songkick-oauth2-provider 0.10.2 → 0.10.3

data/lib/songkick/oauth2/model/client.rb

@@ -1,58 +1,58 @@
 module Songkick
   module OAuth2
     module Model
-      
+
       class Client < ActiveRecord::Base
         self.table_name = :oauth2_clients
-        
+
         belongs_to :oauth2_client_owner, :polymorphic => true
         alias :owner  :oauth2_client_owner
         alias :owner= :oauth2_client_owner=
-            
+
         has_many :authorizations, :class_name => 'Songkick::OAuth2::Model::Authorization', :dependent => :destroy
-        
+
         validates_uniqueness_of :client_id, :name
         validates_presence_of   :name, :redirect_uri
         validate :check_format_of_redirect_uri
-        
+
         attr_accessible :name, :redirect_uri
-        
+
         before_create :generate_credentials
-        
+
         def self.create_client_id
           Songkick::OAuth2.generate_id do |client_id|
-            count(:conditions => {:client_id => client_id}).zero?
+            Helpers.count(self, :client_id => client_id).zero?
           end
         end
-        
+
         attr_reader :client_secret
-        
+
         def client_secret=(secret)
           @client_secret = secret
           hash = BCrypt::Password.create(secret)
           hash.force_encoding('UTF-8') if hash.respond_to?(:force_encoding)
           self.client_secret_hash = hash
         end
-        
+
         def valid_client_secret?(secret)
           BCrypt::Password.new(client_secret_hash) == secret
         end
-        
+
       private
-        
+
         def check_format_of_redirect_uri
           uri = URI.parse(redirect_uri)
           errors.add(:redirect_uri, 'must be an absolute URI') unless uri.absolute?
         rescue
           errors.add(:redirect_uri, 'must be a URI')
         end
-        
+
         def generate_credentials
           self.client_id = self.class.create_client_id
           self.client_secret = Songkick::OAuth2.random_string
         end
       end
-      
+
     end
   end
 end

data/lib/songkick/oauth2/model/client_owner.rb

@@ -1,7 +1,7 @@
 module Songkick
   module OAuth2
     module Model
-      
+
       module ClientOwner
         def self.included(klass)
           klass.has_many :oauth2_clients,
@@ -9,7 +9,7 @@ module Songkick
                          :as => :oauth2_client_owner
         end
       end
-      
+
     end
   end
 end

data/lib/songkick/oauth2/model/hashing.rb

@@ -1,7 +1,7 @@
 module Songkick
   module OAuth2
     module Model
-      
+
       module Hashing
         def hashes_attributes(*attributes)
           attributes.each do |attribute|
@@ -11,7 +11,7 @@ module Songkick
             end
             attr_reader attribute
           end
-          
+
           class_eval <<-RUBY
             def reload(*args)
               super
@@ -22,7 +22,7 @@ module Songkick
           RUBY
         end
       end
-      
+
     end
   end
 end

data/lib/songkick/oauth2/model/helpers.rb

@@ -0,0 +1,16 @@
+module Songkick
+  module OAuth2
+    module Model
+
+      module Helpers
+        def self.count(model, conditions={})
+          if model.respond_to?(:where)
+            model.where(conditions).count
+          else
+            model.count(:conditions => conditions)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/songkick/oauth2/model/resource_owner.rb

@@ -1,7 +1,7 @@
 module Songkick
   module OAuth2
     module Model
-      
+
       module ResourceOwner
         def self.included(klass)
           klass.has_many :oauth2_authorizations,
@@ -9,16 +9,16 @@ module Songkick
                          :as => :oauth2_resource_owner,
                          :dependent => :destroy
         end
-        
+
         def grant_access!(client, options = {})
           Authorization.for(self, client, options)
         end
-        
+
         def oauth2_authorization_for(client)
           oauth2_authorizations.find_by_client_id(client.id)
         end
       end
-      
+
     end
   end
 end

data/lib/songkick/oauth2/provider.rb

@@ -15,11 +15,11 @@ module Songkick
   module OAuth2
     ROOT = File.expand_path(File.dirname(__FILE__) + '/..')
     TOKEN_SIZE = 160
-    
+
     autoload :Model,  ROOT + '/oauth2/model'
     autoload :Router, ROOT + '/oauth2/router'
     autoload :Schema, ROOT + '/oauth2/schema'
-    
+
     def self.random_string
       if defined? SecureRandom
         SecureRandom.hex(TOKEN_SIZE / 8).to_i(16).to_s(36)
@@ -27,18 +27,18 @@ module Songkick
         rand(2 ** TOKEN_SIZE).to_s(36)
       end
     end
-    
+
     def self.generate_id(&predicate)
       id = random_string
       id = random_string until predicate.call(id)
       id
     end
-    
+
     def self.hashify(token)
       return nil unless String === token
       Digest::SHA1.hexdigest(token)
     end
-    
+
     ACCESS_TOKEN           = 'access_token'
     ASSERTION              = 'assertion'
     ASSERTION_TYPE         = 'assertion_type'
@@ -61,7 +61,7 @@ module Songkick
     STATE                  = 'state'
     TOKEN                  = 'token'
     USERNAME               = 'username'
-    
+
     INVALID_REQUEST        = 'invalid_request'
     UNSUPPORTED_RESPONSE   = 'unsupported_response_type'
     REDIRECT_MISMATCH      = 'redirect_uri_mismatch'
@@ -74,7 +74,7 @@ module Songkick
     EXPIRED_TOKEN          = 'expired_token'
     INSUFFICIENT_SCOPE     = 'insufficient_scope'
     ACCESS_DENIED          = 'access_denied'
-    
+
     class Provider
       EXPIRY_TIME = 3600
 
