couchkeeper 0.6.7

data/lib/doorkeeper/oauth/authorization/token.rb

@@ -0,0 +1,28 @@
+module Doorkeeper
+  module OAuth
+    module Authorization
+      class Token
+        attr_accessor :pre_auth, :resource_owner, :token
+
+        def initialize(pre_auth, resource_owner)
+          @pre_auth       = pre_auth
+          @resource_owner = resource_owner
+        end
+
+        def issue_token
+          @token ||= AccessToken.create!({
+            :application_id    => pre_auth.client.id,
+            :resource_owner_id => resource_owner.id,
+            :scopes            => pre_auth.scopes.to_s,
+            :ttl        => configuration.access_token_expires_in,
+            :use_refresh_token => false
+          })
+        end
+
+        def configuration
+          Doorkeeper.configuration
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/authorization/uri_builder.rb

@@ -0,0 +1,29 @@
+module Doorkeeper
+  module OAuth
+    module Authorization
+      module URIBuilder
+        include Rack::Utils
+
+        extend self
+
+        def uri_with_query(url, parameters = {})
+          uri            = URI.parse(url)
+          original_query = parse_query(uri.query)
+          uri.query      = build_query(original_query.merge(parameters))
+          uri.to_s
+        end
+
+        def uri_with_fragment(url, parameters = {})
+          uri = URI.parse(url)
+          uri.fragment = build_query(parameters)
+          uri.to_s
+        end
+
+        def build_query(parameters = {})
+          parameters = parameters.reject { |k, v| v.blank? }
+          super parameters
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/authorization_code_request.rb

@@ -0,0 +1,82 @@
+module Doorkeeper
+  module OAuth
+    class AuthorizationCodeRequest
+      include Doorkeeper::Validations
+
+      validate :attributes,   :error => :invalid_request
+      validate :client,       :error => :invalid_client
+      validate :grant,        :error => :invalid_grant
+      validate :redirect_uri, :error => :invalid_grant
+
+      attr_accessor :server, :grant, :client, :redirect_uri
+
+      def initialize(server, grant, client, parameters = {})
+        @server = server
+        @client = client
+        @grant  = grant
+        @redirect_uri = parameters[:redirect_uri]
+      end
+
+      def authorize
+        validate
+        @response = if valid?
+          grant.revoke
+          find_or_create_access_token
+          TokenResponse.new access_token
+        else
+          ErrorResponse.from_request self
+        end
+      end
+
+      def valid?
+        self.error.nil?
+      end
+
+      def access_token
+        @access_token ||= Doorkeeper::AccessToken.matching_token_for client, grant.resource_owner_id, grant.scopes
+      end
+
+      private
+
+      def find_or_create_access_token
+        if access_token
+          access_token.expired? ? revoke_and_create_access_token : access_token
+        else
+          create_access_token
+        end
+      end
+
+      def revoke_and_create_access_token
+        access_token.revoke
+        create_access_token
+      end
+
+      def create_access_token
+        @access_token = Doorkeeper::AccessToken.create!({
+          :application_id    => grant.application_id,
+          :resource_owner_id => grant.resource_owner_id,
+          :scopes            => grant.scopes_string,
+          :expires_in        => server.access_token_expires_in,
+          :use_refresh_token => server.refresh_token_enabled?
+        })
+      end
+
+      def validate_attributes
+        redirect_uri.present?
+      end
+
+      def validate_client
+        !!client
+      end
+
+      def validate_grant
+        return false unless grant && grant.application_id == client.id
+        grant.accessible?
+      end
+
+      def validate_redirect_uri
+        grant.redirect_uri == redirect_uri
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client.rb

@@ -0,0 +1,29 @@
+require 'doorkeeper/oauth/client/methods'
+require 'doorkeeper/oauth/client/credentials'
+
+module Doorkeeper
+  module OAuth
+    class Client
+      def self.find(uid, method = Doorkeeper::Application.method(:by_uid))
+        if application = method.call(uid)
+          new(application)
+        end
+      end
+
+      def self.authenticate(credentials, method = Doorkeeper::Application.method(:authenticate))
+        return false if credentials.blank?
+        if application = method.call(credentials.uid, credentials.secret)
+          new(application)
+        end
+      end
+
+      delegate :id, :name, :uid, :redirect_uri, :to => :@application
+
+      def initialize(application)
+        @application = application
+      end
+
+      attr_accessor :application
+    end
+  end
+end

