oauth-plugin 0.4.0.pre7 → 0.4.0.rc1

data/CHANGELOG

@@ -1,3 +1,9 @@
+0.4.0-rc1
+  PLEASE help test this so we can mark it as final
+  - Update to OAuth2 draft 22 which is likely the final release. [pelle] ACTION REQUIRED BY YOU, see README.
+  - Update forms to work with rails 3.1 [morgz]
+  - Allow nil callbacks for oob in OAuth 1.0a [Shaliko Usubov]
+  - OAuthFilter:oauth2_token to rejects headers that explicitly state oauth_version="1.0" [KentonWhite]
 0.4.0-pre7
   - OAuth 1 requests using query or form encoded parameters where being interpreted as OAuth2 [pelleb]
   - OAuth 2 requests were not checking for invalidated tokens. Please upgrade for this if you offer OAuth 2 [rymai]

data/README.rdoc

@@ -4,24 +4,88 @@ This is a plugin for implementing OAuth Providers and Consumers in Rails applica
 
 We support the revised OAuth 1.0a specs at:
 
-http://oauth.net/core/1.0a
+http://tools.ietf.org/html/rfc5849
 
 As well as support for OAuth 2.0:
 
-http://tools.ietf.org/html/draft-ietf-oauth-v2-10
+http://tools.ietf.org/html/draft-ietf-oauth-v2-22
 
-and the OAuth site at:
+Find out more on the OAuth site at:
 
 http://oauth.net
 
-For more about the changes made to OAuth1.0a please see Seth's Idiot's Guide to OAuth 1.0a.
+== IMPORTANT note for people upgrading the provider
 
-http://mojodna.net/2009/05/20/an-idiots-guide-to-oauth-10a.html
+There are several changes to the latest OAuth 2.0 spec which requires a couple of changes to 2 models which you are REQUIRED to update manually if you are supporting OAuth2.
+
+https://github.com/pelle/oauth-plugin/blob/master/lib/generators/active_record/oauth_provider_templates/oauth2_token.rb
+
+  class Oauth2Token < AccessToken
+    attr_accessor :state
+    def as_json(options={})
+      d = {:access_token=>token, :token_type => 'bearer'}
+      d[:expires_in] = expires_in if expires_at
+      d
+    end
+
+    def to_query
+      q = "access_token=#{token}&token_type=bearer"
+      q << "&state=#{URI.escape(state)}" if @state
+      q << "&expires_in=#{expires_in}" if expires_at
+      q << "&scope=#{URI.escape(scope)}" if scope
+      q
+    end
+
+    def expires_in
+      expires_at.to_i - Time.now.to_i
+    end
+  end
+
+
+https://github.com/pelle/oauth-plugin/blob/master/lib/generators/active_record/oauth_provider_templates/oauth2_verifier.rb
+
+  class Oauth2Verifier < OauthToken
+    validates_presence_of :user
+    attr_accessor :state
+
+    def exchange!(params={})
+      OauthToken.transaction do
+        token = Oauth2Token.create! :user=>user,:client_application=>client_application, :scope => scope
+        invalidate!
+        token
+      end
+    end
+
+    def code
+      token
+    end
+
+    def redirect_url
+      callback_url
+    end
+
+    def to_query
+      q = "code=#{token}"
+      q << "&state=#{URI.escape(state)}" if @state
+      q
+    end
+
+    protected
+
+    def generate_keys
+      self.token = OAuth::Helper.generate_key(20)[0,20]
+      self.expires_at = 10.minutes.from_now
+      self.authorized_at = Time.now
+    end
+
+  end
+
+There are matching specs for these which you may want to move into your project as well.
 
 == Requirements
 
 You need to install the oauth gem (0.4.4) which is the core OAuth ruby library. It will likely NOT work on any previous version of the gem.
-  
+
   gem install oauth
 
 == Installation (Rails 3.0)
@@ -39,7 +103,7 @@ And install it:
 The plugin can now be installed as an gem from github, which is the easiest way to keep it up to date.
 
   gem install oauth-plugin --pre
-  
+
 You should add the following in the gem dependency section of environment.rb
 
   config.gem "oauth"
@@ -72,7 +136,7 @@ It requires an authentication framework such as acts_as_authenticated, restful_a
 A big change over previous versions is that we now use a rack filter. You have to install this in your application.rb file:
 
   require 'oauth/rack/oauth_filter'
-  config.middleware.use OAuth::Rack::OAuthFilter    
+  config.middleware.use OAuth::Rack::OAuthFilter
 
 
 === Generator Options
@@ -107,7 +171,7 @@ It requires an authentication framework such as acts_as_authenticated, restful_a
 By default the generator generates RSpec and ERB templates. The generator can instead create Test::Unit and/or HAML templates. To do this use the following options:
 
   ./script/generate oauth_provider --test-unit --haml
-  
+
 These can of course be used individually as well.
 
 === User Model
@@ -120,7 +184,7 @@ Add the following lines to your user model:
 === Migrate database
 
 The database is defined in:
-  
+
   db/migrate/XXX_create_oauth_tables.rb
 
 Run them as any other normal migration in rails with:
@@ -173,14 +237,14 @@ Then change the create_request_token method to the following:
 
 === Changes in request_token.rb
 
-The RequestToken contains the bulk of the changes so it's easiest to list it in it's entirety. Mainly we need to add support for the oauth_verifier parameter and also tell the client that we support OAuth 1.0a. 
+The RequestToken contains the bulk of the changes so it's easiest to list it in it's entirety. Mainly we need to add support for the oauth_verifier parameter and also tell the client that we support OAuth 1.0a.
 
