Initial commit

.gitignore

@@ -0,0 +1,7 @@
+.DS_Store
+.idea
+*.iml
+*.pem
+sdk/java-src/target
+examples/java/target
+heroku.properties

CONTRIBUTING.md

@@ -0,0 +1,20 @@
+# Contributing to DelegatedRecoveryReferenceImplementation
+
+This project contains early access sample application and alpha SDK.
+
+Please [open an issue](https://github.com/facebook/DelegatedRecoveryReferenceImplementation/issues)
+for any bugs or feature requests.
+
+We are not accepting pull requests at this time.
+
+## Issues
+We use GitHub issues to track public bugs. Please ensure your description is
+clear and has sufficient instructions to be able to reproduce the issue.
+
+Facebook has a [bounty program](https://www.facebook.com/whitehat/) for the safe
+disclosure of security bugs. In those cases, please go through the process
+outlined on that page and do not file a public issue.
+
+## License
+By contributing to DelegatedRecoveryReferenceImplementation, you agree that your contributions
+will be licensed under the LICENSE file in the root directory of this source tree.

LICENSE

@@ -0,0 +1,30 @@
+BSD License
+
+For DelegatedRecoverReferenceImplementation software
+
+Copyright (c) 2016-present, Facebook, Inc. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+ * Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+ * Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+ * Neither the name Facebook nor the names of its contributors may be used to
+   endorse or promote products derived from this software without specific
+   prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

LICENSE-examples

@@ -0,0 +1,11 @@
+Copyright (c) 2017-present, Facebook, Inc. All rights reserved.
+
+The examples provided by Facebook are for non-commercial testing and evaluation
+purposes only. Facebook reserves all rights not expressly granted.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+FACEBOOK BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

PATENTS

@@ -0,0 +1,33 @@
+Additional Grant of Patent Rights Version 2
+
+"Software" means the DelegatedRecoveryReferenceImplementation software contributed by Facebook, Inc.
+
+Facebook, Inc. ("Facebook") hereby grants to each recipient of the Software
+("you") a perpetual, worldwide, royalty-free, non-exclusive, irrevocable
+(subject to the termination provision below) license under any Necessary
+Claims, to make, have made, use, sell, offer to sell, import, and otherwise
+transfer the Software. For avoidance of doubt, no license is granted under
+Facebook’s rights in any patent claims that are infringed by (i) modifications
+to the Software made by you or any third party or (ii) the Software in
+combination with any software or other technology.
+
+The license granted hereunder will terminate, automatically and without notice,
+if you (or any of your subsidiaries, corporate affiliates or agents) initiate
+directly or indirectly, or take a direct financial interest in, any Patent
+Assertion: (i) against Facebook or any of its subsidiaries or corporate
+affiliates, (ii) against any party if such Patent Assertion arises in whole or
+in part from any software, technology, product or service of Facebook or any of
+its subsidiaries or corporate affiliates, or (iii) against any party relating
+to the Software. Notwithstanding the foregoing, if Facebook or any of its
+subsidiaries or corporate affiliates files a lawsuit alleging patent
+infringement against you in the first instance, and you respond by filing a
+patent infringement counterclaim in that lawsuit against that party that is
+unrelated to the Software, the license granted hereunder will not terminate
+under section (i) of this paragraph due to such counterclaim.
+
+A "Necessary Claim" is a claim of a patent owned by Facebook that is
+necessarily infringed by the Software standing alone.
+
+A "Patent Assertion" is any lawsuit or other action alleging direct, indirect,
+or contributory infringement or inducement to infringe any patent, including a
+cross-claim or counterclaim.

