credential
# @return [Signet::OAuth1::Credential] credential provided by
# credential (if any).
def call_credential_lookup(credential, key)
cred = credential.call(key) if
credential.respond_to?(:call)
return nil if cred.nil?
return nil unless (cred.respond_to?(:to_str) ||
cred.respond_to?(:to_ary) ||
cred.respond_to?(:to_hash) )
if(cred.instance_of?(::Signet::OAuth1::Credential))
cred
else
::Signet::OAuth1::Credential.new(cred)
end
end
##
# Determine if the verifier is valid by calling the Proc in {#verifier}.
#
# @param [String] verifier Key provided to the {#verifier} Proc.
# @return [Boolean] if the verifier Proc returns anything other than
# nil or false.
def find_verifier(verifier)
verified = @verifier.call(verifier) if @verifier.respond_to?(:call)
verified ? true : false
end
##
# Validate and normalize the components from an HTTP request.
# @overload verify_request_components(options)
# @param [Faraday::Request] request A pre-constructed request to verify.
# @param [String] method the HTTP method , defaults to GET
# @param [Addressable::URI, String] uri the URI .
# @param [Hash, Array] headers the HTTP headers.
# @param [StringIO, String] body The HTTP body.
# @param [HTTPAdapter] adapter The HTTP adapter(optional).
# @return [Hash] normalized request components
def verify_request_components(options={})
if options[:request]
if options[:request].kind_of?(Faraday::Request) || options[:request].kind_of?(Array)
request = options[:request]
elsif options[:adapter]
request = options[:adapter].adapt_request(options[:request])
end
method = request.method
uri = request.path
headers = request.headers
body = request.body
else
method = options[:method] || :get
uri = options[:uri]
headers = options[:headers] || []
body = options[:body] || ''
end
headers = headers.to_a if headers.kind_of?(Hash)
method = method.to_s.upcase
request_components = {
:method => method,
:uri => uri,
:headers => headers
}
# Verify that we have all the pieces required to validate the HTTP request
request_components.each do |(key, value)|
unless value
raise ArgumentError, "Missing :#{key} parameter."
end
end
request_components[:body] = body
request_components
end
##
# Validate and normalize the HTTP Authorization header.
#
# @param [Array] headers from HTTP request.
# @return [Hash] Hash of Authorization header.
def verify_auth_header_components(headers)
auth_header = headers.find{|x| x[0] == 'Authorization'}
if(auth_header.nil? || auth_header[1] == '')
raise MalformedAuthorizationError.new('Authorization header is missing')
end
auth_hash = ::Signet::OAuth1.parse_authorization_header(
auth_header[1] ).inject({}) {|acc, (key,val)| acc[key.downcase] = val; acc}
auth_hash
end
##
# @overload request_realm(options)
# @param [Hash] request A pre-constructed request to verify.
# @param [String] method the HTTP method , defaults to GET
# @param [Addressable::URI, String] uri the URI .
# @param [Hash, Array] headers the HTTP headers.
# @param [StringIO, String] body The HTTP body.
# @param [HTTPAdapter] adapter The HTTP adapter(optional).
# @return [String] The Authorization realm(see RFC 2617) of the request.
def request_realm(options={})
if(options[:request])
request_components = verify_request_components(
:request=>options[:request],
:adapter=>options[:adapter] )
else
request_components = verify_request_components(
:method=>options[:method],
:uri=>options[:uri],
:headers=>options[:headers],
:body=>options[:body] )
end
auth_header = request_components[:headers].find{|x| x[0] == 'Authorization'}
if(auth_header.nil? || auth_header[1] == '')
raise MalformedAuthorizationError.new('Authorization header is missing')
end
auth_hash = ::Signet::OAuth1.parse_authorization_header(
auth_header[1] ).inject({}) {|acc, (key,val)| acc[key.downcase] = val; acc}
auth_hash['realm']
