rack-oauth2 0.2.3 → 0.3.0.alpha

data/lib/rack/oauth2/server/resource/bearer.rb

@@ -0,0 +1,74 @@
+module Rack
+  module OAuth2
+    module Server
+      module Resource
+        class Bearer < Abstract::Handler
+          ACCESS_TOKEN = 'rack.oauth2.bearer.oauth_token'
+
+          def initialize(app, &authenticator)
+            @app = app
+            super(&authenticator)
+          end
+
+          def call(env)
+            request = Request.new(env)
+            if request.bearer?
+              authenticate!(request)
+              env[ACCESS_TOKEN] = request.access_token
+            end
+            @app.call(env)
+          rescue Rack::OAuth2::Server::Abstract::Error => e
+            e.finish
+          end
+
+          private
+
+          def authenticate!(request)
+            @authenticator.call(request)
+          end
+
+          class Request < Rack::Request
+            def initialize(env)
+              @env = env
+              @auth_header = Rack::Auth::AbstractRequest.new(env)
+            end
+
+            def bearer?
+              access_token.present?
+            end
+
+            def access_token
+              tokens = [access_token_in_haeder, access_token_in_payload].compact
+              case Array(tokens).size
+              when 0
+                nil
+              when 1
+                tokens.first
+              else
+                invalid_request!('Both Authorization header and payload includes access token.')
+              end
+            end
+
+            def access_token_in_haeder
+              if @auth_header.provided? && @auth_header.scheme == :bearer
+                @auth_header.params
+              else
+                nil
+              end
+            end
+
+            def access_token_in_payload
+              if params['oauth_token'] && !params['oauth_signature_method']
+                params['oauth_token']
+              else
+                nil # This is OAuth1 request
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end
+
+require 'rack/oauth2/server/resource/bearer/error'

data/lib/rack/oauth2/server/resource/bearer/error.rb

@@ -0,0 +1,80 @@
+module Rack
+  module OAuth2
+    module Server
+      module Resource
+        class Bearer
+          class BadRequest < Abstract::BadRequest
+          end
+
+          class Unauthorized < Abstract::Unauthorized
+            def finish
+              super do |response|
+                response.header['WWW-Authenticate'] = if ErrorMethods::DEFAULT_DESCRIPTION.keys.include?(error)
+                  header = "Bearer error=\"#{error}\""
+                  header += " error_description=\"#{description}\"" if description.present?
+                  header += " error_uri=\"#{uri}\""                 if uri.present?
+                  header
+                else
+                  'Bearer'
+                end
+              end
+            end
+          end
+
+          class Forbidden < Abstract::Forbidden
+            attr_accessor :scope
+
+            def initialize(error = :forbidden, description = nil, options = {})
+              super
+              @scope = options[:scope]
+            end
+
+            def protocol_params
+              super.merge(:scope => Array(scope).join(' '))
+            end
+          end
+
+          module ErrorMethods
+            DEFAULT_DESCRIPTION = {
+              :invalid_request => "The request is missing a required parameter, includes an unsupported parameter or parameter value, repeats the same parameter, uses more than one method for including an access token, or is otherwise malformed.",
+              :invalid_token => "The access token provided is expired, revoked, malformed or invalid for other reasons.",
+              :insufficient_scope => "The request requires higher privileges than provided by the access token."
+            }
+
+            def self.included(klass)
+              DEFAULT_DESCRIPTION.each do |error, default_description|
+                error_method = case error
+                when :invalid_request
+                  :bad_request!
+                when :insufficient_scope
+                  :forbidden!
+                else
+                  :unauthorized!
+                end
+                klass.class_eval <<-ERROR
+                  def #{error}!(description = "#{default_description}", options = {})
+                    #{error_method} :#{error}, description, options
+                  end
+                ERROR
+              end
+            end
+
+            def bad_request!(error, description = nil, options = {})
+              raise BadRequest.new(error, description, options)
+            end
+
+            def unauthorized!(error = nil, description = nil, options = {})
+              raise Unauthorized.new(error, description, options)
+            end
+
+            def forbidden!(error, description = nil, options = {})
+              raise Forbidden.new(error, description, options)
+            end
+          end
+
+          Request.send :include, ErrorMethods
+        end
+      end
+    end
+  end
+end

data/lib/rack/oauth2/server/token.rb

@@ -4,26 +4,21 @@ module Rack
   module OAuth2
     module Server
       class Token < Abstract::Handler
-
         def call(env)
           request = Request.new(env)
-          request.profile.new(@realm, &@authenticator).call(env).finish
-        rescue Error => e
+          request.profile.new(&@authenticator).call(env).finish
+        rescue Rack::OAuth2::Server::Abstract::Error => e
           e.finish
         end
 
