pkce.hpp

Go to the documentation of this file.

#pragma once
#ifndef KURLYK_HEADER_KURLYK_UTILS_PKCE_HPP_INCLUDED
#define KURLYK_HEADER_KURLYK_UTILS_PKCE_HPP_INCLUDED

 
#include "base64_url.hpp"
#include <openssl/evp.h>
#include <openssl/rand.h>
#include <limits>
#include <stdexcept>
#include <string>
#include <vector>
#include <cstdint>
 
namespace kurlyk {
namespace utils {
 
namespace detail {

    inline void random_bytes(uint8_t* data, std::size_t size) {
        if (size > static_cast<std::size_t>((std::numeric_limits<int>::max)()) ||
            RAND_bytes(
                reinterpret_cast<unsigned char*>(data),
                static_cast<int>(size)) != 1) {
            throw std::runtime_error("OpenSSL RAND_bytes failed");
        }
    }

    inline std::vector<uint8_t> sha256(const void* data, std::size_t size) {
        std::vector<uint8_t> digest(EVP_MAX_MD_SIZE);
        unsigned int digest_size = 0;
 
        if (EVP_Digest(
                data,
                size,
                reinterpret_cast<unsigned char*>(digest.data()),
                &digest_size,
                EVP_sha256(),
                nullptr) != 1) {
            throw std::runtime_error("OpenSSL SHA-256 digest failed");
        }
 
        digest.resize(digest_size);
        return digest;
    }
 
} // namespace detail

    struct PkcePair {
        std::string code_verifier;          
        std::string code_challenge;         
        std::string code_challenge_method = "S256"; 
    };

    inline std::string generate_code_verifier(std::size_t length = 64) {
        static const char allowed[] =
            "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~";
        if (length < 43) length = 43;
        if (length > 128) length = 128;
 
        std::string verifier;
        verifier.reserve(length);
 
        const std::size_t allowed_count = sizeof(allowed) - 1; // exclude null terminator
        const std::size_t accepted_limit = 256 - (256 % allowed_count);
 
        while (verifier.size() < length) {
            const std::size_t remaining = length - verifier.size();
            std::vector<uint8_t> random_data(remaining);
            detail::random_bytes(random_data.data(), random_data.size());
 
            for (std::size_t i = 0; i < random_data.size() && verifier.size() < length; ++i) {
                if (random_data[i] >= accepted_limit) {
                    continue;
                }
                verifier.push_back(allowed[random_data[i] % allowed_count]);
            }
        }
        return verifier;
    }

    inline std::string make_s256_code_challenge(const std::string& verifier) {
        std::vector<uint8_t> digest = detail::sha256(verifier.data(), verifier.size());
        return base64url_encode(digest.data(), digest.size());
    }

    inline PkcePair make_pkce_pair() {
        PkcePair pair;
        pair.code_verifier = generate_code_verifier();
        pair.code_challenge = make_s256_code_challenge(pair.code_verifier);
        return pair;
    }
 
} // namespace utils
} // namespace kurlyk
 
#endif // KURLYK_HEADER_KURLYK_UTILS_PKCE_HPP_INCLUDED