OAuth PKCE Authentication

import AuthenticationServices
import CryptoKit

class OAuthManager {
    private var currentAuthSession: ASWebAuthenticationSession?
    private var codeVerifier: String?
    
    func authenticate() {
        // Generate PKCE parameters
        let (verifier, challenge) = generatePKCEPair()
        self.codeVerifier = verifier
        
        // Build authorization URL
        var components = URLComponents(string: "https://api.parrotrouter.com/oauth/authorize")!
        components.queryItems = [
            URLQueryItem(name: "client_id", value: "your-ios-client-id"),
            URLQueryItem(name: "redirect_uri", value: "com.example.app://oauth/callback"),
            URLQueryItem(name: "response_type", value: "code"),
            URLQueryItem(name: "scope", value: "openid profile api.read"),
            URLQueryItem(name: "code_challenge", value: challenge),
            URLQueryItem(name: "code_challenge_method", value: "S256"),
            URLQueryItem(name: "state", value: UUID().uuidString)
        ]
        
        // Start authentication session
        let session = ASWebAuthenticationSession(
            url: components.url!,
            callbackURLScheme: "com.example.app"
        ) { callbackURL, error in
            guard error == nil, let callbackURL = callbackURL else {
                print("Authentication error: \(error?.localizedDescription ?? "Unknown")")
                return
            }
            
            self.handleCallback(url: callbackURL)
        }
        
        session.presentationContextProvider = self
        session.prefersEphemeralWebBrowserSession = false // Allow SSO
        session.start()
        
        self.currentAuthSession = session
    }
    
    private func generatePKCEPair() -> (verifier: String, challenge: String) {
        let verifier = generateRandomString(length: 128)
        let data = verifier.data(using: .utf8)!
        let hash = SHA256.hash(data: data)
        let challenge = Data(hash)
            .base64EncodedString()
            .replacingOccurrences(of: "+", with: "-")
            .replacingOccurrences(of: "/", with: "_")
            .replacingOccurrences(of: "=", with: "")
        
        return (verifier, challenge)
    }
    
    private func handleCallback(url: URL) {
        let components = URLComponents(url: url, resolvingAgainstBaseURL: false)
        guard let code = components?.queryItems?.first(where: { $0.name == "code" })?.value else {
            print("No authorization code found")
            return
        }
        
        // Exchange code for tokens
        exchangeCodeForTokens(code: code)
    }
    
    private func exchangeCodeForTokens(code: String) {
        guard let verifier = self.codeVerifier else { return }
        
        let tokenURL = URL(string: "https://api.parrotrouter.com/oauth/token")!
        var request = URLRequest(url: tokenURL)
        request.httpMethod = "POST"
        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
        
        let body = [
            "grant_type": "authorization_code",
            "client_id": "your-ios-client-id",
            "code": code,
            "redirect_uri": "com.example.app://oauth/callback",
            "code_verifier": verifier
        ]
        
        request.httpBody = try? JSONSerialization.data(withJSONObject: body)
        
        URLSession.shared.dataTask(with: request) { data, response, error in
            guard let data = data else { return }
            
            if let tokens = try? JSONDecoder().decode(TokenResponse.self, from: data) {
                // Store tokens in keychain
                KeychainHelper.store(tokens: tokens)
                
                DispatchQueue.main.async {
                    // Navigate to authenticated state
                    self.onAuthenticationSuccess()
                }
            }
        }.resume()
    }
}

import android.net.Uri
import androidx.browser.customtabs.CustomTabsIntent
import java.security.MessageDigest
import java.security.SecureRandom
import java.util.Base64

class OAuthManager(private val activity: AppCompatActivity) {
    private var codeVerifier: String? = null
    
    companion object {
        private const val REDIRECT_URI = "com.example.app://oauth/callback"
        private const val AUTH_ENDPOINT = "https://api.parrotrouter.com/oauth/authorize"
        private const val TOKEN_ENDPOINT = "https://api.parrotrouter.com/oauth/token"
    }
    
    fun startAuthentication() {
        // Generate PKCE parameters
        val (verifier, challenge) = generatePKCEPair()
        codeVerifier = verifier
        
        // Save state for CSRF protection
        val state = generateRandomString(16)
        saveState(state)
        
