rodauth-oauth 0.0.6 → 0.4.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +167 -5
- data/README.md +43 -20
- data/lib/generators/roda/oauth/templates/db/migrate/create_rodauth_oauth.rb +8 -5
- data/lib/rodauth/features/oauth.rb +534 -409
- data/lib/rodauth/features/oauth_http_mac.rb +6 -10
- data/lib/rodauth/features/oauth_jwt.rb +115 -70
- data/lib/rodauth/features/oauth_saml.rb +104 -0
- data/lib/rodauth/features/oidc.rb +399 -0
- data/lib/rodauth/oauth/database_extensions.rb +73 -0
- data/lib/rodauth/oauth/ttl_store.rb +1 -1
- data/lib/rodauth/oauth/version.rb +1 -1
- data/templates/authorize.str +34 -0
- data/templates/client_secret_field.str +4 -0
- data/templates/description_field.str +4 -0
- data/templates/homepage_url_field.str +4 -0
- data/templates/name_field.str +4 -0
- data/templates/new_oauth_application.str +10 -0
- data/templates/oauth_application.str +11 -0
- data/templates/oauth_applications.str +14 -0
- data/templates/oauth_tokens.str +49 -0
- data/templates/redirect_uri_field.str +4 -0
- data/templates/scope_field.str +10 -0
- metadata +24 -10
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: c7c9cc026f547d781b05599d177237498390c8347791aaf5960e7447d2640b0b
|
|
4
|
+
data.tar.gz: 290ec103b22d394fbae7f153430605fa032b8baf6b6083e31ad8af8cd3d422b8
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 64c22bd200ff9dcb5e8406ace5f4eb34625bcee5a381e52b6b7e960b614ec3941c0460997542d843ed4eaa843a85a7f2592a027c741d5380a7572edb974ca3a9
|
|
7
|
+
data.tar.gz: 0a6c93bc131d2fcb45e400173ced20096caa191e3ef73f4e67ab0fc12d5ead9b9f9e6867d163612299141b96b7691429cb5e5b263036887134396f244c3dd4f7
|
data/CHANGELOG.md
CHANGED
|
@@ -2,8 +2,160 @@
|
|
|
2
2
|
|
|
3
3
|
## master
|
|
4
4
|
|
|
5
|
+
### 0.4.1
|
|
6
|
+
|
|
7
|
+
### Improvements
|
|
8
|
+
|
|
9
|
+
When in "Resource Server" mode, calling `rodauth.authorization_token` will now return an hash of the JSON payload that the Authorization Server responds, and which was already previously used to authorize access to protected resources.
|
|
10
|
+
|
|
11
|
+
### Bugfixes
|
|
12
|
+
|
|
13
|
+
* An error ocurred if the client passed an empty authorization header (`Authorization: ` or `Authorization: Bearer `), causing an unexpected error; It now responds with the proper `401 Unauthorized` status code.
|
|
14
|
+
|
|
15
|
+
### 0.4.0
|
|
16
|
+
|
|
17
|
+
### Features
|
|
18
|
+
|
|
19
|
+
* A new method, `get_additional_param(account, claim)`, is now exposed; this method will be called whenever non-OIDC scopes are requested in the emission of the ID token.
|
|
20
|
+
|
|
21
|
+
* The `form_post` response is now supported, either by passing the `response_mode=form_post` request param in the authorization URL, or by setting `oauth_response_mode "form_post"` option. This improves the overall security of an Authorization server even more, as authorization codes are sent to client applications via a POST request to the redirect URI.
|
|
22
|
+
|
|
23
|
+
|
|
24
|
+
### Improvements
|
|
25
|
+
|
|
26
|
+
* For the OIDC `address` scope, proper claims are now emitted as per the standard, i.e. the "formatted", "street_address", "locality", "region", "postal_code", "country". These will be the ones referenced in the `get_oidc_param` method.
|
|
27
|
+
|
|
28
|
+
### Bugfixes
|
|
29
|
+
|
|
30
|
+
* The rails templates were missing declarations from a few params, which made some of the flows (the PKCE for example) not work out-of-the box;
|
|
31
|
+
* rails tests were silently not running in CI;
|
|
32
|
+
* The CI suite was revamped, so that all Oauth tests would be run under rails as well. All versions from rails equal or above 5.0 are now targeted;
|
|
33
|
+
|
|
34
|
+
### 0.3.0
|
|
35
|
+
|
|
36
|
+
#### Features
|
|
37
|
+
|
|
38
|
+
* `oauth_refresh_token_protection_policy` is a new option, which can be used to set a protection policy around usage of refresh tokens. By default it's `none`, for backwards-compatibility. However, when set to `rotation`, refresh tokens will be "use-once", i.e. a token refresh request will generate a new refresh token. Also, refresh token requests performed with already-used refresh tokens will be interpreted as a security breach, i.e. all tokens linked to the compromised refresh token will be revoked.
|
|
39
|
+
|
|
40
|
+
#### Improvements
|
|
41
|
+
|
|
42
|
+
|
|
43
|
+
* Support for the OIDC authorize [`prompt` parameter](https://openid.net/specs/openid-connect-core-1_0.html) (sectionn 3.1.2.1). It supports the `none`, `login` and `consent` out-of-the-box, while providing support for `select-account` when paired with [rodauth-select-account, a rodauth feature to handle multiple accounts in the same session](https://gitlab.com/honeyryderchuck/rodauth-select-account).
|
|
44
|
+
|
|
45
|
+
* Refresh Tokens are now expirable. The refresh token expiration period is governed by the `oauth_refresh_token_expires_in` option (default: 1 year), and is the period for which a refresh token can be used after its respective access token expired.
|
|
46
|
+
|
|
47
|
+
#### Bugfixes
|
|
48
|
+
|
|
49
|
+
* Default Templates now being packaged, as a way to provide a default experience to the OAuth journeys.
|
|
50
|
+
|
|
51
|
+
* fixing metadata urls when plugin loaded with a prefix path (@ianks)
|
|
52
|
+
|
|
53
|
+
* All date/time-based calculations, such as determining an expiration date, or checking if a token has expired, are now performed using database arithmetic operations, using sequel's `date_arithmetic` plugin. This will eliminate subtle bugs, such as when the database timezone is different than the application OS timezone.
|
|
54
|
+
|
|
55
|
+
* OIDC configuration endpoint is now stricter, eliminating JSON metadata inherited from the Oauth metadata endpoint. (@ianks)
|
|
56
|
+
|
|
57
|
+
#### Chore
|
|
58
|
+
|
|
59
|
+
Use `rodauth.convert_timestamp` in the templates, whenever dates are displayed.
|
|
60
|
+
|
|
61
|
+
Set HTTP Cache headers for metadata responses, such as `/.well-known/oauth-authorization-server` and `/.well-known/openid-configuration`, so they can be stored at the edge. The cache will be valid for 1 day (this value isn't set by an option yet).
|
|
62
|
+
|
|
63
|
+
### 0.2.0
|
|
64
|
+
|
|
65
|
+
#### Features
|
|
66
|
+
|
|
67
|
+
##### SAML Assertion Grant Type
|
|
68
|
+
|
|
69
|
+
`rodauth-auth` now supports using a SAML Assertion to request for an Access token.In order to enable, you have to:
|
|
70
|
+
|
|
71
|
+
```ruby
|
|
72
|
+
plugin :rodauth do
|
|
73
|
+
enable :oauth_saml
|
|
74
|
+
end
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
For more info about integrating it, [check the wiki](https://gitlab.com/honeyryderchuck/rodauth-oauth/-/wikis/SAML-Assertion-Access-Tokens).
|
|
78
|
+
|
|
79
|
+
##### Supporting rotating keys
|
|
80
|
+
|
|
81
|
+
At some point, you'll want to replace the pkeys and algorithm used to generate and verify the JWT access tokens, but you want to keep validating previously-distributed JWT tokens, at least until they expire. Now you can, via two new options, `oauth_jwt_legacy_public_key` and `oauth_jwt_legacy_algorithm`, which will be declared in the JWKs URI and used to verify access tokens.
|
|
82
|
+
|
|
83
|
+
|
|
84
|
+
##### Reuse access tokens
|
|
85
|
+
|
|
86
|
+
If the `oauth_reuse_access_token` is set, if there's already an existing valid access token, any new grant for the same application / account / scope will keep the same access token. This can be helpful in scenarios where one wants the same access token distributed across devices.
|
|
87
|
+
|
|
88
|
+
##### require_authorizable_account
|
|
89
|
+
|
|
90
|
+
The method used to verify access to the authorize flow is called `require_authorizable_account`. By default, it checks if a user is logged in by using rodauth's own `require_account`. This is the method you'd want to redefine in order to augment these requirements, i.e. request 2fa authentication.
|
|
91
|
+
|
|
92
|
+
#### Improvements
|
|
93
|
+
|
|
94
|
+
Expired and revoked access tokens end up generating a lot of garbage, which will have to be periodically cleaned up. You can mitigate this now by setting a uniqueness index for a group of columns, i.e. if you set a uniqueness index for the `oauth_application_id/account_id/scopes` column, `rodauth-oauth` will transparently reuse the same db entry to store the new access token. If setting some other type of uniqueness index, make sure to update the option `oauth_tokens_unique_columns` (the array of columns from the uniqueness index).
|
|
95
|
+
|
|
96
|
+
#### Bugfixes
|
|
97
|
+
|
|
98
|
+
Calling `before_*_route` callbacks appropriately.
|
|
99
|
+
|
|
100
|
+
Fixed some mishandling of HTTP headers when in in resource-server mode.
|
|
101
|
+
|
|
102
|
+
#### Chore
|
|
103
|
+
|
|
104
|
+
* 97.7% test coverage;
|
|
105
|
+
* `rodauth-oauth` CI tests run against sqlite, postgresql and mysql.
|
|
106
|
+
|
|
107
|
+
### 0.1.0
|
|
108
|
+
|
|
109
|
+
(31/7/2020)
|
|
110
|
+
|
|
111
|
+
#### Features
|
|
112
|
+
|
|
113
|
+
##### OpenID
|
|
114
|
+
|
|
115
|
+
`rodauth-oauth` now ships with support for [OpenID Connect](https://openid.net/connect/). In order to enable, you have to:
|
|
116
|
+
|
|
117
|
+
```ruby
|
|
118
|
+
plugin :rodauth do
|
|
119
|
+
enable :oidc
|
|
120
|
+
end
|
|
121
|
+
```
|
|
122
|
+
|
|
123
|
+
For more info about integrating it, [check the wiki](https://gitlab.com/honeyryderchuck/rodauth-oauth/-/wikis/home#openid-connect-since-v01).
|
|
124
|
+
|
|
125
|
+
It supports omniauth openID integrations out-of-the-box, [check the OpenID example, which integrates with omniauth_openid_connect](https://gitlab.com/honeyryderchuck/rodauth-oauth/-/tree/master/examples).
|
|
126
|
+
|
|
127
|
+
#### Improvements
|
|
128
|
+
|
|
129
|
+
* JWT: `sub` claim now also handles "pairwise" subjects. For that, you have to set the `oauth_jwt_subject_type` option (`"public"` or `"pairwise"`) and `oauth_jwt_subject_secret` (will be used for salting the `sub` when the type is `"pairwise"`).
|
|
130
|
+
* JWT: `auth_time` claim is now supported; if your application uses the `rodauth` feature `:account_expiration`, it'll use the `last_account_login_at` method, otherwise you can set the `last_account_login_at` option:
|
|
131
|
+
|
|
132
|
+
```ruby
|
|
133
|
+
last_account_login_at do
|
|
134
|
+
convert_timestamp(db[accounts_table].where(account_id_column => account_id).get(:that_column_where_you_keep_the_data))
|
|
135
|
+
end
|
|
136
|
+
```
|
|
137
|
+
* JWT: `iss` claim now defaults to `authorization_server_url` when not defined;
|
|
138
|
+
* JWT: `aud` claim now defaults to the token application's client ID (`client_id` claim was removed as a result);
|
|
139
|
+
|
|
140
|
+
|
|
141
|
+
|
|
142
|
+
#### Breaking Changes
|
|
143
|
+
|
|
144
|
+
`rodauth-oauth` URLs no longer have the `oauth-` prefix, so make sure you update your integrations accordingly, i.e. where you used to rely on `/oauth-authorize`, you'll have to use `/authorize`.
|
|
145
|
+
|
|
146
|
+
URI schemes for client applications redirect URIs have to be `https`. In order to override this, set the `oauth_valid_uri_schemes` to an array of your expected URI schemes.
|
|
147
|
+
|
|
148
|
+
|
|
149
|
+
#### Bugfixes
|
|
150
|
+
|
|
151
|
+
* Authorization request submission can receive the `scope` as an array of values now, instead of only dealing with receiving a white-space separated list.
|
|
152
|
+
* fixed trailing "/" in the "issuer" value in server metadata (`https://server.com/` -> `https://server.com`).
