oauth-plugin 0.4.0.rc1 → 0.4.0.rc2

data/CHANGELOG

@@ -1,3 +1,6 @@
+0.4.0-rc2
+  - Better OAuth2 support.
+  - Refactored authorizer into a Authorizer object which is now better tested
 0.4.0-rc1
   PLEASE help test this so we can mark it as final
   - Update to OAuth2 draft 22 which is likely the final release. [pelle] ACTION REQUIRED BY YOU, see README.

data/lib/oauth-plugin/version.rb

@@ -1,5 +1,5 @@
 module Oauth
   module Plugin
-    VERSION = "0.4.0.rc1"
+    VERSION = "0.4.0.rc2"
   end
 end

data/lib/oauth/controllers/provider_controller.rb

@@ -1,3 +1,4 @@
+require 'oauth/provider/authorizer'
 module OAuth
   module Controllers
 
@@ -9,7 +10,7 @@ module OAuth
           oauthenticate :strategies => :token, :interactive => false, :only => [:invalidate,:capabilities]
           oauthenticate :strategies => :two_legged, :interactive => false, :only => [:request_token]
           oauthenticate :strategies => :oauth10_request_token, :interactive => false, :only => [:access_token]
-          skip_before_filter :verify_authenticity_token, :only=>[:request_token, :access_token, :invalidate, :test_request]
+          skip_before_filter :verify_authenticity_token, :only=>[:request_token, :access_token, :invalidate, :test_request, :token]
         end
       end
 
@@ -37,7 +38,10 @@ module OAuth
           oauth2_error "invalid_client"
           return
         end
-        if ["authorization_code","password","none"].include?(params[:grant_type])
+        # older drafts used none for client_credentials
+        params[:grant_type] = 'client_credentials' if params[:grant_type] == 'none'
+        logger.info "grant_type=#{params[:grant_type]}"
+        if ["authorization_code", "password", "client_credentials"].include?(params[:grant_type])
           send "oauth2_token_#{params[:grant_type].underscore}"
         else
           oauth2_error "unsupported_grant_type"
@@ -52,10 +56,14 @@ module OAuth
         if params[:oauth_token]
           @token = ::RequestToken.find_by_token! params[:oauth_token]
           oauth1_authorize
-        elsif ["code","token"].include?(params[:response_type]) # pick flow
-          send "oauth2_authorize_#{params[:response_type]}"
         else
-          render :status=>404, :text=>"No token provided"
+          if request.post?
+            @authorizer = OAuth::Provider::Authorizer.new current_user, user_authorizes_token?, params
+            redirect_to @authorizer.redirect_uri
+          else
+            @client_application = ClientApplication.find_by_key! params[:client_id]
+            render :action => "oauth2_authorize"
+          end
         end
       end
 
@@ -121,59 +129,6 @@ module OAuth
         end
       end
 
-      def oauth2_authorize_code
-        @client_application = ClientApplication.find_by_key params[:client_id]
-        # Using ||= allows us to override this and customize the verification_code and call super to handle the rest
-        @token ||= Oauth2Verifier.new :client_application=>@client_application, :user=>current_user, :callback_url=>@redirect_url.to_s, :scope => params[:scope], :state => params[:state]
-        if request.post?
-          @redirect_url = URI.parse(params[:redirect_uri] || @client_application.callback_url) if params[:redirect_uri] || @client_application.callback_url
-          if user_authorizes_token? && @token.save
-            unless @redirect_url.to_s.blank?
-              @redirect_url.query = @redirect_url.query.blank? ? @token.to_query : @redirect_url.query + @token.to_query
-              redirect_to @redirect_url.to_s
-            else
-              render :action => "authorize_success"
-            end
-          else
-            unless @redirect_url.to_s.blank?
-              @redirect_url.query = @redirect_url.query.blank? ?
-                                    "error=user_denied" :
-                                    @redirect_url.query + "&error=user_denied"
-              redirect_to @redirect_url.to_s
-            else
-              render :action => "authorize_failure"
-            end
-          end
-        else
-          render :action => "oauth2_authorize"
-        end
-      end
-
-      def oauth2_authorize_token
-        @client_application = ClientApplication.find_by_key params[:client_id]
-        @token  = Oauth2Token.new :client_application=>@client_application, :user=>current_user, :scope=>params[:scope]
-        if request.post?
-          @redirect_url = URI.parse(params[:redirect_uri] || @client_application.callback_url)
-          if user_authorizes_token? && @token.save
-            unless @redirect_url.to_s.blank?
-              redirect_to "#{@redirect_url.to_s}##{@token.to_query}"
-            else
-              render :action => "authorize_success"
-            end
-          else
-            unless @redirect_url.to_s.blank?
-              @redirect_url.query = @redirect_url.query.blank? ?
-                                    "error=user_denied" :
-                                    @redirect_url.query + "&error=user_denied"
-              redirect_to @redirect_url.to_s
-            else
-              render :action => "authorize_failure"
-            end
-          end
-        else
-          render :action => "oauth2_authorize"
-        end
-      end
 