end
##
# Authenticates a temporary credential request. If no oauth_callback is
# present in the request, oob will be returned.
#
# @overload authenticate_temporary_credential_request(options)
# @param [Hash] request The configuration parameters for the request.
# @param [String] method the HTTP method , defaults to GET
# @param [Addressable::URI, String] uri the URI .
# @param [Hash, Array] headers the HTTP headers.
# @param [StringIO, String] body The HTTP body.
# @param [HTTPAdapter] adapter The HTTP adapter(optional).
# @return [String] The oauth_callback value, or false if not valid.
def authenticate_temporary_credential_request(options={})
verifications = {
:client_credential =>
lambda { |x| ::Signet::OAuth1::Credential.new('Client credential key',
'Client credential secret'
)
}
}
verifications.each do |(key, _value)|
raise ArgumentError, "#{key} was not set." unless self.send(key)
end
if(options[:request])
request_components = verify_request_components(
:request=>options[:request],
:adapter=>options[:adapter] )
else
request_components = verify_request_components(
:method=>options[:method],
:uri=>options[:uri],
:headers=>options[:headers] )
end
# body should be blank; we don't care in any case.
method = request_components[:method]
uri = request_components[:uri]
headers = request_components[:headers]
auth_hash = verify_auth_header_components(headers)
return false unless(client_credential = find_client_credential(
auth_hash['oauth_consumer_key']) )
return false unless validate_nonce_timestamp(auth_hash['oauth_nonce'],
auth_hash['oauth_timestamp'])
client_credential_secret = client_credential.secret if client_credential
computed_signature = ::Signet::OAuth1.sign_parameters(
method,
uri,
# Realm isn't used, and will throw the signature off.
auth_hash.reject{|k,v| k=='realm'}.to_a,
client_credential_secret,
nil
)
if(computed_signature == auth_hash['oauth_signature'])
if(auth_hash.fetch('oauth_callback', 'oob').empty?)
'oob'
else
auth_hash.fetch('oauth_callback')
end
else
false
end
end
##
# Authenticates a token credential request.
# @overload authenticate_token_credential_request(options)
# @param [Hash] request The configuration parameters for the request.
# @param [String] method the HTTP method , defaults to GET
# @param [Addressable::URI, String] uri the URI .
# @param [Hash, Array] headers the HTTP headers.
# @param [StringIO, String] body The HTTP body.
# @param [HTTPAdapter] adapter The HTTP adapter(optional).
# @return [Hash] A hash of credentials and realm for a valid request,
# or nil if not valid.
def authenticate_token_credential_request(options={})
verifications = {
:client_credential =>
lambda {|x| ::Signet::OAuth1::Credential.new('Client credential key',
'Client credential secret')
},
:temporary_credential =>
lambda {|x| ::Signet::OAuth1::Credential.new('Temporary credential key',
'Temporary credential secret')
},
:verifier =>
lambda {|x| 'Verifier' }
}
verifications.each do |(key, _value)|
unless self.send(key)
raise ArgumentError, "#{key} was not set."
end
end
if(options[:request])
request_components = verify_request_components(
:request=>options[:request],
:adapter=>options[:adapter]
)
else
request_components = verify_request_components(
:method=>options[:method],
:uri=>options[:uri],
:headers=>options[:headers],
:body=>options[:body]
)
end
# body should be blank; we don't care in any case.
method = request_components[:method]
uri = request_components[:uri]
headers = request_components[:headers]
auth_hash = verify_auth_header_components(headers)
return false unless(
client_credential = find_client_credential(auth_hash['oauth_consumer_key'])
)
return false unless(
temporary_credential = find_temporary_credential(auth_hash['oauth_token'])
)
return false unless validate_nonce_timestamp(
auth_hash['oauth_nonce'], auth_hash['oauth_timestamp'])
computed_signature = ::Signet::OAuth1.sign_parameters(
method,
uri,
# Realm isn't used, and will throw the signature off.
auth_hash.reject{|k,v| k=='realm'}.to_a,
client_credential.secret,
temporary_credential.secret
)
if(computed_signature == auth_hash['oauth_signature'])
{:client_credential=>client_credential,
:temporary_credential=>temporary_credential,
:realm=>auth_hash['realm']
}
else
nil
end
end
##
# Authenticates a request for a protected resource.
# @overload authenticate_resource_request(options)
# @param [Hash] request The configuration parameters for the request.
# @param [String] method the HTTP method , defaults to GET
# @param [Addressable::URI, String] uri the URI .
# @param [Hash, Array] headers the HTTP headers.
# @param [StringIO, String] body The HTTP body.
# @param [Boolean] two_legged skip the token_credential lookup?
# @param [HTTPAdapter] adapter The HTTP adapter(optional).
#
# @return [Hash] A hash of the credentials and realm for a valid request,
# or nil if not valid.
def authenticate_resource_request(options={})
verifications = {
:client_credential =>
lambda do |x|
::Signet::OAuth1::Credential.new('Client credential key',
'Client credential secret')
end
}
unless(options[:two_legged] == true)
verifications.update(
:token_credential =>
lambda do |x|
::Signet::OAuth1::Credential.new('Token credential key',
'Token credential secret')
end
)
end
# Make sure all required state is set
verifications.each do |(key, _value)|
unless self.send(key)
raise ArgumentError, "#{key} was not set."
