add state param

bot/src/cogs/galtinn.py

@@ -43,7 +43,8 @@ class Galtinn(commands.Cog):
             """
             CREATE TABLE IF NOT EXISTS galtinn_verification (
                 discord_id BIGINT PRIMARY KEY,
-                challenge TEXT NOT NULL
+                challenge TEXT NOT NULL,
+                state TEXT NOT NULL
             );
             """
         )
@@ -144,7 +145,8 @@ class Galtinn(commands.Cog):
             return
 
         # Generate OAuth2 URL
-        challenge = f"{interaction.user.id}:{secrets.token_urlsafe(32)}"
+        challenge = f"{secrets.token_urlsafe(32)}"  # TODO: generate challenge based on private key?
+        state = f"{secrets.token_urlsafe(32)}"
         base_url = f"{self.bot.galtinn['api_url']}/oauth/authorize/"
         params = {
             "client_id": self.bot.galtinn["client_id"],
@@ -152,6 +154,7 @@ class Galtinn(commands.Cog):
             "response_type": "code",
             "redirect_uri": self.bot.galtinn["redirect_uri"],
             "code_challenge": challenge,
+            "state": state,
         }
         url = f"{base_url}?{urllib.parse.urlencode(params)}"
 
@@ -159,9 +162,9 @@ class Galtinn(commands.Cog):
         self.cursor.execute(
             """
             INSERT INTO galtinn_verification
-            VALUES (%s, %s)
+            VALUES (%s, %s, %s)
             """,
-            (interaction.user.id, challenge),
+            (interaction.user.id, challenge, state),
         )
 
         self.bot.logger.info(f"Generated challenge for user {interaction.user.id}")

verification_server/src/server.py

@@ -41,24 +41,14 @@ async def index():
 
 @app.get("/callback")
 async def callback(request: Request, code: str, state: str):
-    try:
-        discord_id, _ = state.split(":")
-    except ValueError:
-        return templates.TemplateResponse(
-            "error.html",
-            {
-                "request": request,
-                "message": "Ugyldig forespørsel! Manglende data eller feil format",
-            },
-        )
 
     # Check if user is pending verification
     db_cursor.execute(
         """
         SELECT *
-        FROM verification WHERE discord_id = %s
+        FROM galtinn_verification WHERE state = %s
         """,
-        (discord_id,),
+        (state,),
     )
     if not (db_result := db_cursor.fetchone()):
         return templates.TemplateResponse(
@@ -69,14 +59,7 @@ async def callback(request: Request, code: str, state: str):
             },
         )
 
-    if db_result[1] != state:
-        return templates.TemplateResponse(
-            "error.html",
-            {
-                "request": request,
-                "message": "Ugyldig lenke! Prøv igjen fra start",
-            },
-        )
+    discord_id, code_challenge, state = db_result
 
     # Get auth_token from code
     payload = {
@@ -84,7 +67,7 @@ async def callback(request: Request, code: str, state: str):
         "grant_type": "authorization_code",
         "code": code,
         "redirect_uri": GALTINN_REDIRECT_URI,
-        "code_verifier": state,
+        "code_verifier": code_challenge,
     }
     async with aiohttp.ClientSession() as session:
         async with session.post(f"{GALTINN_API_URL}/ouath/token/", data=payload) as r: