Added WorldId provider

AspNet.Security.OAuth.Providers.sln

@@ -299,6 +299,8 @@ Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "AspNet.Security.OAuth.PingO
 EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "AspNet.Security.OAuth.JumpCloud", "src\AspNet.Security.OAuth.JumpCloud\AspNet.Security.OAuth.JumpCloud.csproj", "{8AF5DDBE-2631-4E71-9045-73A6356CE86B}"
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "AspNet.Security.OAuth.WorldID", "src\AspNet.Security.OAuth.WorldID\AspNet.Security.OAuth.WorldID.csproj", "{05636DB7-37C4-48B1-9093-FE1428DBCF98}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@@ -685,6 +687,10 @@ Global
 		{8AF5DDBE-2631-4E71-9045-73A6356CE86B}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{8AF5DDBE-2631-4E71-9045-73A6356CE86B}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{8AF5DDBE-2631-4E71-9045-73A6356CE86B}.Release|Any CPU.Build.0 = Release|Any CPU
+		{05636DB7-37C4-48B1-9093-FE1428DBCF98}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{05636DB7-37C4-48B1-9093-FE1428DBCF98}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{05636DB7-37C4-48B1-9093-FE1428DBCF98}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{05636DB7-37C4-48B1-9093-FE1428DBCF98}.Release|Any CPU.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
@@ -791,6 +797,7 @@ Global
 		{101681FB-569F-4941-B943-2AD380039BE0} = {C1352FD3-AE8B-43EE-B45B-F6E0B3FBAC6D}
 		{CF8C4235-6AE6-404E-B572-4FF4E85AB5FF} = {C1352FD3-AE8B-43EE-B45B-F6E0B3FBAC6D}
 		{8AF5DDBE-2631-4E71-9045-73A6356CE86B} = {C1352FD3-AE8B-43EE-B45B-F6E0B3FBAC6D}
+		{05636DB7-37C4-48B1-9093-FE1428DBCF98} = {C1352FD3-AE8B-43EE-B45B-F6E0B3FBAC6D}
 	EndGlobalSection
 	GlobalSection(ExtensibilityGlobals) = postSolution
 		SolutionGuid = {C7B54DE2-6407-4802-AD9C-CE54BF414C8C}

