oauthenticator 0.1.2 → 0.1.3
Sign up to get free protection for your applications and to get access to all the features.
- data/README.md +27 -12
- data/lib/oauthenticator/middleware.rb +1 -1
- data/lib/oauthenticator/version.rb +1 -1
- metadata +1 -1
data/README.md
CHANGED
@@ -11,7 +11,7 @@ implementation up to the user. The user configures this by creating a module imp
|
|
11
11
|
which will be passed to OAuthenticator.
|
12
12
|
|
13
13
|
For more information on the details of the methods which must or may be implemented, please see the
|
14
|
-
documentation for the module OAuthenticator::
|
14
|
+
documentation for the module `OAuthenticator::ConfigMethods`, which defines stub methods for
|
15
15
|
each recognized method, with method documentation relating to your implementation.
|
16
16
|
|
17
17
|
A simple, contrived example follows, which approximately resembles what you might implement. It is not useful
|
@@ -20,8 +20,8 @@ on its own but will be used in following examples for usage of Middleware and Si
|
|
20
20
|
```ruby
|
21
21
|
require 'oauthenticator'
|
22
22
|
|
23
|
-
# we'll suppose that there exist the following ActiveRecord classes with the named
|
24
|
-
# are strings), for this example:
|
23
|
+
# we'll suppose that there exist the following ActiveRecord classes with the named
|
24
|
+
# attributes (all of which are strings), for this example:
|
25
25
|
#
|
26
26
|
# - OAuthNonce:
|
27
27
|
# - nonce
|
@@ -40,12 +40,14 @@ module AwesomeOAuthConfig
|
|
40
40
|
OAuthNonce.where(:nonce => nonce, :timestamp => timestamp).any?
|
41
41
|
end
|
42
42
|
|
43
|
-
# nonce is used, store it so that in the future #nonce_used? will return true
|
43
|
+
# nonce is used, store it so that in the future #nonce_used? will return true
|
44
|
+
# correctly
|
44
45
|
def use_nonce!
|
45
46
|
OAuthNonce.create!(:nonce => nonce, :timestamp => timestamp)
|
46
47
|
end
|
47
48
|
|
48
|
-
# number seconds in the past and the future for which we'll consider a request
|
49
|
+
# number seconds in the past and the future for which we'll consider a request
|
50
|
+
# authentic
|
49
51
|
def timestamp_valid_period
|
50
52
|
25
|
51
53
|
end
|
@@ -62,13 +64,14 @@ module AwesomeOAuthConfig
|
|
62
64
|
|
63
65
|
# access token secret, looked up by access token
|
64
66
|
def access_token_secret
|
65
|
-
|
67
|
+
OAuthAccessToken.where(:token => token).first.try(:secret)
|
66
68
|
end
|
67
69
|
|
68
70
|
# whether the access token belongs to the consumer
|
69
71
|
def access_token_belongs_to_consumer?
|
70
|
-
|
71
|
-
# alternately
|
72
|
+
OAuthAccessToken.where(:token => token).first.try(:consumer_key) == consumer_key
|
73
|
+
# alternately:
|
74
|
+
# OAuthAccessToken.where(:token => token, :consumer_key => consumer_key).any?
|
72
75
|
end
|
73
76
|
end
|
74
77
|
```
|
@@ -79,7 +82,7 @@ tests.
|
|
79
82
|
|
80
83
|
## OAuthenticator::Middleware
|
81
84
|
|
82
|
-
The middleware is used by passing the above-mentioned module on the
|
85
|
+
The middleware is used by passing the above-mentioned module on the `:config_methods` key to initialize the
|
83
86
|
middleware:
|
84
87
|
|
85
88
|
```ruby
|
@@ -89,8 +92,8 @@ use OAuthenticator::Middleware, :config_methods => AwesomeOAuthConfig
|
|
89
92
|
run proc { |env| [200, {'Content-Type' => 'text/plain'}, ['access granted!']] }
|
90
93
|
```
|
91
94
|
|
92
|
-
The authentication can also be bypassed with a proc on the
|
93
|
-
OAuthenticator::Middleware for the details of that.
|
95
|
+
The authentication can also be bypassed with a proc on the `:bypass` key; see the documentation for
|
96
|
+
`OAuthenticator::Middleware` for the details of that.
|
94
97
|
|
95
98
|
## OAuthenticator::SignedRequest
|
96
99
|
|
@@ -98,9 +101,21 @@ The OAuthenticator::SignedRequest class may be used independently of the middlew
|
|
98
101
|
passed your module of config methods to include. It is used like:
|
99
102
|
|
100
103
|
```ruby
|
101
|
-
OAuthenticator::SignedRequest.including_config(AwesomeOAuthConfig).new(
|
104
|
+
OAuthenticator::SignedRequest.including_config(AwesomeOAuthConfig).new(request_attrs)
|
102
105
|
```
|
103
106
|
|
104
107
|
See the documentation of OAuthenticator::SignedRequest for how the class is used, once it includes the methods
|
105
108
|
it needs to function.
|
106
109
|
|
110
|
+
# Other
|
111
|
+
|
112
|
+
## SimpleOAuth
|
113
|
+
|
114
|
+
OAuthenticator uses [SimpleOAuth](https://github.com/laserlemon/simple_oauth) underneath. There is a
|
115
|
+
fork with some improvements that have not yet made it into the main SimpleOAuth repo, and it is recommended
|
116
|
+
to use these for more robust and safe parsing of the Authorization header. This is not published in rubygems,
|
117
|
+
but if you use Bundler, you can use this by using the following line in your `Gemfile`;
|
118
|
+
|
119
|
+
```ruby
|
120
|
+
gem 'simple_oauth', :git => 'https://github.com/notEthan/simple_oauth.git', :tag => 'ethan-v0.2.0.1'
|
121
|
+
```
|
@@ -35,7 +35,7 @@ module OAuthenticator
|
|
35
35
|
|
36
36
|
if @options[:bypass] && @options[:bypass].call(request)
|
37
37
|
env["oauth.authenticated"] = false
|
38
|
-
@app.call(env
|
38
|
+
@app.call(env)
|
39
39
|
else
|
40
40
|
oauth_signed_request_class = OAuthenticator::SignedRequest.including_config(@options[:config_methods])
|
41
41
|
oauth_request = oauth_signed_request_class.from_rack_request(request)
|