From 68e014aa7c6de178d98741e9da28b175f7ac9207 Mon Sep 17 00:00:00 2001 From: Victor Costa Date: Fri, 29 Aug 2014 16:53:57 -0300 Subject: [PATCH] oauth_provider: added plugin --- plugins/oauth_provider/Gemfile | 1 + plugins/oauth_provider/db/migrate/20140829153047_create_doorkeeper_tables.rb | 41 +++++++++++++++++++++++++++++++++++++++++ plugins/oauth_provider/lib/oauth_provider_plugin.rb | 109 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 151 insertions(+), 0 deletions(-) create mode 100644 plugins/oauth_provider/Gemfile create mode 100644 plugins/oauth_provider/db/migrate/20140829153047_create_doorkeeper_tables.rb create mode 100644 plugins/oauth_provider/lib/oauth_provider_plugin.rb diff --git a/plugins/oauth_provider/Gemfile b/plugins/oauth_provider/Gemfile new file mode 100644 index 0000000..89285c2 --- /dev/null +++ b/plugins/oauth_provider/Gemfile @@ -0,0 +1 @@ +gem 'doorkeeper' diff --git a/plugins/oauth_provider/db/migrate/20140829153047_create_doorkeeper_tables.rb b/plugins/oauth_provider/db/migrate/20140829153047_create_doorkeeper_tables.rb new file mode 100644 index 0000000..fd0bd10 --- /dev/null +++ b/plugins/oauth_provider/db/migrate/20140829153047_create_doorkeeper_tables.rb @@ -0,0 +1,41 @@ +class CreateDoorkeeperTables < ActiveRecord::Migration + def change + create_table :oauth_applications do |t| + t.string :name, null: false + t.string :uid, null: false + t.string :secret, null: false + t.text :redirect_uri, null: false + t.timestamps + end + + add_index :oauth_applications, :uid, unique: true + + create_table :oauth_access_grants do |t| + t.integer :resource_owner_id, null: false + t.integer :application_id, null: false + t.string :token, null: false + t.integer :expires_in, null: false + t.text :redirect_uri, null: false + t.datetime :created_at, null: false + t.datetime :revoked_at + t.string :scopes + end + + add_index :oauth_access_grants, :token, unique: true + + create_table :oauth_access_tokens do |t| + t.integer :resource_owner_id + t.integer :application_id + t.string :token, null: false + t.string :refresh_token + t.integer :expires_in + t.datetime :revoked_at + t.datetime :created_at, null: false + t.string :scopes + end + + add_index :oauth_access_tokens, :token, unique: true + add_index :oauth_access_tokens, :resource_owner_id + add_index :oauth_access_tokens, :refresh_token, unique: true + end +end diff --git a/plugins/oauth_provider/lib/oauth_provider_plugin.rb b/plugins/oauth_provider/lib/oauth_provider_plugin.rb new file mode 100644 index 0000000..9cd757e --- /dev/null +++ b/plugins/oauth_provider/lib/oauth_provider_plugin.rb @@ -0,0 +1,109 @@ +class OauthProviderPlugin < Noosfero::Plugin + + def self.plugin_name + "Oauth Provider Plugin" + end + + def self.plugin_description + _("Oauth Provider.") + end + + Doorkeeper.configure do + # Change the ORM that doorkeeper will use. + # Currently supported options are :active_record, :mongoid2, :mongoid3, :mongo_mapper + orm :active_record + + # This block will be called to check whether the resource owner is authenticated or not. + resource_owner_authenticator do + User.find_by_id(session[:user]) || redirect_to('/account/login') + #fail "Please configure doorkeeper resource_owner_authenticator block located in #{__FILE__}" + # Put your resource owner authentication logic here. + # Example implementation: + # User.find_by_id(session[:user_id]) || redirect_to(new_user_session_url) + end + + # If you want to restrict access to the web interface for adding oauth authorized applications, you need to declare the block below. + admin_authenticator do + # Put your admin authentication logic here. + # Example implementation: + User.find_by_id(session[:user]) || redirect_to('/account/login') + end + + # Authorization Code expiration time (default 10 minutes). + # authorization_code_expires_in 10.minutes + + # Access token expiration time (default 2 hours). + # If you want to disable expiration, set this to nil. + # access_token_expires_in 2.hours + + # Reuse access token for the same resource owner within an application (disabled by default) + # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/383 + # reuse_access_token + + # Issue access tokens with refresh token (disabled by default) + # use_refresh_token + + # Provide support for an owner to be assigned to each registered application (disabled by default) + # Optional parameter :confirmation => true (default false) if you want to enforce ownership of + # a registered application + # Note: you must also run the rails g doorkeeper:application_owner generator to provide the necessary support + # enable_application_owner :confirmation => false + + # Define access token scopes for your provider + # For more information go to + # https://github.com/doorkeeper-gem/doorkeeper/wiki/Using-Scopes + # default_scopes :public + # optional_scopes :write, :update + + # Change the way client credentials are retrieved from the request object. + # By default it retrieves first from the `HTTP_AUTHORIZATION` header, then + # falls back to the `:client_id` and `:client_secret` params from the `params` object. + # Check out the wiki for more information on customization + # client_credentials :from_basic, :from_params + + # Change the way access token is authenticated from the request object. + # By default it retrieves first from the `HTTP_AUTHORIZATION` header, then + # falls back to the `:access_token` or `:bearer_token` params from the `params` object. + # Check out the wiki for more information on customization + # access_token_methods :from_bearer_authorization, :from_access_token_param, :from_bearer_param + + # Change the native redirect uri for client apps + # When clients register with the following redirect uri, they won't be redirected to any server and the authorization code will be displayed within the provider + # The value can be any string. Use nil to disable this feature. When disabled, clients must provide a valid URL + # (Similar behaviour: https://developers.google.com/accounts/docs/OAuth2InstalledApp#choosingredirecturi) + # + # native_redirect_uri 'urn:ietf:wg:oauth:2.0:oob' + + # Specify what grant flows are enabled in array of Strings. The valid + # strings and the flows they enable are: + # + # "authorization_code" => Authorization Code Grant Flow + # "implicit" => Implicit Grant Flow + # "password" => Resource Owner Password Credentials Grant Flow + # "client_credentials" => Client Credentials Grant Flow + # + # If not specified, Doorkeeper enables all the four grant flows. + # + # grant_flows %w(authorization_code implicit password client_credentials) + + # Under some circumstances you might want to have applications auto-approved, + # so that the user skips the authorization step. + # For example if dealing with trusted a application. + # skip_authorization do |resource_owner, client| + # client.superapp? or resource_owner.admin? + # end + + # WWW-Authenticate Realm (default "Doorkeeper"). + # realm "Doorkeeper" + + # Allow dynamic query parameters (disabled by default) + # Some applications require dynamic query parameters on their request_uri + # set to true if you want this to be allowed + # wildcard_redirect_uri false + end + + Rails.application.routes.prepend do + use_doorkeeper + end + +end -- libgit2 0.21.2