deeplink sign in for app, give it its own session token (#7791)

* deeplink sign in flow

* prepr

* fix: conflict

* emit warnings on deeplink fail

---------

Co-authored-by: Calum H. (IMB11) <contact@cal.engineer>

Author: Prospector

Cargo.lock

@@ -33,6 +33,7 @@ actix-rt = "2.11.0"
 actix-web = "4.11.0"
 actix-web-prom = "0.10.0"
 actix-ws = "0.3.0"
+aes-gcm = "0.10.3"
 arc-swap = "1.7.1"
 argon2 = { version = "0.5.3", features = ["std"] }
 ariadne = { path = "packages/ariadne" }
@@ -96,6 +97,7 @@ governor = "0.10.4"
 heck = "0.5.0"
 hex = "0.4.3"
 hickory-resolver = "0.25.2"
+hkdf = "0.12.4"
 hmac = "0.12.1"
 httpdate = "1.0.3"
 hyper = "1.7.0"

Cargo.toml

@@ -8,18 +8,23 @@ repository = "https://github.com/modrinth/code/apps/app/"
 license = "GPL-3.0-only"
 
 [dependencies]
+aes-gcm = { workspace = true }
 async_zip = { workspace = true, features = ["deflate", "tokio-fs"] }
+base64 = { workspace = true }
 chrono = { workspace = true }
 daedalus = { workspace = true }
 dashmap = { workspace = true }
 either = { workspace = true }
 enumset = { workspace = true, features = ["serde"] }
+hkdf = { workspace = true }
 hyper = { workspace = true, features = ["server"] }
 hyper-util = { workspace = true }
 image = { workspace = true, features = ["gif", "jpeg", "png", "webp"] }
 native-dialog = { workspace = true }
+p256 = { workspace = true, features = ["ecdh"] }
 paste = { workspace = true }
 path-util = { workspace = true }
+rand = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 serde_with = { workspace = true }

apps/app/Cargo.toml

@@ -1,12 +1,16 @@
 use crate::api::Result;
 use crate::api::TheseusSerializableError;
 use crate::api::oauth_utils;
+use crate::api::oauth_utils::auth_code_reply::AuthReplySession;
+use crate::api::oauth_utils::auth_seal::AuthSeal;
 use tauri::Manager;
 use tauri::Runtime;
 use tauri::plugin::TauriPlugin;
 use tauri_plugin_opener::OpenerExt;
 use theseus::prelude::*;
-use tokio::sync::oneshot;
+use url::Url;
+
+const LAUNCHER_AUTH_PROTOCOL: &str = "2";
 
 pub fn init<R: tauri::Runtime>() -> TauriPlugin<R> {
     tauri::plugin::Builder::new("mr-auth")
@@ -28,27 +32,16 @@ pub async fn modrinth_login<R: Runtime>(
     flow: mr_auth::ModrinthAuthFlow,
     add_account: Option<bool>,
 ) -> Result<ModrinthCredentials> {
-    let (auth_code_recv_socket_tx, auth_code_recv_socket) = oneshot::channel();
-    let auth_code = tokio::spawn(oauth_utils::auth_code_reply::listen(
-        auth_code_recv_socket_tx,
-    ));
-
-    let auth_code_recv_socket = auth_code_recv_socket.await.unwrap()?;
-
-    let mut auth_request_uri = format!(
-        "{}?launcher=true&ipver={}&port={}",
+    let seal = AuthSeal::generate();
+    let mut reply = AuthReplySession::start(seal.nonce().to_string());
+    let auth_code_recv_socket = reply.socket_addr().await?;
+    let auth_request_uri = auth_request_url(
         mr_auth::authenticate_begin_flow(flow).await?,
-        if auth_code_recv_socket.is_ipv4() {
-            "4"
-        } else {
-            "6"
-        },
-        auth_code_recv_socket.port()
-    );
-
-    if add_account.unwrap_or(false) {
-        auth_request_uri.push_str("&add_account=true");
-    }
+        &auth_code_recv_socket,
+        &seal.public_key()?,
+        seal.nonce(),
+        add_account.unwrap_or(false),
+    )?;
 
     app.opener()
         .open_url(auth_request_uri, None::<&str>)
@@ -61,13 +54,13 @@ pub async fn modrinth_login<R: Runtime>(
             )
         })?;
 
-    let Some(auth_code) = auth_code.await.unwrap()? else {
+    let Some(auth_code) = reply.wait().await? else {
         return Err(TheseusSerializableError::Theseus(
             theseus::ErrorKind::OtherError("Login canceled".into()).into(),
         ));
     };
-
-    let credentials = mr_auth::authenticate_finish_flow(&auth_code).await?;
+    let session_token = seal.open(&auth_code)?;
+    let credentials = mr_auth::authenticate_finish_flow(&session_token).await?;
 
     if let Some(main_window) = app.get_window("main") {
         main_window.set_focus().ok();
@@ -103,5 +96,34 @@ pub async fn remove_account(user_id: String) -> Result<()> {
 
 #[tauri::command]
 pub fn cancel_modrinth_login() {
-    oauth_utils::auth_code_reply::stop_listeners();
+    oauth_utils::auth_code_reply::cancel_pending_auth();
+}
+
+fn auth_request_url(
+    begin_url: &str,
+    socket: &std::net::SocketAddr,
+    public_key: &str,
+    nonce: &str,
+    add_account: bool,
+) -> Result<String> {
+    let mut url = Url::parse(begin_url).map_err(|error| -> theseus::Error {
+        theseus::ErrorKind::OtherError(format!(
+            "Failed to build auth request URI: {error}"
+        ))
+        .into()
+    })?;
+    {
+        let mut query = url.query_pairs_mut();
+        query.append_pair("launcher", "true");
+        query.append_pair("protocol", LAUNCHER_AUTH_PROTOCOL);
+        query.append_pair("key", public_key);
+        query.append_pair("nonce", nonce);
+        query.append_pair("ipver", if socket.is_ipv4() { "4" } else { "6" });
+        query.append_pair("port", &socket.port().to_string());
+        if add_account {
+            query.append_pair("add_account", "true");
+        }
+    }
+
+    Ok(url.into())
 }