panjiva-oauth-plugin 0.4.1

data/generators/oauth_provider/templates/new.html.erb

@@ -0,0 +1,5 @@
+<h1>Register a new application</h1>
+<%% form_for :client_application, :url => { :action => :create } do |f| %>
+   <%%= render :partial => "form", :locals => { :f => f } %>
+   <%%= submit_tag "Register" %>
+<%% end %>

data/generators/oauth_provider/templates/new.html.haml

@@ -0,0 +1,5 @@
+%h1 Register a new application
+
+- form_for :client_application, :url => { :action => :create } do |f|
+  = render :partial => "form", :locals => { :f => f }
+  = submit_tag "Register"

data/generators/oauth_provider/templates/oauth2_authorize.html.erb

@@ -0,0 +1,16 @@
+<h1>Authorize access to your account</h1>
+<p>Would you like to authorize <%%= link_to @token.client_application.name,@token.client_application.url %> (<%%= link_to @token.client_application.url,@token.client_application.url %>) to access your account?</p>
+<%% form_tag authorize_url do %>
+  <%%= hidden_field_tag "response_type", params[:response_type]%>
+  <%%= hidden_field_tag "client_id", params[:client_id]%>
+  <%%= hidden_field_tag "redirect_uri", params[:redirect_uri]%>
+  <%%= hidden_field_tag "state", params[:state]%>
+  <%%= hidden_field_tag "scope", params[:scope]%>
+
+<p>
+  <%%= check_box_tag 'authorize' %> authorize access
+</p>
+<p>
+  <%%= submit_tag %>
+</p>
+<%% end %>

data/generators/oauth_provider/templates/oauth2_authorize.html.haml

@@ -0,0 +1,17 @@
+%h1 Authorize access to your account
+%p
+  Would you like to authorize
+  = link_to @client_application.name,@client_application.url
+  (
+  = link_to @client_application.url,@client_application.url
+  ) to access your account?
+- form_tag authorize_url do
+  = hidden_field_tag "response_type", params[:response_type]
+  = hidden_field_tag "client_id", params[:client_id]
+  = hidden_field_tag "redirect_uri", params[:redirect_uri]
+  = hidden_field_tag "state", params[:state]
+  = hidden_field_tag "scope", params[:scope]
+  = check_box_tag 'authorize'
+  authorize access
+  %p
+    = submit_tag

data/generators/oauth_provider/templates/oauth2_token.rb

@@ -0,0 +1,20 @@
+class Oauth2Token < AccessToken
+  attr_accessor :state
+  def as_json(options={})
+    d = {:access_token=>token, :token_type => 'bearer'}
+    d[:expires_in] = expires_in if expires_at
+    d
+  end
+
+  def to_query
+    q = "access_token=#{token}&token_type=bearer"
+    q << "&state=#{URI.escape(state)}" if @state
+    q << "&expires_in=#{expires_in}" if expires_at
+    q << "&scope=#{URI.escape(scope)}" if scope
+    q
+  end
+
+  def expires_in
+    expires_at.to_i - Time.now.to_i
+  end
+end

data/generators/oauth_provider/templates/oauth2_token_spec.rb

@@ -0,0 +1,52 @@
+require File.dirname(__FILE__) + '/../spec_helper'
+
+describe Oauth2Token do
+  fixtures :client_applications, :users, :oauth_tokens
+  before(:each) do
+    @token = Oauth2Token.create :client_application => client_applications(:one), :user=>users(:aaron)
+  end
+
+  it "should be valid" do
+    @token.should be_valid
+  end
+
+  it "should have a token" do
+    @token.token.should_not be_nil
+  end
+
+  it "should have a secret" do
+    @token.secret.should_not be_nil
+  end
+
+  it "should be authorized" do
+    @token.should be_authorized
+  end
+
+  it "should not be invalidated" do
+    @token.should_not be_invalidated
+  end
+
+  it "should generate correct json and query strong" do
+    @token.as_json.should == {:access_token => @token.token, :token_type => 'bearer'}
+    @token.to_query.should == "access_token=#{@token.token}&token_type=bearer"
+  end
+
+  it "should generate correct json and query string and include state in query if present" do
+    @token.state = 'bb bb'
+    @token.as_json.should == {:access_token => @token.token, :token_type => 'bearer'}
+    @token.to_query.should == "access_token=#{@token.token}&token_type=bearer&state=bb%20bb"
+  end
+
+  it "should generate correct json and query string and include scope in query if present" do
+    @token.scope = 'bbbb aaaa'
+    @token.as_json.should == {:access_token => @token.token, :token_type => 'bearer'}
+    @token.to_query.should == "access_token=#{@token.token}&token_type=bearer&scope=bbbb%20aaaa"
+  end
+
+  it "should generate correct json and include expires_in if present" do
+    @token.expires_at = 1.hour.from_now
+    @token.as_json.should == { :access_token => @token.token, :token_type => 'bearer', :expires_in => 3600 }
+    @token.to_query.should == "access_token=#{@token.token}&token_type=bearer&expires_in=3600"
+  end
+
+end

