rodauth-oauth 0.0.2 → 0.0.3

data/lib/generators/roda/oauth/install_generator.rb

@@ -10,7 +10,7 @@ module Rodauth::OAuth::Rails
       include ::Rails::Generators::Migration
 
       source_root "#{__dir__}/templates"
-      namespace "roda:oauth:install"
+      namespace "rodauth:oauth:install"
 
       def create_rodauth_migration
         return unless defined?(ActiveRecord::Base)

data/lib/generators/roda/oauth/views_generator.rb

@@ -7,7 +7,7 @@ module Rodauth::OAuth
     module Generators
       class ViewsGenerator < ::Rails::Generators::Base
         source_root "#{__dir__}/templates"
-        namespace "roda:oauth:views"
+        namespace "rodauth:oauth:views"
 
         DEFAULT = %w[oauth_authorize].freeze
         VIEWS = {
@@ -16,11 +16,6 @@ module Rodauth::OAuth
         }.freeze
 
         DEPENDENCIES = {
-          active_sessions: :logout,
-          otp: :two_factor_base,
-          sms_codes: :two_factor_base,
-          recovery_codes: :two_factor_base,
-          webauthn: :two_factor_base
         }.freeze
 
         class_option :features, type: :array,

data/lib/rodauth/features/oauth.rb

@@ -33,8 +33,6 @@ module Rodauth
 
     SCOPES = %w[profile.read].freeze
 
-    depends :login
-
     before "authorize"
     after "authorize"
     after "authorize_failure"
@@ -64,13 +62,17 @@ module Rodauth
 
     auth_value_method :json_response_content_type, "application/json"
 
-    auth_value_method :oauth_grant_expires_in, 60 * 5 # 5 minutes
+    auth_value_method :oauth_grant_expires_in, 60 * 5 # 60 minutes
     auth_value_method :oauth_token_expires_in, 60 * 60 # 60 minutes
-    auth_value_method :use_oauth_implicit_grant_type, false
+    auth_value_method :use_oauth_implicit_grant_type?, false
+    auth_value_method :use_oauth_pkce?, true
+    auth_value_method :use_oauth_access_type?, true
 
     auth_value_method :oauth_require_pkce, false
     auth_value_method :oauth_pkce_challenge_method, "S256"
 
+    auth_value_method :oauth_valid_uri_schemes, %w[http https]
+
     # URL PARAMS
 
     # Authorize / token
@@ -168,6 +170,8 @@ module Rodauth
       :secret_hash
     )
 
+    auth_value_methods(:only_json?)
+
     redirect(:oauth_application) do |id|
       "/#{oauth_applications_path}/#{id}"
     end
@@ -175,13 +179,14 @@ module Rodauth
     redirect(:require_authorization) do
       if logged_in?
         oauth_authorize_path
-      else
+      elsif respond_to?(:login_redirect)
         login_redirect
+      else
+        default_redirect
       end
     end
 
-    auth_value_method :json_request_accept_regexp, %r{\bapplication/(?:vnd\.api\+)?json\b}i
-    auth_methods(:json_request?)
+    auth_value_method :json_request_regexp, %r{\bapplication/(?:vnd\.api\+)?json\b}i
 
     def check_csrf?
       case request.path
@@ -189,6 +194,8 @@ module Rodauth
         false
       when oauth_revoke_path
         !json_request?
+      when oauth_authorize_path, %r{/#{oauth_applications_path}}
+        only_json? ? false : super
       else
         super
       end
@@ -199,10 +206,19 @@ module Rodauth
       super || authorization_token
     end
 
-    def json_request?
-      return @json_request if defined?(@json_request)
+    def accepts_json?
+      return true if only_json?
 
-      @json_request = request.get_header("HTTP_ACCEPT") =~ json_request_accept_regexp
+      (accept = request.env["HTTP_ACCEPT"]) && accept =~ json_request_regexp
+    end
+
+    unless method_defined?(:json_request?)
+      # copied from the jwt feature
+      def json_request?
+        return @json_request if defined?(@json_request)
+
+        @json_request = request.content_type =~ json_request_regexp
+      end
     end
 
     attr_reader :oauth_application
@@ -275,7 +291,7 @@ module Rodauth
 
       scopes << oauth_application_default_scope if scopes.empty?
 