README.md

@@ -211,6 +211,7 @@ If a provider you're looking for does not exist, consider making a PR to add one
 | Weixin (WeChat) | [![NuGet](https://buildstats.info/nuget/AspNet.Security.OAuth.Weixin?includePreReleases=false)](https://www.nuget.org/packages/AspNet.Security.OAuth.Weixin/ "Download AspNet.Security.OAuth.Weixin from NuGet.org") | [![MyGet](https://buildstats.info/myget/aspnet-contrib/AspNet.Security.OAuth.Weixin?includePreReleases=true)](https://www.myget.org/feed/aspnet-contrib/package/nuget/AspNet.Security.OAuth.Weixin "Download AspNet.Security.OAuth.Weixin from MyGet.org") | [Documentation](https://open.wechat.com/cgi-bin/newreadtemplate?t=overseas_open/docs/web/login/login "WeChat developer documentation") |
 | WordPress | [![NuGet](https://buildstats.info/nuget/AspNet.Security.OAuth.WordPress?includePreReleases=false)](https://www.nuget.org/packages/AspNet.Security.OAuth.WordPress/ "Download AspNet.Security.OAuth.WordPress from NuGet.org") | [![MyGet](https://buildstats.info/myget/aspnet-contrib/AspNet.Security.OAuth.WordPress?includePreReleases=true)](https://www.myget.org/feed/aspnet-contrib/package/nuget/AspNet.Security.OAuth.WordPress "Download AspNet.Security.OAuth.WordPress from MyGet.org") | [Documentation](https://developer.wordpress.com/docs/oauth2/ "WordPress developer documentation") |
 | WorkWeixin (WeCom) | [![NuGet](https://buildstats.info/nuget/AspNet.Security.OAuth.WorkWeixin?includePreReleases=false)](https://www.nuget.org/packages/AspNet.Security.OAuth.WorkWeixin/ "Download AspNet.Security.OAuth.WorkWeixin from NuGet.org") | [![MyGet](https://buildstats.info/myget/aspnet-contrib/AspNet.Security.OAuth.WorkWeixin?includePreReleases=true)](https://www.myget.org/feed/aspnet-contrib/package/nuget/AspNet.Security.OAuth.WorkWeixin "Download AspNet.Security.OAuth.WorkWeixin from MyGet.org") | [Documentation](https://open.work.weixin.qq.com/api/doc/ "WorkWeixin developer documentation") |
+| WorldID (Worldcoin) | [![NuGet](https://buildstats.info/nuget/AspNet.Security.OAuth.WorldID?includePreReleases=false)](https://www.nuget.org/packages/AspNet.Security.OAuth.WorldID/ "Download AspNet.Security.OAuth.WorldID from NuGet.org") | [![MyGet](https://buildstats.info/myget/aspnet-contrib/AspNet.Security.OAuth.WorldID?includePreReleases=true)](https://www.myget.org/feed/aspnet-contrib/package/nuget/AspNet.Security.OAuth.WorldID "Download AspNet.Security.OAuth.WorldID from MyGet.org") | [Documentation](https://docs.worldcoin.org/ "WorldID developer documentation") |]
 | Xero | [![NuGet](https://buildstats.info/nuget/AspNet.Security.OAuth.Xero?includePreReleases=false)](https://www.nuget.org/packages/AspNet.Security.OAuth.Xero/ "Download AspNet.Security.OAuth.Xero from NuGet.org") | [![MyGet](https://buildstats.info/myget/aspnet-contrib/AspNet.Security.OAuth.Xero?includePreReleases=true)](https://www.myget.org/feed/aspnet-contrib/package/nuget/AspNet.Security.OAuth.Xero "Download AspNet.Security.OAuth.Xero from MyGet.org") | [Documentation](https://developer.xero.com/documentation/guides/oauth2/sign-in/ "Xero developer documentation") |
 | Xumm | [![NuGet](https://buildstats.info/nuget/AspNet.Security.OAuth.Xumm?includePreReleases=false)](https://www.nuget.org/packages/AspNet.Security.OAuth.Xumm/ "Download AspNet.Security.OAuth.Xumm from NuGet.org") | [![MyGet](https://buildstats.info/myget/aspnet-contrib/AspNet.Security.OAuth.Xumm?includePreReleases=true)](https://www.myget.org/feed/aspnet-contrib/package/nuget/AspNet.Security.OAuth.Xumm "Download AspNet.Security.OAuth.Xumm from MyGet.org") | [Documentation](https://xumm.readme.io/docs/user-sign-in-identity-provider "Xumm developer documentation") |
 | Yahoo | [![NuGet](https://buildstats.info/nuget/AspNet.Security.OAuth.Yahoo?includePreReleases=false)](https://www.nuget.org/packages/AspNet.Security.OAuth.Yahoo/ "Download AspNet.Security.OAuth.Yahoo from NuGet.org") | [![MyGet](https://buildstats.info/myget/aspnet-contrib/AspNet.Security.OAuth.Yahoo?includePreReleases=true)](https://www.myget.org/feed/aspnet-contrib/package/nuget/AspNet.Security.OAuth.Yahoo "Download AspNet.Security.OAuth.Yahoo from MyGet.org") | [Documentation](https://developer.yahoo.com/oauth2/guide/ "Yahoo developer documentation") |

src/AspNet.Security.OAuth.WorldID/AspNet.Security.OAuth.WorldID.csproj

@@ -0,0 +1,23 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFrameworks>$(DefaultNetCoreTargetFramework)</TargetFrameworks>
+  </PropertyGroup>
+
+  <!-- TODO Remove once published to NuGet.org -->
+  <PropertyGroup>
+    <DisablePackageBaselineValidation>true</DisablePackageBaselineValidation>
+  </PropertyGroup>
+
+  <PropertyGroup>
+    <Description>ASP.NET Core security middleware enabling WorldID authentication.</Description>
+    <Authors>Sandro Hanea</Authors>
+    <PackageTags>aspnetcore;authentication;worldid;oauth;security</PackageTags>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <FrameworkReference Include="Microsoft.AspNetCore.App" />
+    <PackageReference Include="JetBrains.Annotations" PrivateAssets="All" />
+  </ItemGroup>
+
+</Project>