|
|
153
|
+
|
|
154
|
+
|
|
5
155
|
### 0.0.6
|
|
6
156
|
|
|
157
|
+
(6/7/2020)
|
|
158
|
+
|
|
7
159
|
#### Features
|
|
8
160
|
|
|
9
161
|
The `oauth_jwt` feature now supports JWT Secured Authorization Request (JAR) (see https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-20). This means that client applications can send the authorization parameters inside a signed JWT. The client applications keeps the private key, while the authorization server **must** store a public key for the client application. For encrypted JWTs, the client application should use one of the public encryption keys exposed in the JWKs URI, to encrypt the JWT. Remember, **tokens must be signed then encrypted** (or just signed).
|
|
@@ -25,7 +177,9 @@ The `oauth_jwt` feature now supports JWT Secured Authorization Request (JAR) (se
|
|
|
25
177
|
Removed React Javascript from example applications.
|
|
26
178
|
|
|
27
179
|
|
|
28
|
-
### 0.0.5
|
|
180
|
+
### 0.0.5
|
|
181
|
+
|
|
182
|
+
(26/6/2020)
|
|
29
183
|
|
|
30
184
|
#### Features
|
|
31
185
|
|
|
@@ -62,7 +216,9 @@ It **requires** the authorization to implement the server metadata endpoint (`/.
|
|
|
62
216
|
* option `scopes_param` renamed to `scope_param`;
|
|
63
217
|
*
|
|
64
218
|
|
|
65
|
-
## 0.0.4
|
|
219
|
+
## 0.0.4
|
|
220
|
+
|
|
221
|
+
(13/6/2020)
|
|
66
222
|
|
|
67
223
|
### Features
|
|
68
224
|
|
|
@@ -99,7 +255,9 @@ The `oauth_jwt` feature now allows the usage of access tokens to authorize the g
|
|
|
99
255
|
|
|
100
256
|
* Fixed scope claim of JWT ("scopes" -> "scope");
|
|
101
257
|
|
|
102
|
-
## 0.0.3
|
|
258
|
+
## 0.0.3
|
|
259
|
+
|
|
260
|
+
(5/6/2020)
|
|
103
261
|
|
|
104
262
|
### Features
|
|
105
263
|
|
|
@@ -131,7 +289,9 @@ end
|
|
|
131
289
|
* renamed the existing `use_oauth_implicit_grant_type` to `use_oauth_implicit_grant_type?`;
|
|
132
290
|
* It's now usable as JSON API (small caveat: POST authorize will still redirect on success...);
|
|
133
291
|
|
|
134
|
-
## 0.0.2
|
|
292
|
+
## 0.0.2
|
|
293
|
+
|
|
294
|
+
(29/5/2020)
|
|
135
295
|
|
|
136
296
|
### Features
|
|
137
297
|
|
|
@@ -147,6 +307,8 @@ end
|
|
|
147
307
|
|
|
148
308
|
* usage of client secret for authorizing the generation of tokens, as the spec mandates (and refraining from them when doing PKCE).
|
|
149
309
|
|
|
150
|
-
## 0.0.1
|
|
310
|
+
## 0.0.1
|
|
311
|
+
|
|
312
|
+
(14/5/2020)
|
|
151
313
|
|
|
152
314
|
Initial implementation of the Oauth 2.0 framework, with an example app done using roda.
|
data/README.md
CHANGED
|
@@ -1,13 +1,13 @@
|
|
|
1
1
|
# Rodauth::Oauth
|
|
2
2
|
|
|
3
|
-
[](https://gitlab.com/honeyryderchuck/rodauth-oauth/-/
|
|
4
|
-
[](https://gitlab.
|
|
3
|
+
[](https://gitlab.com/honeyryderchuck/rodauth-oauth/-/pipelines?page=1&ref=master)
|
|
4
|
+
[](https://honeyryderchuck.gitlab.io/rodauth-oauth/coverage/#_AllFiles)
|
|
5
5
|
|
|
6
6
|
This is an extension to the `rodauth` gem which implements the [OAuth 2.0 framework](https://tools.ietf.org/html/rfc6749) for an authorization server.
|
|
7
7
|
|
|
8
8
|
## Features
|
|
9
9
|
|
|
10
|
-
This gem implements:
|
|
10
|
+
This gem implements the following RFCs and features of OAuth:
|
|
11
11
|
|
|
12
12
|
* [The OAuth 2.0 protocol framework](https://tools.ietf.org/html/rfc6749):
|
|
13
13
|
* [Authorization grant flow](https://tools.ietf.org/html/rfc6749#section-1.3);
|
|
@@ -21,9 +21,12 @@ This gem implements:
|
|
|
21
21
|
* Access Type (Token refresh online and offline);
|
|
22
22
|
* [MAC Authentication Scheme](https://tools.ietf.org/html/draft-hammer-oauth-v2-mac-token-02);
|
|
23
23
|
* [JWT Acess Tokens](https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-07);
|
|
24
|
+
* [SAML 2.0 Assertion Access Tokens](https://tools.ietf.org/html/draft-ietf-oauth-saml2-bearer-03);
|
|
24
25
|
* [JWT Secured Authorization Requests](https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-20);
|
|
25
26
|
* OAuth application and token management dashboards;
|
|
26
27
|
|
|
28
|
+
It also implements the [OpenID Connect layer](https://openid.net/connect/) on top of the OAuth features it provides.
|
|
29
|
+
|
|
27
30
|
This gem supports also rails (through [rodauth-rails]((https://github.com/janko/rodauth-rails))).
|
|
28
31
|
|
|
29
32
|
|
|
@@ -43,6 +46,15 @@ Or install it yourself as:
|
|
|
43
46
|
|
|
44
47
|
$ gem install rodauth-oauth
|
|
45
48
|
|
|
49
|
+
|
|
50
|
+
## Resources
|
|
51
|
+
| | |
|
|
52
|
+
| ------------- | ----------------------------------------------------------- |
|
|
53
|
+
| Website | https://honeyryderchuck.gitlab.io/rodauth-oauth/ |
|
|
54
|
+
| Documentation | https://honeyryderchuck.gitlab.io/rodauth-oauth/rdoc/ |
|
|
55
|
+
| Wiki | https://gitlab.com/honeyryderchuck/rodauth-oauth/wikis/home |
|
|
56
|
+
| CI | https://gitlab.com/honeyryderchuck/rodauth-oauth/pipelines |
|
|
57
|
+
|
|
46
58
|
## Usage
|
|
47
59
|
|
|
48
60
|
This tutorial assumes you already read the documentation and know how to set up `rodauth`. After that, integrating `roda-auth` will look like:
|
|
@@ -86,7 +98,18 @@ route do |r|
|
|
|
86
98
|
end
|
|
87
99
|
```
|
|
88
100
|
|
|
89
|
-
|
|
101
|
+
|
|
102
|
+
For OpenID, it's very similar to the example above:
|
|
103
|
+
|
|
104
|
+
```ruby
|
|
105
|
+
plugin :rodauth do
|
|
106
|
+
# enable it in the plugin
|
|
107
|
+
enable :login, :openid
|
|
108
|
+
oauth_application_default_scope %w[openid]
|
|
109
|
+
oauth_application_scopes %w[openid email profile]
|
|
110
|
+
end
|
|
111
|
+
```
|
|
112
|
+
|
|
90
113
|
|
|
91
114
|
### Example (TL;DR)
|
|
92
115
|
|
|
@@ -101,7 +124,7 @@ Generating tokens happens mostly server-to-server, so here's an example using:
|
|
|
101
124
|
|
|
102
125
|
```ruby
|
|
103
126
|
require "httpx"
|
|
104
|
-
response = HTTPX.post("https://auth_server/
|
|
127
|
+
response = HTTPX.post("https://auth_server/token",json: {
|
|
105
128
|
client_id: ENV["OAUTH_CLIENT_ID"],
|
|
106
129
|
client_secret: ENV["OAUTH_CLIENT_SECRET"],
|
|
107
130
|
grant_type: "authorization_code",
|
|
@@ -115,7 +138,7 @@ puts payload #=> {"access_token" => "awr23f3h8f9d2h89...", "refresh_token" => "2
|
|
|
115
138
|
##### cURL
|
|
116
139
|
|
|
117
140
|
```
|
|
118
|
-
> curl --data '{"client_id":"$OAUTH_CLIENT_ID","client_secret":"$OAUTH_CLIENT_SECRET","grant_type":"authorization_code","code":"oiweicnewdh32fhoi3hf3ihfo2ih3f2o3as"}' https://auth_server/
|
|
141
|
+
> curl --data '{"client_id":"$OAUTH_CLIENT_ID","client_secret":"$OAUTH_CLIENT_SECRET","grant_type":"authorization_code","code":"oiweicnewdh32fhoi3hf3ihfo2ih3f2o3as"}' https://auth_server/token
|
|
119
142
|
```
|
|
120
143
|
|
|
121
144
|
#### Refresh Token
|
|
@@ -126,7 +149,7 @@ Refreshing expired tokens also happens mostly server-to-server, here's an exampl
|
|
|
126
149
|
|
|
127
150
|
```ruby
|
|
128
151
|
require "httpx"
|
|
129
|
-
response = HTTPX.post("https://auth_server/
|
|
152
|
+
response = HTTPX.post("https://auth_server/token",json: {
|
|
130
153
|
client_id: ENV["OAUTH_CLIENT_ID"],
|
|
131
154
|
client_secret: ENV["OAUTH_CLIENT_SECRET"],
|
|
132
155
|
grant_type: "refresh_token",
|
|
@@ -140,7 +163,7 @@ puts payload #=> {"access_token" => "awr23f3h8f9d2h89...", "token_type" => "Bear
|
|
|
140
163
|
##### cURL
|
|
141
164
|
|
|
142
165
|
```
|
|
143
|
-
> curl -H "X-your-auth-scheme: $SERVER_KEY" --data '{"client_id":"$OAUTH_CLIENT_ID","client_secret":"$OAUTH_CLIENT_SECRET","grant_type":"token","token":"2r89hfef4j9f90d2j2390jf390g"}' https://auth_server/
|
|
166
|
+
> curl -H "X-your-auth-scheme: $SERVER_KEY" --data '{"client_id":"$OAUTH_CLIENT_ID","client_secret":"$OAUTH_CLIENT_SECRET","grant_type":"token","token":"2r89hfef4j9f90d2j2390jf390g"}' https://auth_server/token
|
|
144
167
|
```
|
|
145
168
|
|
|
146
169
|
#### Revoking tokens
|
|
@@ -151,7 +174,7 @@ Token revocation can be done both by the idenntity owner or the application owne
|
|
|
151
174
|
require "httpx"
|
|
152
175
|
httpx = HTTPX.plugin(:basic_authorization)
|
|
153
176
|
response = httpx.basic_authentication(ENV["CLIENT_ID"], ENV["CLIENT_SECRET"])
|
|
154
|
-
.post("https://auth_server/
|
|
177
|
+
.post("https://auth_server/revoke",json: {
|
|
155
178
|
token_type_hint: "access_token", # can also be "refresh:tokn"
|
|
156
179
|
token: "2r89hfef4j9f90d2j2390jf390g"
|
|
157
180
|
})
|
|
@@ -163,7 +186,7 @@ puts payload #=> {"access_token" => "awr23f3h8f9d2h89...", "token_type" => "Bear
|
|
|
163
186
|
##### cURL
|
|
164
187
|
|
|
165
188
|
```
|
|
166
|
-
> curl -H "X-your-auth-scheme: $SERVER_KEY" --data '{"client_id":"$OAUTH_CLIENT_ID","token_type_hint":"access_token","token":"2r89hfef4j9f90d2j2390jf390g"}' https://auth_server/
|
|
189
|
+
> curl -H "X-your-auth-scheme: $SERVER_KEY" --data '{"client_id":"$OAUTH_CLIENT_ID","token_type_hint":"access_token","token":"2r89hfef4j9f90d2j2390jf390g"}' https://auth_server/revoke
|
|
167
190
|
```
|
|
168
191
|
|
|
169
192
|
#### Token introspection
|
|
@@ -174,7 +197,7 @@ Token revocation can be used to determine the state of a token (whether active,
|
|
|
174
197
|
require "httpx"
|
|
175
198
|
httpx = HTTPX.plugin(:basic_authorization)
|
|
176
199
|
response = httpx.basic_authentication(ENV["CLIENT_ID"], ENV["CLIENT_SECRET"])
|
|
177
|
-
.post("https://auth_server/
|
|
200
|
+
.post("https://auth_server/introspect",json: {
|
|
178
201
|
token_type_hint: "access_token", # can also be "refresh:tokn"
|
|
179
202
|
token: "2r89hfef4j9f90d2j2390jf390g"
|
|
180
203
|
})
|
|
@@ -186,7 +209,7 @@ puts payload #=> {"active" => true, "scope" => "read write" ....