end
end
if(options[:request])
request_components = verify_request_components(
:request=>options[:request],
:adapter=>options[:adapter] )
else
request_components = verify_request_components(
:method=>options[:method],
:uri=>options[:uri],
:headers=>options[:headers],
:body=>options[:body] )
end
method = request_components[:method]
uri = request_components[:uri]
headers = request_components[:headers]
body = request_components[:body]
if !body.kind_of?(String) && body.respond_to?(:each)
# Just in case we get a chunked body
merged_body = StringIO.new
body.each do |chunk|
merged_body.write(chunk)
end
body = merged_body.string
end
if !body.kind_of?(String)
raise TypeError, "Expected String, got #{body.class}."
end
media_type = nil
headers.each do |(header, value)|
if header.downcase == 'Content-Type'.downcase
media_type = value.gsub(/^([^;]+)(;.*?)?$/, '\1')
end
end
auth_hash = verify_auth_header_components(headers)
auth_token = auth_hash['oauth_token']
unless(options[:two_legged])
return nil if(auth_token.nil?)
return nil unless(token_credential = find_token_credential(auth_token))
token_credential_secret = token_credential.secret if token_credential
end
return nil unless(client_credential =
find_client_credential(auth_hash['oauth_consumer_key']))
return nil unless validate_nonce_timestamp(auth_hash['oauth_nonce'],
auth_hash['oauth_timestamp'])
if(method == ('POST' || 'PUT') &&
media_type == 'application/x-www-form-urlencoded')
request_components[:body] = body
post_parameters = Addressable::URI.form_unencode(body)
post_parameters.each {|param| param[1] = "" if param[1].nil?}
# If the auth header doesn't have the same params as the body, it
# can't have been signed correctly(5849#3.4.1.3)
unless(post_parameters.sort == auth_hash.reject{|k,v| k.index('oauth_')}.to_a.sort)
raise MalformedAuthorizationError.new(
'Request is of type application/x-www-form-urlencoded ' +
'but Authentication header did not include form values'
)
end
end
client_credential_secret = client_credential.secret if client_credential
computed_signature = ::Signet::OAuth1.sign_parameters(
method,
uri,
# Realm isn't used, and will throw the signature off.
auth_hash.reject{|k,v| k=='realm'}.to_a,
client_credential_secret,
token_credential_secret
)
if(computed_signature == auth_hash['oauth_signature'])
{:client_credential=>client_credential,
:token_credential=>token_credential,
:realm=>auth_hash['realm']
}
else
nil
end
end
end
end
end
signet-0.7.3/lib/signet/oauth_1/client.rb 0000644 0001750 0001750 00000116333 13043627421 017251 0 ustar pravi pravi # Copyright (C) 2010 Google Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
require 'faraday'
#require 'faraday/utils'
require 'stringio'
require 'addressable/uri'
require 'signet'
require 'signet/errors'
require 'signet/oauth_1'
require 'signet/oauth_1/credential'
module Signet
module OAuth1
class Client
##
# Creates an OAuth 1.0 client.
#
# @param [Hash] options
# The configuration parameters for the client.
# - :temporary_credential_uri -
# The OAuth temporary credentials URI.
# - :authorization_uri -
# The OAuth authorization URI.
# - :token_credential_uri -
# The OAuth token credentials URI.
# - :client_credential_key -
# The OAuth client credential key.
# - :client_credential_secret -
# The OAuth client credential secret.
# - :callback - The OAuth callback. Defaults to 'oob'.
#
# @example
# client = Signet::OAuth1::Client.new(
# :temporary_credential_uri =>
# 'https://www.google.com/accounts/OAuthGetRequestToken',
# :authorization_uri =>
# 'https://www.google.com/accounts/OAuthAuthorizeToken',
# :token_credential_uri =>
# 'https://www.google.com/accounts/OAuthGetAccessToken',
# :client_credential_key => 'anonymous',
# :client_credential_secret => 'anonymous'
# )
def initialize(options={})
self.update!(options)
