Add rate limits to token endpoint

ref DEV-2917
ref DEV-2919
ref DEV-2907

Author: louischan-oursky

pkg/auth/deps.go

@@ -71,6 +71,9 @@ var DependencySet = wire.NewSet(
 	deps.CommonDependencySet,
 
 	nonce.DependencySet,
+
+	wire.Bind(new(oauthhandler.TokenHandlerAppDatabase), new(*appdb.Handle)),
+
 	wire.Bind(new(interaction.NonceService), new(*nonce.Service)),
 
 	wire.Bind(new(webapp.SessionMiddlewareOAuthSessionService), new(*oauthsession.StoreRedis)),

pkg/auth/handler/oauth/token.go

@@ -43,13 +43,10 @@ func (h *TokenHandler) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
 
 	var result httputil.Result
 	ctx := r.Context()
-	err = h.Database.WithTx(ctx, func(ctx context.Context) error {
-		result = h.TokenHandler.Handle(ctx, rw, r, req)
-		if result.IsInternalError() {
-			return errAuthzInternalError
-		}
-		return nil
-	})
+	result = h.TokenHandler.Handle(ctx, rw, r, req)
+	if result.IsInternalError() {
+		err = errAuthzInternalError
+	}
 
 	if err == nil || errors.Is(err, errAuthzInternalError) {
 		result.WriteResponse(rw, r)

pkg/auth/wire_gen.go

@@ -307,6 +307,14 @@ func (d AuthgearYAMLDescriptor) validateOAuthClients(validationCtx *validation.C
 	if len(addedClientIds) > 0 && len(removedClientIds) > 0 {
 		validationCtx.Child("oauth", "clients").EmitErrorMessage("client ids cannot be changed")
 	}
+
+	// Validate the final clients length <= 50
+	const maxFinalOAuthClients = 50
+	if len(incoming.OAuth.Clients) > maxFinalOAuthClients {
+		validationCtx.Child("oauth", "clients").EmitErrorMessage(
+			fmt.Sprintf("exceed the maximum number of oauth clients, actual: %d, expected: %d", len(incoming.OAuth.Clients), maxFinalOAuthClients),
+		)
+	}
 }
 
 func (d AuthgearYAMLDescriptor) validateBasedOnFeatureConfig(appConfig *config.AppConfig, fc *config.FeatureConfig) error {

pkg/lib/config/configsource/resources.go

@@ -5,7 +5,10 @@ var _ = Schema.Add("OAuthConfig", `
 	"type": "object",
 	"additionalProperties": false,
 	"properties": {
-		"clients": { "type": "array", "items": { "$ref": "#/$defs/OAuthClientConfig" } }
+		"clients": {
+			"type": "array",
+			"items": { "$ref": "#/$defs/OAuthClientConfig" }
+		}
 	}
 }
 `)
@@ -220,6 +223,23 @@ var _ = Schema.Add("OAuthClientConfig", `
 			"then": {
 				"required": ["redirect_uris"]
 			}
+		},
+		{
+			"if": {
+				"properties": {
+					"x_application_type": {
+						"enum": ["m2m"]
+					}
+				},
+				"required": ["x_application_type"]
+			},
+			"then": {
+				"properties": {
+					"access_token_lifetime_seconds": {
+						"maximum": 2419200
+					}
+				}
+			}
 		}
 	]
 }

pkg/lib/config/oauth.go

@@ -1388,3 +1388,20 @@ config:
       - name: Test Client
         client_id: test-client
         x_application_type: m2m
+
+---
+name: oauth-m2m-client-access-token-lifetime-exceeds-max
+error: |-
+  invalid configuration:
+  /oauth/clients/0/access_token_lifetime_seconds: maximum
+    map[actual:3e+06 maximum:2.4192e+06]
+config:
+  id: test
+  http:
+    public_origin: http://test
+  oauth:
+    clients:
+      - name: Test Client M2M
+        client_id: test-client-m2m
+        x_application_type: m2m
+        access_token_lifetime_seconds: 3000000

pkg/lib/config/testdata/config_tests.yaml

@@ -540,6 +540,7 @@ var CommonDependencySet = wire.NewSet(
 		wire.Bind(new(otp.RateLimiter), new(*ratelimit.Limiter)),
 		wire.Bind(new(messaging.RateLimiter), new(*ratelimit.Limiter)),
 		wire.Bind(new(mfa.RateLimiter), new(*ratelimit.Limiter)),
+		wire.Bind(new(oauthhandler.TokenHandlerRateLimiter), new(*ratelimit.Limiter)),
 	),
 
 	wire.NewSet(

pkg/lib/deps/deps_common.go

@@ -645,12 +645,13 @@ func (h *AuthorizationHandler) finishSettingsAction(
 	redirectURI *url.URL,
 	r protocol.AuthorizationRequest,
 	cookies []*http.Cookie,
+	userID string,
 ) (httputil.Result, error) {
 	resp := protocol.AuthorizationResponse{}
 	responseType := r.ResponseType()
 	switch {
 	case responseType.Equal(SettingsActonResponseType):
-		err := h.generateSettingsActionResponse(ctx, redirectURI.String(), r, resp)
+		err := h.generateSettingsActionResponse(ctx, redirectURI.String(), r, resp, userID)
 		if err != nil {
 			return nil, err
 		}
@@ -780,12 +781,14 @@ func (h *AuthorizationHandler) doHandleConsentRequest(
 	responseType := opts.ConsentRequest.OAuthSessionEntry.T.AuthorizationRequest.ResponseType()
 	switch {
 	case responseType.Equal(SettingsActonResponseType):
+		userID := opts.ConsentRequest.AuthInfoEntry.T.UserID
 		return h.finishSettingsAction(
 			ctx,
 			opts.ConsentRequest.Client,
 			opts.ConsentRequest.RedirectURI,
 			opts.ConsentRequest.OAuthSessionEntry.T.AuthorizationRequest,
 			[]*http.Cookie{},
+			userID,
 		)
 	default:
 		_, uiInfoByProduct, err := h.UIInfoResolver.ResolveForAuthorizationEndpoint(
@@ -930,10 +933,12 @@ func (h *AuthorizationHandler) generateSettingsActionResponse(
 	redirectURI string,
 	r protocol.AuthorizationRequest,
 	resp protocol.AuthorizationResponse,
+	userID string,
 ) error {
 	code, _, err := h.SettingsActionGrantService.CreateSettingsActionGrant(ctx, &CreateSettingsActionGrantOptions{
 		RedirectURI:          redirectURI,
 		AuthorizationRequest: r,
+		UserID:               userID,
 	})
 	if err != nil {
 		return err