 Make sure it looks like this:
 
   class RequestToken < OauthToken
-  
+
     attr_accessor :provided_oauth_verifier
-  
+
     def authorize!(user)
       return false if authorized?
       self.user = user
@@ -188,18 +252,18 @@ Make sure it looks like this:
       self.verifier=OAuth::Helper.generate_key(16)[0,20] unless oauth10?
       self.save
     end
-  
+
     def exchange!
       return false unless authorized?
       return false unless oauth10? || verifier == provided_oauth_verifier
-    
+
       RequestToken.transaction do
         access_token = AccessToken.create(:user => user, :client_application => client_application)
         invalidate!
         access_token
       end
     end
-  
+
     def to_query
       if oauth10?
         super
@@ -207,11 +271,11 @@ Make sure it looks like this:
         "#{super}&oauth_callback_confirmed = true"
       end
     end
-  
+
     def oob?
       self.callback_url == 'oob'
     end
-  
+
     def oauth10?
       (defined? OAUTH_10_SUPPORT) && OAUTH_10_SUPPORT && self.callback_url.blank?
     end
@@ -220,12 +284,12 @@ Make sure it looks like this:
 
 === Changes in oauth_controller
 
-All you need to do here is the change the authorize action to use the request_token callback url and add the oauth_verifier to the callback url. 
+All you need to do here is the change the authorize action to use the request_token callback url and add the oauth_verifier to the callback url.
 
   def authorize
     @token = ::RequestToken.find_by_token params[:oauth_token]
-    unless @token.invalidated?    
-      if request.post? 
+    unless @token.invalidated?
+      if request.post?
         if params[:authorize] == '1'
           @token.authorize!(current_user)
           if @token.oauth10?
@@ -233,7 +297,7 @@ All you need to do here is the change the authorize action to use the request_to
           else
             @redirect_url = @token.oob? ? @token.client_application.callback_url : @token.callback_url
           end
-        
+
           if @redirect_url
             if @token.oauth10?
               redirect_to "#{@redirect_url}?oauth_token=#{@token.token}"
@@ -305,7 +369,7 @@ You could add application specific information to the OauthToken and ClientAppli
 The oauth_consumer generator creates a controller to manage the authentication flow between your application and any number of external OAuth secured applications that you wish to connect to.
 
 To run it in Rails 3 simply run:
-  
+
   rails g oauth_consumer
 
 In previous versions:
@@ -320,7 +384,7 @@ By default the generator generates ERB templates. The generator can instead crea
 
   ./script/generate oauth_consumer --haml
 
-Rails 3 respects your application defaults, see the oauth provider generator section above for more info. 
+Rails 3 respects your application defaults, see the oauth provider generator section above for more info.
 
 === Configuration
 
@@ -346,13 +410,13 @@ Add entries to OAUTH_CREDENTIALS for all OAuth Applications you wish to connect
       :key => "",
       :secret => "",
       :options = {
-        :site => "http://hourfeed.com" 
+        :site => "http://hourfeed.com"
       }
     },
     :nu_bux => {
       :key => "",
       :secret => "",
-      :super_class => "OpenTransactToken",  # if a OAuth service follows a particular standard 
+      :super_class => "OpenTransactToken",  # if a OAuth service follows a particular standard
                                           # with a token implementation you can set the superclass
                                           # to use
       :options => {
@@ -402,7 +466,7 @@ These can be found in lib/oauth/models/consulers/services. Contributions will be
 To connect a user to an external service link or redirect them to:
 
   /oauth_consumers/[SERVICE_NAME]
-  
+
 Where SERVICE_NAME is the name you set in the OAUTH_CREDENTIALS hash. This will request the request token and redirect the user to the services authorization screen. When the user accepts the get redirected back to:
 
   /oauth_consumers/[SERVICE_NAME]/callback
@@ -420,7 +484,7 @@ This is designed to let your local javascript apps access remote OAuth apis. You
       :client => :oauth_gem, # :twitter_gem or :oauth_gem (defaults to :twitter_gem)
       :expose => true      # set to true to expose client via the web
     }
-      
+
 Once the user has authorized your application, you can access the client APIs via:
 
   /oauth_consumers/[SERVICE_NAME]/client/[ENDPOINT]

data/generators/oauth_provider/templates/oauth2_token.rb

@@ -1,6 +1,20 @@
 class Oauth2Token < AccessToken
-  
+  attr_accessor :state
   def as_json(options={})
-    {:access_token => token}
+    d = {:access_token=>token, :token_type => 'bearer'}
+    d[:expires_in] = expires_in if expires_at
+    d
+  end
+
+  def to_query
+    q = "access_token=#{token}&token_type=bearer"
+    q << "&state=#{URI.escape(state)}" if @state
+    q << "&expires_in=#{expires_in}" if expires_at
+    q << "&scope=#{URI.escape(scope)}" if scope
+    q
+  end
+
+  def expires_in
+    expires_at.to_i - Time.now.to_i
   end
 end

data/generators/oauth_provider/templates/oauth2_token_spec.rb

@@ -5,25 +5,48 @@ describe Oauth2Token do
   before(:each) do
     @token = Oauth2Token.create :client_application => client_applications(:one), :user=>users(:aaron)
   end
-  
+
   it "should be valid" do
     @token.should be_valid
   end
-  
+
   it "should have a token" do
     @token.token.should_not be_nil
   end
-  
+
   it "should have a secret" do
     @token.secret.should_not be_nil
   end
-  
+
   it "should be authorized" do
     @token.should be_authorized
   end
-  
+
   it "should not be invalidated" do
     @token.should_not be_invalidated
   end
 
