doorkeeper 0.5.0 → 0.6.0.rc1

data/lib/doorkeeper/oauth/helpers/uri_checker.rb

@@ -22,6 +22,10 @@ module Doorkeeper
         def self.as_uri(url)
           URI.parse(url)
         end
+
+        def self.test_uri?(url)
+          url == Doorkeeper.configuration.test_redirect_uri
+        end
       end
     end
   end

data/lib/doorkeeper/oauth/password_access_token_request.rb

@@ -1,51 +1,31 @@
-# coding: utf-8
-
-# TODO: refactor to DRY up, this is very similar to AccessTokenRequest
 module Doorkeeper::OAuth
   class PasswordAccessTokenRequest
     include Doorkeeper::Validations
     include Doorkeeper::OAuth::Helpers
 
-    ATTRIBUTES = [
-      :grant_type,
-      :username,
-      :password,
-      :scope,
-      :refresh_token
-    ]
-
-    validate :attributes,     :error => :invalid_request
-    validate :grant_type,     :error => :unsupported_grant_type
     validate :client,         :error => :invalid_client
     validate :resource_owner, :error => :invalid_resource_owner
-    validate :scope,          :error => :invalid_scope
+    validate :scopes,         :error => :invalid_scope
 
-    attr_accessor *ATTRIBUTES
-    attr_accessor :resource_owner, :client
+    attr_accessor :server, :resource_owner, :client
 
-    def initialize(client, owner, attributes = {})
-      ATTRIBUTES.each { |attr| instance_variable_set("@#{attr}", attributes[attr]) }
-      @resource_owner = owner
-      @client = client
-      validate
+    def initialize(server, client, resource_owner, parameters = {})
+      @server          = server
+      @resource_owner  = resource_owner
+      @client          = client
+      @original_scopes = parameters[:scope]
     end
 
     def authorize
-      if valid?
+      validate
+      @response = if valid?
         find_or_create_access_token
+        TokenResponse.new access_token
+      else
+        ErrorResponse.from_request self
       end
     end
 
-    def authorization
-      auth = {
-        'access_token' => access_token.token,
-        'token_type'   => access_token.token_type,
-        'expires_in'   => access_token.expires_in,
-      }
-      auth.merge!({'refresh_token' => access_token.refresh_token}) if refresh_token_enabled?
-      auth
-    end
-
     def valid?
       self.error.nil?
     end
@@ -55,23 +35,15 @@ module Doorkeeper::OAuth
       @access_token ||= Doorkeeper::AccessToken.matching_token_for client, resource_owner.id, scopes
     end
 
-    def token_type
-      "bearer"
-    end
-
-    def error_response
-      Doorkeeper::OAuth::ErrorResponse.from_request(self)
-    end
-
     def scopes
-      @scopes ||= if scope.present?
-        Doorkeeper::OAuth::Scopes.from_string(scope)
+      @scopes ||= if @original_scopes.present?
+        Doorkeeper::OAuth::Scopes.from_string(@original_scopes)
       else
-        Doorkeeper.configuration.default_scopes
+        server.default_scopes
       end
     end
 
-    private
+  private
 
     def find_or_create_access_token
       if access_token
@@ -91,38 +63,22 @@ module Doorkeeper::OAuth
         :application_id     => client.id,
         :resource_owner_id  => resource_owner.id,
         :scopes             => scopes.to_s,
-        :expires_in         => configuration.access_token_expires_in,
-        :use_refresh_token  => refresh_token_enabled?
+        :expires_in         => server.access_token_expires_in,
+        :use_refresh_token  => server.refresh_token_enabled?
       })
     end
 
-    def validate_attributes
-      grant_type.present?
-    end
-
-    def refresh_token_enabled?
-      configuration.refresh_token_enabled?
-    end
-
     def validate_client
       !!client
     end
 
