1 files changed, 127 insertions, 0 deletions

diff --git a/auth/github/github.go b/auth/github/github.go
new file mode 100644
index 0000000..b403296
--- /dev/null
+++ b/auth/github/github.go
@@ -0,0 +1,127 @@
+package github
+
+import (
+        "crypto/rand"
+        "encoding/base64"
+        "encoding/json"
+        "fmt"
+        "io/ioutil"
+        "net/http"
+        "net/url"
+        "strings"
+)
+
+type apiLoginResponse struct {
+        Username string `json:"login"`
+}
+
+type GitHubToken struct {
+        AccessToken  string `json:"access_token"`
+        RefreshToken string `json:"refresh_token"`
+}
+
+type GitHubAuthenticator struct {
+        ClientId     string
+        ClientSecret string
+}
+
+// GetAuthRedirect returns a redirect URL and a state parameter that should be
+// stored in the user's browser to correlate the authentication result and
+// request.
+func (a *GitHubAuthenticator) GetAuthRedirect() (string, string) {
+        sr := make([]byte, 32)
+        if _, err := rand.Read(sr); err != nil {
+                panic(err) // This should only happen if no entropy available
+        }
+        random := base64.URLEncoding.EncodeToString(sr)
+
+        return (&url.URL{
+                Scheme: "https",
+                Host:   "github.com",
+                Path:   "/login/oauth/authorize",
+                RawQuery: url.Values{
+                        "client_id":    []string{a.ClientId},
+                        "scope":        []string{"read:user"},
+                        "state":        []string{random},
+                        "allow_signup": []string{"false"},
+                }.Encode(),
+        }).String(), random
+}
+
+// GetTokens returns the GitHub Oauth tokens from the service given a token
+// request code. The returned tokens are used for authentication to the GitHub
+// API.
+//
+// This relies on a GitHub Oauth application on the GitHub side to act as the
+// client for these tokens.
+func (a *GitHubAuthenticator) GetTokens(code string) (*GitHubToken, error) {
+        r, err := (&http.Client{}).Do(&http.Request{
+                Method: http.MethodPost,
+                URL: &url.URL{
+                        Scheme: "https",
+                        Host:   "github.com",
+                        Path:   "/login/oauth/access_token",
+                },
+                Header: http.Header{
+                        "Content-Type": []string{"application/x-www-form-urlencoded"},
+                        "Accept":       []string{"application/json"},
+                },
+                Body: ioutil.NopCloser(strings.NewReader(url.Values{
+                        "client_id":     []string{a.ClientId},
+                        "client_secret": []string{a.ClientSecret},
+                        "code":          []string{code},
+                }.Encode())),
+        })
+        if err != nil {
+                return nil, err
+        }
+        defer r.Body.Close()
+
+        body, err := ioutil.ReadAll(r.Body)
+        if err != nil {
+                return nil, err
+        }
+
+        var ret GitHubToken
+        if err = json.Unmarshal(body, &ret); err != nil {
+                return nil, err
+        }
+
+        return &ret, nil
+}
+
+// GetUsernameWithToken returns the authenticated user's GitHub username given
+// an Oauth auth token.
+func (a *GitHubAuthenticator) GetUsernameWithToken(accessToken string) (string, error) {
+        r, err := (&http.Client{}).Do(&http.Request{
+                Method: http.MethodGet,
+                URL: &url.URL{
+                        Scheme: "https",
+                        Host:   "api.github.com",
+                        Path:   "/user",
+                },
+                Header: http.Header{
+                        "Authorization": []string{fmt.Sprintf("token %s", accessToken)},
+                },
+        })
+        if err != nil {
+                return "", err
+        }
+        defer r.Body.Close()
+
+        body, err := ioutil.ReadAll(r.Body)
+        if err != nil {
+                return "", err
+        }
+
+        var data apiLoginResponse
+        if err = json.Unmarshal(body, &data); err != nil {
+                return "", err
+        }
+
+        if data.Username == "" {
+                return "", fmt.Errorf("No user returned in GitHub response")
+        }
+
+        return data.Username, nil
+}