@@ -86,42 +86,42 @@ module Songkick
       class << self
         attr_accessor :realm, :enforce_ssl
       end
-      
+
       def self.clear_assertion_handlers!
         @password_handler   = nil
         @assertion_handlers = {}
         @assertion_filters  = []
       end
-      
+
       clear_assertion_handlers!
-      
+
       def self.handle_passwords(&block)
         @password_handler = block
       end
-      
+
       def self.handle_password(client, username, password, scopes)
         return nil unless @password_handler
         @password_handler.call(client, username, password, scopes)
       end
-      
+
       def self.filter_assertions(&filter)
         @assertion_filters.push(filter)
       end
-      
+
       def self.handle_assertions(assertion_type, &handler)
         @assertion_handlers[assertion_type] = handler
       end
-      
+
       def self.handle_assertion(client, assertion, scopes)
         return nil unless @assertion_filters.all? { |f| f.call(client) }
         handler = @assertion_handlers[assertion.type]
         handler ? handler.call(client, assertion.value, scopes) : nil
       end
-      
+
       def self.parse(*args)
         Router.parse(*args)
       end
-      
+
       def self.access_token(*args)
         Router.access_token(*args)
       end

data/lib/songkick/oauth2/provider/access_token.rb

@@ -1,35 +1,35 @@
 module Songkick
   module OAuth2
     class Provider
-      
+
       class AccessToken
         attr_reader :authorization
-        
+
         def initialize(resource_owner = nil, scopes = [], access_token = nil, error = nil)
           @resource_owner = resource_owner
           @scopes         = scopes
           @access_token   = access_token
           @error          = error && INVALID_REQUEST
-          
+
           authorize!(access_token, error)
           validate!
         end
-        
+
         def client
           valid? ? @authorization.client : nil
         end
-        
+
         def owner
           valid? ? @authorization.owner : nil
         end
-        
+
         def response_headers
           return {} if valid?
           error_message =  "OAuth realm='#{ Provider.realm }'"
           error_message << ", error='#{ @error }'" unless @error == ''
           {'WWW-Authenticate' => error_message}
         end
-        
+
         def response_status
           case @error
             when INVALID_REQUEST, INVALID_TOKEN, EXPIRED_TOKEN then 401
@@ -38,30 +38,35 @@ module Songkick
                                                                else 200
           end
         end
-        
+
         def valid?
           @error.nil?
         end
-        
+
       private
-        
+
         def authorize!(access_token, error)
           return unless @authorization = Model.find_access_token(access_token)
           @authorization.update_attribute(:access_token, nil) if error
         end
-        
+
         def validate!
           return @error = ''                 unless @access_token
           return @error = INVALID_TOKEN      unless @authorization
           return @error = EXPIRED_TOKEN      if @authorization.expired?
           return @error = INSUFFICIENT_SCOPE unless @authorization.in_scope?(@scopes)
-          
-          if @resource_owner and @authorization.owner != @resource_owner
-            @error = INSUFFICIENT_SCOPE
+
+          case @resource_owner
+          when :implicit
+            # no error
+          when nil
+            @error = INVALID_TOKEN
+          else
+            @error = INSUFFICIENT_SCOPE if @authorization.owner != @resource_owner
           end
         end
       end
-      
+
     end
   end
 end