end
##
# Updates an OAuth 1.0 client.
#
# @param [Hash] options
# The configuration parameters for the client.
# - :temporary_credential_uri -
# The OAuth temporary credentials URI.
# - :authorization_uri -
# The OAuth authorization URI.
# - :token_credential_uri -
# The OAuth token credentials URI.
# - :client_credential_key -
# The OAuth client credential key.
# - :client_credential_secret -
# The OAuth client credential secret.
# - :callback - The OAuth callback. Defaults to 'oob'.
#
# @example
# client.update!(
# :temporary_credential_uri =>
# 'https://www.google.com/accounts/OAuthGetRequestToken',
# :authorization_uri =>
# 'https://www.google.com/accounts/OAuthAuthorizeToken',
# :token_credential_uri =>
# 'https://www.google.com/accounts/OAuthGetAccessToken',
# :client_credential_key => 'anonymous',
# :client_credential_secret => 'anonymous'
# )
#
# @see Signet::OAuth1::Client#initialize
def update!(options={})
# Normalize key to String to allow indifferent access.
options = options.inject({}) { |accu, (k, v)| accu[k.to_s] = v; accu }
self.temporary_credential_uri = options["temporary_credential_uri"]
self.authorization_uri = options["authorization_uri"]
self.token_credential_uri = options["token_credential_uri"]
# Technically... this would allow you to pass in a :client key...
# But that would be weird. Don't do that.
self.client_credential_key =
Signet::OAuth1.extract_credential_key_option("client", options)
self.client_credential_secret =
Signet::OAuth1.extract_credential_secret_option("client", options)
self.temporary_credential_key =
Signet::OAuth1.extract_credential_key_option("temporary", options)
self.temporary_credential_secret =
Signet::OAuth1.extract_credential_secret_option("temporary", options)
self.token_credential_key =
Signet::OAuth1.extract_credential_key_option("token", options)
self.token_credential_secret =
Signet::OAuth1.extract_credential_secret_option("token", options)
self.callback = options["callback"]
self.two_legged = options["two_legged"] || false
return self
end
##
# Returns the temporary credentials URI for this client.
#
# @return [Addressable::URI] The temporary credentials URI.
def temporary_credential_uri
return @temporary_credential_uri
end
alias_method :request_token_uri, :temporary_credential_uri
##
# Sets the temporary credentials URI for this client.
#
# @param [Addressable::URI, String, #to_str]
# new_temporary_credential_uri
# The temporary credentials URI.
def temporary_credential_uri=(new_temporary_credential_uri)
if new_temporary_credential_uri != nil
new_temporary_credential_uri =
Addressable::URI.parse(new_temporary_credential_uri)
@temporary_credential_uri = new_temporary_credential_uri
else
@temporary_credential_uri = nil
end
end
alias_method :request_token_uri=, :temporary_credential_uri=
##
# Returns the authorization URI that the user should be redirected to.
#
# @return [Addressable::URI] The authorization URI.
#
# @see Signet::OAuth1.generate_authorization_uri
def authorization_uri(options={})
options = options.merge(
:temporary_credential_key => self.temporary_credential_key,
:callback => self.callback
)
return nil if @authorization_uri == nil
return Addressable::URI.parse(
::Signet::OAuth1.generate_authorization_uri(
@authorization_uri, options
)
)
end
##
# Sets the authorization URI for this client.
#
# @param [Addressable::URI, String, #to_str] new_authorization_uri
# The authorization URI.
def authorization_uri=(new_authorization_uri)
if new_authorization_uri != nil
new_authorization_uri = Addressable::URI.send(
new_authorization_uri.kind_of?(Hash) ? :new : :parse,
new_authorization_uri
)
@authorization_uri = new_authorization_uri
else
@authorization_uri = nil
end
end
##
# Returns the token credential URI for this client.
#
# @return [Addressable::URI] The token credential URI.
def token_credential_uri
return @token_credential_uri
end
alias_method :access_token_uri, :token_credential_uri
##
# Sets the token credential URI for this client.
#
# @param [Addressable::URI, Hash, String, #to_str] new_token_credential_uri
# The token credential URI.
def token_credential_uri=(new_token_credential_uri)
if new_token_credential_uri != nil
new_token_credential_uri = Addressable::URI.send(
new_token_credential_uri.kind_of?(Hash) ? :new : :parse,
new_token_credential_uri
)
@token_credential_uri = new_token_credential_uri
else
@token_credential_uri = nil
end
end
alias_method :access_token_uri=, :token_credential_uri=
# Lots of duplicated code here, but for the sake of auto-generating
# documentation, we're going to let it slide. Oh well.
##
# Returns the client credential for this client.
#
# @return [Signet::OAuth1::Credential] The client credentials.
def client_credential
if self.client_credential_key && self.client_credential_secret
return ::Signet::OAuth1::Credential.new(
self.client_credential_key,
self.client_credential_secret
)
elsif !self.client_credential_key && !self.client_credential_secret
return nil
else
raise ArgumentError,
"The client credential key and secret must be set."
