riddl 0.99.256 → 0.99.257

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 234355d07a1365d8c3edad0985f8fbed5c1020b1
-  data.tar.gz: eeedfe05639e119ff574ecaef299e4fe792786aa
+  metadata.gz: 32d893d88c9f303cb71b2ad369e45cf7581c177c
+  data.tar.gz: 9a2ea9a6ae45aa961fff86a5a4fcf58cdc71d0ad
 SHA512:
-  metadata.gz: 8746dda65d1ecfb226db477340b060ca803392ddf40d1228299c39a670afdd6fb004bb579ed1cfeab379c9d7dbfc2af06a4688405de26132d713eb4e149095fa
-  data.tar.gz: fccc19fdd4ca57f9673ece1c9a071c85d1188fc52a3b9c76461424232b3d08fe06590e5738d88fcf30c4bbc640ec7217d5241bb10874ed4b6fce1fb274bb552f
+  metadata.gz: 43a615f7a29b7a1240a5a38ec8ef73c26d113e468474edcf11b148637fd7fdb82968a205edf353d1a694c707205357fe39cfdef5ed1602dab4036bbf4ee12a86
+  data.tar.gz: 38cdd3f4eaa23b0d18adfb983f255ec017a5c2f365d05452a3a481eef5c5992cf215b498d4457dc98bbae2eec28881c64710b106e092fbffc30fd9c30aaaaffe

data/lib/ruby/riddl/utils/oauth2-univie.rb

@@ -50,6 +50,11 @@ module Riddl
               end
 
               @headers << Riddl::Header.new('AUTHORIZATION_BEARER', access_tokens.get(token))
+            else
+              @status = 403
+              return Riddl::Parameter::Complex.new('data', 'application/json', {
+                :error => 'No authorization provided.'
+              }.to_json)
             end
 
             @p

data/lib/ruby/riddl/utils/oauth2-univie.rb.orig

@@ -0,0 +1,166 @@
+require File.expand_path(File.dirname(__FILE__) + '/oauth2-helper')
+
+module Riddl
+  module Utils
+    module OAuth2
+
+      module UnivieBearer
+        class CheckAuth < Riddl::Implementation
+          def response
+            client_id = @a[0]
+            client_secret = @a[1]
+            access_tokens = @a[2]
+            if @h['AUTHORIZATION']
+              token = @h['AUTHORIZATION'].sub(/^Bearer /, '')
+
+              data, _, signature = token.rpartition '.'
+              expected_sign = Riddl::Utils::OAuth2::Helper::sign(client_id + ':' + client_secret, data)
+
+              if !access_tokens.key? token
+                @status = 403
+                return Riddl::Parameter::Complex.new('data', 'application/json', {
+                  :error => 'Unknown token'
+                }.to_json)
+              elsif signature != expected_sign
+                @status = 403
+                return Riddl::Parameter::Complex.new('data', 'application/json', {
+                  :error => 'Invalid token, you bad boy'
+                }.to_json)
+              end
+
+              header_claims, payload_claims = data.split('.').map { |v| Base64::urlsafe_decode64 v }
+              payload_claims = JSON::parse payload_claims
+
+              if header_claims != Riddl::Utils::OAuth2::Helper::header
+                @status = 401
+                return Riddl::Parameter::Complex.new('data', 'application/json', {
+                  :error => 'Invalid header claims'
+                }.to_json)
+              elsif payload_claims['exp'] <= Time.now.to_i
+                @status = 403
+                return Riddl::Parameter::Complex.new('data', 'application/json', {
+                  :error => 'Expired token'
+                }.to_json)
+              elsif !payload_claims['aud'].split(',').map(&:strip).include? client_id
+                # XXX: ein token für mehrere clients gültig? lookup?
+                @status = 403
+                return Riddl::Parameter::Complex.new('data', 'application/json', {
+                  :error => 'Token is not valid for this application'
+                }.to_json)
+              end
+
+              @headers << Riddl::Header.new('AUTHORIZATION_BEARER', access_tokens.get(token))
+            end
+
+            @p
+          end
+        end
+      end
+
+      module UnivieApp
+        def self::implementation(client_id, client_secret, access_tokens, refresh_tokens, codes, adur, rdur)
+          Proc.new do
+            run UnivieBearer::CheckAuth, client_id, client_secret, access_tokens if get 'check'
+            on resource 'verify' do
+              run VerifyIdentity, access_tokens, refresh_tokens, codes, client_id, client_secret, adur, rdur if post 'verify_in'
+            end
+            on resource 'token' do
+              run RefreshToken, access_tokens, refresh_tokens, client_id, client_secret, adur, rdur if post 'refresh_token_in'
+            end
+            on resource 'revoke' do
+              run RevokeFlow, access_tokens, refresh_tokens, codes if delete 'revoke_in'
+            end
+          end
+        end
+
+        class VerifyIdentity < Riddl::Implementation
+          def response
+            code = Base64::urlsafe_decode64 @p[0].value
+            access_tokens  = @a[0]
+            refresh_tokens = @a[1]
+            codes          = @a[2]
+            client_id      = @a[3]
+            client_secret  = @a[4]
+            adur           = @a[5]
+            rdur           = @a[6]
+            client_pass    = "#{client_id}:#{client_secret}"
+
+            user_id, decrypted = Riddl::Utils::OAuth2::Helper::decrypt_with_shared_secret(code, client_pass).split(':', 2) rescue [nil,nil]
+            if user_id.nil?
+              @status = 403
+              return Riddl::Parameter::Complex.new('data', 'application/json', {
+                :error => 'Code invalid. Client_id or client_secret not suitable for decryption.'
+              }.to_json)
+            else
+              token, refresh_token = Riddl::Utils::OAuth2::Helper::generate_optimistic_token(client_id, client_pass, adur, rdur)
+              codes.set(code, refresh_token, rdur)
+              access_tokens.set(token, user_id, rdur) # not adur, to identify expired access tokens
+              refresh_tokens.set(refresh_token, token, rdur)
+
+              json_response = {
+                :access_token => token,
+                :refresh_token => refresh_token,
+                :code => Base64.urlsafe_encode64(decrypted),
+                :user_id => user_id
+              }.to_json
+
+              Riddl::Parameter::Complex.new('data', 'application/json', json_response)
+            end
+          end
+        end
+
+        class RevokeFlow < Riddl::Implementation
+          def response
+            code           = Base64::urlsafe_decode64 @p[0].value
+            access_tokens  = @a[0]
+            refresh_tokens = @a[1]
+            codes          = @a[2]
+
+            rt = codes.delete(code)
+            at = refresh_tokens.delete(rt)
+            access_tokens.delete(at)
+          end
+        end
+
+        class RefreshToken < Riddl::Implementation
+          def response
+            refresh_token  = @p[1].value
+            access_tokens  = @a[0]
+            refresh_tokens = @a[1]
+            client_id      = @a[2]
+            client_secret  = @a[3]
+            adur           = @a[4]
+            rdur           = @a[5]
+
+            token, _ = refresh_token.split '.'
+            token_data = JSON::parse(Base64::urlsafe_decode64 token)
+
+            if token_data['iss'] != client_id
+              @status = 401
+              return Riddl::Parameter::Complex.new('data', 'application/json', {
+                :error => 'Token must be refreshed by issuer.'
+              }.to_json)
+            elsif !refresh_tokens.key?(refresh_token) || token_data['exp'] <= Time.now.to_i
+              @status = 403
+              puts "i dont know #{refresh_token}", "#{refresh_tokens.get(refresh_token)}"
+              return Riddl::Parameter::Complex.new('data', 'application/json', {
+                :error => 'Invalid refresh token.'
+              }.to_json)
+            end
+
+            old_token = refresh_tokens.get(refresh_token)
+            user = access_tokens.delete old_token
+
+            token = Riddl::Utils::OAuth2::Helper::generate_access_token(client_id, client_id + ':' + client_secret, adur)
+
+            access_tokens.set(token,user,rdur) # not adur, to identify expired access tokens
+            refresh_tokens.set(refresh_token, token)
+
+            Riddl::Parameter::Complex.new('data', 'application/json', { :token => token }.to_json)
+          end
+        end
+      end
+
+    end
+  end
+end