         class Request < Abstract::Request
-          include Error::Token
-
           attr_required :grant_type
           attr_optional :client_secret
-          attr_accessor :via_authorization_header
 
           def initialize(env)
             auth = Rack::Auth::Basic::Request.new(env)
             if auth.provided? && auth.basic?
               @client_id, @client_secret = auth.credentials
-              @via_authorization_header = true
               super
             else
               super
@@ -32,14 +27,12 @@ module Rack
             @grant_type = params['grant_type']
           end
 
-          def profile(allow_no_profile = false)
+          def profile
             case params['grant_type'].to_s
             when 'authorization_code'
               AuthorizationCode
             when 'password'
               Password
-            when 'assertion'
-              Assertion
             when 'refresh_token'
               RefreshToken
             when ''
@@ -48,33 +41,33 @@ module Rack
               unsupported_grant_type!("'#{params['grant_type']}' isn't supported.")
             end
           end
-
         end
 
         class Response < Abstract::Response
           attr_required :access_token
           attr_optional :expires_in, :refresh_token, :scope
 
-          def finish
-            params = {
+          def protocol_params
+            {
               :access_token => access_token,
               :expires_in => expires_in,
               :scope => Array(scope).join(' ')
-            }.delete_if do |key, value|
-              value.blank?
-            end
-            write params.to_json
+            }
+          end
+
+          def finish
+            write Util.compact_hash(protocol_params).to_json
             header['Content-Type'] = "application/json"
+            attr_missing!
             super
           end
         end
-
       end
     end
   end
 end
 
+require 'rack/oauth2/server/token/error'
 require 'rack/oauth2/server/token/authorization_code'
 require 'rack/oauth2/server/token/password'
-require 'rack/oauth2/server/token/assertion'
 require 'rack/oauth2/server/token/refresh_token'

data/lib/rack/oauth2/server/token/authorization_code.rb

@@ -3,7 +3,6 @@ module Rack
     module Server
       class Token
         class AuthorizationCode < Abstract::Handler
-
           def call(env)
             @request  = Request.new(env)
             @response = Response.new(request)
@@ -11,16 +10,16 @@ module Rack
           end
 
           class Request < Token::Request
-            attr_required :code
+            attr_required :code, :redirect_uri
 
             def initialize(env)
               super
-              @grant_type = :authorization_code
-              @code       = params['code']
+              @grant_type   = :authorization_code
+              @code         = params['code']
+              @redirect_uri = params['redirect_uri']
               attr_missing!
             end
           end
-
         end
       end
     end

data/lib/rack/oauth2/server/token/error.rb

@@ -0,0 +1,54 @@
+module Rack
+  module OAuth2
+    module Server
+      class Token
+        class BadRequest < Abstract::BadRequest
+        end
+
+        class Unauthorized < Abstract::Unauthorized
+          def finish
+            super do |response|
+              response.header['WWW-Authenticate'] = 'Basic realm="OAuth2 Token Endpoint"'
+            end
+          end
+        end
+
+        module ErrorMethods
+          DEFAULT_DESCRIPTION = {
+            :invalid_request => "The request is missing a required parameter, includes an unsupported parameter or parameter value, repeats a parameter, includes multiple credentials, utilizes more than one mechanism for authenticating the client, or is otherwise malformed.",
+            :invalid_client => "The client identifier provided is invalid, the client failed to authenticate, the client did not include its credentials, provided multiple client credentials, or used unsupported credentials type.",
+            :invalid_grant => "The provided access grant is invalid, expired, or revoked (e.g. invalid assertion, expired authorization token, bad end-user password credentials, or mismatching authorization code and redirection URI).",
+            :unauthorized_client => "The authenticated client is not authorized to use the access grant type provided.",
+            :unsupported_grant_type => "The access grant included - its type or another attribute - is not supported by the authorization server.",
+            :invalid_scope => "The requested scope is invalid, unknown, malformed, or exceeds the previously granted scope."
+          }
+
+          def self.included(klass)
+            DEFAULT_DESCRIPTION.each do |error, default_description|
+              error_method = if error == :invalid_client
+                :unauthorized!
+              else
+                :bad_request!
+              end
+              klass.class_eval <<-ERROR
+                def #{error}!(description = "#{default_description}", options = {})
+                  #{error_method} :#{error}, description, options
+                end
+              ERROR
+            end
+          end
+
+          def bad_request!(error, description = nil, options = {})
+            raise BadRequest.new(error, description, options)
+          end
+
+          def unauthorized!(error, description = nil, options = {})
+            raise Unauthorized.new(error, description, options)
+          end
+        end
+
+        Request.send :include, ErrorMethods
+      end
+    end
+  end
+end