data/lib/songkick/oauth2/provider/authorization.rb

@@ -1,152 +1,153 @@
 module Songkick
   module OAuth2
     class Provider
-      
+
       class Authorization
         attr_reader :owner, :client,
                     :code, :access_token,
                     :expires_in, :refresh_token,
                     :error, :error_description
-        
+
         REQUIRED_PARAMS = [RESPONSE_TYPE, CLIENT_ID, REDIRECT_URI]
         VALID_PARAMS    = REQUIRED_PARAMS + [SCOPE, STATE]
         VALID_RESPONSES = [CODE, TOKEN, CODE_AND_TOKEN]
-        
+
         def initialize(resource_owner, params, transport_error = nil)
           @owner  = resource_owner
           @params = params
           @scope  = params[SCOPE]
           @state  = params[STATE]
-          
+
           @transport_error = transport_error
-          
+
           validate!
-          
+
           return unless @owner and not @error
-          
+
           @model = @owner.oauth2_authorization_for(@client)
           return unless @model and @model.in_scope?(scopes) and not @model.expired?
-          
+
           @authorized = true
-          
+
           if @params[RESPONSE_TYPE] =~ /code/
             @code = @model.generate_code
           end
-          
+
           if @params[RESPONSE_TYPE] =~ /token/
             @access_token = @model.generate_access_token
           end
         end
-        
+
         def scopes
           scopes = @scope ? @scope.split(/\s+/).delete_if { |s| s.empty? } : []
           Set.new(scopes)
         end
-        
+
         def unauthorized_scopes
           @model ? scopes.select { |s| not @model.in_scope?(s) } : scopes
         end
-        
+
         def grant_access!(options = {})
           @model = Model::Authorization.for(@owner, @client,
             :response_type => @params[RESPONSE_TYPE],
             :scope         => @scope,
             :duration      => options[:duration])
-          
+
           @code          = @model.code
           @access_token  = @model.access_token
           @refresh_token = @model.refresh_token
           @expires_in    = @model.expires_in
-          
+
           unless @params[RESPONSE_TYPE] == CODE
             @expires_in = @model.expires_in
           end
-          
+
           @authorized = true
         end
-        
+
         def deny_access!
           @code = @access_token = @refresh_token = nil
           @error = ACCESS_DENIED
           @error_description = "The user denied you access"
         end
-        
+
         def params
           params = {}
           VALID_PARAMS.each { |key| params[key] = @params[key] if @params.has_key?(key) }
           params
         end
-        
+
         def redirect?
           @client and (@authorized or not valid?)
         end
-        
+
         def redirect_uri
           return nil unless @client
           base_redirect_uri = @client.redirect_uri
-          
+          q = (base_redirect_uri =~ /\?/) ? '&' : '?'
+
           if not valid?
             query = to_query_string(ERROR, ERROR_DESCRIPTION, STATE)
-            "#{ base_redirect_uri }?#{ query }"
-          
+            "#{ base_redirect_uri }#{ q }#{ query }"
+
           elsif @params[RESPONSE_TYPE] == CODE_AND_TOKEN
             query    = to_query_string(CODE, STATE)
             fragment = to_query_string(ACCESS_TOKEN, EXPIRES_IN, SCOPE)
-            "#{ base_redirect_uri }#{ query.empty? ? '' : '?' + query }##{ fragment }"
-          
-          elsif @params[RESPONSE_TYPE] == 'token'
+            "#{ base_redirect_uri }#{ query.empty? ? '' : q + query }##{ fragment }"
+
+          elsif @params[RESPONSE_TYPE] == TOKEN
             fragment = to_query_string(ACCESS_TOKEN, EXPIRES_IN, SCOPE, STATE)
             "#{ base_redirect_uri }##{ fragment }"
-          
+
           else
             query = to_query_string(CODE, SCOPE, STATE)
-            "#{ base_redirect_uri }?#{ query }"
+            "#{ base_redirect_uri }#{ q }#{ query }"
           end
         end
-        
+
         def response_body
           warn "Songkick::OAuth2::Provider::Authorization no longer returns a response body "+
                "when the request is invalid. You should call valid? to determine "+
                "whether to render your login page or an error page."
           nil
         end
-        
+
         def response_headers
           redirect? ? {} : {'Cache-Control' => 'no-store'}
         end
-        
+
         def response_status
           return 302 if redirect?
           return 200 if valid?
           @client ? 302 : 400
         end
-        
+
         def valid?
           @error.nil?
         end
-        
+
       private
-        
+
         def validate!
           if @transport_error
             @error = @transport_error.error
             @error_description = @transport_error.error_description
             return
           end
-          
+
           @client = @params[CLIENT_ID] && Model::Client.find_by_client_id(@params[CLIENT_ID])
           unless @client
             @error = INVALID_CLIENT
             @error_description = "Unknown client ID #{@params[CLIENT_ID]}"
           end
-          
+
           REQUIRED_PARAMS.each do |param|
             next if @params.has_key?(param)
             @error = INVALID_REQUEST
             @error_description = "Missing required parameter #{param}"
           end
           return if @error
-          
+
           [SCOPE, STATE].each do |param|
             next unless @params.has_key?(param)
             if @params[param] =~ /\r\n/
@@ -154,24 +155,24 @@ module Songkick
               @error_description = "Illegal value for #{param} parameter"
             end
           end
-          
+
           unless VALID_RESPONSES.include?(@params[RESPONSE_TYPE])
             @error = UNSUPPORTED_RESPONSE
             @error_description = "Response type #{@params[RESPONSE_TYPE]} is not supported"
           end
-          
+
           @client = Model::Client.find_by_client_id(@params[CLIENT_ID])
           unless @client
             @error = INVALID_CLIENT
             @error_description = "Unknown client ID #{@params[CLIENT_ID]}"
           end
-          
+
           if @client and @client.redirect_uri and @client.redirect_uri != @params[REDIRECT_URI]
             @error = REDIRECT_MISMATCH
             @error_description = "Parameter #{REDIRECT_URI} does not match registered URI"
           end
         end
-        
+
         def to_query_string(*ivars)
           ivars.map { |key|
             value = instance_variable_get("@#{key}")
@@ -180,7 +181,7 @@ module Songkick
           }.compact.join('&')
         end
       end
-      
+
     end
   end
 end