openid_connect 0.0.0 → 0.0.1

data/.gitignore

@@ -1,4 +1,21 @@
-*.gem
-.bundle
-Gemfile.lock
-pkg/*
+## MAC OS
+.DS_Store
+
+## TEXTMATE
+*.tmproj
+tmtags
+
+## EMACS
+*~
+\#*
+.\#*
+
+## VIM
+*.swp
+
+## PROJECT::GENERAL
+coverage
+rdoc
+pkg
+
+## PROJECT::SPECIFIC

data/Gemfile.lock

@@ -0,0 +1,67 @@
+PATH
+  remote: .
+  specs:
+    openid_connect (0.0.0)
+      activemodel
+      attr_required
+      rack-oauth2 (>= 0.9.0)
+      tzinfo
+      validate_email
+      validate_url
+
+GEM
+  remote: http://rubygems.org/
+  specs:
+    activemodel (3.0.9)
+      activesupport (= 3.0.9)
+      builder (~> 2.1.2)
+      i18n (~> 0.5.0)
+    activesupport (3.0.9)
+    attr_required (0.0.3)
+    builder (2.1.2)
+    diff-lcs (1.1.2)
+    httpclient (2.2.1)
+    i18n (0.5.0)
+    json (1.5.3)
+    mail (2.3.0)
+      i18n (>= 0.4.0)
+      mime-types (~> 1.16)
+      treetop (~> 1.4.8)
+    mime-types (1.16)
+    polyglot (0.3.2)
+    rack (1.3.2)
+    rack-oauth2 (0.9.0)
+      activesupport (>= 2.3)
+      attr_required (>= 0.0.3)
+      httpclient (>= 2.2.0.2)
+      i18n
+      json (>= 1.4.3)
+      rack (>= 1.1)
+    rake (0.9.2)
+    rcov (0.9.10)
+    rspec (2.6.0)
+      rspec-core (~> 2.6.0)
+      rspec-expectations (~> 2.6.0)
+      rspec-mocks (~> 2.6.0)
+    rspec-core (2.6.4)
+    rspec-expectations (2.6.0)
+      diff-lcs (~> 1.1.2)
+    rspec-mocks (2.6.0)
+    treetop (1.4.10)
+      polyglot
+      polyglot (>= 0.3.1)
+    tzinfo (0.3.29)
+    validate_email (0.1.5)
+      activemodel (>= 3.0)
+      mail (>= 2.2.5)
+    validate_url (0.2.0)
+      activemodel (>= 3.0.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  openid_connect!
+  rake (>= 0.8)
+  rcov (>= 0.9)
+  rspec (>= 2)

data/VERSION

@@ -1 +1 @@
-0.0.0
+0.0.1

data/lib/openid_connect.rb

@@ -1,7 +1,5 @@
 require 'rack/oauth2'
-require 'rack/oauth2/server/authorize/extensions/id_token'
-require 'rack/oauth2/server/authorize/extensions/id_token_and_token'
+require 'rack/oauth2/server/authorize/extension/id_token'
+require 'rack/oauth2/server/authorize/extension/id_token_and_token'
 
-module OpenIDConnect
-  # Your code goes here...
-end
+require 'openid_connect/response_object'

data/lib/openid_connect/response_object.rb

@@ -0,0 +1,42 @@
+require 'active_model'
+require 'tzinfo'
+require 'validate_url'
+require 'validate_email'
+require 'attr_required'
+require 'attr_optional'
+
+module OpenIDConnect
+  class ResponseObject
+    include ActiveModel::Validations, AttrRequired, AttrOptional
+
+    def initialize(attributes = {})
+      all_attriutes.each do |_attr_|
+        self.send :"#{_attr_}=", attributes[_attr_]
+      end
+      attr_missing!
+    end
+
+    def all_attriutes
+      required_attributes + optional_attributes
+    end
+
+    def require_at_least_one_attributes
+      all_blank = all_attriutes.all? do |key|
+        self.send(key).blank?
+      end
+      errors.add :base, 'At least one attribute is required' if all_blank
+    end
+
+    def as_json(options = {})
+      all_attriutes.inject({}) do |hash, _attr_|
+        hash.merge! _attr_ => self.send(_attr_)
+      end.delete_if do |key, value|
+        value.nil?
+      end
+    end
+  end
+end
+
+Dir[File.dirname(__FILE__) + '/response_object/*.rb'].each do |file|
+  require file
+end