|
|
|
186
209
|
##### cURL
|
|
187
210
|
|
|
188
211
|
```
|
|
189
|
-
> curl -H "X-your-auth-scheme: $SERVER_KEY" --data '{"client_id":"$OAUTH_CLIENT_ID","token_type_hint":"access_token","token":"2r89hfef4j9f90d2j2390jf390g"}' https://auth_server/
|
|
212
|
+
> curl -H "X-your-auth-scheme: $SERVER_KEY" --data '{"client_id":"$OAUTH_CLIENT_ID","token_type_hint":"access_token","token":"2r89hfef4j9f90d2j2390jf390g"}' https://auth_server/revoke
|
|
190
213
|
```
|
|
191
214
|
|
|
192
215
|
### Authorization Server Metadata
|
|
@@ -243,10 +266,10 @@ The rodauth default setup expects the roda `render` plugin to be activated; by d
|
|
|
243
266
|
|
|
244
267
|
Once you set it up, by default, the following endpoints will be available:
|
|
245
268
|
|
|
246
|
-
* `GET /
|
|
247
|
-
* `POST /
|
|
248
|
-
* `POST /
|
|
249
|
-
* `POST /
|
|
269
|
+
* `GET /authorize`: Loads the OAuth authorization HTML form;
|
|
270
|
+
* `POST /authorize`: Responds to an OAuth authorization request, as [per the spec](https://tools.ietf.org/html/rfc6749#section-4);
|
|
271
|
+
* `POST /token`: Generates OAuth tokens as [per the spec](https://tools.ietf.org/html/rfc6749#section-4.4.2);
|
|
272
|
+
* `POST /revoke`: Revokes OAuth tokens as [per the spec](https://tools.ietf.org/html/rfc7009);
|
|
250
273
|
|
|
251
274
|
### OAuth applications
|
|
252
275
|
|
|
@@ -426,7 +449,7 @@ The "Proof Key for Code Exchange by OAuth Public Clients" (aka PKCE) flow, which
|
|
|
426
449
|
```ruby
|
|
427
450
|
# with httpx
|
|
428
451
|
require "httpx"
|
|
429
|
-
response = HTTPX.post("https://auth_server/
|
|
452
|
+
response = HTTPX.post("https://auth_server/token",json: {
|
|
430
453
|
client_id: ENV["OAUTH_CLIENT_ID"],
|
|
431
454
|
grant_type: "authorization_code",
|
|
432
455
|
code: "oiweicnewdh32fhoi3hf3ihfo2ih3f2o3as",
|
|
@@ -477,7 +500,7 @@ Generating an access token will deliver the following fields:
|
|
|
477
500
|
```ruby
|
|
478
501
|
# with httpx
|
|
479
502
|
require "httpx"
|
|
480
|
-
response = httpx.post("https://auth_server/
|
|
503
|
+
response = httpx.post("https://auth_server/token",json: {
|
|
481
504
|
client_id: env["oauth_client_id"],
|
|
482
505
|
client_secret: env["oauth_client_secret"],
|
|
483
506
|
grant_type: "authorization_code",
|
|
@@ -576,7 +599,7 @@ which adds an extra layer of protection.
|
|
|
576
599
|
|
|
577
600
|
#### JWKS URI
|
|
578
601
|
|
|
579
|
-
A route is defined for getting the JWK Set in a JSON format; this is typically used by client applications, who need the JWK set to decode the JWT token. This URL is typically `https://oauth-server/
|
|
602
|
+
A route is defined for getting the JWK Set in a JSON format; this is typically used by client applications, who need the JWK set to decode the JWT token. This URL is typically `https://oauth-server/jwks`.
|
|
580
603
|
|
|
581
604
|
#### JWT Bearer as authorization grant
|
|
582
605
|
|
|
@@ -585,7 +608,7 @@ One can emit a new access token by using the bearer access token as grant. This
|
|
|
585
608
|
```ruby
|
|
586
609
|
# with httpx
|
|
587
610
|
require "httpx"
|
|
588
|
-
response = httpx.post("https://auth_server/
|
|
611
|
+
response = httpx.post("https://auth_server/token",json: {
|
|
589
612
|
grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
|
|
590
613
|
assertion: "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOjEsImlzcyI6IkV4YW1wbGUiLCJpYXQiOjE1OTIwMDk1MDEsImNsaWVudF9pZCI6IkNMSUVOVF9JRCIsImV4cCI6MTU5MjAxMzEwMSwiYXVkIjpudWxsLCJzY29wZSI6InVzZXIucmVhZCB1c2VyLndyaXRlIiwianRpIjoiOGM1NTVjMjdiOWRjNDdmOTcyNWRkYzBhMjk0NzA1ZTA4NzFkY2JlN2Q5ZTNlMmVkNGE1ZTBiOGZlNTZlYzcxMSJ9.AlxKRtE3ec0mtyBSDx4VseND4eC6cH5ubtv8gfYxxsc"
|
|
591
614
|
})
|
|
@@ -29,7 +29,8 @@ class CreateRodauthOAuth < ActiveRecord::Migration<%= migration_version %>
|
|
|
29
29
|
# uncomment to enable PKCE
|
|
30
30
|
# t.string :code_challenge
|
|
31
31
|
# t.string :code_challenge_method
|
|
32
|
-
|
|
32
|
+
# uncomment to use OIDC nonce
|
|
33
|
+
# t.string :nonce
|
|
33
34
|
t.index(%i[oauth_application_id code], unique: true)
|
|
34
35
|
end
|
|
35
36
|
|
|
@@ -42,18 +43,20 @@ class CreateRodauthOAuth < ActiveRecord::Migration<%= migration_version %>
|
|
|
42
43
|
t.foreign_key :oauth_tokens, column: :oauth_token_id
|
|
43
44
|
t.integer :oauth_application_id
|
|
44
45
|
t.foreign_key :oauth_applications, column: :oauth_application_id
|
|
45
|
-
t.string :token, null: false, token: true
|
|
46
|
+
t.string :token, null: false, token: true, unique: true
|
|
46
47
|
# uncomment if setting oauth_tokens_token_hash_column
|
|
47
48
|
# and delete the token column
|
|
48
|
-
# t.string :token_hash, token: true
|
|
49
|
-
t.string :refresh_token
|
|
49
|
+
# t.string :token_hash, token: true, unique: true
|
|
50
|
+
t.string :refresh_token, unique: true
|
|
50
51
|
# uncomment if setting oauth_tokens_refresh_token_hash_column
|
|
51
52
|
# and delete the refresh_token column
|
|
52
|
-
# t.string :refresh_token_hash, token: true
|
|
53
|
+
# t.string :refresh_token_hash, token: true, unique: true
|
|
53
54
|
t.datetime :expires_in, null: false
|
|
54
55
|
t.datetime :revoked_at
|
|
55
56
|
t.string :scopes, null: false
|
|
56
57
|
t.datetime :created_at, null: false, default: -> { "CURRENT_TIMESTAMP" }
|
|
58
|
+
# uncomment to use OIDC nonce
|
|
59
|
+
# t.string :nonce
|
|
57
60
|
end
|
|
58
61
|
end
|
|
59
62
|
end
|
|
@@ -1,16 +1,21 @@
|
|
|
1
1
|
# frozen-string-literal: true
|
|
2
2
|
|
|
3
|
+
require "time"
|
|
3
4
|
require "base64"
|
|
4
5
|
require "securerandom"
|
|
5
6
|
require "net/http"
|
|
6
7
|
|
|
7
8
|
require "rodauth/oauth/ttl_store"
|
|
9
|
+
require "rodauth/oauth/database_extensions"
|
|
8
10
|
|
|
9
11
|
module Rodauth
|
|
10
12
|
Feature.define(:oauth) do
|
|
11
13
|
# RUBY EXTENSIONS
|
|
12
|
-
# :nocov:
|
|
13
14
|
unless Regexp.method_defined?(:match?)
|
|
15
|
+
# If you wonder why this is there: the oauth feature uses a refinement to enhance the
|
|
16
|
+
# Regexp class locally with #match? , but this is never tested, because ActiveSupport
|
|
17
|
+
# monkey-patches the same method... Please ActiveSupport, stop being so intrusive!
|
|
18
|
+
# :nocov:
|
|
14
19
|
module RegexpExtensions
|
|
15
20
|
refine(Regexp) do
|
|
16
21
|
def match?(*args)
|
|
@@ -19,6 +24,7 @@ module Rodauth
|
|
|
19
24
|
end
|
|
20
25
|
end
|
|
21
26
|
using(RegexpExtensions)
|
|
27
|
+
# :nocov:
|
|
22
28
|
end
|
|
23
29
|
|
|
24
30
|
unless String.method_defined?(:delete_suffix!)
|
|
@@ -37,13 +43,13 @@ module Rodauth
|
|
|
37
43
|
end
|
|
38
44
|
using(SuffixExtensions)
|
|
39
45
|
end
|
|
40
|
-
# :nocov:
|
|
41
46
|
|
|
42
47
|
SCOPES = %w[profile.read].freeze
|
|
43
48
|
|
|
49
|
+
SERVER_METADATA = OAuth::TtlStore.new
|
|
50
|
+
|
|
44
51
|
before "authorize"
|
|
45
52
|
after "authorize"
|
|
46
|
-
after "authorize_failure"
|
|
47
53
|
|
|
48
54
|
before "token"
|
|
49
55
|
|
|
@@ -55,15 +61,13 @@ module Rodauth
|
|
|
55
61
|
before "create_oauth_application"
|
|
56
62
|
after "create_oauth_application"
|
|
57
63
|
|
|
58
|
-
error_flash "OAuth Authorization invalid parameters", "oauth_grant_valid_parameters"
|
|
59
|
-
|
|
60
64
|
error_flash "Please authorize to continue", "require_authorization"
|
|
61
65
|
error_flash "There was an error registering your oauth application", "create_oauth_application"
|
|
62
66
|
notice_flash "Your oauth application has been registered", "create_oauth_application"
|
|
63
67
|
|
|
64
68
|
notice_flash "The oauth token has been revoked", "revoke_oauth_token"
|
|
65
69
|
|
|
66
|
-
view "
|
|
70
|
+
view "authorize", "Authorize", "authorize"
|
|
67
71
|
view "oauth_applications", "Oauth Applications", "oauth_applications"
|
|
68
72
|
view "oauth_application", "Oauth Application", "oauth_application"
|
|
69
73
|
view "new_oauth_application", "New Oauth Application", "new_oauth_application"
|
|
@@ -73,14 +77,16 @@ module Rodauth
|
|
|
73
77
|
|
|
74
78
|
auth_value_method :oauth_grant_expires_in, 60 * 5 # 5 minutes
|
|
75
79
|
auth_value_method :oauth_token_expires_in, 60 * 60 # 60 minutes
|
|
80
|
+
auth_value_method :oauth_refresh_token_expires_in, 60 * 60 * 24 * 360 # 1 year
|
|
76
81
|
auth_value_method :use_oauth_implicit_grant_type?, false
|
|
77
82
|
auth_value_method :use_oauth_pkce?, true
|
|
78
83
|
auth_value_method :use_oauth_access_type?, true
|
|
79
84
|
|
|
80
85
|
auth_value_method :oauth_require_pkce, false
|
|
81
86
|
auth_value_method :oauth_pkce_challenge_method, "S256"
|
|
87
|
+
auth_value_method :oauth_response_mode, "query"
|
|
82
88
|
|
|
83
|
-
auth_value_method :oauth_valid_uri_schemes, %w[
|
|
89
|
+
auth_value_method :oauth_valid_uri_schemes, %w[https]
|
|
84
90
|
|
|
85
91
|
auth_value_method :oauth_scope_separator, " "
|
|
86
92
|
|
|
@@ -95,6 +101,7 @@ module Rodauth
|
|
|
95
101
|
button "Register", "oauth_application"
|
|
96
102
|
button "Authorize", "oauth_authorize"
|
|
97
103
|
button "Revoke", "oauth_token_revoke"
|
|
104
|
+
button "Back to Client Application", "oauth_authorize_post"
|
|
98
105
|
|
|
99
106
|
# OAuth Token
|
|
100
107
|
auth_value_method :oauth_tokens_path, "oauth-tokens"
|
|
@@ -113,6 +120,8 @@ module Rodauth
|
|
|
113
120
|
auth_value_method :oauth_tokens_token_hash_column, nil
|
|
114
121
|
auth_value_method :oauth_tokens_refresh_token_hash_column, nil
|
|
115
122
|
|
|
123
|
+
# Access Token reuse
|
|
124
|
+
auth_value_method :oauth_reuse_access_token, false
|
|
116
125
|
# OAuth Grants
|
|
117
126
|
auth_value_method :oauth_grants_table, :oauth_grants
|
|
118
127
|
auth_value_method :oauth_grants_id_column, :id
|
|
@@ -127,6 +136,7 @@ module Rodauth
|
|
|
127
136
|
|
|
128
137
|
auth_value_method :authorization_required_error_status, 401
|
|
129
138
|
auth_value_method :invalid_oauth_response_status, 400
|
|
139
|
+
auth_value_method :already_in_use_response_status, 409
|
|
130
140
|
|
|
131
141
|
# OAuth Applications
|
|
132
142
|
auth_value_method :oauth_applications_path, "oauth-applications"
|
|
@@ -144,13 +154,13 @@ module Rodauth
|
|
|
144
154
|
auth_value_method :"oauth_applications_#{column}_column", column
|
|
145
155
|
end
|
|
146
156
|
|
|
157
|
+
# Feature options
|
|
147
158
|
auth_value_method :oauth_application_default_scope, SCOPES.first
|
|
148
159
|
auth_value_method :oauth_application_scopes, SCOPES
|
|
149
160
|
auth_value_method :oauth_token_type, "bearer"
|
|
161
|
+
auth_value_method :oauth_refresh_token_protection_policy, "none" # can be: none, sender_constrained, rotation
|
|
150
162
|
|
|
151
|
-
auth_value_method :
|
|
152
|
-
auth_value_method :invalid_client, "Invalid client"
|
|
153
|
-
auth_value_method :unauthorized_client, "Unauthorized client"
|
|
163
|
+
auth_value_method :invalid_client_message, "Invalid client"
|
|
154
164
|
auth_value_method :invalid_grant_type_message, "Invalid grant type"
|
|
155
165
|
auth_value_method :invalid_grant_message, "Invalid grant"
|
|
156
166
|
auth_value_method :invalid_scope_message, "Invalid scope"
|
|
@@ -160,6 +170,8 @@ module Rodauth
|
|
|
160
170
|
|
|
161
171
|
auth_value_method :unique_error_message, "is already in use"
|
|
162
172
|
auth_value_method :null_error_message, "is not filled"
|
|
173
|
+
auth_value_method :already_in_use_message, "error generating unique token"
|
|
174
|
+
auth_value_method :already_in_use_error_code, "invalid_request"
|
|
163
175
|
|
|
164
176
|
# PKCE
|
|
165
177
|
auth_value_method :code_challenge_required_error_code, "invalid_request"
|
|
@@ -177,6 +189,8 @@ module Rodauth
|
|
|
177
189
|
# Only required to use if the plugin is to be used in a resource server
|
|
178
190
|
auth_value_method :is_authorization_server?, true
|
|
179
191
|
|
|
192
|
+
auth_value_method :oauth_unique_id_generation_retries, 3
|
|
193
|
+
|
|
180
194
|
auth_value_methods(
|
|
181
195
|
:fetch_access_token,
|
|
182
196
|
:oauth_unique_id_generator,
|
|
@@ -184,22 +198,231 @@ module Rodauth
|
|
|
184
198
|
:secret_hash,
|
|
185
199
|
:generate_token_hash,
|
|
186
200
|
:authorization_server_url,
|
|
187
|
-
:before_introspection_request
|
|
201
|
+
:before_introspection_request,
|
|
202
|
+
:require_authorizable_account,
|
|
203
|
+
:oauth_tokens_unique_columns
|
|
188
204
|
)
|
|
189
205
|
|
|
190
206
|
auth_value_methods(:only_json?)
