rack-oauth2 0.9.5 → 0.10.0.alpha

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    rack-oauth2 (0.9.4)
+    rack-oauth2 (0.9.5)
       activesupport (>= 2.3)
       attr_required (>= 0.0.3)
       httpclient (>= 2.2.0.2)
@@ -24,7 +24,6 @@ GEM
     jruby-openssl (0.7.4)
       bouncy-castle-java
     json (1.5.4)
-    json (1.5.4-java)
     multi_json (1.0.3)
     rack (1.3.2)
     rake (0.9.2)

data/VERSION

@@ -1 +1 @@
-0.9.5
+0.10.0.alpha

data/lib/rack/oauth2/server/authorize.rb

@@ -46,15 +46,20 @@ module Rack
             @state = params['state']
           end
 
-          def verify_redirect_uri!(pre_registered)
+          def verify_redirect_uri!(pre_registered, allow_partial_match = false)
             @verified_redirect_uri = if redirect_uri.present?
-              if Util.uri_match?(pre_registered, redirect_uri)
+              verified = Array(pre_registered).any? do |_pre_registered_|
+                Util.uri_match?(_pre_registered_, redirect_uri, allow_partial_match)
+              end
+              if verified
                 redirect_uri
               else
-                bad_request!
+                bad_request! 'Invalid redirect_uri is given'
               end
-            else
+            elsif pre_registered.present?
               pre_registered
+            else
+              bad_request! 'No redirect_uri is given'
             end
             self.verified_redirect_uri.to_s
           end

data/lib/rack/oauth2/util.rb

@@ -40,14 +40,19 @@ module Rack
           redirect_uri.to_s
         end
 
-        def uri_match?(base, given)
+        def uri_match?(base, given, allow_partial_match = true)
           base = parse_uri(base)
           given = parse_uri(given)
           base.path = '/' if base.path.blank?
           given.path = '/' if given.path.blank?
+          path_match = if allow_partial_match
+            /^#{base.path}/ =~ given.path
+          else
+            base.path == given.path
+          end
           [:scheme, :host, :port].all? do |key|
             base.send(key) == given.send(key)
-          end && /^#{base.path}/ =~ given.path
+          end && path_match
         rescue
           false
         end

data/spec/rack/oauth2/server/authorize_spec.rb

@@ -42,25 +42,73 @@ describe Rack::OAuth2::Server::Authorize do
   describe Rack::OAuth2::Server::Authorize::Request do
     let(:env)            { Rack::MockRequest.env_for("/authorize?client_id=client&redirect_uri=#{redirect_uri}") }
     let(:request)        { Rack::OAuth2::Server::Authorize::Request.new env }
-    let(:pre_registered) { 'http://client.example.com' }
 
     describe '#varified_redirect_uri' do
-      context 'when valid redirect_uri is given' do
-        it 'should use given redirect_uri' do
+      context 'when an Array of pre-registered URIs are given' do
+        context 'when given redirect_uri is valid against one of them' do
+          let :pre_registered do
+            [
+              redirect_uri,
+              'http://ja.client.example.com/callback',
+              'http://en.client.example.com/callback'
+            ]
+          end
+          it 'should be valid' do
+            request.verify_redirect_uri!(pre_registered).should == redirect_uri
+          end
+        end
+
+        context 'otherwise' do
+          let :pre_registered do
+            [
+              'http://ja.client.example.com/callback',
+              'http://en.client.example.com/callback'
+            ]
+          end
+          it do
+            expect do
+              request.verify_redirect_uri!(pre_registered)
+            end.should raise_error Rack::OAuth2::Server::Authorize::BadRequest
+          end
+        end
+      end
+
+      context 'when exact mathed redirect_uri is given' do
+        let(:pre_registered) { redirect_uri }
+        it 'should be valid' do
           request.verify_redirect_uri!(pre_registered).should == redirect_uri
         end
       end
 
+      context 'when partially mathed redirect_uri is given' do
+        let(:pre_registered) { 'http://client.example.com' }
+
+        context 'when partial matching allowed' do
+          it 'should be valid' do
+            request.verify_redirect_uri!(pre_registered, :allow_partial_match).should == redirect_uri
+          end
+        end
+
+        context 'otherwise' do
+          it do
+            expect do
+              request.verify_redirect_uri!(pre_registered)
+            end.should raise_error Rack::OAuth2::Server::Authorize::BadRequest
+          end
+        end
+      end
+
       context 'when invalid redirect_uri is given' do
         let(:pre_registered) { 'http://client2.example.com' }
         it do
           expect do
-            request.verify_redirect_uri!(pre_registered).should == pre_registered
+            request.verify_redirect_uri!(pre_registered)
           end.should raise_error Rack::OAuth2::Server::Authorize::BadRequest
         end
       end
 
       context 'when redirect_uri is missing' do
+        let(:pre_registered) { redirect_uri }
         let(:env) { Rack::MockRequest.env_for("/authorize?client_id=client") }
         it 'should use pre-registered redirect_uri' do
           request.verify_redirect_uri!(pre_registered).should == pre_registered

metadata

@@ -1,8 +1,8 @@
 --- !ruby/object:Gem::Specification 
 name: rack-oauth2
 version: !ruby/object:Gem::Version 
-  prerelease: 
-  version: 0.9.5
+  prerelease: 7
+  version: 0.10.0.alpha
 platform: ruby
 authors: 
 - nov matake
@@ -10,7 +10,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-09-11 00:00:00 Z
+date: 2011-09-13 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: rack