-      token_scopes = authorization_token[:scopes].split(",")
+      token_scopes = authorization_token[oauth_tokens_scopes_column].split(",")
 
       authorization_required unless scopes.any? { |scope| token_scopes.include?(scope) }
     end
@@ -426,6 +442,18 @@ module Rodauth
       end
     end
 
+    def json_access_token_payload(oauth_token)
+      payload = {
+        "access_token" => oauth_token[oauth_tokens_token_column],
+        "token_type" => oauth_token_type.downcase,
+        "expires_in" => oauth_token_expires_in
+      }
+      if oauth_token[oauth_tokens_refresh_token_column]
+        payload["refresh_token"] = oauth_token[oauth_tokens_refresh_token_column]
+      end
+      payload
+    end
+
     # Oauth Application
 
     def oauth_application_params
@@ -444,7 +472,9 @@ module Rodauth
         if key == oauth_application_homepage_url_param ||
            key == oauth_application_redirect_uri_param
 
-          set_field_error(key, invalid_url_message) unless URI::DEFAULT_PARSER.make_regexp(%w[http https]).match?(value)
+          unless URI::DEFAULT_PARSER.make_regexp(oauth_valid_uri_schemes).match?(value)
+            set_field_error(key, invalid_url_message)
+          end
 
         elsif key == oauth_application_scopes_param
 
@@ -509,6 +539,9 @@ module Rodauth
     end
 
     # Authorize
+    def before_authorize
+      require_account
+    end
 
     def validate_oauth_grant_params
       unless oauth_application && check_valid_redirect_uri? && check_valid_access_type? &&
@@ -517,7 +550,7 @@ module Rodauth
       end
       redirect_response_error("invalid_scope") unless check_valid_scopes?
 
-      validate_pkce_challenge_params
+      validate_pkce_challenge_params if use_oauth_pkce?
     end
 
     def try_approval_prompt
@@ -548,18 +581,24 @@ module Rodauth
         oauth_grants_scopes_column => scopes.join(",")
       }
 
-      if (access_type = param_or_nil(access_type_param))
-        create_params[oauth_grants_access_type_column] = access_type
+      # Access Type flow
+      if use_oauth_access_type?
+        if (access_type = param_or_nil(access_type_param))
+          create_params[oauth_grants_access_type_column] = access_type
+        end
       end
 
       # PKCE flow
-      if (code_challenge = param_or_nil(code_challenge_param))
-        code_challenge_method = param_or_nil(code_challenge_method_param)
+      if use_oauth_pkce?
 
-        create_params[oauth_grants_code_challenge_column] = code_challenge
-        create_params[oauth_grants_code_challenge_method_column] = code_challenge_method
-      elsif oauth_require_pkce
-        redirect_response_error("code_challenge_required")
+        if (code_challenge = param_or_nil(code_challenge_param))
+          code_challenge_method = param_or_nil(code_challenge_method_param)
+
+          create_params[oauth_grants_code_challenge_column] = code_challenge
+          create_params[oauth_grants_code_challenge_method_column] = code_challenge_method
+        elsif oauth_require_pkce
+          redirect_response_error("code_challenge_required")
+        end
       end
 
       ds = db[oauth_grants_table]
@@ -613,19 +652,29 @@ module Rodauth
 
       case param(grant_type_param)
       when "authorization_code"
+        create_oauth_token_from_authorization_code(oauth_application)
+      when "refresh_token"
+        create_oauth_token_from_token(oauth_application)
+      else
+        redirect_response_error("invalid_grant")
+      end
+    end
 
-        # fetch oauth grant
-        oauth_grant = db[oauth_grants_table].where(
-          oauth_grants_code_column => param(code_param),
-          oauth_grants_redirect_uri_column => param(redirect_uri_param),
-          oauth_grants_oauth_application_id_column => oauth_application[oauth_applications_id_column],
-          oauth_grants_revoked_at_column => nil
-        ).where(Sequel[oauth_grants_expires_in_column] >= Sequel::CURRENT_TIMESTAMP)
-                                            .first
+    def create_oauth_token_from_authorization_code(oauth_application)
+      # fetch oauth grant
+      oauth_grant = db[oauth_grants_table].where(
+        oauth_grants_code_column => param(code_param),
+        oauth_grants_redirect_uri_column => param(redirect_uri_param),
+        oauth_grants_oauth_application_id_column => oauth_application[oauth_applications_id_column],
+        oauth_grants_revoked_at_column => nil
+      ).where(Sequel[oauth_grants_expires_in_column] >= Sequel::CURRENT_TIMESTAMP)
+                                          .for_update
+                                          .first
 
-        redirect_response_error("invalid_grant") unless oauth_grant
+      redirect_response_error("invalid_grant") unless oauth_grant
 
-        # PKCE
+      # PKCE
+      if use_oauth_pkce?
         if oauth_grant[oauth_grants_code_challenge_column]
           code_verifier = param_or_nil(code_verifier_param)
 
@@ -635,63 +684,69 @@ module Rodauth
         elsif oauth_require_pkce
           redirect_response_error("code_challenge_required")
         end
+      end
+
+      create_params = {
+        oauth_tokens_account_id_column => oauth_grant[oauth_grants_account_id_column],
+        oauth_tokens_oauth_application_id_column => oauth_grant[oauth_grants_oauth_application_id_column],
+        oauth_tokens_oauth_grant_id_column => oauth_grant[oauth_grants_id_column],
+        oauth_tokens_scopes_column => oauth_grant[oauth_grants_scopes_column]
+      }
 