+  it "should generate correct json and query strong" do
+    @token.as_json.should == {:access_token => @token.token, :token_type => 'bearer'}
+    @token.to_query.should == "access_token=#{@token.token}&token_type=bearer"
+  end
+
+  it "should generate correct json and query string and include state in query if present" do
+    @token.state = 'bb bb'
+    @token.as_json.should == {:access_token => @token.token, :token_type => 'bearer'}
+    @token.to_query.should == "access_token=#{@token.token}&token_type=bearer&state=bb%20bb"
+  end
+
+  it "should generate correct json and query string and include scope in query if present" do
+    @token.scope = 'bbbb aaaa'
+    @token.as_json.should == {:access_token => @token.token, :token_type => 'bearer'}
+    @token.to_query.should == "access_token=#{@token.token}&token_type=bearer&scope=bbbb%20aaaa"
+  end
+
+  it "should generate correct json and include expires_in if present" do
+    @token.expires_at = 1.hour.from_now
+    @token.as_json.should == { :access_token => @token.token, :token_type => 'bearer', :expires_in => 3600 }
+    @token.to_query.should == "access_token=#{@token.token}&token_type=bearer&expires_in=3600"
+  end
+
 end

data/generators/oauth_provider/templates/oauth2_verifier.rb

@@ -1,28 +1,35 @@
 class Oauth2Verifier < OauthToken
   validates_presence_of :user
-  
+  attr_accessor :state
+
   def exchange!(params={})
     OauthToken.transaction do
-      token = Oauth2Token.create! :user=>user,:client_application=>client_application
+      token = Oauth2Token.create! :user=>user,:client_application=>client_application, :scope => scope
       invalidate!
       token
     end
   end
-  
+
   def code
     token
   end
-  
+
   def redirect_url
     callback_url
   end
-  
+
+  def to_query
+    q = "code=#{token}"
+    q << "&state=#{URI.escape(state)}" if @state
+    q
+  end
+
   protected
-  
+
   def generate_keys
     self.token = OAuth::Helper.generate_key(20)[0,20]
-    self.valid_to = 10.minutes.from_now
+    self.expires_at = 10.minutes.from_now
     self.authorized_at = Time.now
   end
-  
+
 end

data/generators/oauth_provider/templates/oauth2_verifier_spec.rb

@@ -3,52 +3,42 @@ require File.dirname(__FILE__) + '/../spec_helper'
 describe Oauth2Verifier do
   fixtures :client_applications, :users, :oauth_tokens
   before(:each) do
-    @verifier = Oauth2Verifier.create :client_application => client_applications(:one), :user=>users(:aaron)
+    @verifier = Oauth2Verifier.create :client_application => client_applications(:one), :user=>users(:aaron), :scope => "bbbb aaaa"
   end
-  
+
   it "should be valid" do
     @verifier.should be_valid
   end
-  
+
   it "should have a code" do
     @verifier.code.should_not be_nil
   end
-  
+
   it "should not have a secret" do
     @verifier.secret.should be_nil
   end
-  
+
   it "should be authorized" do
     @verifier.should be_authorized
   end
-  
+
   it "should not be invalidated" do
     @verifier.should_not be_invalidated
   end
-  
-  describe "exchange for oauth2 token" do
-    before(:each) do
-      @token = @verifier.exchange!
-    end
-    
-    it "should invalidate verifier" do
-      @verifier.should be_invalidated
-    end
-    
-    it "should set user on token" do
-      @token.user.should==@verifier.user
-    end
-    
-    it "should set client application on token" do
-      @token.client_application.should == @verifier.client_application
-    end
-    
-    it "should be authorized" do
-      @token.should be_authorized
-    end
-    
-    it "should not be invalidated" do
-      @token.should_not be_invalidated
-    end
+
+  it "should generate query string" do
+    @verifier.to_query.should == "code=#{@verifier.code}"
+    @verifier.state="bbbb aaaa"
+    @verifier.to_query.should == "code=#{@verifier.code}&state=bbbb%20aaaa"
+  end
+
+  it "should properly exchange for token" do
+    @token = @verifier.exchange!
+    @verifier.should be_invalidated
+    @token.user.should==@verifier.user
+    @token.client_application.should == @verifier.client_application
+    @token.should be_authorized
+    @token.should_not be_invalidated
+    @token.scope.should == @verifier.scope
   end
 end

data/lib/generators/active_record/oauth_provider_templates/oauth2_token.rb

@@ -1,5 +1,20 @@
 class Oauth2Token < AccessToken
+  attr_accessor :state
   def as_json(options={})
-    {:access_token=>token}
+    d = {:access_token=>token, :token_type => 'bearer'}
+    d[:expires_in] = expires_in if expires_at
+    d
+  end
+
+  def to_query
+    q = "access_token=#{token}&token_type=bearer"
+    q << "&state=#{URI.escape(state)}" if @state
+    q << "&expires_in=#{expires_in}" if expires_at
+    q << "&scope=#{URI.escape(scope)}" if scope
+    q
+  end
+
+  def expires_in
+    expires_at.to_i - Time.now.to_i
   end
 end

data/lib/generators/active_record/oauth_provider_templates/oauth2_verifier.rb

@@ -1,9 +1,10 @@
 class Oauth2Verifier < OauthToken
   validates_presence_of :user
+  attr_accessor :state
 
   def exchange!(params={})
     OauthToken.transaction do
-      token = Oauth2Token.create! :user=>user,:client_application=>client_application
+      token = Oauth2Token.create! :user=>user,:client_application=>client_application, :scope => scope
       invalidate!
       token
     end
@@ -17,11 +18,17 @@ class Oauth2Verifier < OauthToken
     callback_url
   end
 