       # http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-4.1.1
       def oauth2_token_authorization_code
@@ -207,7 +162,7 @@ module OAuth
       end
 
       # autonomous authorization which creates a token for client_applications user
-      def oauth2_token_none
+      def oauth2_token_client_credentials
         @token = Oauth2Token.create :client_application=>@client_application, :user=>@client_application.user, :scope=>params[:scope]
         render :json=>@token
       end

data/lib/oauth/provider/authorizer.rb

@@ -0,0 +1,83 @@
+require 'uri'
+
+module OAuth
+  module Provider
+    class Authorizer
+      attr_accessor :user, :params, :app
+
+      def initialize(user, authorized, params = {})
+        @user = user
+        @params = params
+        @authorized = authorized
+      end
+
+      def app
+        @app ||= ::ClientApplication.find_by_key!(params[:client_id])
+      end
+
+      def code
+        @code ||= ::Oauth2Verifier.create! :client_application => app,
+                                      :user => @user,
+                                      :scope => @params[:scope],
+                                      :callback_url => @params[:redirect_uri]
+      end
+
+      def token
+        @token ||= ::Oauth2Token.create! :client_application => app,
+                                      :user => @user,
+                                      :scope => @params[:scope],
+                                      :callback_url => @params[:redirect_uri]
+      end
+
+      def authorized?
+        @authorized == true
+      end
+
+      def redirect_uri
+        uri = base_uri
+        if params[:response_type] == 'code'
+          if uri.query
+            uri.query << '&'
+          else
+            uri.query = ''
+          end
+          uri.query << encode_response
+        else
+          uri.fragment = encode_response
+        end
+        uri.to_s
+      end
+
+      def response
+        r = {}
+        if ['token','code'].include? params[:response_type]
+          if authorized?
+            if params[:response_type] == 'code'
+              r[:code] = code.token
+            else
+              r[:access_token] = token.token
+            end
+          else
+            r[:error] = 'access_denied'
+          end
+        else
+          r[:error] = 'unsupported_response_type'
+        end
+        r[:state] = params[:state] if params[:state]
+        r
+      end
+
+      def encode_response
+        response.map do |k, v|
+          [URI.escape(k.to_s),URI.escape(v)] * "="
+        end * "&"
+      end
+
+      protected
+
+        def base_uri
+          URI.parse(params[:redirect_uri] || app.callback_url)
+        end
+    end
+  end
+end

data/oauth-plugin.gemspec

@@ -8,7 +8,7 @@ Gem::Specification.new do |s|
 
   s.required_rubygems_version = Gem::Requirement.new("> 1.3.1") if s.respond_to? :required_rubygems_version=
   s.authors = ["Pelle Braendgaard"]
-  s.date = %q{2011-06-28}
+  s.date = %q{2011-10-20}
   s.description = %q{Rails plugin for implementing an OAuth Provider or Consumer}
   s.email = %q{oauth-ruby@googlegroups.com}
   s.extra_rdoc_files = [