data/generators/oauth_provider/templates/oauth2_verifier.rb

@@ -0,0 +1,35 @@
+class Oauth2Verifier < OauthToken
+  validates_presence_of :user
+  attr_accessor :state
+
+  def exchange!(params={})
+    OauthToken.transaction do
+      token = Oauth2Token.create! :user=>user,:client_application=>client_application, :scope => scope
+      invalidate!
+      token
+    end
+  end
+
+  def code
+    token
+  end
+
+  def redirect_url
+    callback_url
+  end
+
+  def to_query
+    q = "code=#{token}"
+    q << "&state=#{URI.escape(state)}" if @state
+    q
+  end
+
+  protected
+
+  def generate_keys
+    self.token = OAuth::Helper.generate_key(20)[0,20]
+    self.expires_at = 10.minutes.from_now
+    self.authorized_at = Time.now
+  end
+
+end

data/generators/oauth_provider/templates/oauth2_verifier_spec.rb

@@ -0,0 +1,44 @@
+require File.dirname(__FILE__) + '/../spec_helper'
+
+describe Oauth2Verifier do
+  fixtures :client_applications, :users, :oauth_tokens
+  before(:each) do
+    @verifier = Oauth2Verifier.create :client_application => client_applications(:one), :user=>users(:aaron), :scope => "bbbb aaaa"
+  end
+
+  it "should be valid" do
+    @verifier.should be_valid
+  end
+
+  it "should have a code" do
+    @verifier.code.should_not be_nil
+  end
+
+  it "should not have a secret" do
+    @verifier.secret.should be_nil
+  end
+
+  it "should be authorized" do
+    @verifier.should be_authorized
+  end
+
+  it "should not be invalidated" do
+    @verifier.should_not be_invalidated
+  end
+
+  it "should generate query string" do
+    @verifier.to_query.should == "code=#{@verifier.code}"
+    @verifier.state="bbbb aaaa"
+    @verifier.to_query.should == "code=#{@verifier.code}&state=bbbb%20aaaa"
+  end
+
+  it "should properly exchange for token" do
+    @token = @verifier.exchange!
+    @verifier.should be_invalidated
+    @token.user.should==@verifier.user
+    @token.client_application.should == @verifier.client_application
+    @token.should be_authorized
+    @token.should_not be_invalidated
+    @token.scope.should == @verifier.scope
+  end
+end

data/generators/oauth_provider/templates/oauth_nonce.rb

@@ -0,0 +1,13 @@
+# Simple store of nonces. The OAuth Spec requires that any given pair of nonce and timestamps are unique.
+# Thus you can use the same nonce with a different timestamp and viceversa.
+class OauthNonce < ActiveRecord::Base
+  validates_presence_of :nonce, :timestamp
+  validates_uniqueness_of :nonce, :scope => :timestamp
+
+  # Remembers a nonce and it's associated timestamp. It returns false if it has already been used
+  def self.remember(nonce, timestamp)
+    oauth_nonce = OauthNonce.create(:nonce => nonce, :timestamp => timestamp)
+    return false if oauth_nonce.new_record?
+    oauth_nonce
+  end
+end

data/generators/oauth_provider/templates/oauth_nonce_spec.rb

@@ -0,0 +1,24 @@
+require File.dirname(__FILE__) + '/../spec_helper'
+require 'oauth/helper'
+describe OauthNonce do
+  include OAuth::Helper
+  before(:each) do
+    @oauth_nonce = OauthNonce.remember(generate_key, Time.now.to_i)
+  end
+
+  it "should be valid" do
+    @oauth_nonce.should be_valid
+  end
+
+  it "should not have errors" do
+    @oauth_nonce.errors.full_messages.should == []
+  end
+
+  it "should not be a new record" do
+    @oauth_nonce.should_not be_new_record
+  end
+
+  it "should not allow a second one with the same values" do
+    OauthNonce.remember(@oauth_nonce.nonce,@oauth_nonce.timestamp).should == false
+  end
+end