|
|
191
207
|
|
|
192
208
|
auth_value_method :json_request_regexp, %r{\bapplication/(?:vnd\.api\+)?json\b}i
|
|
193
209
|
|
|
194
|
-
|
|
210
|
+
# /token
|
|
211
|
+
route(:token) do |r|
|
|
212
|
+
next unless is_authorization_server?
|
|
213
|
+
|
|
214
|
+
before_token_route
|
|
215
|
+
require_oauth_application
|
|
216
|
+
|
|
217
|
+
r.post do
|
|
218
|
+
catch_error do
|
|
219
|
+
validate_oauth_token_params
|
|
220
|
+
|
|
221
|
+
oauth_token = nil
|
|
222
|
+
transaction do
|
|
223
|
+
before_token
|
|
224
|
+
oauth_token = create_oauth_token
|
|
225
|
+
end
|
|
226
|
+
|
|
227
|
+
json_response_success(json_access_token_payload(oauth_token))
|
|
228
|
+
end
|
|
229
|
+
|
|
230
|
+
throw_json_response_error(invalid_oauth_response_status, "invalid_request")
|
|
231
|
+
end
|
|
232
|
+
end
|
|
233
|
+
|
|
234
|
+
# /introspect
|
|
235
|
+
route(:introspect) do |r|
|
|
236
|
+
next unless is_authorization_server?
|
|
237
|
+
|
|
238
|
+
before_introspect_route
|
|
239
|
+
|
|
240
|
+
r.post do
|
|
241
|
+
catch_error do
|
|
242
|
+
validate_oauth_introspect_params
|
|
243
|
+
|
|
244
|
+
before_introspect
|
|
245
|
+
oauth_token = case param("token_type_hint")
|
|
246
|
+
when "access_token"
|
|
247
|
+
oauth_token_by_token(param("token"))
|
|
248
|
+
when "refresh_token"
|
|
249
|
+
oauth_token_by_refresh_token(param("token"))
|
|
250
|
+
else
|
|
251
|
+
oauth_token_by_token(param("token")) || oauth_token_by_refresh_token(param("token"))
|
|
252
|
+
end
|
|
253
|
+
|
|
254
|
+
if oauth_application
|
|
255
|
+
redirect_response_error("invalid_request") if oauth_token && !token_from_application?(oauth_token, oauth_application)
|
|
256
|
+
elsif oauth_token
|
|
257
|
+
@oauth_application = db[oauth_applications_table].where(oauth_applications_id_column =>
|
|
258
|
+
oauth_token[oauth_tokens_oauth_application_id_column]).first
|
|
259
|
+
end
|
|
260
|
+
|
|
261
|
+
json_response_success(json_token_introspect_payload(oauth_token))
|
|
262
|
+
end
|
|
263
|
+
|
|
264
|
+
throw_json_response_error(invalid_oauth_response_status, "invalid_request")
|
|
265
|
+
end
|
|
266
|
+
end
|
|
267
|
+
|
|
268
|
+
# /revoke
|
|
269
|
+
route(:revoke) do |r|
|
|
270
|
+
next unless is_authorization_server?
|
|
271
|
+
|
|
272
|
+
before_revoke_route
|
|
273
|
+
require_oauth_application
|
|
274
|
+
|
|
275
|
+
r.post do
|
|
276
|
+
catch_error do
|
|
277
|
+
validate_oauth_revoke_params
|
|
278
|
+
|
|
279
|
+
oauth_token = nil
|
|
280
|
+
transaction do
|
|
281
|
+
before_revoke
|
|
282
|
+
oauth_token = revoke_oauth_token
|
|
283
|
+
after_revoke
|
|
284
|
+
end
|
|
285
|
+
|
|
286
|
+
if accepts_json?
|
|
287
|
+
json_response_success \
|
|
288
|
+
"token" => oauth_token[oauth_tokens_token_column],
|
|
289
|
+
"refresh_token" => oauth_token[oauth_tokens_refresh_token_column],
|
|
290
|
+
"revoked_at" => convert_timestamp(oauth_token[oauth_tokens_revoked_at_column])
|
|
291
|
+
else
|
|
292
|
+
set_notice_flash revoke_oauth_token_notice_flash
|
|
293
|
+
redirect request.referer || "/"
|
|
294
|
+
end
|
|
295
|
+
end
|
|
296
|
+
|
|
297
|
+
redirect_response_error("invalid_request", request.referer || "/")
|
|
298
|
+
end
|
|
299
|
+
end
|
|
300
|
+
|
|
301
|
+
# /authorize
|
|
302
|
+
route(:authorize) do |r|
|
|
303
|
+
next unless is_authorization_server?
|
|
304
|
+
|
|
305
|
+
before_authorize_route
|
|
306
|
+
require_authorizable_account
|
|
307
|
+
|
|
308
|
+
validate_oauth_grant_params
|
|
309
|
+
try_approval_prompt if use_oauth_access_type? && request.get?
|
|
310
|
+
|
|
311
|
+
r.get do
|
|
312
|
+
authorize_view
|
|
313
|
+
end
|
|
314
|
+
|
|
315
|
+
r.post do
|
|
316
|
+
redirect_url = URI.parse(redirect_uri)
|
|
317
|
+
|
|
318
|
+
params, mode = transaction do
|
|
319
|
+
before_authorize
|
|
320
|
+
do_authorize
|
|
321
|
+
end
|
|
322
|
+
|
|
323
|
+
case mode
|
|
324
|
+
when "query"
|
|
325
|
+
params = params.map { |k, v| "#{k}=#{v}" }
|
|
326
|
+
params << redirect_url.query if redirect_url.query
|
|
327
|
+
redirect_url.query = params.join("&")
|
|
328
|
+
redirect(redirect_url.to_s)
|
|
329
|
+
when "fragment"
|
|
330
|
+
params = params.map { |k, v| "#{k}=#{v}" }
|
|
331
|
+
params << redirect_url.query if redirect_url.query
|
|
332
|
+
redirect_url.fragment = params.join("&")
|
|
333
|
+
redirect(redirect_url.to_s)
|
|
334
|
+
when "form_post"
|
|
335
|
+
scope.view layout: false, inline: <<-FORM
|
|
336
|
+
<html>
|
|
337
|
+
<head><title>Authorized</title></head>
|
|
338
|
+
<body onload="javascript:document.forms[0].submit()">
|
|
339
|
+
<form method="post" action="#{redirect_uri}">
|
|
340
|
+
#{
|
|
341
|
+
params.map do |name, value|
|
|
342
|
+
"<input type=\"hidden\" name=\"#{name}\" value=\"#{scope.h(value)}\" />"
|
|
343
|
+
end.join
|
|
344
|
+
}
|
|
345
|
+
<input type="submit" class="btn btn-outline-primary" value="#{scope.h(oauth_authorize_post_button)}"/>
|
|
346
|
+
</form>
|
|
347
|
+
</body>
|
|
348
|
+
</html>
|
|
349
|
+
FORM
|
|
350
|
+
when "none"
|
|
351
|
+
redirect(redirect_url.to_s)
|
|
352
|
+
end
|
|
353
|
+
end
|
|
354
|
+
end
|
|
355
|
+
|
|
356
|
+
def oauth_server_metadata(issuer = nil)
|
|
357
|
+
request.on(".well-known") do
|
|
358
|
+
request.on("oauth-authorization-server") do
|
|
359
|
+
request.get do
|
|
360
|
+
json_response_success(oauth_server_metadata_body(issuer), true)
|
|
361
|
+
end
|
|
362
|
+
end
|
|
363
|
+
end
|
|
364
|
+
end
|
|
365
|
+
|
|
366
|
+
# /oauth-applications routes
|
|
367
|
+
def oauth_applications
|
|
368
|
+
request.on(oauth_applications_path) do
|
|
369
|
+
require_account
|
|
370
|
+
|
|
371
|
+
request.get "new" do
|
|
372
|
+
new_oauth_application_view
|
|
373
|
+
end
|
|
374
|
+
|
|
375
|
+
request.on(oauth_applications_id_pattern) do |id|
|
|
376
|
+
oauth_application = db[oauth_applications_table].where(oauth_applications_id_column => id).first
|
|
377
|
+
next unless oauth_application
|
|
378
|
+
|
|
379
|
+
scope.instance_variable_set(:@oauth_application, oauth_application)
|
|
380
|
+
|
|
381
|
+
request.is do
|
|
382
|
+
request.get do
|
|
383
|
+
oauth_application_view
|
|
384
|
+
end
|
|
385
|
+
end
|
|
386
|
+
|
|
387
|
+
request.on(oauth_tokens_path) do
|
|
388
|
+
oauth_tokens = db[oauth_tokens_table].where(oauth_tokens_oauth_application_id_column => id)
|
|
389
|
+
scope.instance_variable_set(:@oauth_tokens, oauth_tokens)
|
|
390
|
+
request.get do
|
|
391
|
+
oauth_tokens_view
|
|
392
|
+
end
|
|
393
|
+
end
|
|
394
|
+
end
|
|
395
|
+
|
|
396
|
+
request.get do
|
|
397
|
+
scope.instance_variable_set(:@oauth_applications, db[oauth_applications_table])
|
|
398
|
+
oauth_applications_view
|
|
399
|
+
end
|
|
400
|
+
|
|
401
|
+
request.post do
|
|
402
|
+
catch_error do
|
|
403
|
+
validate_oauth_application_params
|
|
404
|
+
|
|
405
|
+
transaction do
|
|
406
|
+
before_create_oauth_application
|
|
407
|
+
id = create_oauth_application
|
|
408
|
+
after_create_oauth_application
|
|
409
|
+
set_notice_flash create_oauth_application_notice_flash
|
|
410
|
+
redirect "#{request.path}/#{id}"
|
|
411
|
+
end
|
|
412
|
+
end
|
|
413
|
+
set_error_flash create_oauth_application_error_flash
|
|
414
|
+
new_oauth_application_view
|
|
415
|
+
end
|
|
416
|
+
end
|
|
417
|
+
end
|
|
195
418
|
|
|
196
419
|
def check_csrf?
|
|
197
420
|
case request.path
|
|
198
|
-
when
|
|
421
|
+
when token_path, introspect_path
|
|
199
422
|
false
|
|
200
|
-
when
|
|
423
|
+
when revoke_path
|
|
201
424
|
!json_request?
|
|
202
|
-
when
|
|
425
|
+
when authorize_path, %r{/#{oauth_applications_path}}
|
|
203
426
|
only_json? ? false : super
|
|
204
427
|
else
|
|
205
428
|
super
|
|
@@ -218,14 +441,12 @@ module Rodauth
|
|
|
218
441
|
end
|
|
219
442
|
|
|
220
443
|
unless method_defined?(:json_request?)