-        create_params = {
-          oauth_tokens_account_id_column => oauth_grant[oauth_grants_account_id_column],
-          oauth_tokens_oauth_application_id_column => oauth_grant[oauth_grants_oauth_application_id_column],
-          oauth_tokens_oauth_grant_id_column => oauth_grant[oauth_grants_id_column],
-          oauth_tokens_scopes_column => oauth_grant[oauth_grants_scopes_column]
-        }
+      # revoke oauth grant
+      db[oauth_grants_table].where(oauth_grants_id_column => oauth_grant[oauth_grants_id_column])
+                            .update(oauth_grants_revoked_at_column => Sequel::CURRENT_TIMESTAMP)
 
-        # revoke oauth grant
-        db[oauth_grants_table].where(oauth_grants_id_column => oauth_grant[oauth_grants_id_column])
-                              .update(oauth_grants_revoked_at_column => Sequel::CURRENT_TIMESTAMP)
+      should_generate_refresh_token = !use_oauth_access_type? ||
+                                      oauth_grant[oauth_grants_access_type_column] == "offline"
 
-        generate_oauth_token(create_params, oauth_grant[oauth_grants_access_type_column] == "offline")
+      generate_oauth_token(create_params, should_generate_refresh_token)
+    end
 
-      when "refresh_token"
-        # fetch oauth token
-        oauth_token = oauth_token_by_refresh_token(param(refresh_token_param)).where(
-          oauth_tokens_oauth_application_id_column => oauth_application[oauth_applications_id_column]
-        ).where(oauth_grants_revoked_at_column => nil).first
+    def create_oauth_token_from_token(oauth_application)
+      # fetch oauth token
+      oauth_token = oauth_token_by_refresh_token(param(refresh_token_param)).where(
+        oauth_tokens_oauth_application_id_column => oauth_application[oauth_applications_id_column]
+      ).where(oauth_grants_revoked_at_column => nil).for_update.first
 
-        redirect_response_error("invalid_grant") unless oauth_token
+      redirect_response_error("invalid_grant") unless oauth_token
 
-        token = oauth_unique_id_generator
+      token = oauth_unique_id_generator
 
-        update_params = {
-          oauth_tokens_oauth_application_id_column => oauth_token[oauth_grants_oauth_application_id_column],
-          oauth_tokens_expires_in_column => Time.now + oauth_token_expires_in
-        }
+      update_params = {
+        oauth_tokens_oauth_application_id_column => oauth_token[oauth_grants_oauth_application_id_column],
+        oauth_tokens_expires_in_column => Time.now + oauth_token_expires_in
+      }
 
-        if oauth_tokens_token_hash_column
-          update_params[oauth_tokens_token_hash_column] = generate_token_hash(token)
-        else
-          update_params[oauth_tokens_token_column] = token
-        end
+      if oauth_tokens_token_hash_column
+        update_params[oauth_tokens_token_hash_column] = generate_token_hash(token)
+      else
+        update_params[oauth_tokens_token_column] = token
+      end
 
-        ds = db[oauth_tokens_table].where(oauth_tokens_id_column => oauth_token[oauth_tokens_id_column])
+      ds = db[oauth_tokens_table].where(oauth_tokens_id_column => oauth_token[oauth_tokens_id_column])
 
-        oauth_token = begin
-          if ds.supports_returning?(:update)
-            ds.returning.update(update_params)
-          else
-            ds.update(update_params)
-            ds.first
-          end
-                      rescue Sequel::UniqueConstraintViolation
-                        retry
+      oauth_token = begin
+        if ds.supports_returning?(:update)
+          ds.returning.update(update_params)
+        else
+          ds.update(update_params)
+          ds.first
         end
-
-        oauth_token[oauth_tokens_token_column] = token
-        oauth_token
-      else
-        redirect_response_error("invalid_grant")
+                    rescue Sequel::UniqueConstraintViolation
+                      retry
       end
+
+      oauth_token[oauth_tokens_token_column] = token
+      oauth_token
     end
 