data/spec/dummy_provider_models.rb

@@ -0,0 +1,53 @@
+# Dummy implementation
+class ClientApplication
+  attr_accessor :key
+
+  def self.find_by_key(key)
+    ClientApplication.new(key)
+  end
+
+  def initialize(key)
+    @key = key
+  end
+
+  def tokens
+    @tokens||=[]
+  end
+
+  def secret
+    "secret"
+  end
+end
+
+class OauthToken
+  attr_accessor :token
+
+  def self.first(conditions_hash)
+    case conditions_hash[:conditions].last
+    when "not_authorized", "invalidated"
+      nil
+    else
+      OauthToken.new(conditions_hash[:conditions].last)
+    end
+  end
+
+  def initialize(token)
+    @token = token
+  end
+
+  def secret
+    "secret"
+  end
+end
+
+class Oauth2Token < OauthToken ; end
+class Oauth2Verifier < OauthToken ; end
+class AccessToken < OauthToken ; end
+class RequestToken < OauthToken ; end
+
+class OauthNonce
+  # Always remember
+  def self.remember(nonce,timestamp)
+    true
+  end
+end

data/spec/oauth/provider/authorizer_spec.rb

@@ -0,0 +1,202 @@
+require 'spec_helper'
+require 'multi_json'
+require 'oauth/provider/authorizer'
+require 'dummy_provider_models'
+
+describe OAuth::Provider::Authorizer do
+
+
+  describe "Authorization code" do
+
+    describe "should issue code" do
+
+      before(:each) do
+        @user = double("user")
+        @app  = double("app")
+        @code = double("code", :token => "secret auth code")
+
+        ::ClientApplication.should_receive(:find_by_key!).with('client id').and_return(@app)
+      end
+
+      it "should allow" do
+        ::Oauth2Verifier.should_receive(:create!).with( :client_application=>@app,
+                                                  :user=>@user,
+                                                  :callback_url=>'http://mysite.com/callback',
+                                                  :scope => 'a b').and_return(@code)
+
+        @authorizer = OAuth::Provider::Authorizer.new @user, true, :response_type => 'code',
+                                                      :scope => "a b",
+                                                      :client_id => 'client id',
+                                                      :redirect_uri => 'http://mysite.com/callback'
+
+        @authorizer.redirect_uri.should == "http://mysite.com/callback?code=secret%20auth%20code"
+        @authorizer.should be_authorized
+
+      end
+
+      it "should include state" do
+        ::Oauth2Verifier.should_receive(:create!).with( :client_application=>@app,
+                                                  :user=>@user,
+                                                  :callback_url=>'http://mysite.com/callback',
+                                                  :scope => 'a b').and_return(@code)
+
+        @authorizer = OAuth::Provider::Authorizer.new @user, true, :response_type => 'code',
+                                                      :state => 'customer id',
+                                                      :scope => "a b",
+                                                      :client_id => 'client id',
+                                                      :redirect_uri => 'http://mysite.com/callback'
+
+        @authorizer.redirect_uri.should == "http://mysite.com/callback?code=secret%20auth%20code&state=customer%20id"
+        @authorizer.should be_authorized
+
+      end
+
+      it "should allow query string in callback" do
+        ::Oauth2Verifier.should_receive(:create!).with( :client_application=>@app,
+                                                  :user=>@user,
+                                                  :callback_url=>'http://mysite.com/callback?this=one',
+                                                  :scope => 'a b').and_return(@code)
+
+        @authorizer = OAuth::Provider::Authorizer.new @user, true, :response_type => 'code',
+                                                      :scope => "a b",
+                                                      :client_id => 'client id',
+                                                      :redirect_uri => 'http://mysite.com/callback?this=one'
+        @authorizer.should be_authorized
+        @authorizer.redirect_uri.should == "http://mysite.com/callback?this=one&code=secret%20auth%20code"
+      end
+    end
+
+
+  end
+
+  describe "user does not authorize" do
+
+    it "should send error" do
+      @authorizer = OAuth::Provider::Authorizer.new @user, false, :response_type => 'code',
+                                                    :scope => "a b",
+                                                    :client_id => 'client id',
+                                                    :redirect_uri => 'http://mysite.com/callback'
+
+      @authorizer.redirect_uri.should == "http://mysite.com/callback?error=access_denied"
+      @authorizer.should_not be_authorized
+
+    end
+
+    it "should send error with state and query params in callback" do
+      @authorizer = OAuth::Provider::Authorizer.new @user, false, :response_type => 'code',
+                                                    :scope => "a b",
+                                                    :client_id => 'client id',
+                                                    :redirect_uri=>'http://mysite.com/callback?this=one',