README.md

@@ -0,0 +1,30 @@
+# DelegatedRecoveryReferenceImplementation
+
+This repository contains alpha SDKs and sample applications for using
+delegated account recovery with Facebook.
+
+Code under the /sdk directory is licensed under the BSD-style license found in the
+LICENSE file in the root directory of this source tree. An additional grant
+of patent rights can be found in the PATENTS file in the same directory.
+
+**These SDKs are alpha and subject to change.**
+
+Code under the /examples directory is licensed under the license found in the
+LICENSE-examples file in the root directory of this source tree.
+
+**The example applications are for non-commercial testing and evaluation purposes only.**
+
+## Specification
+See the protocol specification for additional information on the delegated recovery protocol:
+[https://github.com/facebook/DelegatedRecoverySpecification](https://github.com/facebook/DelegatedRecoverySpecification)
+
+## Example Applications
+Example application for NodeJS: [README.md](https://github.com/facebook/DelegatedRecoveryReferenceImplementation/blob/master/examples/nodejs/README.md)
+
+Example application for Java: [README.md](https://github.com/facebook/DelegatedRecoveryReferenceImplementation/blob/master/examples/java/README.md)
+
+## Developer documentation
+To use the SDKs, please see documentation available at [https://developers.facebook.com/docs/delegated-recovery/](https://developers.facebook.com/docs/delegated-recovery/)
+
+## Contributing
+See [CONTRIBUTING.md](https://github.com/facebook/DelegatedRecoveryReferenceImplementation/blob/master/CONTRIBUTING.md)

circle.yml

@@ -0,0 +1,10 @@
+dependencies:
+  override:
+    - mvn package
+  post:
+    - npm i -g eslint
+    - npm i -g eslint-plugin-json
+
+test:
+  override:
+    - eslint ./sdk/js-src/index.js

examples/java/README.md

@@ -0,0 +1,103 @@
+# Delegated Account Recovery Example Application for Java
+The "examples/java"  directory of
+[https://github.com/facebook/DelegatedRecoveryReferenceImplementation](https://github.com/facebook/DelegatedRecoveryReferenceImplementation) provides an example web application and library for using the Delegated Account
+Recovery protocol documented at [https://github.com/facebook/DelegatedRecoveryReferenceImplementation](https://github.com/facebook/DelegatedRecoveryReferenceImplementation)
+
+**This is an alpha implementation and subject to change.**
+
+## Sample app
+The `com.fbsamples.delegatedrecovery.sparkapp` package contains a sample
+app that demonstrates the basic features of using delegated account recovery
+with Facebook.  It is intended to demonstrate concepts and is for evaluation purposes only.
+
+## Dependencies
+Java version 1.8 is required.
+
+The sample app is built using the [Spark Framework](https://sparkjava.com/).
+
+The application is built to deploy on [Heroku](https://heroku.com/).
+
+The overall project is build using [Maven](https://maven.apache.org/) and its
+dependencies are listed in the `pom.xml` file.
+
+## Installation
+Begin by forking the repository.  In the top right corner of [the repository home page on GitHub](https://github.com/facebook/DelegatedRecoveryReferenceImplementation), click **Fork** ![Fork](https://help.github.com/assets/images/help/repository/fork_button.jpg)
+
+Now, in your bash command line, get a copy of the forked repository.
+```bash
+$ git clone https://github.com/{your-github-username}/DelegatedRecoveryReferenceImplementation
+```
+
+Change to the sample application directory of your cloned repository
+```bash
+$ cd DelegatedRecoveryReferenceImplementation/examples/java
+```
+
+To deploy, pick a name for your app on Heroku.  Using the command line Heroku toolbelt,
+create the app.
+```bash
+$ heroku create my-app-name
+```
+
+Then create a file called 'heroku.properties' that defines your app name
+```bash
+$ echo "heroku.appName=my-app-name" >> heroku.properties
+$ echo "heroku.properties" >> .gitignore
+```
+
+Next, you need to set some config variables for the application. 
+You must have a recent build of openssl to complete this step. 
+
+First set the issuer origin:
+
+```bash
+$ heroku config:set ISSUER_ORIGIN=https://{my-app-name}.herokuapp.com --app my-app-name
+```
+
+Create the assymetric key pair for signing recovery tokens.
+```bash
+$ openssl ecparam -name prime256v1 -genkey -noout -out prime256v1-key.pem
+$ openssl ec -in prime256v1-key.pem -pubout -out prime256v1-pub.pem
+```
+
+Make sure you don't check the secret keys into your source control.  It is
+important to keep a backup of every private key and symmetric key ever
+used in order to verify and ecrypt tokens being returned to your app as part
+a recovery, but it's always a bad idea to keep secrets in source control.
+(it's fine to check in the public key if you want)
+```bash
+$ echo "*.pem" >> .gitignore
+```
+
+ And now we'll strip the PEM files down to unadorned, single-line base64
+for use as config variables.
+```bash
+$ heroku config:set RECOVERY_PRIVATE_KEY=`perl -p -e 's/\R//g; s/-----[\w\s]+-----//' prime256v1-key.pem` --app my-app-name
+$ heroku config:set RECOVERY_PUBLIC_KEY=`perl -p -e 's/\R//g; s/-----[\w\s]+-----//' prime256v1-pub.pem` --app my-app-name
+```
+
+You can see your current configuration using:
+```bash
+$ heroku config --app my-app-name
+```
+
+And deploy with Maven
+```bash
+$ mvn heroku:deploy
+```
+
+Check that your application deployed successfully with these configuration variables from the command line:
+```bash
+$ curl https://{your-app-name}.herokuapp.com/.well-known/delegated-account-recovery/configuration
+```
+
+You should get a JSON file that lists your public key as the first entry in the
+array that is the value of the key `tokensign-pubkeys-secp256r1`
+
+You can try the application itself by running:
+
+```bash
+$ heroku open --app my-app-name
+```
+
+During the closed beta, you will only be able to use the sample applications when logging in to Facebook with a whitehat test account.  [Create and manage test accounts here](https://www.facebook.com/whitehat/accounts).