+  def to_query
+    q = "code=#{token}"
+    q << "&state=#{URI.escape(state)}" if @state
+    q
+  end
+
   protected
 
   def generate_keys
     self.token = OAuth::Helper.generate_key(20)[0,20]
-    self.valid_to = 10.minutes.from_now
+    self.expires_at = 10.minutes.from_now
     self.authorized_at = Time.now
   end
 

data/lib/generators/erb/oauth_provider_templates/authorize.html.erb

@@ -1,6 +1,6 @@
 <h1>Authorize access to your account</h1>
 <p>Would you like to authorize <%%= link_to @token.client_application.name,@token.client_application.url %> (<%%= link_to @token.client_application.url,@token.client_application.url %>) to access your account?</p>
-<%% form_tag authorize_url do %>
+<%%= form_tag authorize_url do %>
   <%%= hidden_field_tag "oauth_token", @token.token %>
   <%%- if params[:oauth_callback] -%>
   <%%= hidden_field_tag "oauth_callback", params[:oauth_callback] %>

data/lib/generators/erb/oauth_provider_templates/edit.html.erb

@@ -1,5 +1,5 @@
 <h1>Edit your application</h1>
-<%% form_for :client_application, @client_application, :url => oauth_client_path(@client_application), :html => {:method => :put}  do |f| %>
+<%%= form_for :client_application, @client_application, :url => oauth_client_path(@client_application), :html => {:method => :put}  do |f| %>
        <%%= render :partial => "form", :locals => { :f => f } %>
        <%%= submit_tag "Edit" %>
 <%% end %>

data/lib/generators/erb/oauth_provider_templates/new.html.erb

@@ -1,5 +1,5 @@
 <h1>Register a new application</h1>
-<%% form_for :client_application, :url => { :action => :create } do |f| %>
+<%%= form_for :client_application, :url => { :action => :create } do |f| %>
    <%%= render :partial => "form", :locals => { :f => f } %>
    <%%= submit_tag "Register" %>
 <%% end %>

data/lib/generators/erb/oauth_provider_templates/oauth2_authorize.html.erb

@@ -1,6 +1,6 @@
 <h1>Authorize access to your account</h1>
 <p>Would you like to authorize <%%= link_to @token.client_application.name,@token.client_application.url %> (<%%= link_to @token.client_application.url,@token.client_application.url %>) to access your account?</p>
-<%% form_tag authorize_url do %>
+<%%= form_tag authorize_url do %>
   <%%= hidden_field_tag "response_type", params[:response_type]%>
   <%%= hidden_field_tag "client_id", params[:client_id]%>
   <%%= hidden_field_tag "redirect_uri", params[:redirect_uri]%>

data/lib/generators/haml/oauth_provider_templates/authorize.html.haml

@@ -5,7 +5,7 @@
   (
   = link_to @token.client_application.url,@token.client_application.url
   ) to access your account?
-- form_tag authorize_url do
+= form_tag authorize_url do
   = hidden_field_tag "oauth_token", @token.token
   - if params[:oauth_callback]
     = hidden_field_tag "oauth_callback", params[:oauth_callback]

data/lib/generators/haml/oauth_provider_templates/edit.html.haml

@@ -1,4 +1,4 @@
 %h1 Edit your application
-- form_for :client_application do |f|
+= form_for :client_application do |f|
   = render :partial => "form", :locals => { :f => f }
   = submit_tag "Edit"

data/lib/generators/haml/oauth_provider_templates/new.html.haml

@@ -1,5 +1,5 @@
 %h1 Register a new application
 
-- form_for :client_application, :url => { :action => :create } do |f|
+= form_for :client_application, :url => { :action => :create } do |f|
   = render :partial => "form", :locals => { :f => f }
   = submit_tag "Register"

data/lib/generators/haml/oauth_provider_templates/oauth2_authorize.html.haml

@@ -5,7 +5,7 @@
   (
   = link_to @client_application.url,@client_application.url
   ) to access your account?
-- form_tag authorize_url do
+= form_tag authorize_url do
   = hidden_field_tag "response_type", params[:response_type]
   = hidden_field_tag "client_id", params[:client_id]
   = hidden_field_tag "redirect_uri", params[:redirect_uri]

data/lib/generators/mongoid/oauth_provider_templates/oauth2_token.rb

@@ -1,5 +1,20 @@
 class Oauth2Token < AccessToken
+  attr_accessor :state
   def as_json(options={})
-    {:access_token=>token}
+    d = {:access_token=>token, :token_type => 'bearer'}
+    d[:expires_in] = expires_in if expires_at
+    d
+  end
+
+  def to_query
+    q = "access_token=#{token}&token_type=bearer"
+    q << "&state=#{URI.escape(state)}" if @state
+    q << "&expires_in=#{expires_in}" if expires_at
+    q << "&scope=#{URI.escape(scope)}" if scope
+    q
+  end
+
+  def expires_in
+    expires_at.to_i - Time.now.to_i
   end
 end

data/lib/generators/mongoid/oauth_provider_templates/oauth2_verifier.rb

@@ -1,9 +1,12 @@
 class Oauth2Verifier < OauthToken
   validates_presence_of :user
+  attr_accessor :state
 
   def exchange!(params={})
-    Oauth2Token.create!(:user => user, :client_application => client_application).tap do
+    OauthToken.transaction do
+      token = Oauth2Token.create! :user=>user,:client_application=>client_application, :scope => scope
       invalidate!
+      token
     end
   end
 
@@ -15,11 +18,18 @@ class Oauth2Verifier < OauthToken
     callback_url
   end
 
+  def to_query
+    q = "code=#{token}"
+    q << "&state=#{URI.escape(state)}" if @state
+    q
+  end
+
   protected
 
   def generate_keys
     self.token = OAuth::Helper.generate_key(20)[0,20]
-    self.valid_to = 10.minutes.from_now
+    self.expires_at = 10.minutes.from_now
     self.authorized_at = Time.now
   end
+
 end

data/lib/generators/rspec/templates/oauth2_token_spec.rb

@@ -26,4 +26,27 @@ describe Oauth2Token do
     @token.should_not be_invalidated
   end
 