src/AspNet.Security.OAuth.WorldID/WorldIDAuthenticationConstants.cs

@@ -0,0 +1,19 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
+ * See https://github.com/aspnet-contrib/AspNet.Security.OAuth.Providers
+ * for more information concerning the license and the contributors participating to this project.
+ */
+
+namespace AspNet.Security.OAuth.WorldID;
+
+/// <summary>
+/// Contains constants specific to the <see cref="WorldIDAuthenticationHandler"/>.
+/// </summary>
+public static class WorldIDAuthenticationConstants
+{
+    public static class Claims
+    {
+        public const string CredentialType = "urn:worldid:credential_type";
+        public const string LikelyHuman = "urn:worldid:likely_human";
+    }
+}

src/AspNet.Security.OAuth.WorldID/WorldIDAuthenticationDefaults.cs

@@ -0,0 +1,45 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
+ * See https://github.com/aspnet-contrib/AspNet.Security.OAuth.Providers
+ * for more information concerning the license and the contributors participating to this project.
+ */
+
+namespace AspNet.Security.OAuth.WorldID;
+
+public static class WorldIDAuthenticationDefaults
+{
+    /// <summary>
+    /// Default value for <see cref="AuthenticationScheme.Name"/>.
+    /// </summary>
+    public const string AuthenticationScheme = "WorldID";
+
+    /// <summary>
+    /// Default value for <see cref="AuthenticationScheme.DisplayName"/>.
+    /// </summary>
+    public static readonly string DisplayName = "World ID";
+
+    /// <summary>
+    /// Default value for <see cref="AuthenticationSchemeOptions.ClaimsIssuer"/>.
+    /// </summary>
+    public static readonly string Issuer = "WorldID";
+
+    /// <summary>
+    /// Default value for <see cref="RemoteAuthenticationOptions.CallbackPath"/>.
+    /// </summary>
+    public static readonly string CallbackPath = "/signin-worldid";
+
+    /// <summary>
+    /// Default value for <see cref="OAuthOptions.AuthorizationEndpoint"/>.
+    /// </summary>
+    public static readonly string AuthorizationEndpoint = "https://id.worldcoin.org/authorize";
+
+    /// <summary>
+    /// Default value for <see cref="OAuthOptions.TokenEndpoint"/>.
+    /// </summary>
+    public static readonly string TokenEndpoint = "https://id.worldcoin.org/token";
+
+    /// <summary>
+    /// Default value for <see cref="OAuthOptions.UserInformationEndpoint"/>.
+    /// </summary>
+    public static readonly string UserInformationEndpoint = "https://id.worldcoin.org/userinfo";
+}