        // Build authorization URL
        val authUri = Uri.parse(AUTH_ENDPOINT).buildUpon()
            .appendQueryParameter("client_id", "your-android-client-id")
            .appendQueryParameter("redirect_uri", REDIRECT_URI)
            .appendQueryParameter("response_type", "code")
            .appendQueryParameter("scope", "openid profile api.read")
            .appendQueryParameter("code_challenge", challenge)
            .appendQueryParameter("code_challenge_method", "S256")
            .appendQueryParameter("state", state)
            .build()
        
        // Launch Chrome Custom Tab
        val customTabsIntent = CustomTabsIntent.Builder()
            .setShowTitle(true)
            .setToolbarColor(activity.getColor(R.color.primary))
            .build()
            
        customTabsIntent.launchUrl(activity, authUri)
    }
    
    fun handleAuthorizationResponse(uri: Uri) {
        val code = uri.getQueryParameter("code")
        val state = uri.getQueryParameter("state")
        
        // Verify state
        if (state != getSavedState()) {
            throw SecurityException("Invalid state parameter")
        }
        
        code?.let { exchangeCodeForTokens(it) }
    }
    
    private fun generatePKCEPair(): Pair<String, String> {
        // Generate code verifier
        val verifier = generateRandomString(128)
        
        // Generate code challenge
        val bytes = verifier.toByteArray(Charsets.US_ASCII)
        val digest = MessageDigest.getInstance("SHA-256").digest(bytes)
        val challenge = Base64.getUrlEncoder()
            .withoutPadding()
            .encodeToString(digest)
        
        return Pair(verifier, challenge)
    }
    
    private fun exchangeCodeForTokens(code: String) {
        val client = OkHttpClient()
        
        val requestBody = FormBody.Builder()
            .add("grant_type", "authorization_code")
            .add("client_id", "your-android-client-id")
            .add("code", code)
            .add("redirect_uri", REDIRECT_URI)
            .add("code_verifier", codeVerifier ?: "")
            .build()
        
        val request = Request.Builder()
            .url(TOKEN_ENDPOINT)
            .post(requestBody)
            .build()
        
        client.newCall(request).enqueue(object : Callback {
            override fun onResponse(call: Call, response: Response) {
                if (response.isSuccessful) {
                    val tokens = parseTokenResponse(response.body?.string())
                    
                    // Store tokens securely
                    TokenManager.storeTokens(tokens)
                    
                    // Navigate to authenticated state
                    activity.runOnUiThread {
                        navigateToMainScreen()
                    }
                }
            }
            
            override fun onFailure(call: Call, e: IOException) {
                // Handle error
                handleAuthError(e)
            }
        })
    }
    
    private fun generateRandomString(length: Int): String {
        val charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"
        val random = SecureRandom()
        return (1..length)
            .map { charset[random.nextInt(charset.length)] }
            .joinToString("")
    }
}

// Secure token storage strategies

// 1. Memory-only storage (most secure, doesn't survive refresh)
class InMemoryTokenStore {
  private tokens: TokenSet | null = null;
  
  store(tokens: TokenSet) {
    this.tokens = tokens;
  }
  
  get(): TokenSet | null {
    return this.tokens;
  }
  
  clear() {
    this.tokens = null;
  }
}

// 2. Encrypted IndexedDB storage
class SecureTokenStore {
  private dbName = 'oauth_tokens';
  private encryptionKey: CryptoKey;
  
  async initialize() {
    // Generate or retrieve encryption key
    this.encryptionKey = await this.getOrCreateEncryptionKey();
  }
  
  async store(tokens: TokenSet) {
    const encrypted = await this.encrypt(tokens);
    
    const db = await this.openDB();
    const tx = db.transaction(['tokens'], 'readwrite');
    await tx.objectStore('tokens').put({
      id: 'current',
      data: encrypted,
      timestamp: Date.now()
    });
  }
  
  async get(): Promise<TokenSet | null> {
    const db = await this.openDB();
    const tx = db.transaction(['tokens'], 'readonly');
    const stored = await tx.objectStore('tokens').get('current');
    
    if (!stored) return null;
    
    // Check expiry
    const age = Date.now() - stored.timestamp;
    if (age > 3600000) { // 1 hour
      await this.clear();
      return null;
    }
    
    return await this.decrypt(stored.data);
  }
  
  private async encrypt(data: any): Promise<ArrayBuffer> {
    const iv = crypto.getRandomValues(new Uint8Array(12));
    const encoded = new TextEncoder().encode(JSON.stringify(data));
    
    const encrypted = await crypto.subtle.encrypt(
      { name: 'AES-GCM', iv },
      this.encryptionKey,
      encoded
    );
    
