From e121b0fe6d1e663e5688d88ad191e0092f66094d Mon Sep 17 00:00:00 2001
From: danielgrippi <danielgrippi@gmail.com>
Date: Wed, 1 Jun 2011 18:56:43 -0700
Subject: [PATCH] Chubbies now sees that it has no secret and registers itself.
---
app/controllers/authorizations_controller.rb | 23 ++++++-
config/routes.rb | 2 +
features/oauth.feature | 13 +++-
features/step_definitions/oauth_steps.rb | 5 ++
spec/support/chubbies/Gemfile | 3 +-
spec/support/chubbies/Gemfile.lock | 2 +
spec/support/chubbies/app.rb | 70 ++++++++++++++------
7 files changed, 94 insertions(+), 24 deletions(-)
diff --git a/app/controllers/authorizations_controller.rb b/app/controllers/authorizations_controller.rb
index 2b90aed5eb..a3f42a1ae0 100644
--- a/app/controllers/authorizations_controller.rb
+++ b/app/controllers/authorizations_controller.rb
@@ -1,7 +1,9 @@
class AuthorizationsController < ApplicationController
include OAuth2::Provider::Rack::AuthorizationCodesSupport
- before_filter :authenticate_user!
- before_filter :block_invalid_authorization_code_requests
+ before_filter :authenticate_user!, :except => :token
+ before_filter :block_invalid_authorization_code_requests, :except => :token
+
+ skip_before_filter :verify_authenticity_token, :only => :token
def new
@client = oauth2_authorization_request.client
@@ -14,5 +16,22 @@ class AuthorizationsController < ApplicationController
deny_authorization_code
end
end
+
+ def token
+ if(params[:type] == 'client_associate' && params[:redirect_uri] && params[:name])
+ client = OAuth2::Provider.client_class.create!(:name => params[:name])
+
+ render :json => {:client_id => client.oauth_identifier,
+ :client_secret => client.oauth_secret,
+ :expires_in => 0,
+ :flows_supported => "",
+ :user_endpoint_url => "bob"}
+
+ #redirect_to("#{params[:redirect_uri]}?#{query_string}")
+
+ else
+ render :text => "bad request", :status => 403
+ end
+ end
end
diff --git a/config/routes.rb b/config/routes.rb
index 5a551a2670..ca32853cac 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -71,6 +71,8 @@ Diaspora::Application.routes.draw do
get "/oauth/authorize" => "authorizations#new"
post "/oauth/authorize" => "authorizations#create"
+ post "/oauth/token" => "authorizations#token"
+
#Temporary token_authenticable route
resource :token, :only => [:show, :create]
diff --git a/features/oauth.feature b/features/oauth.feature
index c3ce9a3e6e..cdc97fbe72 100644
--- a/features/oauth.feature
+++ b/features/oauth.feature
@@ -7,7 +7,6 @@ Feature: oauth
And a user with username "bob" and password "secret"
Scenario: Authorize Chubbies
- Given Chubbies is registered on my pod
When I visit "/" on Chubbies
And I try to authorize Chubbies
Then I should see "Authorize Chubbies?"
@@ -18,7 +17,6 @@ Feature: oauth
And I should see my "name"
Scenario: Not authorize Chubbies
- Given Chubbies is registered on my pod
When I visit "/" on Chubbies
And I try to authorize Chubbies
Then I should see "Authorize Chubbies?"
@@ -27,3 +25,14 @@ Feature: oauth
Then I should be on "/callback" on Chubbies
Then I should see "What is your major malfunction?"
+ Scenario: Authorize Chubbies
+ Given Chubbies is registered on my pod
+ When I visit "/" on Chubbies
+ And I try to authorize Chubbies
+ Then I should see "Authorize Chubbies?"
