RubyGems - tpitale-rack-oauth2-server - Versions diffs - 2.2.1 - Mend

tpitale-rack-oauth2-server 2.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (64) hide show

data/CHANGELOG +202 -0
data/Gemfile +16 -0
data/MIT-LICENSE +21 -0
data/README.rdoc +604 -0
data/Rakefile +90 -0
data/VERSION +1 -0
data/bin/oauth2-server +206 -0
data/lib/rack-oauth2-server.rb +4 -0
data/lib/rack/oauth2/admin/css/screen.css +347 -0
data/lib/rack/oauth2/admin/images/loading.gif +0 -0
data/lib/rack/oauth2/admin/images/oauth-2.png +0 -0
data/lib/rack/oauth2/admin/js/application.coffee +220 -0
data/lib/rack/oauth2/admin/js/jquery.js +166 -0
data/lib/rack/oauth2/admin/js/jquery.tmpl.js +414 -0
data/lib/rack/oauth2/admin/js/protovis-r3.2.js +277 -0
data/lib/rack/oauth2/admin/js/sammy.js +5 -0
data/lib/rack/oauth2/admin/js/sammy.json.js +5 -0
data/lib/rack/oauth2/admin/js/sammy.oauth2.js +142 -0
data/lib/rack/oauth2/admin/js/sammy.storage.js +5 -0
data/lib/rack/oauth2/admin/js/sammy.title.js +5 -0
data/lib/rack/oauth2/admin/js/sammy.tmpl.js +5 -0
data/lib/rack/oauth2/admin/js/underscore.js +722 -0
data/lib/rack/oauth2/admin/views/client.tmpl +58 -0
data/lib/rack/oauth2/admin/views/clients.tmpl +52 -0
data/lib/rack/oauth2/admin/views/edit.tmpl +80 -0
data/lib/rack/oauth2/admin/views/index.html +39 -0
data/lib/rack/oauth2/admin/views/no_access.tmpl +4 -0
data/lib/rack/oauth2/models.rb +27 -0
data/lib/rack/oauth2/models/access_grant.rb +54 -0
data/lib/rack/oauth2/models/access_token.rb +129 -0
data/lib/rack/oauth2/models/auth_request.rb +61 -0
data/lib/rack/oauth2/models/client.rb +93 -0
data/lib/rack/oauth2/rails.rb +105 -0
data/lib/rack/oauth2/server.rb +458 -0
data/lib/rack/oauth2/server/admin.rb +250 -0
data/lib/rack/oauth2/server/errors.rb +104 -0
data/lib/rack/oauth2/server/helper.rb +147 -0
data/lib/rack/oauth2/server/practice.rb +79 -0
data/lib/rack/oauth2/server/railtie.rb +24 -0
data/lib/rack/oauth2/server/utils.rb +30 -0
data/lib/rack/oauth2/sinatra.rb +71 -0
data/rack-oauth2-server.gemspec +24 -0
data/rails/init.rb +11 -0
data/test/admin/api_test.rb +228 -0
data/test/admin/ui_test.rb +38 -0
data/test/oauth/access_grant_test.rb +276 -0
data/test/oauth/access_token_test.rb +311 -0
data/test/oauth/authorization_test.rb +298 -0
data/test/oauth/server_methods_test.rb +292 -0
data/test/rails2/app/controllers/api_controller.rb +40 -0
data/test/rails2/app/controllers/application_controller.rb +2 -0
data/test/rails2/app/controllers/oauth_controller.rb +17 -0
data/test/rails2/config/environment.rb +19 -0
data/test/rails2/config/environments/test.rb +0 -0
data/test/rails2/config/routes.rb +13 -0
data/test/rails3/app/controllers/api_controller.rb +40 -0
data/test/rails3/app/controllers/application_controller.rb +2 -0
data/test/rails3/app/controllers/oauth_controller.rb +17 -0
data/test/rails3/config/application.rb +19 -0
data/test/rails3/config/environment.rb +2 -0
data/test/rails3/config/routes.rb +12 -0
data/test/setup.rb +120 -0
data/test/sinatra/my_app.rb +69 -0
metadata +145 -0

data/test/admin/ui_test.rb ADDED