-    def validate_scope
-      return true unless scope.present?
-      ScopeChecker.valid?(scope, configuration.scopes)
-    end
-
-    def validate_grant_type
-      grant_type == 'password'
+    def validate_scopes
+      return true unless @original_scopes.present?
+      ScopeChecker.valid?(@original_scopes, @server.scopes)
     end
 
     def validate_resource_owner
       !!resource_owner
     end
-
-    def configuration
-      Doorkeeper.configuration
-    end
   end
 end

data/lib/doorkeeper/oauth/pre_authorization.rb

@@ -0,0 +1,62 @@
+module Doorkeeper
+  module OAuth
+    class PreAuthorization
+      include Doorkeeper::Validations
+
+      validate :response_type, :error => :unsupported_response_type
+      validate :client, :error => :invalid_client
+      validate :scopes, :error => :invalid_scope
+      validate :redirect_uri, :error => :invalid_redirect_uri
+
+      attr_accessor :server, :client, :response_type, :redirect_uri, :state
+      attr_writer   :scope
+
+      def initialize(server, client, attrs = {})
+        @server        = server
+        @client        = client
+        @response_type = attrs[:response_type]
+        @redirect_uri  = attrs[:redirect_uri]
+        @scope         = attrs[:scope]
+        @state         = attrs[:state]
+      end
+
+      def authorizable?
+        valid?
+      end
+
+      def scopes
+        Scopes.from_string scope
+      end
+
+      def scope
+        @scope.presence || server.default_scopes.to_s
+      end
+
+      def error_response
+        Doorkeeper::OAuth::ErrorResponse.from_request(self)
+      end
+
+    private
+
+      def validate_response_type
+        %w[code token].include? response_type
+      end
+
+      def validate_client
+        client.present?
+      end
+
+      def validate_scopes
+        return true unless scope.present?
+        Helpers::ScopeChecker.valid? scope, server.scopes
+      end
+
+      # TODO: test uri should be matched against the client's one
+      def validate_redirect_uri
+        return false unless redirect_uri.present?
+        Helpers::URIChecker.test_uri?(redirect_uri) ||
+        Helpers::URIChecker.valid_for_authorization?(redirect_uri, client.redirect_uri)
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/refresh_token_request.rb

@@ -0,0 +1,58 @@
+module Doorkeeper
+  module OAuth
+    class RefreshTokenRequest
+      include Doorkeeper::Validations
+
+      validate :token,  :error => :invalid_request
+      validate :client, :error => :invalid_client
+
+      attr_accessor :server, :refresh_token, :client, :access_token
+
+      # TODO: refresh token can receive scope as parameters
+      def initialize(server, refresh_token, client)
+        @server        = server
+        @refresh_token = refresh_token
+        @client        = client
+      end
+
+      def authorize
+        validate
+        @response = if valid?
+          revoke_and_create_access_token
+          OAuth::TokenResponse.new access_token
+        else
+          OAuth::ErrorResponse.from_request(self)
+        end
+      end
+
+      def valid?
+        self.error.nil?
+      end
+
+    private
+
+      def revoke_and_create_access_token
+        refresh_token.revoke
+        create_access_token
+      end
+
+      def create_access_token
+        @access_token = Doorkeeper::AccessToken.create!({
+          :application_id    => refresh_token.application_id,
+          :resource_owner_id => refresh_token.resource_owner_id,
+          :scopes            => refresh_token.scopes_string,
+          :expires_in        => server.access_token_expires_in,
+          :use_refresh_token => true
+        })
+      end
+
+      def validate_token
+        refresh_token.present? && !refresh_token.revoked?
+      end
+
+      def validate_client
+        client.present? && refresh_token.application_id == client.id
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/token_request.rb

@@ -0,0 +1,28 @@
+module Doorkeeper
+  module OAuth
+    class TokenRequest
+      attr_accessor :pre_auth, :resource_owner, :client
+
+      def initialize(pre_auth, resource_owner)
+        @pre_auth       = pre_auth
+        @client         = pre_auth.client
+        @resource_owner = resource_owner
+      end
+
+      def authorize
+        @response = if pre_auth.authorizable?
+          auth = Authorization::Token.new(pre_auth, resource_owner)
+          auth.issue_token
+          CodeResponse.new pre_auth, auth, :response_on_fragment => true
+        else
+          ErrorResponse.from_request pre_auth, :redirect_uri => pre_auth.redirect_uri, :response_on_fragment => true
+        end
+      end
+
+      def deny
+        pre_auth.error = :access_denied
+        ErrorResponse.from_request(pre_auth, :redirect_uri => pre_auth.redirect_uri, :response_on_fragment => true)
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/token_response.rb