-end
+  it "should generate correct json and query strong" do
+    @token.as_json.should == {:access_token => @token.token, :token_type => 'bearer'}
+    @token.to_query.should == "access_token=#{@token.token}&token_type=bearer"
+  end
+
+  it "should generate correct json and query string and include state in query if present" do
+    @token.state = 'bb bb'
+    @token.as_json.should == {:access_token => @token.token, :token_type => 'bearer'}
+    @token.to_query.should == "access_token=#{@token.token}&token_type=bearer&state=bb%20bb"
+  end
+
+  it "should generate correct json and query string and include scope in query if present" do
+    @token.scope = 'bbbb aaaa'
+    @token.as_json.should == {:access_token => @token.token, :token_type => 'bearer'}
+    @token.to_query.should == "access_token=#{@token.token}&token_type=bearer&scope=bbbb%20aaaa"
+  end
+
+  it "should generate correct json and include expires_in if present" do
+    @token.expires_at = 1.hour.from_now
+    @token.as_json.should == { :access_token => @token.token, :token_type => 'bearer', :expires_in => 3600 }
+    @token.to_query.should == "access_token=#{@token.token}&token_type=bearer&expires_in=3600"
+  end
+
+end

data/lib/generators/rspec/templates/oauth2_verifier_spec.rb

@@ -3,7 +3,7 @@ require File.dirname(__FILE__) + '/../spec_helper'
 describe Oauth2Verifier do
   fixtures :client_applications, :users, :oauth_tokens
   before(:each) do
-    @verifier = Oauth2Verifier.create :client_application => client_applications(:one), :user=>users(:aaron)
+    @verifier = Oauth2Verifier.create :client_application => client_applications(:one), :user=>users(:aaron), :scope => "bbbb aaaa"
   end
 
   it "should be valid" do
@@ -26,29 +26,19 @@ describe Oauth2Verifier do
     @verifier.should_not be_invalidated
   end
 
-  describe "exchange for oauth2 token" do
-    before(:each) do
-      @token = @verifier.exchange!
-    end
-
-    it "should invalidate verifier" do
-      @verifier.should be_invalidated
-    end
-
-    it "should set user on token" do
-      @token.user.should==@verifier.user
-    end
-
-    it "should set client application on token" do
-      @token.client_application.should == @verifier.client_application
-    end
-
-    it "should be authorized" do
-      @token.should be_authorized
-    end
+  it "should generate query string" do
+    @verifier.to_query.should == "code=#{@verifier.code}"
+    @verifier.state="bbbb aaaa"
+    @verifier.to_query.should == "code=#{@verifier.code}&state=bbbb%20aaaa"
+  end
 
-    it "should not be invalidated" do
-      @token.should_not be_invalidated
-    end
+  it "should properly exchange for token" do
+    @token = @verifier.exchange!
+    @verifier.should be_invalidated
+    @token.user.should==@verifier.user
+    @token.client_application.should == @verifier.client_application
+    @token.should be_authorized
+    @token.should_not be_invalidated
+    @token.scope.should == @verifier.scope
   end
-end
+end

data/lib/oauth/controllers/provider_controller.rb

@@ -100,7 +100,8 @@ module OAuth
           if request.post?
             if user_authorizes_token?
               @token.authorize!(current_user)
-              @redirect_url = URI.parse(@token.oob? ? @token.client_application.callback_url : @token.callback_url)
+              callback_url  = @token.oob? ? @token.client_application.callback_url : @token.callback_url
+              @redirect_url = URI.parse(callback_url) unless callback_url.blank?
 
               unless @redirect_url.to_s.blank?
                 @redirect_url.query = @redirect_url.query.blank? ?
@@ -122,15 +123,13 @@ module OAuth
 
       def oauth2_authorize_code
         @client_application = ClientApplication.find_by_key params[:client_id]
+        # Using ||= allows us to override this and customize the verification_code and call super to handle the rest
+        @token ||= Oauth2Verifier.new :client_application=>@client_application, :user=>current_user, :callback_url=>@redirect_url.to_s, :scope => params[:scope], :state => params[:state]
         if request.post?
-          @redirect_url = URI.parse(params[:redirect_uri] || @client_application.callback_url)
-          if user_authorizes_token?
-            @verification_code = Oauth2Verifier.create :client_application=>@client_application, :user=>current_user, :callback_url=>@redirect_url.to_s
-
+          @redirect_url = URI.parse(params[:redirect_uri] || @client_application.callback_url) if params[:redirect_uri] || @client_application.callback_url
+          if user_authorizes_token? && @token.save
             unless @redirect_url.to_s.blank?
-              @redirect_url.query = @redirect_url.query.blank? ?
-                                    "code=#{@verification_code.code}" :
-                                    @redirect_url.query + "&code=#{@verification_code.code}"
+              @redirect_url.query = @redirect_url.query.blank? ? @token.to_query : @redirect_url.query + @token.to_query
               redirect_to @redirect_url.to_s
             else
               render :action => "authorize_success"
@@ -152,12 +151,12 @@ module OAuth
 
       def oauth2_authorize_token
         @client_application = ClientApplication.find_by_key params[:client_id]
+        @token  = Oauth2Token.new :client_application=>@client_application, :user=>current_user, :scope=>params[:scope]
         if request.post?
           @redirect_url = URI.parse(params[:redirect_uri] || @client_application.callback_url)
-          if user_authorizes_token?
-            @token  = Oauth2Token.create :client_application=>@client_application, :user=>current_user, :scope=>params[:scope]
+          if user_authorizes_token? && @token.save
             unless @redirect_url.to_s.blank?
-              redirect_to "#{@redirect_url.to_s}#access_token=#{@token.token}"
+              redirect_to "#{@redirect_url.to_s}##{@token.to_query}"
             else
               render :action => "authorize_success"
             end
@@ -176,7 +175,7 @@ module OAuth
         end
       end
 