@@ -0,0 +1,38 @@
+require "test/setup"
+class AdminUiTest < Test::Unit::TestCase
+  context "/" do
+    setup { get "/oauth/admin" }
+    should "return OK" do
+      assert_equal 200, last_response.status
+    end
+    should "return HTML page" do
+      assert_match "<html>", last_response.body
+    end
+  end
+  context "force SSL" do
+    setup { Server::Admin.force_ssl = true }
+    context "HTTP request" do
+      setup { get "/oauth/admin" }
+      should "redirect to HTTPS" do
+        assert_equal 302, last_response.status
+        assert_equal "https://example.org/oauth/admin", last_response.location
+      end
+    end
+    context "HTTPS request" do
+      setup { get "https://example.org/oauth/admin" }
+      should "serve request" do
+        assert_equal 200, last_response.status
+        assert_match "<html>", last_response.body
+      end
+    end
+    teardown { Server::Admin.force_ssl = false }
+  end
+end

data/test/oauth/access_grant_test.rb ADDED

@@ -0,0 +1,276 @@
+require "test/setup"
+# 4.  Obtaining an Access Token
+class AccessGrantTest < Test::Unit::TestCase
+  module Helpers
+    def should_return_error(error)
+      should "respond with status 400 (Bad Request)" do
+        assert_equal 400, last_response.status
+      end
+      should "respond with JSON document" do
+        assert_equal "application/json", last_response.content_type
+      end
+      should "respond with error code #{error}" do
+        assert_equal error.to_s, JSON.parse(last_response.body)["error"]
+      end
+    end
+    def should_respond_with_authentication_error(error)
+      should "respond with status 401 (Unauthorized)" do
+        assert_equal 401, last_response.status
+      end
+      should "respond with authentication method OAuth" do
+        assert_equal "OAuth", last_response["WWW-Authenticate"].split.first
+      end
+      should "respond with realm" do
+        assert_match " realm=\"example.org\"", last_response["WWW-Authenticate"]
+      end
+      should "respond with error code #{error}" do
+        assert_match " error=\"#{error}\"", last_response["WWW-Authenticate"]
+      end
+    end
+    def should_respond_with_access_token(scope = "read write")
+      should "respond with status 200" do
+        assert_equal 200, last_response.status
+      end
+      should "respond with JSON document" do
+        assert_equal "application/json", last_response.content_type
+      end
+      should "respond with cache control no-store" do
+        assert_equal "no-store", last_response["Cache-Control"]
+      end
+      should "not respond with error code" do
+        assert JSON.parse(last_response.body)["error"].nil?
+      end
+      should "response with access token" do
+        assert_match /[a-f0-9]{32}/i, JSON.parse(last_response.body)["access_token"]
+      end
+      should "response with scope" do
+        assert_equal scope || "", JSON.parse(last_response.body)["scope"]
+      end
+    end
+  end
+  extend Helpers
+  def setup
+    super
+    # Get authorization code.
