fix: access token validation

recipe/thirdparty/providers/config_utils.go

@@ -28,6 +28,7 @@ func getProviderConfigForClient(config tpmodels.ProviderConfig, clientConfig tpm
 		OIDCDiscoveryEndpoint:            config.OIDCDiscoveryEndpoint,
 		UserInfoMap:                      config.UserInfoMap,
 		ValidateIdTokenPayload:           config.ValidateIdTokenPayload,
+		ValidateAccessToken:              config.ValidateAccessToken,
 		RequireEmail:                     config.RequireEmail,
 		GenerateFakeEmail:                config.GenerateFakeEmail,
 	}

recipe/thirdparty/providers/github.go

@@ -16,6 +16,7 @@
 package providers
 
 import (
+	"encoding/base64"
 	"errors"
 	"fmt"
 
@@ -36,6 +37,36 @@ func Github(input tpmodels.ProviderInput) *tpmodels.TypeProvider {
 		input.Config.TokenEndpoint = "https://github.com/login/oauth/access_token"
 	}
 
+	if input.Config.ValidateAccessToken == nil {
+		input.Config.ValidateAccessToken = func(accessToken string, clientConfig tpmodels.ProviderConfigForClientType, userContext supertokens.UserContext) error {
+			credentials := fmt.Sprintf("%s:%s", clientConfig.ClientID, clientConfig.ClientSecret)
+			basicAuthToken := base64.StdEncoding.EncodeToString([]byte(credentials))
+
+			resp, err := doPostRequest(
+				fmt.Sprintf("https://api.github.com/applications/%s/token", clientConfig.ClientID),
+				map[string]interface{}{
+					"access_token": accessToken,
+				},
+				map[string]interface{}{
+					"Authorization": fmt.Sprintf("Basic %s", basicAuthToken),
+				},
+			)
+			if err != nil {
+				return err
+			}
+
+			if _, ok := resp["app"]; !ok {
+				return errors.New("Access token does not belong to your application")
+			}
+
+			if resp["client_id"].(string) != clientConfig.ClientID {
+				return errors.New("Access token does not belong to your application")
+			}
+
+			return nil
+		}
+	}
+
 	oOverride := input.Override
 
 	input.Override = func(originalImplementation *tpmodels.TypeProvider) *tpmodels.TypeProvider {

recipe/thirdparty/providers/oauth2_impl.go

@@ -144,6 +144,13 @@ func oauth2_GetUserInfo(config tpmodels.ProviderConfigForClientType, oAuthTokens
 		}
 	}
 
+	if accessTokenOk && config.ValidateAccessToken != nil {
+		err := config.ValidateAccessToken(accessToken, config, userContext)
+		if err != nil {
+			return tpmodels.TypeUserInfo{}, err
+		}
+	}
+
 	if accessTokenOk && config.UserInfoEndpoint != "" {
 		headers := map[string]string{
 			"Authorization": "Bearer " + accessToken,

recipe/thirdparty/tpmodels/models.go

@@ -126,7 +126,15 @@ type ProviderConfig struct {
 	RequireEmail                     *bool                  `json:"requireEmail,omitempty"`
 
 	ValidateIdTokenPayload func(idTokenPayload map[string]interface{}, clientConfig ProviderConfigForClientType, userContext supertokens.UserContext) error `json:"-"`
-	GenerateFakeEmail      func(thirdPartyUserId string, tenantId string, userContext supertokens.UserContext) string                                       `json:"-"`
+
+	/**
+	 * This function is responsible for validating the access token received from the third party provider.
+	 * This check can include checking the expiry of the access token, checking the audience of the access token, etc.
+	 *
+	 * This function should return an error if the access token should be considered invalid, or return nothing if it is valid
+	 */
+	ValidateAccessToken func(accessToken string, clientConfig ProviderConfigForClientType, userContext supertokens.UserContext) error `json:"-"`
+	GenerateFakeEmail   func(thirdPartyUserId string, tenantId string, userContext supertokens.UserContext) string                    `json:"-"`
 }
 
 type ProviderClientConfig struct {
@@ -158,6 +166,7 @@ type ProviderConfigForClientType struct {
 	OIDCDiscoveryEndpoint            string
 	UserInfoMap                      TypeUserInfoMap
 	ValidateIdTokenPayload           func(idTokenPayload map[string]interface{}, clientConfig ProviderConfigForClientType, userContext supertokens.UserContext) error
+	ValidateAccessToken              func(accessToken string, clientConfig ProviderConfigForClientType, userContext supertokens.UserContext) error `json:"-"`
 
 	RequireEmail      *bool
 	GenerateFakeEmail func(thirdPartyUserId string, tenantId string, userContext supertokens.UserContext) string