-      # http://tools.ietf.org/html/draft-ietf-oauth-v2-08#section-4.1.1
+      # http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-4.1.1
       def oauth2_token_authorization_code
         @verification_code =  @client_application.oauth2_verifiers.find_by_token params[:code]
         unless @verification_code
@@ -191,7 +190,7 @@ module OAuth
         render :json=>@token
       end
 
-      # http://tools.ietf.org/html/draft-ietf-oauth-v2-08#section-4.1.2
+      # http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-4.1.2
       def oauth2_token_password
         @user = authenticate_user( params[:username], params[:password])
         unless @user
@@ -221,6 +220,7 @@ module OAuth
       def oauth2_error(error="invalid_grant")
         render :json=>{:error=>error}.to_json
       end
+
     end
   end
 end

data/lib/oauth/rack/oauth_filter.rb

@@ -83,9 +83,10 @@ module OAuth
       end
 
       def oauth2_token(request)
-        (request.params["oauth_token"] && !request.params["oauth_signature"] ? request.params["oauth_token"] : nil )  ||
+        request.params['bearer_token'] || request.params['access_token'] || (request.params["oauth_token"] && !request.params["oauth_signature"] ? request.params["oauth_token"] : nil )  ||
           request.env["HTTP_AUTHORIZATION"] &&
-          request.env["HTTP_AUTHORIZATION"][/^(OAuth|Token) ([^\s]*)$/, 2]
+          !request.env["HTTP_AUTHORIZATION"][/(oauth_version="1.0")/] &&
+          request.env["HTTP_AUTHORIZATION"][/^(Bearer|OAuth|Token) ([^\s]*)$/, 2]
       end
     end
   end

data/lib/oauth-plugin/version.rb

@@ -1,5 +1,5 @@
 module Oauth
   module Plugin
-    VERSION = "0.4.0.pre7"
+    VERSION = "0.4.0.rc1"
   end
 end

data/spec/rack/oauth_filter_spec.rb

@@ -28,39 +28,72 @@ describe OAuth::Rack::OAuthFilter do
     response = MultiJson.decode(last_response.body)
     response.should == {}
   end
+  
+  describe 'OAuth1' do
+    describe 'with optional white space' do
+      it "should sign with consumer" do
+        get '/',{},{"HTTP_AUTHORIZATION"=>'OAuth oauth_consumer_key="my_consumer", oauth_nonce="amrLDyFE2AMztx5fOYDD1OEqWps6Mc2mAR5qyO44Rj8", oauth_signature="KCSg0RUfVFUcyhrgJo580H8ey0c%3D", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1295039581", oauth_version="1.0"'}
+        last_response.should be_ok
+        response = MultiJson.decode(last_response.body)
+        response.should == {"client_application" => "my_consumer", "oauth_version"=>1, "strategies"=>["two_legged"]}
+      end
 
-  it "should sign with consumer" do
-    get '/',{},{"HTTP_AUTHORIZATION"=>'OAuth oauth_consumer_key="my_consumer", oauth_nonce="amrLDyFE2AMztx5fOYDD1OEqWps6Mc2mAR5qyO44Rj8", oauth_signature="KCSg0RUfVFUcyhrgJo580H8ey0c%3D", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1295039581", oauth_version="1.0"'}
-    last_response.should be_ok
-    response = MultiJson.decode(last_response.body)
-    response.should == {"client_application" => "my_consumer", "oauth_version"=>1, "strategies"=>["two_legged"]}
-  end
+      it "should sign with oauth 1 access token" do
+        client_application = ClientApplication.new "my_consumer"
+        ClientApplication.stub!(:find_by_key).and_return(client_application)
+        client_application.tokens.stub!(:first).and_return(AccessToken.new("my_token"))
+        get '/',{},{"HTTP_AUTHORIZATION"=>'OAuth oauth_consumer_key="my_consumer", oauth_nonce="oiFHXoN0172eigBBUfgaZLdQg7ycGekv8iTdfkCStY", oauth_signature="y35B2DqTWaNlzNX0p4wv%2FJAGzg8%3D", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1295040394", oauth_token="my_token", oauth_version="1.0"'}
+        last_response.should be_ok
+        response = MultiJson.decode(last_response.body)
+        response.should == {"client_application" => "my_consumer", "oauth_token"=>"my_token","oauth_version"=>1, "strategies"=>["oauth10_token","token","oauth10_access_token"]}
+      end
 