|
|
221
|
-
# :nocov:
|
|
222
444
|
# copied from the jwt feature
|
|
223
445
|
def json_request?
|
|
224
446
|
return @json_request if defined?(@json_request)
|
|
225
447
|
|
|
226
448
|
@json_request = request.content_type =~ json_request_regexp
|
|
227
449
|
end
|
|
228
|
-
# :nocov:
|
|
229
450
|
end
|
|
230
451
|
|
|
231
452
|
def initialize(scope)
|
|
@@ -233,7 +454,15 @@ module Rodauth
|
|
|
233
454
|
end
|
|
234
455
|
|
|
235
456
|
def scopes
|
|
236
|
-
|
|
457
|
+
scope = request.params["scope"]
|
|
458
|
+
case scope
|
|
459
|
+
when Array
|
|
460
|
+
scope
|
|
461
|
+
when String
|
|
462
|
+
scope.split(" ")
|
|
463
|
+
when nil
|
|
464
|
+
[oauth_application_default_scope]
|
|
465
|
+
end
|
|
237
466
|
end
|
|
238
467
|
|
|
239
468
|
def redirect_uri
|
|
@@ -260,12 +489,14 @@ module Rodauth
|
|
|
260
489
|
def fetch_access_token
|
|
261
490
|
value = request.env["HTTP_AUTHORIZATION"]
|
|
262
491
|
|
|
263
|
-
return unless value
|
|
492
|
+
return unless value && !value.empty?
|
|
264
493
|
|
|
265
494
|
scheme, token = value.split(" ", 2)
|
|
266
495
|
|
|
267
496
|
return unless scheme.downcase == oauth_token_type
|
|
268
497
|
|
|
498
|
+
return if token.nil? || token.empty?
|
|
499
|
+
|
|
269
500
|
token
|
|
270
501
|
end
|
|
271
502
|
|
|
@@ -277,101 +508,79 @@ module Rodauth
|
|
|
277
508
|
|
|
278
509
|
return unless bearer_token
|
|
279
510
|
|
|
280
|
-
|
|
281
|
-
|
|
282
|
-
|
|
511
|
+
@authorization_token = if is_authorization_server?
|
|
512
|
+
# check if token has not expired
|
|
513
|
+
# check if token has been revoked
|
|
514
|
+
oauth_token_by_token(bearer_token)
|
|
515
|
+
else
|
|
516
|
+
# where in resource server, NOT the authorization server.
|
|
517
|
+
payload = introspection_request("access_token", bearer_token)
|
|
518
|
+
|
|
519
|
+
return unless payload["active"]
|
|
520
|
+
|
|
521
|
+
payload
|
|
522
|
+
end
|
|
283
523
|
end
|
|
284
524
|
|
|
285
525
|
def require_oauth_authorization(*scopes)
|
|
286
|
-
|
|
287
|
-
authorization_required unless authorization_token
|
|
526
|
+
authorization_required unless authorization_token
|
|
288
527
|
|
|
289
|
-
|
|
528
|
+
scopes << oauth_application_default_scope if scopes.empty?
|
|
290
529
|
|
|
530
|
+
token_scopes = if is_authorization_server?
|
|
291
531
|
authorization_token[oauth_tokens_scopes_column].split(oauth_scope_separator)
|
|
292
532
|
else
|
|
293
|
-
|
|
294
|
-
|
|
295
|
-
|
|
296
|
-
|
|
297
|
-
|
|
298
|
-
|
|
299
|
-
# where in resource server, NOT the authorization server.
|
|
300
|
-
payload = introspection_request("access_token", bearer_token)
|
|
301
|
-
|
|
302
|
-
authorization_required unless payload["active"]
|
|
303
|
-
|
|
304
|
-
payload["scope"].split(oauth_scope_separator)
|
|
533
|
+
aux_scopes = authorization_token["scope"]
|
|
534
|
+
if aux_scopes
|
|
535
|
+
aux_scopes.split(oauth_scope_separator)
|
|
536
|
+
else
|
|
537
|
+
[]
|
|
538
|
+
end
|
|
305
539
|
end
|
|
306
540
|
|
|
307
541
|
authorization_required unless scopes.any? { |scope| token_scopes.include?(scope) }
|
|
308
542
|
end
|
|
309
543
|
|
|
310
|
-
|
|
311
|
-
|
|
312
|
-
|
|
313
|
-
require_account
|
|
314
|
-
|
|
315
|
-
request.get "new" do
|
|
316
|
-
new_oauth_application_view
|
|
317
|
-
end
|
|
318
|
-
|
|
319
|
-
request.on(oauth_applications_id_pattern) do |id|
|
|
320
|
-
oauth_application = db[oauth_applications_table].where(oauth_applications_id_column => id).first
|
|
321
|
-
next unless oauth_application
|
|
322
|
-
|
|
323
|
-
scope.instance_variable_set(:@oauth_application, oauth_application)
|
|
544
|
+
def post_configure
|
|
545
|
+
super
|
|
546
|
+
self.class.__send__(:include, Rodauth::OAuth::ExtendDatabase(db))
|
|
324
547
|
|
|
325
|
-
|
|
326
|
-
|
|
327
|
-
|
|
328
|
-
|
|
329
|
-
|
|
330
|
-
|
|
331
|
-
request.on(oauth_tokens_path) do
|
|
332
|
-
oauth_tokens = db[oauth_tokens_table].where(oauth_tokens_oauth_application_id_column => id)
|
|
333
|
-
scope.instance_variable_set(:@oauth_tokens, oauth_tokens)
|
|
334
|
-
request.get do
|
|
335
|
-
oauth_tokens_view
|
|
336
|
-
end
|
|
337
|
-
end
|
|
548
|
+
# Check whether we can reutilize db entries for the same account / application pair
|
|
549
|
+
one_oauth_token_per_account = begin
|
|
550
|
+
db.indexes(oauth_tokens_table).values.any? do |definition|
|
|
551
|
+
definition[:unique] &&
|
|
552
|
+
definition[:columns] == oauth_tokens_unique_columns
|
|
338
553
|
end
|
|
554
|
+
end
|
|
555
|
+
self.class.send(:define_method, :__one_oauth_token_per_account) { one_oauth_token_per_account }
|
|
556
|
+
end
|
|
339
557
|
|
|
340
|
-
|
|
341
|
-
|
|
342
|
-
|
|
343
|
-
end
|
|
558
|
+
def use_date_arithmetic?
|
|
559
|
+
true
|
|
560
|
+
end
|
|
344
561
|
|
|
345
|
-
|
|
346
|
-
catch_error do
|
|
347
|
-
validate_oauth_application_params
|
|
562
|
+
private
|
|
348
563
|
|
|
349
|
-
|
|
350
|
-
|
|
351
|
-
|
|
352
|
-
|
|
353
|
-
|
|
354
|
-
|
|
355
|
-
|
|
356
|
-
|
|
357
|
-
set_error_flash create_oauth_application_error_flash
|
|
358
|
-
new_oauth_application_view
|
|
359
|
-
end
|
|
564
|
+
def rescue_from_uniqueness_error(&block)
|
|
565
|
+
retries = oauth_unique_id_generation_retries
|
|
566
|
+
begin
|
|
567
|
+
transaction(savepoint: :only, &block)
|
|
568
|
+
rescue Sequel::UniqueConstraintViolation
|
|
569
|
+
redirect_response_error("already_in_use") if retries.zero?
|
|
570
|
+
retries -= 1
|
|
571
|
+
retry
|
|
360
572
|
end
|
|
361
573
|
end
|
|
362
574
|
|
|
363
|
-
|
|
364
|
-
|
|
365
|
-
|
|
366
|
-
|
|
367
|
-
|
|
368
|
-
|
|
369
|
-
|
|
370
|
-
end
|
|
575
|
+
# OAuth Token Unique/Reuse
|
|
576
|
+
def oauth_tokens_unique_columns
|
|
577
|
+
[
|
|
578
|
+
oauth_tokens_oauth_application_id_column,
|
|
579
|
+
oauth_tokens_account_id_column,
|
|
580
|
+
oauth_tokens_scopes_column
|
|
581
|
+
]
|
|
371
582
|
end
|
|
372
583
|
|
|
373
|
-
private
|
|
374
|
-
|
|
375
584
|
def authorization_server_url
|
|
376
585
|
base_url
|
|
377
586
|
end
|
|
@@ -394,10 +603,10 @@ module Rodauth
|
|
|
394
603
|
|
|
395
604
|
# time-to-live
|
|
396
605
|
ttl = if response.key?("cache-control")
|
|
397
|
-
cache_control = response["
|
|
398
|
-
cache_control[/max-age=(\d+)/, 1]
|
|
606
|
+
cache_control = response["cache-control"]
|
|
607
|
+
cache_control[/max-age=(\d+)/, 1].to_i
|
|
399
608
|
elsif response.key?("expires")
|
|
400
|
-
Time.
|
|
609
|
+
Time.parse(response["expires"]).to_i - Time.now.to_i
|
|
401
610
|
end
|
|
402
611
|
|
|
403
612
|
[JSON.parse(response.body, symbolize_names: true), ttl]
|
|
@@ -409,7 +618,7 @@ module Rodauth
|
|
|
409
618
|
http = Net::HTTP.new(auth_url.host, auth_url.port)
|
|
410
619
|
http.use_ssl = auth_url.scheme == "https"
|
|
411
620
|
|
|
412
|
-
request = Net::HTTP::Post.new(
|
|
621
|
+
request = Net::HTTP::Post.new(introspect_path)
|
|
413
622
|
request["content-type"] = json_response_content_type
|
|
414
623
|
request["accept"] = json_response_content_type
|
|
415
624
|
request.body = JSON.dump({ "token_type_hint" => token_type_hint, "token" => token })
|
|
@@ -465,7 +674,7 @@ module Rodauth
|
|
|
465
674
|
end
|
|
466
675
|
|
|
467
676
|
def oauth_unique_id_generator
|
|
468
|
-
SecureRandom.
|
|
677
|
+
SecureRandom.urlsafe_base64(32)
|
|
469
678
|
end
|
|
470
679
|
|
|
471
680
|
def generate_token_hash(token)
|
|
@@ -477,89 +686,106 @@ module Rodauth
|
|
|
477
686
|
end
|
|
478
687
|
|
|
479
688
|
unless method_defined?(:password_hash)
|
|
480
|
-
# :nocov:
|
|
481
689
|
# From login_requirements_base feature
|
|
482
|
-
if ENV["RACK_ENV"] == "test"
|
|
483
|
-
def password_hash_cost
|
|
484
|
-
BCrypt::Engine::MIN_COST
|
|
485
|
-
end
|
|
486
|
-
else
|
|
487
|
-
def password_hash_cost
|
|
488
|
-
BCrypt::Engine::DEFAULT_COST
|
|
489
|
-
end
|
|
490
|
-
end
|
|
491
690
|
|
|
492
691
|
def password_hash(password)
|
|
493
|
-
BCrypt::Password.create(password, cost:
|
|
692
|
+
BCrypt::Password.create(password, cost: BCrypt::Engine::DEFAULT_COST)
|
|
494
693
|
end
|
|
495
|
-
# :nocov:
|
|
496
694
|
end
|
|
497
695
|
|
|
498
696
|
def generate_oauth_token(params = {}, should_generate_refresh_token = true)
|
|
499
697
|
create_params = {
|
|
500
|
-
oauth_grants_expires_in_column =>
|
|
698
|
+
oauth_grants_expires_in_column => Sequel.date_add(Sequel::CURRENT_TIMESTAMP, seconds: oauth_token_expires_in)
|
|
501
699
|
}.merge(params)
|
|
502
700
|
|
|
503
|
-
|
|
504
|
-
|
|
701
|
+
rescue_from_uniqueness_error do
|
|
702
|
+
token = oauth_unique_id_generator
|
|
505
703
|
|
|
506
|
-
|
|
507
|
-
|
|
508
|
-
|
|
509
|
-
|
|
510
|
-
|
|
704
|
+
if oauth_tokens_token_hash_column
|
|
705
|
+
create_params[oauth_tokens_token_hash_column] = generate_token_hash(token)
|
|
706
|
+
else
|
|
707
|
+
create_params[oauth_tokens_token_column] = token
|
|
708
|
+
end
|
|
511
709
|
|
|
512
|
-
|
|
513
|
-
|
|
710
|
+
refresh_token = nil
|
|
711
|
+
if should_generate_refresh_token
|
|
712
|
+
refresh_token = oauth_unique_id_generator
|
|
514
713
|
|
|
515
|
-
|
|
516
|
-
|
|
517
|
-
|
|
518
|
-
|
|
714
|
+
if oauth_tokens_refresh_token_hash_column
|
|
715
|
+
create_params[oauth_tokens_refresh_token_hash_column] = generate_token_hash(refresh_token)
|
|
716
|
+
else
|
|
717
|
+
create_params[oauth_tokens_refresh_token_column] = refresh_token
|
|
718
|
+
end
|
|
519
719
|
end
|
|
720
|
+
oauth_token = _generate_oauth_token(create_params)
|
|
721
|
+
oauth_token[oauth_tokens_token_column] = token
|
|
722
|
+
oauth_token[oauth_tokens_refresh_token_column] = refresh_token if refresh_token
|
|
723
|
+
oauth_token
|
|
520
724
|
end
|
|
521
|
-
oauth_token = _generate_oauth_token(create_params)
|
|
522
|
-
|
|
523
|
-
oauth_token[oauth_tokens_token_column] = token
|
|
524
|
-
oauth_token[oauth_tokens_refresh_token_column] = refresh_token if refresh_token
|
|
525
|
-
oauth_token
|
|
526
725
|
end
|
|
527
726
|
|
|
528
727
|
def _generate_oauth_token(params = {})
|
|
529
728
|
ds = db[oauth_tokens_table]
|
|
530
729
|
|
|
531
|
-
|
|
532
|
-
|
|
533
|
-
|
|
534
|
-
|
|
535
|
-
|
|
536
|
-
|
|
730
|
+
if __one_oauth_token_per_account
|
|
731
|
+
|
|
732
|
+
token = __insert_or_update_and_return__(
|
|
733
|
+
ds,
|
|
734
|
+
oauth_tokens_id_column,
|
|
735
|
+
oauth_tokens_unique_columns,
|
|
736
|
+
params,
|
|
737
|
+
Sequel.expr(Sequel[oauth_tokens_table][oauth_tokens_expires_in_column]) > Sequel::CURRENT_TIMESTAMP,
|
|
738
|
+
([oauth_tokens_token_column, oauth_tokens_refresh_token_column] if oauth_reuse_access_token)
|
|
739
|
+
)
