;
        my $url = $self->issuer . '/.well-known/openid-configuration';
        my $res = $self->ua->get($url);
        unless ($res->is_success) {
            die WWW::Zitadel::Error::Network->new(
                message => 'Discovery failed: ' . $res->status_line,
            );
        }
        decode_json($res->decoded_content);
    },
);

has _jwks_cache => (
    is      => 'rw',
    default => sub { undef },
);

sub discovery { $_[0]->_discovery }

sub jwks_uri {
    my $self = shift;
    $self->_discovery->{jwks_uri}
        // die "No jwks_uri in discovery document\n";
}

sub token_endpoint {
    my $self = shift;
    $self->_discovery->{token_endpoint}
        // die "No token_endpoint in discovery document\n";
}

sub userinfo_endpoint {
    my $self = shift;
    $self->_discovery->{userinfo_endpoint}
        // die "No userinfo_endpoint in discovery document\n";
}

sub authorization_endpoint {
    my $self = shift;
    $self->_discovery->{authorization_endpoint}
        // die "No authorization_endpoint in discovery document\n";
}

sub introspection_endpoint {
    my $self = shift;
    $self->_discovery->{introspection_endpoint}
        // die "No introspection_endpoint in discovery document\n";
}

sub jwks {
    my ($self, %args) = @_;
    my $force = $args{force_refresh} // 0;

    if (!$force && $self->_jwks_cache) {
        return $self->_jwks_cache;
    }

    my $res = $self->ua->get($self->jwks_uri);
    unless ($res->is_success) {
        die WWW::Zitadel::Error::Network->new(
            message => 'JWKS fetch failed: ' . $res->status_line,
        );
    }
    my $jwks = decode_json($res->decoded_content);
    $self->_jwks_cache($jwks);
    return $jwks;
}

sub verify_token {
    my ($self, $token, %args) = @_;
    die WWW::Zitadel::Error::Validation->new(message => 'No token provided')
        unless defined $token;

    my $jwks = $self->jwks;
    my $claims;
    eval {
        $claims = $self->_decode_jwt(
            token       => $token,
            kid_keys    => $jwks,
            verify_exp  => $args{verify_exp} // 1,
            verify_iat  => $args{verify_iat} // 0,
            verify_nbf  => $args{verify_nbf} // 0,
            verify_iss  => $self->issuer,
            verify_aud  => $args{audience},
            accepted_key_alg => $args{accepted_key_alg} // ['RS256', 'RS384', 'RS512'],
        );
    };
    if ($@ && !$args{no_retry}) {
        # Key rotation: refresh JWKS and retry once
        $jwks = $self->jwks(force_refresh => 1);
        $claims = $self->_decode_jwt(
            token       => $token,
            kid_keys    => $jwks,
            verify_exp  => $args{verify_exp} // 1,
            verify_iat  => $args{verify_iat} // 0,
            verify_nbf  => $args{verify_nbf} // 0,
            verify_iss  => $self->issuer,
            verify_aud  => $args{audience},
            accepted_key_alg => $args{accepted_key_alg} // ['RS256', 'RS384', 'RS512'],
        );
    }
    elsif ($@) {
        die $@;
    }

    return $claims;
}

sub _decode_jwt {
    my ($self, %args) = @_;
    return decode_jwt(%args);
}

sub userinfo {
    my ($self, $access_token) = @_;
    die WWW::Zitadel::Error::Validation->new(message => 'No access token provided')
        unless defined $access_token;

    my $res = $self->ua->get(
        $self->userinfo_endpoint,
        Authorization => "Bearer $access_token",
    );
    unless ($res->is_success) {
        die WWW::Zitadel::Error::Network->new(
            message => 'UserInfo failed: ' . $res->status_line,
        );
    }
    return decode_json($res->decoded_content);
}

sub introspect {
    my ($self, $token, %args) = @_;
    die WWW::Zitadel::Error::Validation->new(message => 'No token provided')
        unless defined $token;
    die WWW::Zitadel::Error::Validation->new(
        message => 'Introspection requires client_id and client_secret',
    ) unless $args{client_id} && $args{client_secret};

    my $res = $self->ua->post(
        $self->introspection_endpoint,
        Content_Type => 'application/x-www-form-urlencoded',
        Content      => {
            token         => $token,
            client_id     => $args{client_id},
            client_secret => $args{client_secret},
            token_type_hint => $args{token_type_hint} // 'access_token',
        },
    );
    unless ($res->is_success) {
        die WWW::Zitadel::Error::Network->new(
            message => 'Introspection failed: ' . $res->status_line,
        );
    }
    return decode_json($res->decoded_content);
}

sub token {
    my ($self, %args) = @_;

    my $grant_type = delete $args{grant_type}
        // die WWW::Zitadel::Error::Validation->new(message => 'grant_type required');

    my $res = $self->ua->post(
        $self->token_endpoint,
        Content_Type => 'application/x-www-form-urlencoded',
        Content      => {
            grant_type => $grant_type,
            %args,
        },
    );
    unless ($res->is_success) {
        die WWW::Zitadel::Error::Network->new(
            message => 'Token endpoint failed: ' . $res->status_line,
        );
    }
    return decode_json($res->decoded_content);
}

sub client_credentials_token {
    my ($self, %args) = @_;

    my $client_id = delete $args{client_id}
        // die WWW::Zitadel::Error::Validation->new(message => 'client_id required');
    my $client_secret = delete $args{client_secret}
        // die WWW::Zitadel::Error::Validation->new(message => 'client_secret required');

    return $self->token(
        grant_type    => 'client_credentials',
        client_id     => $client_id,
        client_secret => $client_secret,
        %args,
    );
}

sub refresh_token {
    my ($self, $refresh_token, %args) = @_;
    die WWW::Zitadel::Error::Validation->new(message => 'refresh_token required')
        unless defined $refresh_token && length $refresh_token;

    return $self->token(
        grant_type    => 'refresh_token',
        refresh_token => $refresh_token,
        %args,
    );
}

sub exchange_authorization_code {
    my ($self, %args) = @_;

    my $code = delete $args{code}
        // die WWW::Zitadel::Error::Validation->new(message => 'code required');
    my $redirect_uri = delete $args{redirect_uri}
        // die WWW::Zitadel::Error::Validation->new(message => 'redirect_uri required');

    return $self->token(
        grant_type   => 'authorization_code',
        code         => $code,
        redirect_uri => $redirect_uri,
        %args,
    );
}

1;

__END__