end
end
alias_method :consumer_token, :client_credential
##
# Sets the client credential for this client.
#
# @param [Signet::OAuth1::Credential] new_client_credential
# The client credentials.
def client_credential=(new_client_credential)
if new_client_credential != nil
if !new_client_credential.kind_of?(::Signet::OAuth1::Credential)
raise TypeError,
"Expected Signet::OAuth1::Credential, " +
"got #{new_client_credential.class}."
end
@client_credential_key = new_client_credential.key
@client_credential_secret = new_client_credential.secret
else
@client_credential_key = nil
@client_credential_secret = nil
end
end
alias_method :consumer_token=, :client_credential=
##
# Returns the client credential key for this client.
#
# @return [String] The client credential key.
def client_credential_key
return @client_credential_key
end
alias_method :consumer_key, :client_credential_key
##
# Sets the client credential key for this client.
#
# @param [String, #to_str] new_client_credential_key
# The client credential key.
def client_credential_key=(new_client_credential_key)
if new_client_credential_key != nil
if !new_client_credential_key.respond_to?(:to_str)
raise TypeError,
"Can't convert #{new_client_credential_key.class} into String."
end
new_client_credential_key = new_client_credential_key.to_str
@client_credential_key = new_client_credential_key
else
@client_credential_key = nil
end
end
alias_method :consumer_key=, :client_credential_key=
##
# Returns the client credential secret for this client.
#
# @return [String] The client credential secret.
def client_credential_secret
return @client_credential_secret
end
alias_method :consumer_secret, :client_credential_secret
##
# Sets the client credential secret for this client.
#
# @param [String, #to_str] new_client_credential_secret
# The client credential secret.
def client_credential_secret=(new_client_credential_secret)
if new_client_credential_secret != nil
if !new_client_credential_secret.respond_to?(:to_str)
raise TypeError,
"Can't convert #{new_client_credential_secret.class} " +
"into String."
end
new_client_credential_secret = new_client_credential_secret.to_str
@client_credential_secret = new_client_credential_secret
else
@client_credential_secret = nil
end
end
alias_method :consumer_secret=, :client_credential_secret=
##
# Returns the temporary credential for this client.
#
# @return [Signet::OAuth1::Credential] The temporary credentials.
def temporary_credential
if self.temporary_credential_key && self.temporary_credential_secret
return ::Signet::OAuth1::Credential.new(
self.temporary_credential_key,
self.temporary_credential_secret
)
elsif !self.temporary_credential_key &&
!self.temporary_credential_secret
return nil
else
raise ArgumentError,
"The temporary credential key and secret must be set."
end
end
alias_method :request_token, :temporary_credential
##
# Sets the temporary credential for this client.
#
# @param [Signet::OAuth1::Credential] new_temporary_credential
# The temporary credentials.
def temporary_credential=(new_temporary_credential)
if new_temporary_credential != nil
if !new_temporary_credential.kind_of?(::Signet::OAuth1::Credential)
raise TypeError,
"Expected Signet::OAuth1::Credential, " +
"got #{new_temporary_credential.class}."
end
@temporary_credential_key = new_temporary_credential.key
@temporary_credential_secret = new_temporary_credential.secret
else
@temporary_credential_key = nil
@temporary_credential_secret = nil
end
end
alias_method :request_token=, :temporary_credential=
##
# Returns the temporary credential key for this client.
#
# @return [String] The temporary credential key.
def temporary_credential_key
return @temporary_credential_key
end
alias_method :request_token_key, :temporary_credential_key
##
# Sets the temporary credential key for this client.
#
# @param [String, #to_str] new_temporary_credential_key
# The temporary credential key.
def temporary_credential_key=(new_temporary_credential_key)
if new_temporary_credential_key != nil
if !new_temporary_credential_key.respond_to?(:to_str)
raise TypeError,
"Can't convert #{new_temporary_credential_key.class} " +
"into String."