|
|
740
|
+
|
|
741
|
+
# if the previous operation didn't return a row, it means that the conditions
|
|
742
|
+
# invalidated the update, and the existing token is still valid.
|
|
743
|
+
token || ds.where(
|
|
744
|
+
oauth_tokens_account_id_column => params[oauth_tokens_account_id_column],
|
|
745
|
+
oauth_tokens_oauth_application_id_column => params[oauth_tokens_oauth_application_id_column]
|
|
746
|
+
).first
|
|
747
|
+
else
|
|
748
|
+
if oauth_reuse_access_token
|
|
749
|
+
unique_conds = Hash[oauth_tokens_unique_columns.map { |column| [column, params[column]] }]
|
|
750
|
+
valid_token = ds.where(Sequel.expr(Sequel[oauth_tokens_table][oauth_tokens_expires_in_column]) > Sequel::CURRENT_TIMESTAMP)
|
|
751
|
+
.where(unique_conds).first
|
|
752
|
+
return valid_token if valid_token
|
|
537
753
|
end
|
|
538
|
-
|
|
539
|
-
retry
|
|
754
|
+
__insert_and_return__(ds, oauth_tokens_id_column, params)
|
|
540
755
|
end
|
|
541
756
|
end
|
|
542
757
|
|
|
543
|
-
def oauth_token_by_token(token
|
|
758
|
+
def oauth_token_by_token(token)
|
|
759
|
+
ds = db[oauth_tokens_table]
|
|
760
|
+
|
|
544
761
|
ds = if oauth_tokens_token_hash_column
|
|
545
|
-
|
|
762
|
+
ds.where(oauth_tokens_token_hash_column => generate_token_hash(token))
|
|
546
763
|
else
|
|
547
|
-
|
|
764
|
+
ds.where(oauth_tokens_token_column => token)
|
|
548
765
|
end
|
|
549
766
|
|
|
550
767
|
ds.where(Sequel[oauth_tokens_expires_in_column] >= Sequel::CURRENT_TIMESTAMP)
|
|
551
768
|
.where(oauth_tokens_revoked_at_column => nil).first
|
|
552
769
|
end
|
|
553
770
|
|
|
554
|
-
def oauth_token_by_refresh_token(token,
|
|
771
|
+
def oauth_token_by_refresh_token(token, revoked: false)
|
|
772
|
+
ds = db[oauth_tokens_table]
|
|
773
|
+
#
|
|
774
|
+
# filter expired refresh tokens out.
|
|
775
|
+
# an expired refresh token is a token whose access token expired for a period longer than the
|
|
776
|
+
# refresh token expiration period.
|
|
777
|
+
#
|
|
778
|
+
ds = ds.where(Sequel.date_add(oauth_tokens_expires_in_column, seconds: oauth_refresh_token_expires_in) >= Sequel::CURRENT_TIMESTAMP)
|
|
779
|
+
|
|
555
780
|
ds = if oauth_tokens_refresh_token_hash_column
|
|
556
|
-
|
|
781
|
+
ds.where(oauth_tokens_refresh_token_hash_column => generate_token_hash(token))
|
|
557
782
|
else
|
|
558
|
-
|
|
783
|
+
ds.where(oauth_tokens_refresh_token_column => token)
|
|
559
784
|
end
|
|
560
785
|
|
|
561
|
-
ds.where(
|
|
562
|
-
|
|
786
|
+
ds = ds.where(oauth_tokens_revoked_at_column => nil) unless revoked
|
|
787
|
+
|
|
788
|
+
ds.first
|
|
563
789
|
end
|
|
564
790
|
|
|
565
791
|
def json_access_token_payload(oauth_token)
|
|
@@ -628,7 +854,6 @@ module Rodauth
|
|
|
628
854
|
# set client ID/secret pairs
|
|
629
855
|
|
|
630
856
|
create_params.merge! \
|
|
631
|
-
oauth_applications_client_id_column => oauth_unique_id_generator,
|
|
632
857
|
oauth_applications_client_secret_column => \
|
|
633
858
|
secret_hash(oauth_application_params[oauth_application_client_secret_param])
|
|
634
859
|
|
|
@@ -638,29 +863,14 @@ module Rodauth
|
|
|
638
863
|
oauth_application_default_scope
|
|
639
864
|
end
|
|
640
865
|
|
|
641
|
-
|
|
642
|
-
|
|
643
|
-
|
|
644
|
-
false
|
|
645
|
-
rescue Sequel::ConstraintViolation => e
|
|
646
|
-
e
|
|
647
|
-
end
|
|
648
|
-
|
|
649
|
-
if raised
|
|
650
|
-
field = raised.message[/\.(.*)$/, 1]
|
|
651
|
-
case raised
|
|
652
|
-
when Sequel::UniqueConstraintViolation
|
|
653
|
-
throw_error(field, unique_error_message)
|
|
654
|
-
when Sequel::NotNullConstraintViolation
|
|
655
|
-
throw_error(field, null_error_message)
|
|
656
|
-
end
|
|
866
|
+
rescue_from_uniqueness_error do
|
|
867
|
+
create_params[oauth_applications_client_id_column] = oauth_unique_id_generator
|
|
868
|
+
db[oauth_applications_table].insert(create_params)
|
|
657
869
|
end
|
|
658
|
-
|
|
659
|
-
!raised && id
|
|
660
870
|
end
|
|
661
871
|
|
|
662
872
|
# Authorize
|
|
663
|
-
def
|
|
873
|
+
def require_authorizable_account
|
|
664
874
|
require_account
|
|
665
875
|
end
|
|
666
876
|
|
|
@@ -673,6 +883,9 @@ module Rodauth
|
|
|
673
883
|
end
|
|
674
884
|
redirect_response_error("invalid_scope") unless check_valid_scopes?
|
|
675
885
|
|
|
886
|
+
if (response_mode = param_or_nil("response_mode")) && response_mode != "form_post"
|
|
887
|
+
redirect_response_error("invalid_request")
|
|
888
|
+
end
|
|
676
889
|
validate_pkce_challenge_params if use_oauth_pkce?
|
|
677
890
|
end
|
|
678
891
|
|
|
@@ -690,57 +903,79 @@ module Rodauth
|
|
|
690
903
|
).count.zero?
|
|
691
904
|
|
|
692
905
|
# if there's a previous oauth grant for the params combo, it means that this user has approved before.
|
|
693
|
-
|
|
694
906
|
request.env["REQUEST_METHOD"] = "POST"
|
|
695
907
|
end
|
|
696
908
|
|
|
697
|
-
def create_oauth_grant
|
|
698
|
-
create_params
|
|
909
|
+
def create_oauth_grant(create_params = {})
|
|
910
|
+
create_params.merge!(
|
|
699
911
|
oauth_grants_account_id_column => account_id,
|
|
700
912
|
oauth_grants_oauth_application_id_column => oauth_application[oauth_applications_id_column],
|
|
701
913
|
oauth_grants_redirect_uri_column => redirect_uri,
|
|
702
|
-
oauth_grants_expires_in_column =>
|
|
914
|
+
oauth_grants_expires_in_column => Sequel.date_add(Sequel::CURRENT_TIMESTAMP, seconds: oauth_grant_expires_in),
|
|
703
915
|
oauth_grants_scopes_column => scopes.join(oauth_scope_separator)
|
|
704
|
-
|
|
916
|
+
)
|
|
705
917
|
|
|
706
918
|
# Access Type flow
|
|
707
|
-
if use_oauth_access_type?
|
|
708
|
-
|
|
709
|
-
create_params[oauth_grants_access_type_column] = access_type
|
|
710
|
-
end
|
|
919
|
+
if use_oauth_access_type? && (access_type = param_or_nil("access_type"))
|
|
920
|
+
create_params[oauth_grants_access_type_column] = access_type
|
|
711
921
|
end
|
|
712
922
|
|
|
713
923
|
# PKCE flow
|
|
714
|
-
if use_oauth_pkce?
|
|
924
|
+
if use_oauth_pkce? && (code_challenge = param_or_nil("code_challenge"))
|
|
925
|
+
code_challenge_method = param_or_nil("code_challenge_method")
|
|
715
926
|
|
|
716
|
-
|
|
717
|
-
|
|
718
|
-
|
|
719
|
-
create_params[oauth_grants_code_challenge_column] = code_challenge
|
|
720
|
-
create_params[oauth_grants_code_challenge_method_column] = code_challenge_method
|
|
721
|
-
elsif oauth_require_pkce
|
|
722
|
-
redirect_response_error("code_challenge_required")
|
|
723
|
-
end
|
|
927
|
+
create_params[oauth_grants_code_challenge_column] = code_challenge
|
|
928
|
+
create_params[oauth_grants_code_challenge_method_column] = code_challenge_method
|
|
724
929
|
end
|
|
725
930
|
|
|
726
931
|
ds = db[oauth_grants_table]
|
|
727
932
|
|
|
728
|
-
|
|
729
|
-
|
|
730
|
-
|
|
731
|
-
ds.insert(create_params)
|
|
732
|
-
authorization_code
|
|
733
|
-
rescue Sequel::UniqueConstraintViolation
|
|
734
|
-
retry
|
|
933
|
+
rescue_from_uniqueness_error do
|
|
934
|
+
create_params[oauth_grants_code_column] = oauth_unique_id_generator
|
|
935
|
+
__insert_and_return__(ds, oauth_grants_id_column, create_params)
|
|
735
936
|
end
|
|
937
|
+
create_params[oauth_grants_code_column]
|
|
938
|
+
end
|
|
939
|
+
|
|
940
|
+
def do_authorize(response_params = {}, response_mode = param_or_nil("response_mode"))
|
|
941
|
+
case param("response_type")
|
|
942
|
+
when "token"
|
|
943
|
+
redirect_response_error("invalid_request") unless use_oauth_implicit_grant_type?