@@ -0,0 +1,29 @@
+module Doorkeeper
+  module OAuth
+    class TokenResponse
+      attr_accessor :token
+
+      def initialize(token)
+        @token = token
+      end
+
+      def body
+        {
+          'access_token'  => token.token,
+          'token_type'    => token.token_type,
+          'expires_in'    => token.expires_in,
+          'refresh_token' => token.refresh_token,
+          'scope'         => token.scopes_string
+        }
+      end
+
+      def status
+        :ok
+      end
+
+      def headers
+        { 'Cache-Control' => 'no-store', 'Pragma' => 'no-cache', 'Content-Type' => 'application/json; charset=utf-8' }
+      end
+    end
+  end
+end

data/lib/doorkeeper/rails/routes.rb

@@ -47,9 +47,10 @@ module Doorkeeper
 
       def authorization_routes(mapping)
         routes.scope :controller => mapping[:controllers] do
-          routes.match 'authorize', :via => :get,    :action => :new, :as => mapping[:as]
-          routes.match 'authorize', :via => :post,   :action => :create, :as => mapping[:as]
-          routes.match 'authorize', :via => :delete, :action => :destroy, :as => mapping[:as]
+          routes.match 'authorize/:code', :via => :get,    :action => :show,    :as => "#{mapping[:as]}_code"
+          routes.match 'authorize',       :via => :get,    :action => :new,     :as => mapping[:as]
+          routes.match 'authorize',       :via => :post,   :action => :create,  :as => mapping[:as]
+          routes.match 'authorize',       :via => :delete, :action => :destroy, :as => mapping[:as]
         end
       end
 

data/lib/doorkeeper/request.rb

@@ -0,0 +1,33 @@
+require 'doorkeeper/request/authorization_code'
+require 'doorkeeper/request/client_credentials'
+require 'doorkeeper/request/code'
+require 'doorkeeper/request/password'
+require 'doorkeeper/request/refresh_token'
+require 'doorkeeper/request/token'
+
+module Doorkeeper
+  module Request
+    extend self
+
+    # Available authorization strategies:
+    # :code, :token
+    def authorization_strategy(strategy)
+      get_strategy strategy
+    rescue NameError
+      raise Errors::InvalidAuthorizationStrategy
+    end
+
+    # Available token strategies:
+    # :password, :client_credentials, :authorization_code, :refresh_token
+    def token_strategy(strategy)
+      get_strategy strategy
+    rescue NameError
+      raise Errors::InvalidTokenStrategy
+    end
+
+    def get_strategy(strategy)
+      raise Errors::MissingRequestStrategy unless strategy.present?
+      "Doorkeeper::Request::#{strategy.to_s.camelize}".constantize
+    end
+  end
+end

data/lib/doorkeeper/request/authorization_code.rb

@@ -0,0 +1,23 @@
+module Doorkeeper
+  module Request
+    class AuthorizationCode
+      def self.build(server)
+        new(server.grant, server.client, server)
+      end
+
+      attr_accessor :grant, :client, :server
+
+      def initialize(grant, client, server)
+        @grant, @client, @server = grant, client, server
+      end
+
+      def request
+        @request ||= OAuth::AuthorizationCodeRequest.new(Doorkeeper.configuration, grant, client, server.parameters)
+      end
+
+      def authorize
+        request.authorize
+      end
+    end
+  end
+end

data/lib/doorkeeper/request/client_credentials.rb

@@ -0,0 +1,23 @@
+module Doorkeeper
+  module Request
+    class ClientCredentials
+      def self.build(server)
+        new(server.client, server)
+      end
+
+      attr_accessor :client, :server
+
+      def initialize(client, server)
+        @client, @server = client, server
+      end
+
+      def request
+        @request ||= OAuth::ClientCredentialsRequest.new(Doorkeeper.configuration, client, server.parameters)
+      end
+
+      def authorize
+        request.authorize
+      end
+    end
+  end
+end

data/lib/doorkeeper/request/code.rb

@@ -0,0 +1,24 @@
+module Doorkeeper
+  module Request
+    class Code
+      # TODO: this is so wrong!
+      def self.build(server)
+        new(server.context.send(:pre_auth), server)
+      end
+
+      attr_accessor :pre_auth, :server
+
+      def initialize(pre_auth, server)
+        @pre_auth, @server = pre_auth, server
+      end
+
+      def request
+        @request ||= OAuth::CodeRequest.new(pre_auth, server.current_resource_owner)
+      end
+
+      def authorize
+        request.authorize
+      end
+    end
+  end
+end