data/lib/doorkeeper/oauth/client/credentials.rb

@@ -0,0 +1,21 @@
+module Doorkeeper
+  module OAuth
+    class Client
+      class Credentials < Struct.new(:uid, :secret)
+        extend Methods
+
+        def self.from_request(request, *credentials_methods)
+          credentials_methods.inject(nil) do |credentials, method|
+            method = self.method(method) if method.is_a?(Symbol)
+            credentials = Credentials.new *method.call(request)
+            break credentials unless credentials.blank?
+          end
+        end
+
+        def blank?
+          uid.blank? || secret.blank?
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client/methods.rb

@@ -0,0 +1,18 @@
+module Doorkeeper
+  module OAuth
+    class Client
+      module Methods
+        def from_params(request)
+          request.parameters.values_at(:client_id, :client_secret)
+        end
+
+        def from_basic(request)
+          authorization = request.authorization
+          if authorization.present? && authorization =~ /^Basic (.*)/m
+            Base64.decode64($1).split(/:/, 2)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client_credentials/creator.rb

@@ -0,0 +1,29 @@
+module Doorkeeper
+  module OAuth
+    class ClientCredentialsRequest
+      class Creator
+        def call(client, scopes, attributes = {})
+          existing_token = existing_token_for(client, scopes)
+          if existing_token
+            return existing_token if existing_token.accessible?
+            existing_token.revoke
+          end
+          create(client, scopes, attributes)
+        end
+
+      private
+
+        def existing_token_for(client, scopes)
+          Doorkeeper::AccessToken.matching_token_for client, nil, scopes
+        end
+
+        def create(client, scopes, attributes = {})
+          Doorkeeper::AccessToken.create(attributes.merge({
+            :application_id => client.id,
+            :scopes         => scopes.to_s
+          }))
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client_credentials/issuer.rb

@@ -0,0 +1,35 @@
+require 'doorkeeper/oauth/client_credentials/validation'
+
+module Doorkeeper
+  module OAuth
+    class ClientCredentialsRequest
+      class Issuer
+        attr_accessor :token, :validation, :error
+
+        def initialize(server, validation)
+          @server, @validation = server, validation
+        end
+
+        def create(client, scopes, creator = Creator.new)
+          if validation.valid?
+            @token = create_token(client, scopes, creator)
+            @error = :server_error unless @token
+          else
+            @token = false
+            @error = validation.error
+          end
+          @token
+        end
+
+        private
+
+        def create_token(client, scopes, creator)
+          creator.call(client, scopes, {
+            :use_refresh_token => false,
+            :expires_in        => @server.access_token_expires_in
+          })
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client_credentials/validation.rb

@@ -0,0 +1,33 @@
+require 'doorkeeper/validations'
+require 'doorkeeper/oauth/scopes'
+require 'doorkeeper/oauth/helpers/scope_checker'
+
+module Doorkeeper
+  module OAuth
+    class ClientCredentialsRequest
+      class Validation
+        include Doorkeeper::Validations
+        include Doorkeeper::OAuth::Helpers
+
+        validate :client, :error => :invalid_client
+        validate :scopes, :error => :invalid_scope
+
+        def initialize(server, request)
+          @server, @request = server, request
+          validate
+        end
+
+        private
+
+        def validate_client
+          @request.client.present?
+        end
+
+        def validate_scopes
+          return true unless @request.original_scopes.present?
+          ScopeChecker.valid?(@request.original_scopes, @server.scopes)
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client_credentials_request.rb

@@ -0,0 +1,47 @@
+require 'doorkeeper/oauth/error'
+require 'doorkeeper/oauth/error_response'
+require 'doorkeeper/oauth/scopes'
+require 'doorkeeper/oauth/token_response'
+require 'doorkeeper/oauth/client_credentials/creator'
+require 'doorkeeper/oauth/client_credentials/issuer'
+require 'doorkeeper/oauth/client_credentials/validation'
+
+module Doorkeeper
+  module OAuth
+    class ClientCredentialsRequest
+      attr_accessor :issuer, :server, :client, :original_scopes, :scopes
+      attr_reader   :response
+      alias         :error_response :response
+
+      delegate :error, :to => :issuer
+
+      def issuer
+        @issuer ||= Issuer.new(server, Validation.new(server, self))
+      end
+
+      def initialize(server, client, parameters = {})
+        @client, @server = client, server
+        @response        = nil
+        @original_scopes = parameters[:scope]
+      end
+
+      def authorize
+        status = issuer.create(client, scopes)
+        @response = if status
+          TokenResponse.new(issuer.token)
+        else
+          ErrorResponse.from_request(self)
+        end
+      end
+
+      # TODO: duplicated code in all flows
+      def scopes
+        @scopes ||= if @original_scopes.present?
+          Doorkeeper::OAuth::Scopes.from_string(@original_scopes)
+        else
+          server.default_scopes
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/code_request.rb