+    params = { :redirect_uri=>client.redirect_uri, :client_id=>client.id, :client_secret=>client.secret, :response_type=>"code",
+               :scope=>"read write", :state=>"bring this back" }
+    get "/oauth/authorize?" + Rack::Utils.build_query(params)
+    get last_response["Location"] if last_response.status == 303
+    authorization = last_response.body[/authorization:\s*(\S+)/, 1]
+    post "/oauth/grant", :authorization=>authorization
+    @code = Rack::Utils.parse_query(URI.parse(last_response["Location"]).query)["code"]
+  end
+  def request_none(scope = nil)
+    basic_authorize client.id, client.secret
+    # Note: This grant_type becomes "client_credentials" in version 11 of the OAuth 2.0 spec
+    params = { :grant_type=>"none", :scope=>"read write" }
+    params[:scope] = scope if scope
+    post "/oauth/access_token", params
+  end
+  def request_access_token(changes = nil)
+    params = { :client_id=>client.id, :client_secret=>client.secret, :scope=>"read write",
+               :grant_type=>"authorization_code", :code=>@code, :redirect_uri=>client.redirect_uri }.merge(changes || {})
+    basic_authorize params.delete(:client_id), params.delete(:client_secret)
+    post "/oauth/access_token", params
+  end
+  def request_with_username_password(username, password, scope = nil)
+    basic_authorize client.id, client.secret
+    params = { :grant_type=>"password" }
+    params[:scope] = scope if scope
+    params[:username] = username if username
+    params[:password] = password if password
+    post "/oauth/access_token", params
+  end
+  # 4.  Obtaining an Access Token
+  context "GET request" do
+    setup { get "/oauth/access_token" }
+    should "respond with status 405 (Method Not Allowed)" do
+      assert_equal 405, last_response.status
+    end
+  end
+  context "no client ID" do
+    setup { request_access_token :client_id=>nil }
+    should_respond_with_authentication_error :invalid_client
+  end
+  context "invalid client ID" do
+    setup { request_access_token :client_id=>"foobar" }
+    should_respond_with_authentication_error :invalid_client
+  end
+  context "client ID but no such client" do
+    setup { request_access_token :client_id=>"4cc7bc483321e814b8000000" }
+    should_respond_with_authentication_error :invalid_client
+  end
+  context "no client secret" do
+    setup { request_access_token :client_secret=>nil }
+    should_respond_with_authentication_error :invalid_client
+  end
+  context "wrong client secret" do
+    setup { request_access_token :client_secret=>"plain wrong" }
+    should_respond_with_authentication_error :invalid_client
+  end
+  context "client revoked" do
+    setup do
+      client.revoke!
+      request_access_token
+    end
+    should_respond_with_authentication_error :invalid_client
+  end
+  context "unsupported grant type" do
+    setup { request_access_token :grant_type=>"bogus" }
+    should_return_error :unsupported_grant_type
+  end
+  # 4.1.1.  Authorization Code
+  context "no authorization code" do
+    setup { request_access_token :code=>nil }
+    should_return_error :invalid_grant
+  end
+  context "unknown authorization code" do
+    setup { request_access_token :code=>"unknown" }
+    should_return_error :invalid_grant
+  end
+  context "authorization code for different client" do
+    setup do
+      grant = Server::AccessGrant.create("foo bar", Server.register(:scope=>%w{read write}), "read write", nil)
+      request_access_token :code=>grant.code
+    end
+    should_return_error :invalid_grant
+  end
+  context "authorization code revoked" do
+    setup do
+      Server::AccessGrant.from_code(@code).revoke!
+      request_access_token
+    end
+    should_return_error :invalid_grant
+  end
+  context "mistmatched redirect URI" do
+    setup { request_access_token :redirect_uri=>"http://uberclient.dot/oz" }
+    should_return_error :invalid_grant
+  end
+  context "no redirect URI to match" do
+    setup do
+      @client = Server.register(:display_name=>"No rediret", :scope=>"read write")
+      grant = Server::AccessGrant.create("foo bar", client, "read write", nil)
+      request_access_token :code=>grant.code, :redirect_uri=>"http://uberclient.dot/oz"
+    end
+    should_respond_with_access_token
+  end
+  context "access grant expired" do
+    setup do
+      Timecop.travel 300 do
+        request_access_token
+      end
+    end
+    should_return_error :invalid_grant
+  end
+  context "access grant spent" do
+    setup do
+      request_access_token
+      request_access_token
+    end
+    should_return_error :invalid_grant
+  end
+  # 4.1.2.  Resource Owner Password Credentials
+  context "no username" do
+    setup { request_with_username_password nil, "more" }
+    should_return_error :invalid_grant
+  end
+  context "no password" do
+    setup { request_with_username_password nil, "more" }
+    should_return_error :invalid_grant
+  end
+  context "not authorized" do
+    setup { request_with_username_password "cowbell", "less" }