data/lib/openid_connect/response_object/id_token.rb

@@ -0,0 +1,13 @@
+module OpenIDConnect
+  class ResponseObject
+    class IdToken < ResponseObject
+      attr_required :iss, :user_id, :aud, :exp
+      attr_optional :iso29115, :nonce, :issued_to
+
+      def to_jwt
+        # TODO
+        'jwt_header.jwt_part2.jwt_part3'
+      end
+    end
+  end
+end

data/lib/openid_connect/response_object/user_info.rb

@@ -0,0 +1,3 @@
+Dir[File.dirname(__FILE__) + '/user_info/*.rb'].each do |file| 
+  require file
+end

data/lib/openid_connect/response_object/user_info/open_id.rb

@@ -0,0 +1,47 @@
+module OpenIDConnect
+  class ResponseObject
+    module UserInfo
+      class OpenID < ResponseObject
+        attr_optional :id, :name, :given_name, :family_name, :middle_name, :nickname
+
+        attr_optional :phone_number
+
+        attr_optional :verified, :gender, :zoneinfo, :locale
+        validates_inclusion_of :verified, :in => [true, false], :allow_nil => true
+        validates_inclusion_of :gender, :in => [:male, :female], :allow_nil => true
+        validates_inclusion_of :zoneinfo, :in => TZInfo::TimezoneProxy.all.collect(&:name), :allow_nil => true
+        # TODO: validate locale
+
+        attr_optional :birthday, :updated_time
+
+        attr_optional :profile, :picture, :website
+        validates :profile, :picture, :website, :url => true, :allow_nil => true
+
+        attr_optional :email
+        validates :email, :email => true, :allow_nil => true
+
+        attr_optional :address
+        validate :validate_address
+
+        validate :require_at_least_one_attributes
+
+        def validate_address
+          errors.add :address, 'cannot be blank' unless address.blank? || address.valid?
+        end
+
+        def address=(hash_or_address)
+          @address = case hash_or_address
+          when Hash
+            Address.new hash_or_address
+          when Address
+            hash_or_address
+          end
+        end
+      end
+    end
+  end
+end
+
+Dir[File.dirname(__FILE__) + '/open_id/*.rb'].each do |file| 
+  require file
+end

data/lib/openid_connect/response_object/user_info/open_id/address.rb

@@ -0,0 +1,12 @@
+module OpenIDConnect
+  class ResponseObject
+    module UserInfo
+      class OpenID
+        class Address < ResponseObject
+          attr_optional :formatted, :street_address, :locality, :region, :postal_code, :country
+          validate :require_at_least_one_attributes
+        end
+      end
+    end
+  end
+end

data/lib/rack/oauth2/server/authorize/{extensions → extension}/id_token.rb

@@ -2,7 +2,7 @@ module Rack
   module OAuth2
     module Server
       class Authorize
-        module Extensions
+        module Extension
           class IdToken < Abstract::Handler
             class << self
               def response_type_for?(response_type)
@@ -16,15 +16,28 @@ module Rack
               super
             end
 
-            class Request < Authorize::Token::Request
+            class Request < Authorize::Request
               def initialize(env)
                 super
                 @response_type = :id_token
                 attr_missing!
               end
+
+              def error_params_location
+                :fragment
+              end
             end
 