src/AspNet.Security.OAuth.WorldID/WorldIDAuthenticationExtensions.cs

@@ -0,0 +1,76 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
+ * See https://github.com/aspnet-contrib/AspNet.Security.OAuth.Providers
+ * for more information concerning the license and the contributors participating to this project.
+ */
+
+using AspNet.Security.OAuth.WorldID;
+using Microsoft.Extensions.DependencyInjection.Extensions;
+using Microsoft.Extensions.Options;
+
+namespace Microsoft.Extensions.DependencyInjection;
+
+/// <summary>
+/// Extension methods to add WorldID authentication capabilities to an HTTP application pipeline.
+/// </summary>
+public static class WorldIdAuthenticationExtensions
+{
+    /// <summary>
+    /// Adds <see cref="WorldIDAuthenticationHandler"/> to the specified
+    /// <see cref="AuthenticationBuilder"/>, which enables World ID authentication capabilities.
+    /// </summary>
+    /// <param name="builder">The authentication builder.</param>
+    /// <returns>The <see cref="AuthenticationBuilder"/>.</returns>
+    public static AuthenticationBuilder AddWorldID([NotNull] this AuthenticationBuilder builder)
+    {
+        return builder.AddWorldID(WorldIDAuthenticationDefaults.AuthenticationScheme, options => { });
+    }
+
+    /// <summary>
+    /// Adds <see cref="WorldIDAuthenticationHandler"/> to the specified
+    /// <see cref="AuthenticationBuilder"/>, which enables WorldID authentication capabilities.
+    /// </summary>
+    /// <param name="builder">The authentication builder.</param>
+    /// <param name="configuration">The delegate used to configure the OpenID 2.0 options.</param>
+    /// <returns>The <see cref="AuthenticationBuilder"/>.</returns>
+    public static AuthenticationBuilder AddWorldID(
+        [NotNull] this AuthenticationBuilder builder,
+        [NotNull] Action<WorldIDAuthenticationOptions> configuration)
+    {
+        return builder.AddWorldID(WorldIDAuthenticationDefaults.AuthenticationScheme, configuration);
+    }
+
+    /// <summary>
+    /// Adds <see cref="WorldIDAuthenticationHandler"/> to the specified
+    /// <see cref="AuthenticationBuilder"/>, which enables WorldID authentication capabilities.
+    /// </summary>
+    /// <param name="builder">The authentication builder.</param>
+    /// <param name="scheme">The authentication scheme associated with this instance.</param>
+    /// <param name="configuration">The delegate used to configure the WorldID options.</param>
+    /// <returns>The <see cref="AuthenticationBuilder"/>.</returns>
+    public static AuthenticationBuilder AddWorldID(
+        [NotNull] this AuthenticationBuilder builder,
+        [NotNull] string scheme,
+        [NotNull] Action<WorldIDAuthenticationOptions> configuration)
+    {
+        return builder.AddWorldID(scheme, WorldIDAuthenticationDefaults.DisplayName, configuration);
+    }
+
+    /// <summary>
+    /// Adds <see cref="WorldIDAuthenticationHandler"/> to the specified
+    /// <see cref="AuthenticationBuilder"/>, which enables WorldID authentication capabilities.
+    /// </summary>
+    /// <param name="builder">The authentication builder.</param>
+    /// <param name="scheme">The authentication scheme associated with this instance.</param>
+    /// <param name="caption">The optional display name associated with this instance.</param>
+    /// <param name="configuration">The delegate used to configure the WorldID options.</param>
+    /// <returns>The <see cref="AuthenticationBuilder"/>.</returns>
+    public static AuthenticationBuilder AddWorldID(
+        [NotNull] this AuthenticationBuilder builder,
+        [NotNull] string scheme,
+        [CanBeNull] string caption,
+        [NotNull] Action<WorldIDAuthenticationOptions> configuration)
+    {
+        return builder.AddOAuth<WorldIDAuthenticationOptions, WorldIDAuthenticationHandler>(scheme, caption, configuration);
+    }
+}

src/AspNet.Security.OAuth.WorldID/WorldIDAuthenticationHandler.cs

@@ -0,0 +1,70 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
+ * See https://github.com/aspnet-contrib/AspNet.Security.OAuth.Providers
+ * for more information concerning the license and the contributors participating to this project.
+ */
+
+using System.Net.Http.Headers;
+using System.Security.Claims;
+using System.Text.Encodings.Web;
+using System.Text.Json;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+
+namespace AspNet.Security.OAuth.WorldID;
+
+public partial class WorldIDAuthenticationHandler : OAuthHandler<WorldIDAuthenticationOptions>
+{
+    public WorldIDAuthenticationHandler(
+        [NotNull] IOptionsMonitor<WorldIDAuthenticationOptions> options,
+        [NotNull] ILoggerFactory logger,
+        [NotNull] UrlEncoder encoder)
+        : base(options, logger, encoder)
+    {
+    }
+
+    protected override async Task<AuthenticationTicket> CreateTicketAsync(
+        [NotNull] ClaimsIdentity identity,
+        [NotNull] AuthenticationProperties properties,
+        [NotNull] OAuthTokenResponse tokens)
+    {
+        using var request = new HttpRequestMessage(HttpMethod.Post, Options.UserInformationEndpoint);
+        request.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
+        request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", tokens.AccessToken);
+
+        using var response = await Backchannel.SendAsync(request, HttpCompletionOption.ResponseHeadersRead, Context.RequestAborted);
+        if (!response.IsSuccessStatusCode)
+        {
+            await Log.UserProfileErrorAsync(Logger, response, Context.RequestAborted);
+            throw new HttpRequestException("An error occurred while retrieving the user profile.");
+        }
+
+        using var payload = JsonDocument.Parse(await response.Content.ReadAsStringAsync(Context.RequestAborted));
+
+        var principal = new ClaimsPrincipal(identity);
+        var context = new OAuthCreatingTicketContext(principal, properties, Context, Scheme, Options, Backchannel, tokens, payload.RootElement);
+        context.RunClaimActions();
+
+        await Events.CreatingTicket(context);
+        return new AuthenticationTicket(context.Principal!, context.Properties, Scheme.Name);
+    }
+
+    private static partial class Log
+    {
+        internal static async Task UserProfileErrorAsync(ILogger logger, HttpResponseMessage response, CancellationToken cancellationToken)
+        {
+            UserProfileError(
+                logger,
+                response.StatusCode,
+                response.Headers.ToString(),
+                await response.Content.ReadAsStringAsync(cancellationToken));
+        }
+
+        [LoggerMessage(1, LogLevel.Error, "An error occurred while retrieving the user profile: the remote server returned a {Status} response with the following payload: {Headers} {Body}.")]
+        private static partial void UserProfileError(
+            ILogger logger,
+            System.Net.HttpStatusCode status,
+            string headers,
+            string body);
+    }
+}