     # Token revocation
 
+    def before_revoke
+      require_account
+    end
+
     TOKEN_HINT_TYPES = %w[access_token refresh_token].freeze
 
     def validate_oauth_revoke_params
@@ -719,7 +774,7 @@ module Rodauth
                             oauth_applications_account_id_column => account_id
                           ).select(oauth_applications_id_column)
                         )
-                      ).first
+                      ).for_update.first
 
       redirect_response_error("invalid_request") unless oauth_token
 
@@ -749,7 +804,7 @@ module Rodauth
     # Response helpers
 
     def redirect_response_error(error_code, redirect_url = request.referer || default_redirect)
-      if json_request?
+      if accepts_json?
         throw_json_response_error(invalid_oauth_response_status, error_code)
       else
         redirect_url = URI.parse(redirect_url)
@@ -783,7 +838,7 @@ module Rodauth
       payload["error_description"] = send(:"#{error_code}_message") if respond_to?(:"#{error_code}_message")
       json_payload = _json_response_body(payload)
       response["Content-Type"] ||= json_response_content_type
-      response["WWW-Authenticate"] = "Bearer" if status == 401
+      response["WWW-Authenticate"] = oauth_token_type if status == 401
       response.write(json_payload)
       request.halt
     end
@@ -799,7 +854,7 @@ module Rodauth
     end
 
     def authorization_required
-      if json_request?
+      if accepts_json?
         throw_json_response_error(authorization_required_error_status, "invalid_client")
       else
         set_redirect_error_flash(require_authorization_error_flash)
@@ -820,6 +875,8 @@ module Rodauth
     ACCESS_TYPES = %w[offline online].freeze
 
     def check_valid_access_type?
+      return true unless use_oauth_access_type?
+
       access_type = param_or_nil(access_type_param)
       !access_type || ACCESS_TYPES.include?(access_type)
     end
@@ -827,6 +884,8 @@ module Rodauth
     APPROVAL_PROMPTS = %w[force auto].freeze
 
     def check_valid_approval_prompt?
+      return true unless use_oauth_access_type?
+
       approval_prompt = param_or_nil(approval_prompt_param)
       !approval_prompt || APPROVAL_PROMPTS.include?(approval_prompt)
     end
@@ -836,7 +895,7 @@ module Rodauth
 
       return true if response_type.nil? || response_type == "code"
 
-      return use_oauth_implicit_grant_type if response_type == "token"
+      return use_oauth_implicit_grant_type? if response_type == "token"
 
       false
     end
@@ -873,28 +932,21 @@ module Rodauth
 
     # /oauth-token
     route(:oauth_token) do |r|
+      before_token
+
       r.post do
         catch_error do
           validate_oauth_token_params
 
           oauth_token = nil
           transaction do
-            before_token
             oauth_token = create_oauth_token
             after_token
           end
 
           response.status = 200
           response["Content-Type"] ||= json_response_content_type
-          json_response = {
-            "token" => oauth_token[oauth_tokens_token_column],
-            "token_type" => oauth_token_type,
-            "expires_in" => oauth_token_expires_in
-          }
-
-          json_response["refresh_token"] = oauth_token[oauth_tokens_refresh_token_column] if oauth_token[:refresh_token]
-
-          json_payload = _json_response_body(json_response)
+          json_payload = _json_response_body(json_access_token_payload(oauth_token))
           response.write(json_payload)
           request.halt
         end
@@ -906,6 +958,7 @@ module Rodauth
     # /oauth-revoke
     route(:oauth_revoke) do |r|
       require_account
+      before_revoke
 
       # access-token
       r.post do
@@ -914,12 +967,11 @@ module Rodauth
 
           oauth_token = nil
           transaction do
-            before_revoke
             oauth_token = revoke_oauth_token
             after_revoke
           end
 
-          if json_request?
+          if accepts_json?
             response.status = 200
             response["Content-Type"] ||= json_response_content_type
             json_response = {
@@ -944,7 +996,9 @@ module Rodauth
     route(:oauth_authorize) do |r|
       require_account
       validate_oauth_grant_params
-      try_approval_prompt if request.get?
+      try_approval_prompt if use_oauth_access_type? && request.get?
+
+      before_authorize
 
       r.get do
         authorize_view
@@ -956,10 +1010,9 @@ module Rodauth
         fragment_params = []
 
         transaction do
-          before_authorize
           case param(response_type_param)
           when "token"
-            redirect_response_error("invalid_request", redirect_uri) unless use_oauth_implicit_grant_type
+            redirect_response_error("invalid_request", redirect_uri) unless use_oauth_implicit_grant_type?
 
             create_params = {
               oauth_tokens_account_id_column => account_id,
@@ -968,12 +1021,11 @@ module Rodauth
             }
             oauth_token = generate_oauth_token(create_params, false)
 
-            fragment_params << ["access_token=#{oauth_token[oauth_tokens_token_column]}"]
-            fragment_params << ["token_type=#{oauth_token_type}"]
-            fragment_params << ["expires_in=#{oauth_token_expires_in}"]
+            token_payload = json_access_token_payload(oauth_token)
+            fragment_params.replace(token_payload.map { |k, v| "#{k}=#{v}" })
           when "code", "", nil
             code = create_oauth_grant
-            query_params << ["code=#{code}"]
+            query_params << "code=#{code}"
           else
             redirect_response_error("invalid_request")
           end