-            class Response < Authorize::Token::Response
+            class Response < Authorize::Response
+              attr_required :id_token
+
+              def protocol_params
+                super.merge :id_token => id_token.to_jwt
+              end
+
+              def protocol_params_location
+                :fragment
+              end
             end
           end
         end

data/lib/rack/oauth2/server/authorize/{extensions → extension}/id_token_and_token.rb

@@ -2,7 +2,7 @@ module Rack
   module OAuth2
     module Server
       class Authorize
-        module Extensions
+        module Extension
           class IdTokenAndToken < Abstract::Handler
             class << self
               def response_type_for?(response_type)
@@ -25,6 +25,11 @@ module Rack
             end
 
             class Response < Authorize::Token::Response
+              attr_required :id_token
+
+              def protocol_params
+                super.merge :id_token => id_token.to_jwt
+              end
             end
           end
         end

data/openid_connect.gemspec

@@ -10,6 +10,11 @@ Gem::Specification.new do |s|
   s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
   s.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
   s.require_paths = ["lib"]
+  s.add_runtime_dependency "activemodel"
+  s.add_runtime_dependency "validate_url"
+  s.add_runtime_dependency "validate_email"
+  s.add_runtime_dependency "tzinfo"
+  s.add_runtime_dependency "attr_required"
   s.add_runtime_dependency "rack-oauth2", ">= 0.9.0"
   s.add_development_dependency "rake", ">= 0.8"
   s.add_development_dependency "rcov", ">= 0.9"

data/spec/openid_connect/response_object/id_token_spec.rb

@@ -0,0 +1,11 @@
+require 'spec_helper'
+
+describe OpenIDConnect::ResponseObject::IdToken do
+  let(:klass) { OpenIDConnect::ResponseObject::IdToken }
+
+  describe 'attributes' do
+    subject { klass }
+    its(:required_attributes) { should == [:iss, :user_id, :aud, :exp] }
+    its(:optional_attributes) { should == [:iso29115, :nonce, :issued_to] }
+  end
+end

data/spec/openid_connect/response_object/user_info/open_id/address_spec.rb

@@ -0,0 +1,27 @@
+require 'spec_helper'
+
+describe OpenIDConnect::ResponseObject::UserInfo::OpenID::Address do
+  let(:klass) { OpenIDConnect::ResponseObject::UserInfo::OpenID::Address }
+
+  describe 'attributes' do
+    subject { klass }
+    its(:required_attributes) { should == [] }
+    its(:optional_attributes) { should == [:formatted, :street_address, :locality, :region, :postal_code, :country] }
+  end
+
+  describe 'validations' do
+    subject do
+      instance = klass.new attributes
+      instance.valid?
+      instance
+    end
+
+    context 'when all attributes are blank' do
+      let :attributes do
+        {}
+      end
+      its(:valid?) { should be_false }
+      its(:errors) { should include :base }
+    end
+  end
+end