+                                                    :state => "my customer"
+
+      @authorizer.redirect_uri.should == "http://mysite.com/callback?this=one&error=access_denied&state=my%20customer"
+      @authorizer.should_not be_authorized
+
+    end
+
+  end
+
+  describe "Implict Grant" do
+
+    describe "should issue token" do
+
+      before(:each) do
+        @user = double("user")
+        @app  = double("app")
+        @token = double("token", :token => "secret auth code")
+
+        ::ClientApplication.should_receive(:find_by_key!).with('client id').and_return(@app)
+      end
+
+      it "should allow" do
+        ::Oauth2Token.should_receive(:create!).with( :client_application=>@app,
+                                                  :user=>@user,
+                                                  :callback_url=>'http://mysite.com/callback',
+                                                  :scope => 'a b').and_return(@token)
+
+        @authorizer = OAuth::Provider::Authorizer.new @user, true, :response_type => 'token',
+                                                      :scope => "a b",
+                                                      :client_id => 'client id',
+                                                      :redirect_uri => 'http://mysite.com/callback'
+
+        @authorizer.redirect_uri.should == "http://mysite.com/callback#access_token=secret%20auth%20code"
+        @authorizer.should be_authorized
+
+      end
+
+      it "should include state" do
+        ::Oauth2Token.should_receive(:create!).with( :client_application=>@app,
+                                                  :user=>@user,
+                                                  :callback_url=>'http://mysite.com/callback',
+                                                  :scope => 'a b').and_return(@token)
+
+        @authorizer = OAuth::Provider::Authorizer.new @user, true, :response_type => 'token',
+                                                      :state => 'customer id',
+                                                      :scope => "a b",
+                                                      :client_id => 'client id',
+                                                      :redirect_uri => 'http://mysite.com/callback'
+
+        @authorizer.redirect_uri.should == "http://mysite.com/callback#access_token=secret%20auth%20code&state=customer%20id"
+        @authorizer.should be_authorized
+
+      end
+
+      it "should allow query string in callback" do
+        ::Oauth2Token.should_receive(:create!).with( :client_application=>@app,
+                                                  :user=>@user,
+                                                  :callback_url=>'http://mysite.com/callback?this=one',
+                                                  :scope => 'a b').and_return(@token)
+
+        @authorizer = OAuth::Provider::Authorizer.new @user, true, :response_type => 'token',
+                                                      :scope => "a b",
+                                                      :client_id => 'client id',
+                                                      :redirect_uri => 'http://mysite.com/callback?this=one'
+        @authorizer.should be_authorized
+        @authorizer.redirect_uri.should == "http://mysite.com/callback?this=one#access_token=secret%20auth%20code"
+      end
+    end
+
+
+  end
+
+  describe "user does not authorize" do
+
+    it "should send error" do
+      @authorizer = OAuth::Provider::Authorizer.new @user, false, :response_type => 'token',
+                                                    :scope => "a b",
+                                                    :client_id => 'client id',
+                                                    :redirect_uri => 'http://mysite.com/callback'
+
+      @authorizer.redirect_uri.should == "http://mysite.com/callback#error=access_denied"
+      @authorizer.should_not be_authorized
+
+    end
+
+    it "should send error with state and query params in callback" do
+      @authorizer = OAuth::Provider::Authorizer.new @user, false, :response_type => 'token',
+                                                    :scope => "a b",
+                                                    :client_id => 'client id',
+                                                    :redirect_uri=>'http://mysite.com/callback?this=one',
+                                                    :state => "my customer"
+
+      @authorizer.redirect_uri.should == "http://mysite.com/callback?this=one#error=access_denied&state=my%20customer"
+      @authorizer.should_not be_authorized
+
+    end
+
+  end
+
+  it "should handle unsupported response type" do
+    @user = double("user")
+
+    @authorizer = OAuth::Provider::Authorizer.new @user, false, :response_type => 'my new',
+                                                  :scope => "a b",
+                                                  :client_id => 'client id',
+                                                  :redirect_uri => 'http://mysite.com/callback'
+
+    @authorizer.redirect_uri.should == "http://mysite.com/callback#error=unsupported_response_type"
+    @authorizer.should_not be_authorized
+
+  end
+
+end