+    should_return_error :invalid_grant
+  end
+  context "no scope specified" do
+    setup { request_with_username_password "cowbell", "more" }
+    should_respond_with_access_token "oauth-admin read write"
+  end
+  context "given scope" do
+    setup { request_with_username_password "cowbell", "more", "read" }
+    should_respond_with_access_token "read"
+  end
+  context "unsupported scope" do
+    setup { request_with_username_password "cowbell", "more", "read write math" }
+    should_return_error :invalid_scope
+  end
+  context "authenticator with 4 parameters" do
+    setup do
+      @old = config.authenticator
+      config.authenticator = lambda do |username, password, client_id, scope|
+        @client_id = client_id
+        @scope = scope
+        "Batman"
+      end
+      request_with_username_password "cowbell", "more", "read"
+    end
+    should_respond_with_access_token "read"
+    should "receive client identifier" do
+      assert_equal client.id, @client_id
+    end
+    should "receive scope" do
+      assert_equal %w{read}, @scope
+    end
+    teardown { config.authenticator = @old }
+  end
+  # 4.2.  Access Token Response
+  context "using none" do
+    setup { request_none }
+    should_respond_with_access_token "read write"
+  end
+  context "using authorization code" do
+    setup { request_access_token }
+    should_respond_with_access_token "read write"
+  end
+  context "using username/password" do
+    setup { request_with_username_password "cowbell", "more", "read" }
+    should_respond_with_access_token "read"
+  end
+end

data/test/oauth/access_token_test.rb ADDED

@@ -0,0 +1,311 @@
+require "test/setup"
+# 5.  Accessing a Protected Resource
+class AccessTokenTest < Test::Unit::TestCase
+  module Helpers
+    def should_return_resource(content)
+      should "respond with status 200" do
+        assert_equal 200, last_response.status
+      end
+      should "respond with resource name" do
+        assert_equal content, last_response.body
+      end
+    end
+    def should_fail_authentication(error = nil)
+      should "respond with status 401 (Unauthorized)" do
+        assert_equal 401, last_response.status
+      end
+      should "respond with authentication method OAuth" do
+        assert_equal "OAuth", last_response["WWW-Authenticate"].split.first
+      end
+      should "respond with realm" do
+        assert_match " realm=\"example.org\"", last_response["WWW-Authenticate"]
+      end
+      if error
+        should "respond with error code #{error}" do
+          assert_match " error=\"#{error}\"", last_response["WWW-Authenticate"]
+        end
+      else
+        should "not respond with error code" do
+          assert !last_response["WWW-Authenticate"]["error="]
+        end
+      end
+    end
+  end
+  extend Helpers
+  def setup
+    super
+    # Get authorization code.
+    params = { :redirect_uri=>client.redirect_uri, :client_id=>client.id, :client_secret=>client.secret, :response_type=>"code",
+               :scope=>"read write", :state=>"bring this back" }
+    get "/oauth/authorize?" + Rack::Utils.build_query(params)
+    get last_response["Location"] if last_response.status == 303
+    authorization = last_response.body[/authorization:\s*(\S+)/, 1]
+    post "/oauth/grant", :authorization=>authorization
+    code = Rack::Utils.parse_query(URI.parse(last_response["Location"]).query)["code"]
+    # Get access token
+    basic_authorize client.id, client.secret
+    post "/oauth/access_token", :scope=>"read write", :grant_type=>"authorization_code", :code=>code, :redirect_uri=>client.redirect_uri
+    @token = JSON.parse(last_response.body)["access_token"]
+    header "Authorization", nil
+  end
+  def with_token(token = @token)
+    header "Authorization", "OAuth #{token}"
+  end
+  # 5.  Accessing a Protected Resource
+  context "public resource" do
+    context "no authorization" do
+      setup { get "/public" }
+      should_return_resource "HAI"
+    end
+    context "with authorization" do
+      setup do
+        with_token
+        get "/public"
+      end
+      should_return_resource "HAI from Batman"
+    end
+  end
+  context "private resource" do
+    context "no authorization" do
+      setup { get "/private" }
+      should_fail_authentication
+    end
+    context "HTTP authentication" do
+      context "valid token" do
+        setup do
+          with_token
+          get "/private"
+        end
+        should_return_resource "Shhhh"
+      end
+      context "unknown token" do
+        setup do
+          with_token "dingdong"
+          get "/private"
+        end
+        should_fail_authentication :invalid_token
+      end
+      context "revoked HTTP token" do
+        setup do
+          Server::AccessToken.from_token(@token).revoke!
+          with_token
+          get "/private"
+        end
+        should_fail_authentication :invalid_token
+      end
+      context "revoked client" do
+        setup do
+          client.revoke!