data/spec/openid_connect/response_object/user_info/open_id_spec.rb

@@ -0,0 +1,101 @@
+require 'spec_helper'
+
+describe OpenIDConnect::ResponseObject::UserInfo::OpenID do
+  let(:klass) { OpenIDConnect::ResponseObject::UserInfo::OpenID }
+  let(:instance) { klass.new attributes }
+  subject { instance }
+
+  describe 'attributes' do
+    subject { klass }
+    its(:required_attributes) { should == [] }
+    its(:optional_attributes) do
+      should == [
+        :id, :name, :given_name, :family_name, :middle_name, :nickname,
+        :phone_number,
+        :verified, :gender, :zoneinfo, :locale,
+        :birthday, :updated_time,
+        :profile, :picture, :website,
+        :email,
+        :address
+      ]
+    end
+  end
+
+  describe 'validations' do
+    subject do
+      _instance_ = instance
+      _instance_.valid?
+      _instance_
+    end
+
+    context 'when all attributes are blank' do
+      let :attributes do
+        {}
+      end
+      its(:valid?) { should be_false }
+      its(:errors) { should include :base }
+    end
+
+    [:verified, :gender, :zoneinfo].each do |one_of_list|
+      context "when #{one_of_list} is invalid" do
+        let :attributes do
+          {one_of_list => 'Out of List'}
+        end
+        its(:valid?) { should be_false }
+        its(:errors) { should include one_of_list }
+      end
+    end
+
+    context "when locale is invalid" do
+      it :TODO
+    end
+
+    [:profile, :picture, :website].each do |url|
+      context "when #{url} is invalid" do
+        let :attributes do
+          {url => 'Invalid'}
+        end
+        its(:valid?) { should be_false }
+        its(:errors) { should include url }
+      end
+    end
+
+    context 'when address is blank' do
+      let :attributes do
+        {:address => {}}
+      end
+      its(:valid?) { should be_false }
+      its(:errors) { should include :address }
+    end
+  end
+
+  describe '#address=' do
+    context 'when Hash is given' do
+      let :attributes do
+        {:address => {}}
+      end
+      its(:address) { should be_a OpenIDConnect::ResponseObject::UserInfo::OpenID::Address }
+    end
+
+    context 'when Address is given' do
+      let :attributes do
+        {:address => OpenIDConnect::ResponseObject::UserInfo::OpenID::Address.new}
+      end
+      its(:address) { should be_a OpenIDConnect::ResponseObject::UserInfo::OpenID::Address }
+    end
+  end
+
+  describe '#to_json' do
+    let :attributes do
+      {
+        :id => 'http://example.com/nov.matake#12345',
+        :address => {
+          :formatted => 'Tokyo, Japan'
+        }
+      }
+    end
+    its(:to_json) do
+      should == attributes.to_json
+    end
+  end
+end

data/spec/openid_connect/response_object_spec.rb

@@ -0,0 +1,55 @@
+require 'spec_helper'
+
+describe OpenIDConnect::ResponseObject do
+  class OpenIDConnect::ResponseObject::SubClass < OpenIDConnect::ResponseObject
+    attr_required :required
+    attr_optional :optional
+  end
+
+  let(:klass) { OpenIDConnect::ResponseObject::SubClass }
+  subject { klass.new attributes }
+
+  context 'when required attributes are given' do
+    context 'when optional attributes are given' do
+      let :attributes do
+        {:required => 'Required', :optional => 'Optional'}
+      end
+      its(:required) { should == 'Required' }
+      its(:optional) { should == 'Optional' }
+    end
+
+    context 'otherwise' do
+      let :attributes do
+        {:required => 'Required'}
+      end
+      its(:required) { should == 'Required' }
+      its(:optional) { should == nil }
+    end
+  end
+
+  context 'otherwise' do
+    context 'when optional attributes are given' do
+      let :attributes do
+        {:optional => 'Optional'}
+      end
+      it do
+        expect { klass.new attributes }.should raise_error AttrRequired::AttrMissing
+      end
+    end
+
+    context 'otherwise' do
+      it do
+        expect { klass.new }.should raise_error AttrRequired::AttrMissing
+      end
+    end
+  end
+
+  describe '#as_json' do
+    let :attributes do
+      {:required => 'Required', :optional => 'Optional'}
+    end
+    its(:as_json) do
+      should == {:required => 'Required', :optional => 'Optional'}
+    end
+  end
+end