-  it "should sign with oauth 1 access token" do
-    client_application = ClientApplication.new "my_consumer"
-    ClientApplication.stub!(:find_by_key).and_return(client_application)
-    client_application.tokens.stub!(:first).and_return(AccessToken.new("my_token"))
-    get '/',{},{"HTTP_AUTHORIZATION"=>'OAuth oauth_consumer_key="my_consumer", oauth_nonce="oiFHXoN0172eigBBUfgaZLdQg7ycGekv8iTdfkCStY", oauth_signature="y35B2DqTWaNlzNX0p4wv%2FJAGzg8%3D", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1295040394", oauth_token="my_token", oauth_version="1.0"'}
-    last_response.should be_ok
-    response = MultiJson.decode(last_response.body)
-    response.should == {"client_application" => "my_consumer", "oauth_token"=>"my_token","oauth_version"=>1, "strategies"=>["oauth10_token","token","oauth10_access_token"]}
-  end
+      it "should sign with oauth 1 request token" do
+        client_application = ClientApplication.new "my_consumer"
+        ClientApplication.stub!(:find_by_key).and_return(client_application)
+        client_application.tokens.stub!(:first).and_return(RequestToken.new("my_token"))
+        get '/',{},{"HTTP_AUTHORIZATION"=>'OAuth oauth_consumer_key="my_consumer", oauth_nonce="oiFHXoN0172eigBBUfgaZLdQg7ycGekv8iTdfkCStY", oauth_signature="y35B2DqTWaNlzNX0p4wv%2FJAGzg8%3D", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1295040394", oauth_token="my_token", oauth_version="1.0"'}
+        last_response.should be_ok
+        response = MultiJson.decode(last_response.body)
+        response.should == {"client_application" => "my_consumer", "oauth_token"=>"my_token","oauth_version"=>1, "strategies"=>["oauth10_token","oauth10_request_token"]}
+      end
+    end  
+
+    describe 'without optional white space' do
+      it "should sign with consumer" do
+        get '/',{},{"HTTP_AUTHORIZATION"=>'OAuth oauth_consumer_key="my_consumer",oauth_nonce="amrLDyFE2AMztx5fOYDD1OEqWps6Mc2mAR5qyO44Rj8",oauth_signature="KCSg0RUfVFUcyhrgJo580H8ey0c%3D",oauth_signature_method="HMAC-SHA1",oauth_timestamp="1295039581",oauth_version="1.0"'}
+        last_response.should be_ok
+        response = MultiJson.decode(last_response.body)
+        response.should == {"client_application" => "my_consumer", "oauth_version"=>1, "strategies"=>["two_legged"]}
+      end
 
-  it "should sign with oauth 1 request token" do
-    client_application = ClientApplication.new "my_consumer"
-    ClientApplication.stub!(:find_by_key).and_return(client_application)
-    client_application.tokens.stub!(:first).and_return(RequestToken.new("my_token"))
-    get '/',{},{"HTTP_AUTHORIZATION"=>'OAuth oauth_consumer_key="my_consumer", oauth_nonce="oiFHXoN0172eigBBUfgaZLdQg7ycGekv8iTdfkCStY", oauth_signature="y35B2DqTWaNlzNX0p4wv%2FJAGzg8%3D", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1295040394", oauth_token="my_token", oauth_version="1.0"'}
-    last_response.should be_ok
-    response = MultiJson.decode(last_response.body)
-    response.should == {"client_application" => "my_consumer", "oauth_token"=>"my_token","oauth_version"=>1, "strategies"=>["oauth10_token","oauth10_request_token"]}
-  end
+      it "should sign with oauth 1 access token" do
+        client_application = ClientApplication.new "my_consumer"
+        ClientApplication.stub!(:find_by_key).and_return(client_application)
+        client_application.tokens.stub!(:first).and_return(AccessToken.new("my_token"))
+        get '/',{},{"HTTP_AUTHORIZATION"=>'OAuth oauth_consumer_key="my_consumer",oauth_nonce="oiFHXoN0172eigBBUfgaZLdQg7ycGekv8iTdfkCStY",oauth_signature="y35B2DqTWaNlzNX0p4wv%2FJAGzg8%3D",oauth_signature_method="HMAC-SHA1",oauth_timestamp="1295040394",oauth_token="my_token",oauth_version="1.0"'}
+        last_response.should be_ok
+        response = MultiJson.decode(last_response.body)
+        response.should == {"client_application" => "my_consumer", "oauth_token"=>"my_token","oauth_version"=>1, "strategies"=>["oauth10_token","token","oauth10_access_token"]}
+      end
 
+      it "should sign with oauth 1 request token" do
+        client_application = ClientApplication.new "my_consumer"
+        ClientApplication.stub!(:find_by_key).and_return(client_application)
+        client_application.tokens.stub!(:first).and_return(RequestToken.new("my_token"))
+        get '/',{},{"HTTP_AUTHORIZATION"=>'OAuth oauth_consumer_key="my_consumer",oauth_nonce="oiFHXoN0172eigBBUfgaZLdQg7ycGekv8iTdfkCStY",oauth_signature="y35B2DqTWaNlzNX0p4wv%2FJAGzg8%3D",oauth_signature_method="HMAC-SHA1",oauth_timestamp="1295040394",oauth_token="my_token",oauth_version="1.0"'}
+        last_response.should be_ok
+        response = MultiJson.decode(last_response.body)
+        response.should == {"client_application" => "my_consumer", "oauth_token"=>"my_token","oauth_version"=>1, "strategies"=>["oauth10_token","oauth10_request_token"]}
+      end
+    end  
+  end
+  
   describe "OAuth2" do
     describe "token given through a HTTP Auth Header" do
       context "authorized and non-invalidated token" do
         it "authenticates" do
-          get '/', {}, { "HTTP_AUTHORIZATION" => "OAuth valid_token" }
+          get '/', {}, { "HTTP_AUTHORIZATION" => "Bearer valid_token" }
           last_response.should be_ok
           response = MultiJson.decode(last_response.body)
           response.should == { "oauth_token" => "valid_token", "oauth_version" => 2, "strategies"=> ["oauth20_token", "token"] }
@@ -69,7 +102,7 @@ describe OAuth::Rack::OAuthFilter do
 
       context "non-authorized token" do
         it "doesn't authenticate" do
-          get '/', {}, { "HTTP_AUTHORIZATION" => "OAuth not_authorized" }
+          get '/', {}, { "HTTP_AUTHORIZATION" => "Bearer not_authorized" }
           last_response.should be_ok
           response = MultiJson.decode(last_response.body)
           response.should == {}
@@ -78,7 +111,7 @@ describe OAuth::Rack::OAuthFilter do
 
       context "authorized and invalidated token" do
         it "doesn't authenticate with an invalidated token" do
-          get '/', {}, { "HTTP_AUTHORIZATION" => "OAuth invalidated" }
+          get '/', {}, { "HTTP_AUTHORIZATION" => "Bearer invalidated" }
           last_response.should be_ok
           response = MultiJson.decode(last_response.body)
           response.should == {}
@@ -86,6 +119,37 @@ describe OAuth::Rack::OAuthFilter do
       end
     end
 