|
|
944
|
+
|
|
945
|
+
response_mode ||= "fragment"
|
|
946
|
+
response_params.replace(_do_authorize_token)
|
|
947
|
+
when "code"
|
|
948
|
+
response_mode ||= "query"
|
|
949
|
+
response_params.replace(_do_authorize_code)
|
|
950
|
+
when "none"
|
|
951
|
+
response_mode ||= "none"
|
|
952
|
+
when "", nil
|
|
953
|
+
response_mode ||= oauth_response_mode
|
|
954
|
+
response_params.replace(_do_authorize_code)
|
|
955
|
+
end
|
|
956
|
+
|
|
957
|
+
response_params["state"] = param("state") if param_or_nil("state")
|
|
958
|
+
|
|
959
|
+
[response_params, response_mode]
|
|
736
960
|
end
|
|
737
961
|
|
|
738
|
-
|
|
962
|
+
def _do_authorize_code
|
|
963
|
+
{ "code" => create_oauth_grant }
|
|
964
|
+
end
|
|
739
965
|
|
|
740
|
-
def
|
|
741
|
-
|
|
966
|
+
def _do_authorize_token
|
|
967
|
+
create_params = {
|
|
968
|
+
oauth_tokens_account_id_column => account_id,
|
|
969
|
+
oauth_tokens_oauth_application_id_column => oauth_application[oauth_applications_id_column],
|
|
970
|
+
oauth_tokens_scopes_column => scopes
|
|
971
|
+
}
|
|
972
|
+
oauth_token = generate_oauth_token(create_params, false)
|
|
973
|
+
|
|
974
|
+
json_access_token_payload(oauth_token)
|
|
742
975
|
end
|
|
743
976
|
|
|
977
|
+
# Access Tokens
|
|
978
|
+
|
|
744
979
|
def validate_oauth_token_params
|
|
745
980
|
unless (grant_type = param_or_nil("grant_type"))
|
|
746
981
|
redirect_response_error("invalid_request")
|
|
@@ -760,27 +995,56 @@ module Rodauth
|
|
|
760
995
|
def create_oauth_token
|
|
761
996
|
case param("grant_type")
|
|
762
997
|
when "authorization_code"
|
|
763
|
-
|
|
998
|
+
# fetch oauth grant
|
|
999
|
+
oauth_grant = db[oauth_grants_table].where(
|
|
1000
|
+
oauth_grants_code_column => param("code"),
|
|
1001
|
+
oauth_grants_redirect_uri_column => param("redirect_uri"),
|
|
1002
|
+
oauth_grants_oauth_application_id_column => oauth_application[oauth_applications_id_column],
|
|
1003
|
+
oauth_grants_revoked_at_column => nil
|
|
1004
|
+
).where(Sequel[oauth_grants_expires_in_column] >= Sequel::CURRENT_TIMESTAMP)
|
|
1005
|
+
.for_update
|
|
1006
|
+
.first
|
|
1007
|
+
|
|
1008
|
+
redirect_response_error("invalid_grant") unless oauth_grant
|
|
1009
|
+
|
|
1010
|
+
create_params = {
|
|
1011
|
+
oauth_tokens_account_id_column => oauth_grant[oauth_grants_account_id_column],
|
|
1012
|
+
oauth_tokens_oauth_application_id_column => oauth_grant[oauth_grants_oauth_application_id_column],
|
|
1013
|
+
oauth_tokens_oauth_grant_id_column => oauth_grant[oauth_grants_id_column],
|
|
1014
|
+
oauth_tokens_scopes_column => oauth_grant[oauth_grants_scopes_column]
|
|
1015
|
+
}
|
|
1016
|
+
create_oauth_token_from_authorization_code(oauth_grant, create_params)
|
|
764
1017
|
when "refresh_token"
|
|
765
|
-
|
|
766
|
-
|
|
767
|
-
|
|
1018
|
+
# fetch potentially revoked oauth token
|
|
1019
|
+
oauth_token = oauth_token_by_refresh_token(param("refresh_token"), revoked: true)
|
|
1020
|
+
|
|
1021
|
+
if !oauth_token
|
|
1022
|
+
redirect_response_error("invalid_grant")
|
|
1023
|
+
elsif oauth_token[oauth_tokens_revoked_at_column]
|
|
1024
|
+
if oauth_refresh_token_protection_policy == "rotation"
|
|
1025
|
+
# https://tools.ietf.org/html/draft-ietf-oauth-v2-1-00#section-6.1
|
|
1026
|
+
#
|
|
1027
|
+
# If a refresh token is compromised and subsequently used by both the attacker and the legitimate
|
|
1028
|
+
# client, one of them will present an invalidated refresh token, which will inform the authorization
|
|
1029
|
+
# server of the breach. The authorization server cannot determine which party submitted the invalid
|
|
1030
|
+
# refresh token, but it will revoke the active refresh token. This stops the attack at the cost of
|
|
1031
|
+
# forcing the legitimate client to obtain a fresh authorization grant.
|
|
1032
|
+
|
|
1033
|
+
db[oauth_tokens_table].where(oauth_tokens_oauth_token_id_column => oauth_token[oauth_tokens_id_column])
|
|
1034
|
+
.update(oauth_tokens_revoked_at_column => Sequel::CURRENT_TIMESTAMP)
|
|
1035
|
+
end
|
|
1036
|
+
redirect_response_error("invalid_grant")
|
|
1037
|
+
end
|
|
1038
|
+
|
|
1039
|
+
update_params = {
|
|
1040
|
+
oauth_tokens_oauth_application_id_column => oauth_token[oauth_grants_oauth_application_id_column],
|
|
1041
|
+
oauth_tokens_expires_in_column => Sequel.date_add(Sequel::CURRENT_TIMESTAMP, seconds: oauth_token_expires_in)
|
|
1042
|
+
}
|
|
1043
|
+
create_oauth_token_from_token(oauth_token, update_params)
|
|
768
1044
|
end
|
|
769
1045
|
end
|
|
770
1046
|
|
|
771
|
-
def create_oauth_token_from_authorization_code(
|
|
772
|
-
# fetch oauth grant
|
|
773
|
-
oauth_grant = db[oauth_grants_table].where(
|
|
774
|
-
oauth_grants_code_column => param("code"),
|
|
775
|
-
oauth_grants_redirect_uri_column => param("redirect_uri"),
|
|
776
|
-
oauth_grants_oauth_application_id_column => oauth_application[oauth_applications_id_column],
|
|
777
|
-
oauth_grants_revoked_at_column => nil
|
|
778
|
-
).where(Sequel[oauth_grants_expires_in_column] >= Sequel::CURRENT_TIMESTAMP)
|
|
779
|
-
.for_update
|
|
780
|
-
.first
|
|
781
|
-
|
|
782
|
-
redirect_response_error("invalid_grant") unless oauth_grant
|
|
783
|
-
|
|
1047
|
+
def create_oauth_token_from_authorization_code(oauth_grant, create_params)
|
|
784
1048
|
# PKCE
|
|
785
1049
|
if use_oauth_pkce?
|
|
786
1050
|
if oauth_grant[oauth_grants_code_challenge_column]
|
|
@@ -792,13 +1056,6 @@ module Rodauth
|
|
|
792
1056
|
end
|
|
793
1057
|
end
|
|
794
1058
|
|
|
795
|
-
create_params = {
|
|
796
|
-
oauth_tokens_account_id_column => oauth_grant[oauth_grants_account_id_column],
|
|
797
|
-
oauth_tokens_oauth_application_id_column => oauth_grant[oauth_grants_oauth_application_id_column],
|
|
798
|
-
oauth_tokens_oauth_grant_id_column => oauth_grant[oauth_grants_id_column],
|
|
799
|
-
oauth_tokens_scopes_column => oauth_grant[oauth_grants_scopes_column]
|
|
800
|
-
}
|
|
801
|
-
|
|
802
1059
|
# revoke oauth grant
|
|
803
1060
|
db[oauth_grants_table].where(oauth_grants_id_column => oauth_grant[oauth_grants_id_column])
|
|
804
1061
|
.update(oauth_grants_revoked_at_column => Sequel::CURRENT_TIMESTAMP)
|
|
@@ -809,40 +1066,41 @@ module Rodauth
|
|
|
809
1066
|
generate_oauth_token(create_params, should_generate_refresh_token)
|
|
810
1067
|
end
|
|
811
1068
|
|
|
812
|
-
def create_oauth_token_from_token(
|
|
813
|
-
|
|
814
|
-
oauth_token = oauth_token_by_refresh_token(param("refresh_token"))
|
|
815
|
-
|
|
816
|
-
redirect_response_error("invalid_grant") unless oauth_token && token_from_application?(oauth_token, oauth_application)
|
|
1069
|
+
def create_oauth_token_from_token(oauth_token, update_params)
|
|
1070
|
+
redirect_response_error("invalid_grant") unless token_from_application?(oauth_token, oauth_application)
|
|
817
1071
|
|
|
818
|
-
|
|
1072
|
+
rescue_from_uniqueness_error do
|
|
1073
|
+
oauth_tokens_ds = db[oauth_tokens_table]
|
|
1074
|
+
token = oauth_unique_id_generator
|
|
819
1075
|
|
|
820
|
-
|
|
821
|
-
|
|
822
|
-
oauth_tokens_expires_in_column => Time.now + oauth_token_expires_in
|
|
823
|
-
}
|
|
824
|
-
|
|
825
|
-
if oauth_tokens_token_hash_column
|
|
826
|
-
update_params[oauth_tokens_token_hash_column] = generate_token_hash(token)
|
|
827
|
-
else
|
|
828
|
-
update_params[oauth_tokens_token_column] = token
|
|
829
|
-
end
|
|
830
|
-
|
|
831
|
-
ds = db[oauth_tokens_table].where(oauth_tokens_id_column => oauth_token[oauth_tokens_id_column])
|
|
832
|
-
|
|
833
|
-
oauth_token = begin
|
|
834
|
-
if ds.supports_returning?(:update)
|
|
835
|
-
ds.returning.update(update_params).first
|
|
1076
|
+
if oauth_tokens_token_hash_column
|
|
1077
|
+
update_params[oauth_tokens_token_hash_column] = generate_token_hash(token)
|
|
836
1078
|
else
|
|
837
|
-
|
|
838
|
-
ds.first
|
|
1079
|
+
update_params[oauth_tokens_token_column] = token
|
|
839
1080
|
end
|
|
840
|
-
rescue Sequel::UniqueConstraintViolation
|
|
841
|
-
retry
|
|
842
|
-
end
|
|
843
1081
|
|
|
844
|
-
|
|
845
|
-
|
|
1082
|
+
oauth_token = if oauth_refresh_token_protection_policy == "rotation"
|
|
1083
|
+
insert_params = {
|
|
1084
|
+
**update_params,
|
|
1085
|
+
oauth_tokens_oauth_token_id_column => oauth_token[oauth_tokens_id_column],
|
|
1086
|
+
oauth_tokens_scopes_column => oauth_token[oauth_tokens_scopes_column]
|
|
1087
|
+
}
|
|
1088
|
+
|
|
1089
|
+
# revoke the refresh token
|
|
1090
|
+
oauth_tokens_ds.where(oauth_tokens_id_column => oauth_token[oauth_tokens_id_column])
|
|
1091
|
+
.update(oauth_tokens_revoked_at_column => Sequel::CURRENT_TIMESTAMP)
|
|
1092
|
+
|
|
1093
|
+
insert_params[oauth_tokens_oauth_token_id_column] = oauth_token[oauth_tokens_id_column]
|
|
1094
|
+
__insert_and_return__(oauth_tokens_ds, oauth_tokens_id_column, insert_params)
|
|
1095
|
+
else
|
|
1096
|
+
# includes none
|
|
1097
|
+
ds = oauth_tokens_ds.where(oauth_tokens_id_column => oauth_token[oauth_tokens_id_column])
|
|
1098
|
+
__update_and_return__(ds, update_params)
|
|
1099
|
+
end
|
|
1100
|
+
|
|
1101
|
+
oauth_token[oauth_tokens_token_column] = token
|
|
1102
|
+
oauth_token
|
|
1103
|
+
end
|
|
846
1104
|
end
|
|
847
1105
|
|
|
848
1106
|
TOKEN_HINT_TYPES = %w[access_token refresh_token].freeze
|
|
@@ -851,8 +1109,8 @@ module Rodauth
|
|
|
851
1109
|
|
|
852
1110
|
def validate_oauth_introspect_params
|
|
853
1111
|
# check if valid token hint type
|
|
854
|
-
if param_or_nil("token_type_hint")
|
|
855
|
-
redirect_response_error("unsupported_token_type")
|
|
1112
|
+
if param_or_nil("token_type_hint") && !TOKEN_HINT_TYPES.include?(param("token_type_hint"))
|
|
1113
|
+
redirect_response_error("unsupported_token_type")
|
|
856
1114
|
end
|
|
857
1115
|
|
|
858
1116
|
redirect_response_error("invalid_request") unless param_or_nil("token")
|
|
@@ -870,18 +1128,12 @@ module Rodauth
|
|
|
870
1128
|
}
|
|
871
1129
|
end
|
|
872
1130
|
|
|
873
|
-
def before_introspect; end
|
|
874
|
-
|
|
875
1131
|
# Token revocation
|
|
876
1132
|
|
|
877
|
-
def before_revoke
|
|
878
|
-
require_oauth_application
|
|
879
|
-
end
|
|
880
|
-
|
|
881
1133
|
def validate_oauth_revoke_params
|
|
882
1134
|
# check if valid token hint type
|
|
883
|
-
if param_or_nil("token_type_hint")
|
|
884
|
-
redirect_response_error("unsupported_token_type")
|
|
1135
|
+
if param_or_nil("token_type_hint") && !TOKEN_HINT_TYPES.include?(param("token_type_hint"))
|
|
1136
|
+
redirect_response_error("unsupported_token_type")
|
|
885
1137
|
end
|
|
886
1138
|
|
|
887
1139
|
redirect_response_error("invalid_request") unless param_or_nil("token")
|
|
@@ -898,23 +1150,13 @@ module Rodauth
|
|
|
898
1150
|
|
|
899
1151
|
redirect_response_error("invalid_request") unless oauth_token
|
|
900
1152
|
|
|
901
|
-
|
|
902
|
-
redirect_response_error("invalid_request") unless token_from_application?(oauth_token, oauth_application)
|
|
903
|
-
else
|
|
904
|
-
@oauth_application = db[oauth_applications_table].where(oauth_applications_id_column =>
|
|
905
|
-
oauth_token[oauth_tokens_oauth_application_id_column]).first
|
|
906
|
-
end
|
|
1153
|
+
redirect_response_error("invalid_request") unless token_from_application?(oauth_token, oauth_application)
|
|
907
1154
|
|
|
908
1155
|
update_params = { oauth_tokens_revoked_at_column => Sequel::CURRENT_TIMESTAMP }
|
|
909
1156
|
|
|
910
1157
|
ds = db[oauth_tokens_table].where(oauth_tokens_id_column => oauth_token[oauth_tokens_id_column])
|
|
911
1158
|
|
|
912
|
-
oauth_token =
|
|
913
|
-
ds.returning.update(update_params).first
|
|
914
|
-
else
|
|
915
|
-
ds.update(update_params)
|
|
916
|
-
ds.first
|
|
917
|
-
end
|
|
1159
|
+
oauth_token = __update_and_return__(ds, update_params)
|
|
918
1160
|
|
|
919
1161
|
oauth_token[oauth_tokens_token_column] = token
|
|
920
1162
|
oauth_token
|
|
@@ -932,7 +1174,13 @@ module Rodauth
|
|
|
932
1174
|
|
|
933
1175
|
def redirect_response_error(error_code, redirect_url = redirect_uri || request.referer || default_redirect)
|
|
934
1176
|
if accepts_json?