data/spec/rack/oauth2/server/authorize/extension/id_token_and_token_spec.rb

@@ -0,0 +1,51 @@
+require 'spec_helper'
+
+describe Rack::OAuth2::Server::Authorize::Extension::IdTokenAndToken do
+  let(:request)      { Rack::MockRequest.new app }
+  let(:redirect_uri) { 'http://client.example.com/callback' }
+  let(:access_token) { 'access_token' }
+  let(:response) do
+    request.get("/?response_type=id_token%20token&client_id=client&redirect_uri=#{redirect_uri}")
+  end
+
+  context "when approved" do
+    subject { response }
+    let(:bearer_token) { Rack::OAuth2::AccessToken::Bearer.new(:access_token => access_token) }
+    let :app do
+      Rack::OAuth2::Server::Authorize.new do |request, response|
+        response.redirect_uri = redirect_uri
+        response.access_token = bearer_token
+        response.approve!
+      end
+    end
+    its(:status)   { should == 302 }
+    its(:location) { should == "#{redirect_uri}#access_token=#{access_token}&token_type=bearer" }
+
+    context 'when refresh_token is given' do
+      let :bearer_token do
+        Rack::OAuth2::AccessToken::Bearer.new(
+          :access_token => access_token,
+          :refresh_token => 'refresh'
+        )
+      end
+      its(:location) { should == "#{redirect_uri}#access_token=#{access_token}&token_type=bearer" }
+    end
+  end
+
+  context 'when denied' do
+    let :app do
+      Rack::OAuth2::Server::Authorize.new do |request, response|
+        request.verify_redirect_uri! redirect_uri
+        request.access_denied!
+      end
+    end
+    it 'should redirect with error in fragment' do
+      response.status.should == 302
+      error_message = {
+        :error => :access_denied,
+        :error_description => Rack::OAuth2::Server::Authorize::ErrorMethods::DEFAULT_DESCRIPTION[:access_denied]
+      }
+      response.location.should == "#{redirect_uri}##{error_message.to_query}"
+    end
+  end
+end

data/spec/rack/oauth2/server/authorize/extension/id_token_spec.rb

@@ -0,0 +1,51 @@
+require 'spec_helper'
+
+describe Rack::OAuth2::Server::Authorize::Extension::IdToken do
+  let(:request)      { Rack::MockRequest.new app }
+  let(:redirect_uri) { 'http://client.example.com/callback' }
+  let(:access_token) { 'access_token' }
+  let(:response) do
+    request.get("/?response_type=id_token&client_id=client&redirect_uri=#{redirect_uri}")
+  end
+
+  context "when approved" do
+    subject { response }
+    let(:bearer_token) { Rack::OAuth2::AccessToken::Bearer.new(:access_token => access_token) }
+    let :app do
+      Rack::OAuth2::Server::Authorize.new do |request, response|
+        response.redirect_uri = redirect_uri
+        response.access_token = bearer_token
+        response.approve!
+      end
+    end
+    its(:status)   { should == 302 }
+    its(:location) { should == "#{redirect_uri}#access_token=#{access_token}&token_type=bearer" }
+
+    context 'when refresh_token is given' do
+      let :bearer_token do
+        Rack::OAuth2::AccessToken::Bearer.new(
+          :access_token => access_token,
+          :refresh_token => 'refresh'
+        )
+      end
+      its(:location) { should == "#{redirect_uri}#access_token=#{access_token}&token_type=bearer" }
+    end
+  end
+
+  context 'when denied' do
+    let :app do
+      Rack::OAuth2::Server::Authorize.new do |request, response|
+        request.verify_redirect_uri! redirect_uri
+        request.access_denied!
+      end
+    end
+    it 'should redirect with error in fragment' do
+      response.status.should == 302
+      error_message = {
+        :error => :access_denied,
+        :error_description => Rack::OAuth2::Server::Authorize::ErrorMethods::DEFAULT_DESCRIPTION[:access_denied]
+      }
+      response.location.should == "#{redirect_uri}##{error_message.to_query}"
+    end
+  end
+end