data/lib/ruby/riddl/utils/oauth2-univie.rb.rej

@@ -0,0 +1,10 @@
+*** /dev/null
+--- /dev/null
+***************
+*** 53,57
+- 	    else
+- 	      @status = 403
+- 	      return Riddl::Parameter::Complex.new('data', 'application/json', {
+- 		:error => 'No authorization provided.'
+- 	      }.to_json)
+--- 0 -----

data/riddl.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name             = "riddl"
-  s.version          = "0.99.256"
+  s.version          = "0.99.257"
   s.platform         = Gem::Platform::RUBY
   s.license          = "LGPL-3.0"
   s.summary          = "restful interface description and declaration language: tools and client/server libs"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: riddl
 version: !ruby/object:Gem::Version
-  version: 0.99.256
+  version: 0.99.257
 platform: ruby
 authors:
 - Juergen 'eTM' Mangler
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: tools
 cert_chain: []
-date: 2017-12-01 00:00:00.000000000 Z
+date: 2018-01-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: xml-smart
@@ -442,6 +442,8 @@ files:
 - lib/ruby/riddl/utils/notifications_producer.rb
 - lib/ruby/riddl/utils/oauth2-helper.rb
 - lib/ruby/riddl/utils/oauth2-univie.rb
+- lib/ruby/riddl/utils/oauth2-univie.rb.orig
+- lib/ruby/riddl/utils/oauth2-univie.rb.rej
 - lib/ruby/riddl/utils/properties.rb
 - lib/ruby/riddl/utils/turtle.rb
 - lib/ruby/riddl/utils/xmlserve.rb
@@ -512,18 +514,18 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.6
+rubygems_version: 2.5.2
 signing_key: 
 specification_version: 4
 summary: 'restful interface description and declaration language: tools and client/server
   libs'
 test_files:
-- test/tc_properties.rb
-- test/tc_declaration-hybrid.rb
-- test/tc_declaration-local.rb
+- test/tc_websocket.rb
+- test/tc_producer.rb
 - test/tc_helloworld.rb
+- test/tc_declaration-local.rb
+- test/tc_properties.rb
 - test/tc_library.rb
+- test/tc_declaration-hybrid.rb
 - test/tc_declaration-distributed.rb
-- test/tc_websocket.rb
-- test/tc_producer.rb
 - test/smartrunner.rb