data/generators/oauth_provider/templates/oauth_nonce_test.rb

@@ -0,0 +1,26 @@
+require File.dirname(__FILE__) + '/../test_helper'
+require 'oauth/helper'
+
+class ClientNoneTest < ActiveSupport::TestCase
+  include OAuth::Helper
+
+  def setup
+    @oauth_nonce = OauthNonce.remember(generate_key,Time.now.to_i)
+  end
+
+  def test_should_be_valid
+    assert @oauth_nonce.valid?
+  end
+
+  def test_should_not_have_errors
+    assert_equal [], @oauth_nonce.errors.full_messages
+  end
+
+  def test_should_not_be_a_new_record
+    assert !@oauth_nonce.new_record?
+  end
+
+  def test_shuold_not_allow_a_second_one_with_the_same_values
+    assert_equal false, OauthNonce.remember(@oauth_nonce.nonce, @oauth_nonce.timestamp)
+  end
+end

data/generators/oauth_provider/templates/oauth_nonces.yml

@@ -0,0 +1,13 @@
+# Read about fixtures at http://ar.rubyonrails.org/classes/Fixtures.html
+one:
+  id: 1
+  nonce: a_nonce
+  timestamp: 1
+  created_at: 2007-11-25 17:27:04
+  updated_at: 2007-11-25 17:27:04
+two:
+  id: 2
+  nonce: b_nonce
+  timestamp: 2
+  created_at: 2007-11-25 17:27:04
+  updated_at: 2007-11-25 17:27:04

data/generators/oauth_provider/templates/oauth_token.rb

@@ -0,0 +1,30 @@
+class OauthToken < ActiveRecord::Base
+  belongs_to :client_application
+  belongs_to :user
+  validates_uniqueness_of :token
+  validates_presence_of :client_application, :token
+  before_validation_on_create :generate_keys
+
+  def invalidated?
+    invalidated_at != nil
+  end
+
+  def invalidate!
+    update_attribute(:invalidated_at, Time.now)
+  end
+
+  def authorized?
+    authorized_at != nil && !invalidated?
+  end
+
+  def to_query
+    "oauth_token=#{token}&oauth_token_secret=#{secret}"
+  end
+
+  protected
+
+  def generate_keys
+    self.token = OAuth::Helper.generate_key(40)[0,40]
+    self.secret = OAuth::Helper.generate_key(40)[0,40]
+  end
+end