|
|
935
|
-
|
|
1177
|
+
status_code = if respond_to?(:"#{error_code}_response_status")
|
|
1178
|
+
send(:"#{error_code}_response_status")
|
|
1179
|
+
else
|
|
1180
|
+
invalid_oauth_response_status
|
|
1181
|
+
end
|
|
1182
|
+
|
|
1183
|
+
throw_json_response_error(status_code, error_code)
|
|
936
1184
|
else
|
|
937
1185
|
redirect_url = URI.parse(redirect_url)
|
|
938
1186
|
query_params = []
|
|
@@ -954,9 +1202,17 @@ module Rodauth
|
|
|
954
1202
|
end
|
|
955
1203
|
end
|
|
956
1204
|
|
|
957
|
-
def json_response_success(body)
|
|
1205
|
+
def json_response_success(body, cache = false)
|
|
958
1206
|
response.status = 200
|
|
959
1207
|
response["Content-Type"] ||= json_response_content_type
|
|
1208
|
+
if cache
|
|
1209
|
+
# defaulting to 1-day for everyone, for now at least
|
|
1210
|
+
max_age = 60 * 60 * 24
|
|
1211
|
+
response["Cache-Control"] = "private, max-age=#{max_age}"
|
|
1212
|
+
else
|
|
1213
|
+
response["Cache-Control"] = "no-store"
|
|
1214
|
+
response["Pragma"] = "no-cache"
|
|
1215
|
+
end
|
|
960
1216
|
json_payload = _json_response_body(body)
|
|
961
1217
|
response.write(json_payload)
|
|
962
1218
|
request.halt
|
|
@@ -979,7 +1235,6 @@ module Rodauth
|
|
|
979
1235
|
end
|
|
980
1236
|
|
|
981
1237
|
unless method_defined?(:_json_response_body)
|
|
982
|
-
# :nocov:
|
|
983
1238
|
def _json_response_body(hash)
|
|
984
1239
|
if request.respond_to?(:convert_to_json)
|
|
985
1240
|
request.send(:convert_to_json, hash)
|
|
@@ -987,7 +1242,6 @@ module Rodauth
|
|
|
987
1242
|
JSON.dump(hash)
|
|
988
1243
|
end
|
|
989
1244
|
end
|
|
990
|
-
# :nocov:
|
|
991
1245
|
end
|
|
992
1246
|
|
|
993
1247
|
def authorization_required
|
|
@@ -995,7 +1249,7 @@ module Rodauth
|
|
|
995
1249
|
throw_json_response_error(authorization_required_error_status, "invalid_client")
|
|
996
1250
|
else
|
|
997
1251
|
set_redirect_error_flash(require_authorization_error_flash)
|
|
998
|
-
redirect(
|
|
1252
|
+
redirect(authorize_path)
|
|
999
1253
|
end
|
|
1000
1254
|
end
|
|
1001
1255
|
|
|
@@ -1075,10 +1329,10 @@ module Rodauth
|
|
|
1075
1329
|
|
|
1076
1330
|
def oauth_server_metadata_body(path)
|
|
1077
1331
|
issuer = base_url
|
|
1078
|
-
issuer += "/#{path}" if
|
|
1332
|
+
issuer += "/#{path}" if path
|
|
1079
1333
|
|
|
1080
1334
|
responses_supported = %w[code]
|
|
1081
|
-
response_modes_supported = %w[query]
|
|
1335
|
+
response_modes_supported = %w[query form_post]
|
|
1082
1336
|
grant_types_supported = %w[authorization_code]
|
|
1083
1337
|
|
|
1084
1338
|
if use_oauth_implicit_grant_type?
|
|
@@ -1086,11 +1340,12 @@ module Rodauth
|
|
|
1086
1340
|
response_modes_supported << "fragment"
|
|
1087
1341
|
grant_types_supported << "implicit"
|
|
1088
1342
|
end
|
|
1343
|
+
|
|
1089
1344
|
{
|
|
1090
1345
|
issuer: issuer,
|
|
1091
|
-
authorization_endpoint:
|
|
1092
|
-
token_endpoint:
|
|
1093
|
-
registration_endpoint:
|
|
1346
|
+
authorization_endpoint: authorize_url,
|
|
1347
|
+
token_endpoint: token_url,
|
|
1348
|
+
registration_endpoint: route_url(oauth_applications_path),
|
|
1094
1349
|
scopes_supported: oauth_application_scopes,
|
|
1095
1350
|
response_types_supported: responses_supported,
|
|
1096
1351
|
response_modes_supported: response_modes_supported,
|
|
@@ -1100,142 +1355,12 @@ module Rodauth
|
|
|
1100
1355
|
ui_locales_supported: oauth_metadata_ui_locales_supported,
|
|
1101
1356
|
op_policy_uri: oauth_metadata_op_policy_uri,
|
|
1102
1357
|
op_tos_uri: oauth_metadata_op_tos_uri,
|
|
1103
|
-
revocation_endpoint:
|
|
1358
|
+
revocation_endpoint: revoke_url,
|
|
1104
1359
|
revocation_endpoint_auth_methods_supported: nil, # because it's client_secret_basic
|
|
1105
|
-
introspection_endpoint:
|
|
1360
|
+
introspection_endpoint: introspect_url,
|
|
1106
1361
|
introspection_endpoint_auth_methods_supported: %w[client_secret_basic],
|
|
1107
1362
|
code_challenge_methods_supported: (use_oauth_pkce? ? oauth_pkce_challenge_method : nil)
|
|
1108
1363
|
}
|
|
1109
1364
|
end
|
|
1110
|
-
|
|
1111
|
-
# /oauth-token
|
|
1112
|
-
route(:oauth_token) do |r|
|
|
1113
|
-
before_token
|
|
1114
|
-
|
|
1115
|
-
r.post do
|
|
1116
|
-
catch_error do
|
|
1117
|
-
validate_oauth_token_params
|
|
1118
|
-
|
|
1119
|
-
oauth_token = nil
|
|
1120
|
-
transaction do
|
|
1121
|
-
oauth_token = create_oauth_token
|
|
1122
|
-
end
|
|
1123
|
-
|
|
1124
|
-
json_response_success(json_access_token_payload(oauth_token))
|
|
1125
|
-
end
|
|
1126
|
-
|
|
1127
|
-
throw_json_response_error(invalid_oauth_response_status, "invalid_request")
|
|
1128
|
-
end
|
|
1129
|
-
end
|
|
1130
|
-
|
|
1131
|
-
# /oauth-introspect
|
|
1132
|
-
route(:oauth_introspect) do |r|
|
|
1133
|
-
before_introspect
|
|
1134
|
-
|
|
1135
|
-
r.post do
|
|
1136
|
-
catch_error do
|
|
1137
|
-
validate_oauth_introspect_params
|
|
1138
|
-
|
|
1139
|
-
oauth_token = case param("token_type_hint")
|
|
1140
|
-
when "access_token"
|
|
1141
|
-
oauth_token_by_token(param("token"))
|
|
1142
|
-
when "refresh_token"
|
|
1143
|
-
oauth_token_by_refresh_token(param("token"))
|
|
1144
|
-
else
|
|
1145
|
-
oauth_token_by_token(param("token")) || oauth_token_by_refresh_token(param("token"))
|
|
1146
|
-
end
|
|
1147
|
-
|
|
1148
|
-
if oauth_application
|
|
1149
|
-
redirect_response_error("invalid_request") if oauth_token && !token_from_application?(oauth_token, oauth_application)
|
|
1150
|
-
elsif oauth_token
|
|
1151
|
-
@oauth_application = db[oauth_applications_table].where(oauth_applications_id_column =>
|
|
1152
|
-
oauth_token[oauth_tokens_oauth_application_id_column]).first
|
|
1153
|
-
end
|
|
1154
|
-
|
|
1155
|
-
json_response_success(json_token_introspect_payload(oauth_token))
|
|
1156
|
-
end
|
|
1157
|
-
|
|
1158
|
-
throw_json_response_error(invalid_oauth_response_status, "invalid_request")
|
|
1159
|
-
end
|
|
1160
|
-
end
|
|
1161
|
-
|
|
1162
|
-
# /oauth-revoke
|
|
1163
|
-
route(:oauth_revoke) do |r|
|
|
1164
|
-
before_revoke
|
|
1165
|
-
|
|
1166
|
-
r.post do
|
|
1167
|
-
catch_error do
|
|
1168
|
-
validate_oauth_revoke_params
|
|
1169
|
-
|
|
1170
|
-
oauth_token = nil
|
|
1171
|
-
transaction do
|
|
1172
|
-
oauth_token = revoke_oauth_token
|
|
1173
|
-
after_revoke
|
|
1174
|
-
end
|
|
1175
|
-
|
|
1176
|
-
if accepts_json?
|
|
1177
|
-
json_response_success \
|
|
1178
|
-
"token" => oauth_token[oauth_tokens_token_column],
|
|
1179
|
-
"refresh_token" => oauth_token[oauth_tokens_refresh_token_column],
|
|
1180
|
-
"revoked_at" => oauth_token[oauth_tokens_revoked_at_column]
|
|
1181
|
-
else
|
|
1182
|
-
set_notice_flash revoke_oauth_token_notice_flash
|
|
1183
|
-
redirect request.referer || "/"
|
|
1184
|
-
end
|
|
1185
|
-
end
|
|
1186
|
-
|
|
1187
|
-
redirect_response_error("invalid_request", request.referer || "/")
|
|
1188
|
-
end
|
|
1189
|
-
end
|
|
1190
|
-
|
|
1191
|
-
# /oauth-authorize
|
|
1192
|
-
route(:oauth_authorize) do |r|
|
|
1193
|
-
require_account
|
|
1194
|
-
validate_oauth_grant_params
|
|
1195
|
-
try_approval_prompt if use_oauth_access_type? && request.get?
|
|
1196
|
-
|
|
1197
|
-
before_authorize
|
|
1198
|
-
|
|
1199
|
-
r.get do
|
|
1200
|
-
authorize_view
|
|
1201
|
-
end
|
|
1202
|
-
|
|
1203
|
-
r.post do
|
|
1204
|
-
code = nil
|
|
1205
|
-
query_params = []
|
|
1206
|
-
fragment_params = []
|
|
1207
|
-
|
|
1208
|
-
transaction do
|
|
1209
|
-
case param("response_type")
|
|
1210
|
-
when "token"
|
|
1211
|
-
redirect_response_error("invalid_request") unless use_oauth_implicit_grant_type?
|
|
1212
|
-
|
|
1213
|
-
create_params = {
|
|
1214
|
-
oauth_tokens_account_id_column => account_id,
|
|
1215
|
-
oauth_tokens_oauth_application_id_column => oauth_application[oauth_applications_id_column],
|
|
1216
|
-
oauth_tokens_scopes_column => scopes
|
|
1217
|
-
}
|
|
1218
|
-
oauth_token = generate_oauth_token(create_params, false)
|
|
1219
|
-
|
|
1220
|
-
token_payload = json_access_token_payload(oauth_token)
|
|
1221
|
-
fragment_params.replace(token_payload.map { |k, v| "#{k}=#{v}" })
|
|
1222
|
-
when "code", "", nil
|
|
1223
|
-
code = create_oauth_grant
|
|
1224
|
-
query_params << "code=#{code}"
|
|
1225
|
-
else
|
|
1226
|
-
redirect_response_error("invalid_request")
|
|
1227
|
-
end
|
|
1228
|
-
after_authorize
|
|
1229
|
-
end
|
|
1230
|
-
|
|
1231
|
-
redirect_url = URI.parse(redirect_uri)
|
|
1232
|
-
query_params << "state=#{param('state')}" if param_or_nil("state")
|
|
1233
|
-
query_params << redirect_url.query if redirect_url.query
|
|
1234
|
-
redirect_url.query = query_params.join("&") unless query_params.empty?
|
|
1235
|
-
redirect_url.fragment = fragment_params.join("&") unless fragment_params.empty?
|
|
1236
|
-
|
|
1237
|
-
redirect(redirect_url.to_s)
|
|
1238
|
-
end
|
|
1239
|
-
end
|
|
1240
1365
|
end
|
|
1241
1366
|
end
|