+          with_token
+          get "/private"
+        end
+        should_fail_authentication :invalid_token
+      end
+    end
+    # 5.1.2.  URI Query Parameter
+    context "query parameter" do
+      context "default mode" do
+        setup { get "/private?oauth_token=#{@token}" }
+        should_fail_authentication
+      end
+      context "enabled" do
+        setup do
+          config.param_authentication = true
+        end
+        context "valid token" do
+          setup { get "/private?oauth_token=#{@token}" }
+          should_return_resource "Shhhh"
+        end
+        context "invalid token" do
+          setup { get "/private?oauth_token=dingdong" }
+          should_fail_authentication :invalid_token
+        end
+        teardown do
+          config.param_authentication = false
+        end
+      end
+    end
+  end
+  context "POST" do
+    context "no authorization" do
+      setup { post "/change" }
+      should_fail_authentication
+    end
+    context "HTTP authentication" do
+      context "valid token" do
+        setup do
+          with_token
+          post "/change"
+        end
+        should_return_resource "Woot!"
+      end
+      context "unknown token" do
+        setup do
+          with_token "dingdong"
+          post "/change"
+        end
+        should_fail_authentication :invalid_token
+      end
+    end
+    # 5.1.3.  Form-Encoded Body Parameter
+    context "body parameter" do
+      context "default mode" do
+        setup { post "/change", :oauth_token=>@token }
+        should_fail_authentication
+      end
+      context "enabled" do
+        setup do
+          config.param_authentication = true
+        end
+        context "valid token" do
+          setup { post "/change", :oauth_token=>@token }
+          should_return_resource "Woot!"
+        end
+        context "invalid token" do
+          setup { post "/change", :oauth_token=>"dingdong" }
+          should_fail_authentication :invalid_token
+        end
+        teardown do
+          config.param_authentication = false
+        end
+      end
+    end
+  end
+  context "insufficient scope" do
+    context "valid token" do
+      setup do
+        with_token
+        get "/calc"
+      end
+      should "respond with status 403 (Forbidden)" do
+        assert_equal 403, last_response.status
+      end
+      should "respond with authentication method OAuth" do
+        assert_equal "OAuth", last_response["WWW-Authenticate"].split.first
+      end
+      should "respond with realm" do
+        assert_match " realm=\"example.org\"", last_response["WWW-Authenticate"]
+      end
+      should "respond with error code insufficient_scope" do
+        assert_match " error=\"insufficient_scope\"", last_response["WWW-Authenticate"]
+      end
+      should "respond with scope name" do
+        assert_match " scope=\"math\"", last_response["WWW-Authenticate"]
+      end
+    end
+  end
+  context "setting resource" do
+    context "authenticated" do
+      setup do
+        with_token
+        get "/user"
+      end
+      should "render user name" do
+        assert_equal "Batman", last_response.body
+      end
+    end
+    context "not authenticated" do
+      setup do
+        get "/user"
+      end
+      should "not render user name" do
+        assert  last_response.body.empty?
+      end
+    end
+  end
+  context "list tokens" do
+    setup do
+      @other = Server.token_for("foobar", client.id, "read")
+      get "/list_tokens"
+    end
+    should "return access token" do
+      assert_contains last_response.body.split, @token
+    end
+    should "not return other resource's token" do
+      assert !last_response.body.split.include?(@other)
+    end
+  end
+  context "with specific host" do
+    context "right host" do
+      setup do
+        get "http://example.org/public"
+      end
+      # Right host, but not authenticated
+      should_return_resource "HAI"
+    end
+    context "wrong host" do
+      setup do
+        with_token
+        get "http://wrong.org/public"
+      end
+      # Wrong host, not checking credentials
+      should_return_resource "HAI"
+    end
+  end
+  context "with specific path" do
+    setup { config.path = "/private" }
+    context "outside path" do
+      setup { with_token ; get "http://example.org/public" }
+      # Not authenticated
+      should_return_resource "HAI"
+    end
+    context "inside path" do
+      setup { with_token ; get "http://example.org/private" }
+      # Authenticated
+      should_return_resource "Shhhh"
+    end
+    teardown { config.path = nil }
+  end
+end