    // Combine IV and encrypted data
    const combined = new Uint8Array(iv.length + encrypted.byteLength);
    combined.set(iv, 0);
    combined.set(new Uint8Array(encrypted), iv.length);
    
    return combined.buffer;
  }
}

// 3. Secure cookie storage (server-side)
class CookieTokenStore {
  store(tokens: TokenSet) {
    // Send tokens to backend for secure cookie storage
    fetch('/api/auth/store-tokens', {
      method: 'POST',
      credentials: 'include',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify(tokens)
    });
  }
  
  async get(): Promise<TokenSet | null> {
    // Retrieve tokens from secure HTTP-only cookies
    const response = await fetch('/api/auth/get-tokens', {
      credentials: 'include'
    });
    
    if (!response.ok) return null;
    return response.json();
  }
}

// Silent authentication for SSO
async function silentAuth() {
  try {
    // Create hidden iframe
    const iframe = document.createElement('iframe');
    iframe.style.display = 'none';
    document.body.appendChild(iframe);
    
    // Generate PKCE parameters
    const { codeVerifier, codeChallenge } = await generatePKCE();
    
    // Build auth URL with prompt=none
    const authUrl = new URL(OAUTH_CONFIG.authEndpoint);
    authUrl.searchParams.set('client_id', OAUTH_CONFIG.clientId);
    authUrl.searchParams.set('redirect_uri', OAUTH_CONFIG.redirectUri);
    authUrl.searchParams.set('response_type', 'code');
    authUrl.searchParams.set('scope', 'openid profile');
    authUrl.searchParams.set('prompt', 'none'); // Silent auth
    authUrl.searchParams.set('code_challenge', codeChallenge);
    authUrl.searchParams.set('code_challenge_method', 'S256');
    
    // Load auth URL in iframe
    iframe.src = authUrl.toString();
    
    // Wait for response
    const code = await waitForAuthCode(iframe, 10000); // 10s timeout
    
    // Exchange code for tokens
    const tokens = await exchangeCode(code, codeVerifier);
    
    // Clean up
    document.body.removeChild(iframe);
    
    return { success: true, tokens };
    
  } catch (error) {
    // Silent auth failed, user needs to log in
    return { success: false, error };
  }
}

# Device authorization flow for CLI/TV apps
import requests
import time
from urllib.parse import urlencode

class DeviceAuthFlow:
    def __init__(self, client_id):
        self.client_id = client_id
        self.device_endpoint = "https://api.parrotrouter.com/oauth/device"
        self.token_endpoint = "https://api.parrotrouter.com/oauth/token"
    
    def start_device_flow(self):
        # Request device code
        response = requests.post(self.device_endpoint, data={
            'client_id': self.client_id,
            'scope': 'openid profile api.read'
        })
        
        device_data = response.json()
        
        # Display code to user
        print(f"\n=== Device Authorization ===")
        print(f"1. Visit: {device_data['verification_uri']}")
        print(f"2. Enter code: {device_data['user_code']}")
        print(f"\nOr visit: {device_data['verification_uri_complete']}")
        print(f"\nWaiting for authorization...")
        
        # Poll for token
        return self.poll_for_token(
            device_data['device_code'],
            device_data['interval']
        )
    
    def poll_for_token(self, device_code, interval):
        while True:
            time.sleep(interval)
            
            response = requests.post(self.token_endpoint, data={
                'grant_type': 'urn:ietf:params:oauth:grant-type:device_code',
                'device_code': device_code,
                'client_id': self.client_id
            })
            
            if response.status_code == 200:
                # Success!
                tokens = response.json()
                print("\nAuthorization successful!")
                return tokens
            
            error = response.json().get('error')
            
            if error == 'authorization_pending':
                # Still waiting for user
                continue
            elif error == 'slow_down':
                # Increase polling interval
                interval += 5
            else:
                # Error occurred
                raise Exception(f"Device auth failed: {error}")

# Usage
device_auth = DeviceAuthFlow('your-cli-client-id')
tokens = device_auth.start_device_flow()
print(f"Access token: {tokens['access_token'][:20]}...")