+
+ When I press "Yes"
+ Then I should be on "/account" on Chubbies
+ And I should see my "profile.birthday"
+ And I should see my "name"
+
diff --git a/features/step_definitions/oauth_steps.rb b/features/step_definitions/oauth_steps.rb
index bc219be12f..d059ee0501 100644
--- a/features/step_definitions/oauth_steps.rb
+++ b/features/step_definitions/oauth_steps.rb
@@ -20,6 +20,11 @@ And /^I should see my "([^"]+)"/ do |code|
end
When /^I try to authorize Chubbies$/ do
+ # We need to reset the tokens saved in Chubbies,
+ # as we are clearing the Diaspora DB every scenario
+ Then 'I visit "/reset" on Chubbies'
+ Then 'I visit "/" on Chubbies'
+ ###
And 'I follow "Log in with Diaspora"'
Then 'I should be on the new user session page'
And "I fill in \"Username\" with \"#{@me.username}\""
diff --git a/spec/support/chubbies/Gemfile b/spec/support/chubbies/Gemfile
index 42d3861db9..5c17d3d4eb 100644
--- a/spec/support/chubbies/Gemfile
+++ b/spec/support/chubbies/Gemfile
@@ -3,4 +3,5 @@ source :rubygems
gem 'sinatra'
gem 'haml'
-gem 'httparty'
\ No newline at end of file
+gem 'httparty'
+gem 'json'
diff --git a/spec/support/chubbies/Gemfile.lock b/spec/support/chubbies/Gemfile.lock
index 3e1dd93718..ef6042d285 100644
--- a/spec/support/chubbies/Gemfile.lock
+++ b/spec/support/chubbies/Gemfile.lock
@@ -5,6 +5,7 @@ GEM
haml (3.0.18)
httparty (0.7.4)
crack (= 0.1.8)
+ json (1.4.6)
rack (1.2.2)
sinatra (1.2.6)
rack (~> 1.1)
@@ -17,4 +18,5 @@ PLATFORMS
DEPENDENCIES
haml
httparty
+ json
sinatra
diff --git a/spec/support/chubbies/app.rb b/spec/support/chubbies/app.rb
index 33e1ef2efa..b8607f31a6 100644
--- a/spec/support/chubbies/app.rb
+++ b/spec/support/chubbies/app.rb
@@ -3,6 +3,7 @@ require 'bundler/setup'
require 'sinatra'
require 'haml'
require 'httparty'
+require 'json'
def resource_host
url = "http://localhost:"
@@ -14,8 +15,8 @@ def resource_host
url
end
-CLIENT_ID = 'abcdefgh12345678'
-CLIENT_SECRET = 'secret'
+@@client_id = nil
+@@client_secret = nil
RESOURCE_HOST = resource_host
enable :sessions
@@ -34,7 +35,11 @@ helpers do
end
def authorize_url
- RESOURCE_HOST + "/oauth/authorize?client_id=#{CLIENT_ID}&client_secret=#{CLIENT_SECRET}&redirect_uri=#{redirect_uri}"
+ RESOURCE_HOST + "/oauth/authorize?client_id=#{@@client_id}&client_secret=#{@@client_secret}&redirect_uri=#{redirect_uri}"
+ end
+
+ def token_url
+ RESOURCE_HOST + "/oauth/token"
end
def access_token_url
@@ -48,28 +53,55 @@ end
get '/callback' do
unless params["error"]
- response = HTTParty.post(access_token_url, :body => {
- :client_id => CLIENT_ID,
- :client_secret => CLIENT_SECRET,
- :redirect_uri => redirect_uri,
- :code => params["code"],
- :grant_type => 'authorization_code'}
- )
-
- session[:access_token] = response["access_token"]
- redirect '/account'
+
+ if(params["client_id"] && params["client_secret"])
+ @@client_id = params["client_id"]
+ @@client_secret = params["client_secret"]
+ redirect '/account'
+
+ else
+ response = HTTParty.post(access_token_url, :body => {
+ :client_id => @@client_id,
+ :client_secret => @@client_secret,
+ :redirect_uri => redirect_uri,
+ :code => params["code"],
+ :grant_type => 'authorization_code'}
+ )
+
+ session[:access_token] = response["access_token"]
+ redirect '/account'
+ end
else
"What is your major malfunction?"
end
end
get '/account' do
- if access_token
- @resource_server = RESOURCE_HOST
- @url = "/api/v0/me.json"
- @resource_response = get_with_access_token(@url)
- haml :response
+ if !@@client_id && !@@client_secret
+ response = HTTParty.post(token_url, :body => {
+ :type => :client_associate,
+ :name => :Chubbies,
+ :redirect_uri => redirect_uri
+ })
+
+ json = JSON.parse(response.body)
+
+ @@client_id = json["client_id"]
+ @@client_secret = json["client_secret"]
+
+ redirect '/account'
+
else
- redirect authorize_url
+ if access_token
+ @resource_response = get_with_access_token("/api/v0/me")
+ haml :response
+ else
+ redirect authorize_url
+ end
end
end
+
+get '/reset' do
+ @@client_id = nil
+ @@client_secret = nil
+end
--
GitLab