88d02ea35b
Client must now be registered prior to imitating a call to the token endpoint with the password flow. Squashed commits: [fdcef62] Rename authorization endpoint to protected resource endpoint
50 lines
1.9 KiB
Ruby
50 lines
1.9 KiB
Ruby
module OpenidConnect
|
|
module Authorization
|
|
class Endpoint
|
|
attr_accessor :app, :user, :client, :redirect_uri, :response_type, :scopes, :_request_, :request_uri, :request_object
|
|
delegate :call, to: :app
|
|
|
|
def initialize(current_user)
|
|
@user = current_user
|
|
@app = Rack::OAuth2::Server::Authorize.new do |req, res|
|
|
buildClient(req)
|
|
buildRedirectURI(req, res)
|
|
verifyNonce(req, res)
|
|
buildScopes(req)
|
|
buildRequestObject(req)
|
|
if OAuthApplication.available_response_types.include? Array(req.response_type).collect(&:to_s).join(' ')
|
|
handleResponseType(req, res)
|
|
else
|
|
req.unsupported_response_type!
|
|
end
|
|
end
|
|
end
|
|
def buildClient(req)
|
|
@client = OAuthApplication.find_by_client_id(req.client_id) || req.bad_request!
|
|
end
|
|
def buildRedirectURI(req, res)
|
|
res.redirect_uri = @redirect_uri = req.verify_redirect_uri!(@client.redirect_uris)
|
|
end
|
|
def verifyNonce(req, res)
|
|
if res.protocol_params_location == :fragment && req.nonce.blank?
|
|
req.invalid_request! 'nonce required'
|
|
end
|
|
end
|
|
def buildScopes(req)
|
|
@scopes = req.scope.inject([]) do |_scopes_, scope|
|
|
_scopes_ << Scope.find_by_name(scope) or req.invalid_scope! "Unknown scope: #{scope}"
|
|
end
|
|
end
|
|
def buildRequestObject(req)
|
|
@request_object = if (@_request_ = req.request).present?
|
|
OpenIDConnect::RequestObject.decode req.request, nil # @client.secret
|
|
elsif (@request_uri = req.request_uri).present?
|
|
OpenIDConnect::RequestObject.fetch req.request_uri, nil # @client.secret
|
|
end
|
|
end
|
|
def handleResponseType(req, res)
|
|
# Implemented by subclass
|
|
end
|
|
end
|
|
end
|
|
end
|