@@ -0,0 +1,28 @@
+module Doorkeeper
+  module OAuth
+    class CodeRequest
+      attr_accessor :pre_auth, :resource_owner, :client
+
+      def initialize(pre_auth, resource_owner)
+        @pre_auth       = pre_auth
+        @client         = pre_auth.client
+        @resource_owner = resource_owner
+      end
+
+      def authorize
+        @response = if pre_auth.authorizable?
+          auth = Authorization::Code.new(pre_auth, resource_owner)
+          auth.issue_token
+          CodeResponse.new pre_auth, auth
+        else
+          ErrorResponse.from_request pre_auth
+        end
+      end
+
+      def deny
+        pre_auth.error = :access_denied
+        ErrorResponse.from_request(pre_auth, :redirect_uri => pre_auth.redirect_uri)
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/code_response.rb

@@ -0,0 +1,37 @@
+module Doorkeeper
+  module OAuth
+    class CodeResponse
+      include Doorkeeper::OAuth::Authorization::URIBuilder
+      include Doorkeeper::OAuth::Helpers
+
+      attr_accessor :pre_auth, :auth, :response_on_fragment
+
+      def initialize(pre_auth, auth, options = {})
+        @pre_auth, @auth      = pre_auth, auth
+        @response_on_fragment = options[:response_on_fragment]
+      end
+
+      def redirectable?
+        true
+      end
+
+      # TODO: configure the test oauth path?
+      def redirect_uri
+        if URIChecker.test_uri? pre_auth.redirect_uri
+          "/oauth/authorize/#{auth.token.token}"
+        else
+          if response_on_fragment
+            uri_with_fragment(pre_auth.redirect_uri, {
+              :access_token => auth.token.token,
+              :token_type   => auth.token.token_type,
+              :expires_in   => auth.token.expires_in,
+              :state        => pre_auth.state
+            })
+          else
+            uri_with_query pre_auth.redirect_uri, :code => auth.token.token, :state => pre_auth.state
+          end
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/error.rb

@@ -0,0 +1,9 @@
+module Doorkeeper
+  module OAuth
+    class Error < Struct.new(:name, :state)
+      def description
+        I18n.translate name, :scope => [:doorkeeper, :errors, :messages]
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/error_response.rb

@@ -0,0 +1,44 @@
+module Doorkeeper
+  module OAuth
+    class ErrorResponse
+      include Doorkeeper::OAuth::Authorization::URIBuilder
+
+      def self.from_request(request, attributes = {})
+        state = request.state if request.respond_to?(:state)
+        new(attributes.merge(:name => request.error, :state => state))
+      end
+
+      delegate :name, :description, :state, :to => :@error
+
+      def initialize(attributes = {})
+        @error = Doorkeeper::OAuth::Error.new(*attributes.values_at(:name, :state))
+        @redirect_uri = attributes[:redirect_uri]
+        @response_on_fragment = attributes[:response_on_fragment]
+      end
+
+      def body
+        { :error => name, :error_description => description, :state => state }.reject { |k, v| v.blank? }
+      end
+
+      def status
+        :unauthorized
+      end
+
+      def redirectable?
+        (name != :invalid_redirect_uri) && (name != :invalid_client)
+      end
+
+      def redirect_uri
+        if @response_on_fragment
+          uri_with_fragment @redirect_uri, body
+        else
+          uri_with_query @redirect_uri, body
+        end
+      end
+
+      def headers
+        { 'Cache-Control' => 'no-store', 'Pragma' => 'no-cache', 'Content-Type' => 'application/json; charset=utf-8' }
+      end
+    end
+  end
+end