examples/java/pom.xml

@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>com.fbsamples.recoveryApp</groupId>
+    <artifactId>recovery-app</artifactId>
+    <name>java-recovery-app</name>
+    <version>0.1</version>
+
+    <dependencies>
+        <dependency>
+            <groupId>com.facebook.delegatedrecovery</groupId>
+            <artifactId>delegatedrecovery-sdk</artifactId>
+            <version>1.0.1</version>
+        </dependency>
+        <dependency>
+            <groupId>com.sparkjava</groupId>
+            <artifactId>spark-core</artifactId>
+            <version>2.5</version>
+        </dependency>
+        <dependency>
+            <groupId>com.sparkjava</groupId>
+            <artifactId>spark-debug-tools</artifactId>
+            <version>0.5</version>
+        </dependency>
+        <dependency>
+            <groupId>org.glassfish</groupId>
+            <artifactId>javax.json</artifactId>
+            <version>1.0.4</version>
+        </dependency>
+        <dependency>
+            <groupId>com.sparkjava</groupId>
+            <artifactId>spark-template-mustache</artifactId>
+            <version>2.5.5</version>
+        </dependency>
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-simple</artifactId>
+            <version>1.7.9</version>
+        </dependency>
+    </dependencies>
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <version>2.3.2</version>
+                <configuration>
+                    <source>1.8</source>
+                    <target>1.8</target>
+                </configuration>
+            </plugin>
+            <plugin>
+                <artifactId>maven-assembly-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>single</goal>
+                        </goals>
+                    </execution>
+                </executions>
+                <configuration>
+                    <descriptorRefs>
+                        <!-- This tells Maven to include all dependencies -->
+                        <descriptorRef>jar-with-dependencies</descriptorRef>
+                    </descriptorRefs>
+                    <archive>
+                        <manifest>
+                            <mainClass>com.fbsamples.delegatedrecovery.sparkapp.Main</mainClass>
+                        </manifest>
+                    </archive>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>com.heroku.sdk</groupId>
+                <artifactId>heroku-maven-plugin</artifactId>
+                <version>0.4.4</version>
+                <configuration>
+                    <jdkVersion>1.8</jdkVersion>
+                    <!-- Define application name in heroku.properties-->
+                    <processTypes>
+                        <web>java -jar ./target/${project.artifactId}-${project.version}-jar-with-dependencies.jar</web>
+                    </processTypes>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>