+    describe "OAuth2 pre Bearer" do
+      describe "token given through a HTTP Auth Header" do
+        context "authorized and non-invalidated token" do
+          it "authenticates" do
+            get '/', {}, { "HTTP_AUTHORIZATION" => "OAuth valid_token" }
+            last_response.should be_ok
+            response = MultiJson.decode(last_response.body)
+            response.should == { "oauth_token" => "valid_token", "oauth_version" => 2, "strategies"=> ["oauth20_token", "token"] }
+          end
+        end
+
+        context "non-authorized token" do
+          it "doesn't authenticate" do
+            get '/', {}, { "HTTP_AUTHORIZATION" => "OAuth not_authorized" }
+            last_response.should be_ok
+            response = MultiJson.decode(last_response.body)
+            response.should == {}
+          end
+        end
+
+        context "authorized and invalidated token" do
+          it "doesn't authenticate with an invalidated token" do
+            get '/', {}, { "HTTP_AUTHORIZATION" => "OAuth invalidated" }
+            last_response.should be_ok
+            response = MultiJson.decode(last_response.body)
+            response.should == {}
+          end
+        end
+      end
+    end
+
     describe "token given through a HTTP Auth Header following the OAuth2 pre draft" do
       context "authorized and non-invalidated token" do
         it "authenticates" do
@@ -115,60 +179,63 @@ describe OAuth::Rack::OAuthFilter do
       end
     end
 
-    describe "token given through a query parameter" do
-      context "authorized and non-invalidated token" do
-        it "authenticates" do
-          get '/?oauth_token=valid_token'
-          last_response.should be_ok
-          response = MultiJson.decode(last_response.body)
-          response.should == { "oauth_token" => "valid_token", "oauth_version" => 2, "strategies"=> ["oauth20_token", "token"] }
+    ['bearer_token', 'access_token', 'oauth_token'].each do |name|
+      describe "token given through the query parameter '#{name}'" do
+        context "authorized and non-invalidated token" do
+          it "authenticates" do
+            get "/?#{name}=valid_token"
+
+            last_response.should be_ok
+            response = MultiJson.decode(last_response.body)
+            response.should == { "oauth_token" => "valid_token", "oauth_version" => 2, "strategies"=> ["oauth20_token", "token"] }
+          end
         end
-      end
 
-      context "non-authorized token" do
-        it "doesn't authenticate" do
-          get '/?oauth_token=not_authorized'
-          last_response.should be_ok
-          response = MultiJson.decode(last_response.body)
-          response.should == {}
+        context "non-authorized token" do
+          it "doesn't authenticate" do
+            get "/?#{name}=not_authorized"
+            last_response.should be_ok
+            response = MultiJson.decode(last_response.body)
+            response.should == {}
+          end
         end
-      end
 
-      context "authorized and invalidated token" do
-        it "doesn't authenticate with an invalidated token" do
-          get '/?oauth_token=invalidated'
-          last_response.should be_ok
-          response = MultiJson.decode(last_response.body)
-          response.should == {}
+        context "authorized and invalidated token" do
+          it "doesn't authenticate with an invalidated token" do
+            get "/?#{name}=invalidated"
+            last_response.should be_ok
+            response = MultiJson.decode(last_response.body)
+            response.should == {}
+          end
         end
       end
-    end
 
-    describe "token given through a post parameter" do
-      context "authorized and non-invalidated token" do
-        it "authenticates" do
-          post '/', :oauth_token => 'valid_token'
-          last_response.should be_ok
-          response = MultiJson.decode(last_response.body)
-          response.should == { "oauth_token" => "valid_token", "oauth_version" => 2, "strategies"=> ["oauth20_token", "token"] }
+      describe "token given through the post parameter '#{name}'" do
+        context "authorized and non-invalidated token" do
+          it "authenticates" do
+            post '/', name => 'valid_token'
+            last_response.should be_ok
+            response = MultiJson.decode(last_response.body)
+            response.should == { "oauth_token" => "valid_token", "oauth_version" => 2, "strategies"=> ["oauth20_token", "token"] }
+          end
         end
-      end
 
-      context "non-authorized token" do
-        it "doesn't authenticate" do
-          post '/', :oauth_token => 'not_authorized'
-          last_response.should be_ok
-          response = MultiJson.decode(last_response.body)
-          response.should == {}
+        context "non-authorized token" do
+          it "doesn't authenticate" do
+            post '/', name => 'not_authorized'
+            last_response.should be_ok
+            response = MultiJson.decode(last_response.body)
+            response.should == {}
+          end
         end
-      end
 
-      context "authorized and invalidated token" do
-        it "doesn't authenticate with an invalidated token" do
-          post '/', :oauth_token => 'invalidated'
-          last_response.should be_ok
-          response = MultiJson.decode(last_response.body)
-          response.should == {}
+        context "authorized and invalidated token" do
+          it "doesn't authenticate with an invalidated token" do
+            post '/', name => 'invalidated'
+            last_response.should be_ok
+            response = MultiJson.decode(last_response.body)
+            response.should == {}
+          end
         end
       end
     end

metadata

@@ -2,7 +2,7 @@
 name: oauth-plugin
 version: !ruby/object:Gem::Version 
   prerelease: 6
-  version: 0.4.0.pre7
+  version: 0.4.0.rc1
 platform: ruby
 authors: 
 - Pelle Braendgaard
@@ -327,7 +327,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 
 rubyforge_project: oauth
-rubygems_version: 1.8.5
+rubygems_version: 1.8.11
 signing_key: 
 specification_version: 3
 summary: Ruby on Rails Plugin for OAuth Provider and Consumer