metadata

@@ -2,7 +2,7 @@
 name: openid_connect
 version: !ruby/object:Gem::Version 
   prerelease: 
-  version: 0.0.0
+  version: 0.0.1
 platform: ruby
 authors: 
 - nov matake
@@ -10,52 +10,107 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-08-11 00:00:00 Z
+date: 2011-08-13 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
-  name: rack-oauth2
+  name: activemodel
   prerelease: false
   requirement: &id001 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        version: 0.9.0
+        version: "0"
   type: :runtime
   version_requirements: *id001
 - !ruby/object:Gem::Dependency 
-  name: rake
+  name: validate_url
   prerelease: false
   requirement: &id002 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        version: "0"
+  type: :runtime
+  version_requirements: *id002
+- !ruby/object:Gem::Dependency 
+  name: validate_email
+  prerelease: false
+  requirement: &id003 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        version: "0"
+  type: :runtime
+  version_requirements: *id003
+- !ruby/object:Gem::Dependency 
+  name: tzinfo
+  prerelease: false
+  requirement: &id004 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        version: "0"
+  type: :runtime
+  version_requirements: *id004
+- !ruby/object:Gem::Dependency 
+  name: attr_required
+  prerelease: false
+  requirement: &id005 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        version: "0"
+  type: :runtime
+  version_requirements: *id005
+- !ruby/object:Gem::Dependency 
+  name: rack-oauth2
+  prerelease: false
+  requirement: &id006 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        version: 0.9.0
+  type: :runtime
+  version_requirements: *id006
+- !ruby/object:Gem::Dependency 
+  name: rake
+  prerelease: false
+  requirement: &id007 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
         version: "0.8"
   type: :development
-  version_requirements: *id002
+  version_requirements: *id007
 - !ruby/object:Gem::Dependency 
   name: rcov
   prerelease: false
-  requirement: &id003 !ruby/object:Gem::Requirement 
+  requirement: &id008 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
         version: "0.9"
   type: :development
-  version_requirements: *id003
+  version_requirements: *id008
 - !ruby/object:Gem::Dependency 
   name: rspec
   prerelease: false
-  requirement: &id004 !ruby/object:Gem::Requirement 
+  requirement: &id009 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
         version: "2"
   type: :development
-  version_requirements: *id004
+  version_requirements: *id009
 description: OpenID Connect Server & Client Library
 email: 
 - nov@matake.jp
@@ -68,12 +123,24 @@ extra_rdoc_files: []
 files: 
 - .gitignore
 - Gemfile
+- Gemfile.lock
 - Rakefile
 - VERSION
 - lib/openid_connect.rb
-- lib/rack/oauth2/server/authorize/extensions/id_token.rb
-- lib/rack/oauth2/server/authorize/extensions/id_token_and_token.rb
+- lib/openid_connect/response_object.rb
+- lib/openid_connect/response_object/id_token.rb
+- lib/openid_connect/response_object/user_info.rb
+- lib/openid_connect/response_object/user_info/open_id.rb
+- lib/openid_connect/response_object/user_info/open_id/address.rb
+- lib/rack/oauth2/server/authorize/extension/id_token.rb
+- lib/rack/oauth2/server/authorize/extension/id_token_and_token.rb
 - openid_connect.gemspec
+- spec/openid_connect/response_object/id_token_spec.rb
+- spec/openid_connect/response_object/user_info/open_id/address_spec.rb
+- spec/openid_connect/response_object/user_info/open_id_spec.rb
+- spec/openid_connect/response_object_spec.rb
+- spec/rack/oauth2/server/authorize/extension/id_token_and_token_spec.rb
+- spec/rack/oauth2/server/authorize/extension/id_token_spec.rb
 - spec/spec_helper.rb
 homepage: https://github.com/nov/openid_connect
 licenses: []
@@ -103,4 +170,10 @@ signing_key:
 specification_version: 3
 summary: OpenID Connect Server & Client Library
 test_files: 
+- spec/openid_connect/response_object/id_token_spec.rb
+- spec/openid_connect/response_object/user_info/open_id/address_spec.rb
+- spec/openid_connect/response_object/user_info/open_id_spec.rb
+- spec/openid_connect/response_object_spec.rb
+- spec/rack/oauth2/server/authorize/extension/id_token_and_token_spec.rb
+- spec/rack/oauth2/server/authorize/extension/id_token_spec.rb
 - spec/spec_helper.rb