src/AspNet.Security.OAuth.WorldID/WorldIDAuthenticationOptions.cs

@@ -0,0 +1,35 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
+ * See https://github.com/aspnet-contrib/AspNet.Security.OAuth.Providers
+ * for more information concerning the license and the contributors participating to this project.
+ */
+
+using System.Security.Claims;
+using static AspNet.Security.OAuth.WorldID.WorldIDAuthenticationConstants;
+
+namespace AspNet.Security.OAuth.WorldID;
+
+/// <summary>
+/// Defines a set of options used by <see cref="WorldIDAuthenticationHandler"/>.
+/// </summary>
+public class WorldIDAuthenticationOptions : OAuthOptions
+{
+    public WorldIDAuthenticationOptions()
+    {
+        ClaimsIssuer = WorldIDAuthenticationDefaults.Issuer;
+        CallbackPath = WorldIDAuthenticationDefaults.CallbackPath;
+
+        AuthorizationEndpoint = WorldIDAuthenticationDefaults.AuthorizationEndpoint;
+        TokenEndpoint = WorldIDAuthenticationDefaults.TokenEndpoint;
+        UserInformationEndpoint = WorldIDAuthenticationDefaults.UserInformationEndpoint;
+
+        Scope.Add("openid");
+        Scope.Add("email");
+
+        ClaimActions.MapJsonKey(ClaimTypes.NameIdentifier, "sub");
+        ClaimActions.MapJsonKey(ClaimTypes.Name, "name");
+        ClaimActions.MapJsonKey(ClaimTypes.Email, "email");
+        ClaimActions.MapJsonSubKey(Claims.CredentialType, "https://id.worldcoin.org/beta", "credential_type");
+        ClaimActions.MapJsonSubKey(Claims.LikelyHuman, "https://id.worldcoin.org/beta", "likely_human");
+    }
+}

test/AspNet.Security.OAuth.Providers.Tests/WorldID/WorldIDTests.cs

@@ -0,0 +1,29 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
+ * See https://github.com/aspnet-contrib/AspNet.Security.OAuth.Providers
+ * for more information concerning the license and the contributors participating to this project.
+ */
+
+namespace AspNet.Security.OAuth.WorldID;
+
+public class WorldIDTests(ITestOutputHelper outputHelper) : OAuthTests<WorldIDAuthenticationOptions>(outputHelper)
+{
+    public override string DefaultScheme => WorldIDAuthenticationDefaults.AuthenticationScheme;
+
+    protected internal override void RegisterAuthentication(AuthenticationBuilder builder)
+    {
+        builder.AddWorldID(options =>
+        {
+            ConfigureDefaults(builder, options);
+        });
+    }
+
+    [Theory]
+    [InlineData(ClaimTypes.NameIdentifier, "0x2ae86d6d747702b3b2c81811cd2b39875e8fa6b780ee4a207bdc203a7860b535")]
+    [InlineData(ClaimTypes.Name, "World ID User")]
+    [InlineData(ClaimTypes.Email, "0x2ae86d6d747702b3b2c81811cd2b39875e8fa6b780ee4a207bdc203a7860b535@id.worldcoin.org")]
+    [InlineData(WorldIDAuthenticationConstants.Claims.CredentialType, "orb")]
+    [InlineData(WorldIDAuthenticationConstants.Claims.LikelyHuman, "strong")]
+    public async Task Can_Sign_In_Using_WorldID(string claimType, string claimValue)
+        => await AuthenticateUserAndAssertClaimValue(claimType, claimValue);
+}