data/lib/rack/oauth2/server/token/password.rb

@@ -3,7 +3,6 @@ module Rack
     module Server
       class Token
         class Password < Abstract::Handler
-
           def call(env)
             @request  = Request.new(env)
             @response = Response.new(request)
@@ -21,7 +20,6 @@ module Rack
               attr_missing!
             end
           end
-
         end
       end
     end

data/lib/rack/oauth2/server/token/refresh_token.rb

@@ -15,7 +15,7 @@ module Rack
 
             def initialize(env)
               super
-              @grant_type    = 'refresh_token'
+              @grant_type    = :refresh_token
               @refresh_token = params['refresh_token']
               attr_missing!
             end

data/lib/rack/oauth2/server/util.rb

@@ -3,6 +3,12 @@ module Rack
     module Server
       module Util
         class << self
+          def compact_hash(hash)
+            hash.reject do |key, value|
+              value.blank?
+            end
+          end
+
           def parse_uri(uri)
             case uri
             when URI::Generic
@@ -13,6 +19,29 @@ module Rack
               raise "Invalid format of URI is given."
             end
           end
+
+          def redirect_uri(base_uri, location, params)
+            redirect_uri = parse_uri base_uri
+            case location
+            when :query
+              redirect_uri.query = [redirect_uri.query, Util.compact_hash(params).to_query].compact.join('&')
+            when :fragment
+              redirect_uri.fragment = Util.compact_hash(params).to_query
+            end
+            redirect_uri.to_s
+          end
+
+          def verify_redirect_uri(registered, given)
+            registered = parse_uri(registered)
+            given = parse_uri(given)
+            registered.path = '/' if registered.path.blank?
+            given.path = '/' if given.path.blank?
+            [:scheme, :host, :port].all? do |key|
+              registered.send(key) == given.send(key)
+            end && /^#{registered.path}/ =~ given.path
+          rescue
+            false
+          end
         end
       end
     end

data/rack-oauth2.gemspec

@@ -17,7 +17,7 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency "json", ">= 1.4.3"
   s.add_runtime_dependency "activesupport", ">= 2.3"
   s.add_runtime_dependency "i18n"
-  s.add_runtime_dependency "attr_required", ">= 0.0.2"
+  s.add_runtime_dependency "attr_required", ">= 0.0.3"
   s.add_development_dependency "rake", ">= 0.8"
   s.add_development_dependency "rcov", ">= 0.9"
   s.add_development_dependency "rspec", ">= 2"

data/spec/rack/oauth2/server/abstract/error_spec.rb

@@ -0,0 +1,51 @@
+require 'spec_helper.rb'
+
+describe Rack::OAuth2::Server::Abstract::Error do
+
+  context 'when full attributes are given' do
+    subject do
+      Rack::OAuth2::Server::Abstract::Error.new 400, :invalid_request, 'Missing some required params', :uri => 'http://server.example.com/error'
+    end
+    its(:status)      { should == 400 }
+    its(:error)       { should == :invalid_request }
+    its(:description) { should == 'Missing some required params' }
+    its(:uri)         { should == 'http://server.example.com/error' }
+    its(:protocol_params) do
+      should == {
+        :error             => :invalid_request,
+        :error_description => 'Missing some required params',
+        :error_uri         => 'http://server.example.com/error'
+      }
+    end
+  end
+
+  context 'when optional attributes are not given' do
+    subject do
+      Rack::OAuth2::Server::Abstract::Error.new 400, :invalid_request
+    end
+    its(:status)      { should == 400 }
+    its(:error)       { should == :invalid_request }
+    its(:description) { should be_nil }
+    its(:uri)         { should be_nil }
+    its(:protocol_params) do
+      should == {
+        :error             => :invalid_request,
+        :error_description => nil,
+        :error_uri         => nil
+      }
+    end
+  end
+
+end
+
+describe Rack::OAuth2::Server::Abstract::BadRequest do
+  its(:status) { should == 400 }
+end
+
+describe Rack::OAuth2::Server::Abstract::Unauthorized do
+  its(:status) { should == 401 }
+end
+
+describe Rack::OAuth2::Server::Abstract::Forbidden do
+  its(:status) { should == 403 }
+end