data/spec/rack/oauth_filter_spec.rb

@@ -3,6 +3,7 @@ require 'rack/test'
 require 'oauth/rack/oauth_filter'
 require 'multi_json'
 require 'forwardable'
+require 'dummy_provider_models'
 
 class OAuthEcho
   def call(env)
@@ -28,7 +29,7 @@ describe OAuth::Rack::OAuthFilter do
     response = MultiJson.decode(last_response.body)
     response.should == {}
   end
-  
+
   describe 'OAuth1' do
     describe 'with optional white space' do
       it "should sign with consumer" do
@@ -57,7 +58,7 @@ describe OAuth::Rack::OAuthFilter do
         response = MultiJson.decode(last_response.body)
         response.should == {"client_application" => "my_consumer", "oauth_token"=>"my_token","oauth_version"=>1, "strategies"=>["oauth10_token","oauth10_request_token"]}
       end
-    end  
+    end
 
     describe 'without optional white space' do
       it "should sign with consumer" do
@@ -86,9 +87,9 @@ describe OAuth::Rack::OAuthFilter do
         response = MultiJson.decode(last_response.body)
         response.should == {"client_application" => "my_consumer", "oauth_token"=>"my_token","oauth_version"=>1, "strategies"=>["oauth10_token","oauth10_request_token"]}
       end
-    end  
+    end
   end
-  
+
   describe "OAuth2" do
     describe "token given through a HTTP Auth Header" do
       context "authorized and non-invalidated token" do
@@ -240,59 +241,4 @@ describe OAuth::Rack::OAuthFilter do
       end
     end
   end
-
-
-  # Dummy implementation
-  class ClientApplication
-    attr_accessor :key
-
-    def self.find_by_key(key)
-      ClientApplication.new(key)
-    end
-
-    def initialize(key)
-      @key = key
-    end
-
-    def tokens
-      @tokens||=[]
-    end
-
-    def secret
-      "secret"
-    end
-  end
-
-  class OauthToken
-    attr_accessor :token
-
-    def self.first(conditions_hash)
-      case conditions_hash[:conditions].last
-      when "not_authorized", "invalidated"
-        nil
-      else
-        OauthToken.new(conditions_hash[:conditions].last)
-      end
-    end
-
-    def initialize(token)
-      @token = token
-    end
-
-    def secret
-      "secret"
-    end
-  end
-
-  class Oauth2Token < OauthToken ; end
-  class AccessToken < OauthToken ; end
-  class RequestToken < OauthToken ; end
-
-  class OauthNonce
-    # Always remember
-    def self.remember(nonce,timestamp)
-      true
-    end
-  end
-
 end

metadata

@@ -2,7 +2,7 @@
 name: oauth-plugin
 version: !ruby/object:Gem::Version 
   prerelease: 6
-  version: 0.4.0.rc1
+  version: 0.4.0.rc2
 platform: ruby
 authors: 
 - Pelle Braendgaard
@@ -10,7 +10,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-06-28 00:00:00 Z
+date: 2011-10-20 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: opentransact
@@ -297,9 +297,12 @@ files:
 - lib/oauth/models/consumers/services/twitter_token.rb
 - lib/oauth/models/consumers/simple_client.rb
 - lib/oauth/models/consumers/token.rb
+- lib/oauth/provider/authorizer.rb
 - lib/oauth/rack/oauth_filter.rb
 - oauth-plugin.gemspec
 - rails/init.rb
+- spec/dummy_provider_models.rb
+- spec/oauth/provider/authorizer_spec.rb
 - spec/rack/oauth_filter_spec.rb
 - spec/spec_helper.rb
 - tasks/oauth_tasks.rake
@@ -332,5 +335,7 @@ signing_key:
 specification_version: 3
 summary: Ruby on Rails Plugin for OAuth Provider and Consumer
 test_files: 
+- spec/dummy_provider_models.rb
+- spec/oauth/provider/authorizer_spec.rb
 - spec/rack/oauth_filter_spec.rb
 - spec/spec_helper.rb