data/generators/oauth_provider/templates/oauth_token_spec.rb

@@ -0,0 +1,309 @@
+require File.dirname(__FILE__) + '/../spec_helper'
+
+describe RequestToken do
+  fixtures :client_applications, :users, :oauth_tokens
+  before(:each) do
+    @token = RequestToken.create :client_application => client_applications(:one)
+  end
+
+  it "should be valid" do
+    @token.should be_valid
+  end
+
+  it "should not have errors" do
+    @token.errors.should_not == []
+  end
+
+  it "should have a token" do
+    @token.token.should_not be_nil
+  end
+
+  it "should have a secret" do
+    @token.secret.should_not be_nil
+  end
+
+  it "should not be authorized" do
+    @token.should_not be_authorized
+  end
+
+  it "should not be invalidated" do
+    @token.should_not be_invalidated
+  end
+
+  it "should not have a verifier" do
+    @token.verifier.should be_nil
+  end
+
+  it "should not be oob" do
+    @token.should_not be_oob
+  end
+
+  describe "OAuth 1.0a" do
+
+    describe "with provided callback" do
+      before(:each) do
+        @token.callback_url="http://test.com/callback"
+      end
+
+      it "should not be oauth10" do
+        @token.should_not be_oauth10
+      end
+
+      it "should not be oob" do
+        @token.should_not be_oob
+      end
+
+      describe "authorize request" do
+        before(:each) do
+          @token.authorize!(users(:quentin))
+        end
+
+        it "should be authorized" do
+          @token.should be_authorized
+        end
+
+        it "should have authorized at" do
+          @token.authorized_at.should_not be_nil
+        end
+
+        it "should have user set" do
+          @token.user.should == users(:quentin)
+        end
+
+        it "should have verifier" do
+          @token.verifier.should_not be_nil
+        end
+
+        describe "exchange for access token" do
+
+          before(:each) do
+            @token.provided_oauth_verifier=@token.verifier
+            @access = @token.exchange!
+          end
+
+          it "should be valid" do
+            @access.should be_valid
+          end
+
+          it "should have no error messages" do
+            @access.errors.full_messages.should==[]
+          end
+
+          it "should invalidate request token" do
+            @token.should be_invalidated
+          end
+
+          it "should set user on access token" do
+            @access.user.should == users(:quentin)
+          end
+
+          it "should authorize accesstoken" do
+            @access.should be_authorized
+          end
+        end
+
+        describe "attempt exchange with invalid verifier (OAuth 1.0a)" do
+
+          before(:each) do
+            @value = @token.exchange!
+          end
+
+          it "should return false" do
+            @value.should==false
+          end
+
+          it "should not invalidate request token" do
+            @token.should_not be_invalidated
+          end
+        end
+
+      end
+
+      describe "attempt exchange with out authorization" do
+
+        before(:each) do
+          @value = @token.exchange!
+        end
+
+        it "should return false" do
+          @value.should==false
+        end
+
+        it "should not invalidate request token" do
+          @token.should_not be_invalidated
+        end
+      end
+
+      it "should return 1.0a style to_query" do
+        @token.to_query.should=="oauth_token=#{@token.token}&oauth_token_secret=#{@token.secret}&oauth_callback_confirmed=true"
+      end
+
+    end
+
+    describe "with oob callback" do
+      before(:each) do
+        @token.callback_url='oob'
+      end
+
+      it "should not be oauth10" do
+        @token.should_not be_oauth10
+      end
+
+      it "should be oob" do
+        @token.should be_oob
+      end
+
+      describe "authorize request" do
+        before(:each) do
+          @token.authorize!(users(:quentin))
+        end
+
+        it "should be authorized" do
+          @token.should be_authorized
+        end
+
+        it "should have authorized at" do
+          @token.authorized_at.should_not be_nil
+        end
+
+        it "should have user set" do
+          @token.user.should == users(:quentin)
+        end
+
+        it "should have verifier" do
+          @token.verifier.should_not be_nil
+        end
+
+        describe "exchange for access token" do
+
+          before(:each) do
+            @token.provided_oauth_verifier=@token.verifier
+            @access = @token.exchange!
+          end
+
+          it "should invalidate request token" do
+            @token.should be_invalidated
+          end
+
+          it "should set user on access token" do
+            @access.user.should == users(:quentin)
+          end
+
+          it "should authorize accesstoken" do
+            @access.should be_authorized
+          end
+        end
+
+        describe "attempt exchange with invalid verifier (OAuth 1.0a)" do
+
+          before(:each) do
+            @value = @token.exchange!
+          end
+
+          it "should return false" do
+            @value.should==false
+          end
+
+          it "should not invalidate request token" do
+            @token.should_not be_invalidated
+          end
+        end
+
+      end
+
+      describe "attempt exchange with out authorization invalid verifier" do
+
+        before(:each) do
+          @value = @token.exchange!
+        end
+
+        it "should return false" do
+          @value.should==false
+        end
+
+        it "should not invalidate request token" do
+          @token.should_not be_invalidated
+        end
+      end
+
+      it "should return 1.0 style to_query" do
+        @token.to_query.should=="oauth_token=#{@token.token}&oauth_token_secret=#{@token.secret}&oauth_callback_confirmed=true"
+      end
+    end
+  end
+
+  if defined? OAUTH_10_SUPPORT && OAUTH_10_SUPPORT
+    describe "OAuth 1.0" do
+
+      it "should be oauth10" do
+        @token.should be_oauth10
+      end
+
+      it "should not be oob" do
+        @token.should_not be_oob
+      end
+
+      describe "authorize request" do
+        before(:each) do
+          @token.authorize!(users(:quentin))
+        end
+
+        it "should be authorized" do
+          @token.should be_authorized
+        end
+
+        it "should have authorized at" do
+          @token.authorized_at.should_not be_nil
+        end
+
+        it "should have user set" do
+          @token.user.should == users(:quentin)
+        end
+
+        it "should not have verifier" do
+          @token.verifier.should be_nil
+        end
+
+        describe "exchange for access token" do
+
+          before(:each) do
+            @access = @token.exchange!
+          end
+
+          it "should invalidate request token" do
+            @token.should be_invalidated
+          end
+
+          it "should set user on access token" do
+            @access.user.should == users(:quentin)
+          end
+
+          it "should authorize accesstoken" do
+            @access.should be_authorized
+          end
+        end
+
+      end
+
+      describe "attempt exchange with out authorization" do
+
+        before(:each) do
+          @value = @token.exchange!
+        end
+
+        it "should return false" do
+          @value.should==false
+        end
+
+        it "should not invalidate request token" do
+          @token.should_not be_invalidated
+        end
+      end
+
+      it "should return 1.0 style to_query" do
+        @token.to_query.should=="oauth_token=#{@token.token}&oauth_token_secret=#{@token.secret}"
+      end
+
+    end
+  end
+end