end
new_temporary_credential_key = new_temporary_credential_key.to_str
@temporary_credential_key = new_temporary_credential_key
else
@temporary_credential_key = nil
end
end
alias_method :request_token_key=, :temporary_credential_key=
##
# Returns the temporary credential secret for this client.
#
# @return [String] The temporary credential secret.
def temporary_credential_secret
return @temporary_credential_secret
end
alias_method :request_token_secret, :temporary_credential_secret
##
# Sets the temporary credential secret for this client.
#
# @param [String, #to_str] new_temporary_credential_secret
# The temporary credential secret.
def temporary_credential_secret=(new_temporary_credential_secret)
if new_temporary_credential_secret != nil
if !new_temporary_credential_secret.respond_to?(:to_str)
raise TypeError,
"Can't convert #{new_temporary_credential_secret.class} " +
"into String."
end
new_temporary_credential_secret =
new_temporary_credential_secret.to_str
@temporary_credential_secret = new_temporary_credential_secret
else
@temporary_credential_secret = nil
end
end
alias_method :request_token_secret=, :temporary_credential_secret=
##
# Returns the token credential for this client.
#
# @return [Signet::OAuth1::Credential] The token credentials.
def token_credential
if self.token_credential_key && self.token_credential_secret
return ::Signet::OAuth1::Credential.new(
self.token_credential_key,
self.token_credential_secret
)
elsif !self.token_credential_key &&
!self.token_credential_secret
return nil
else
raise ArgumentError,
"The token credential key and secret must be set."
end
end
alias_method :access_token, :token_credential
##
# Sets the token credential for this client.
#
# @param [Signet::OAuth1::Credential] new_token_credential
# The token credentials.
def token_credential=(new_token_credential)
if new_token_credential != nil
if !new_token_credential.kind_of?(::Signet::OAuth1::Credential)
raise TypeError,
"Expected Signet::OAuth1::Credential, " +
"got #{new_token_credential.class}."
end
@token_credential_key = new_token_credential.key
@token_credential_secret = new_token_credential.secret
else
@token_credential_key = nil
@token_credential_secret = nil
end
end
alias_method :access_token=, :token_credential=
##
# Returns the token credential key for this client.
#
# @return [String] The token credential key.
def token_credential_key
return @token_credential_key
end
alias_method :access_token_key, :token_credential_key
##
# Sets the token credential key for this client.
#
# @param [String, #to_str] new_token_credential_key
# The token credential key.
def token_credential_key=(new_token_credential_key)
if new_token_credential_key != nil
if !new_token_credential_key.respond_to?(:to_str)
raise TypeError,
"Can't convert #{new_token_credential_key.class} " +
"into String."
end
new_token_credential_key = new_token_credential_key.to_str
@token_credential_key = new_token_credential_key
else
@token_credential_key = nil
end
end
alias_method :access_token_key=, :token_credential_key=
##
# Returns the token credential secret for this client.
#
# @return [String] The token credential secret.
def token_credential_secret
return @token_credential_secret
end
alias_method :access_token_secret, :token_credential_secret
##
# Sets the token credential secret for this client.
#
# @param [String, #to_str] new_token_credential_secret
# The token credential secret.
def token_credential_secret=(new_token_credential_secret)
if new_token_credential_secret != nil
if !new_token_credential_secret.respond_to?(:to_str)
raise TypeError,
"Can't convert #{new_token_credential_secret.class} " +
"into String."
end
new_token_credential_secret =
new_token_credential_secret.to_str
@token_credential_secret = new_token_credential_secret
else
@token_credential_secret = nil
end
end
alias_method :access_token_secret=, :token_credential_secret=
##
# Returns the callback for this client.
#
# @return [String] The OAuth callback.
def callback
return @callback || ::Signet::OAuth1::OUT_OF_BAND
end
##
# Sets the callback for this client.
#
# @param [String, #to_str] new_callback
# The OAuth callback.
def callback=(new_callback)
if new_callback != nil
if !new_callback.respond_to?(:to_str)
raise TypeError,
"Can't convert #{new_callback.class} into String."
end
new_callback = new_callback.to_str
@callback = new_callback
else
@callback = nil
end
end
##
# Returns whether the client is in two-legged mode.
#
# @return [TrueClass, FalseClass]
# true for two-legged mode, false otherwise.
def two_legged
return @two_legged ||= false
end
##
# Sets the client for two-legged mode.
#
# @param [TrueClass, FalseClass] new_two_legged
# true for two-legged mode, false otherwise.
def two_legged=(new_two_legged)
if new_two_legged != true && new_two_legged != false
raise TypeError,
"Expected true or false, got #{new_two_legged.class}."
else
@two_legged = new_two_legged
end
end
##
# Serialize the client object to JSON.
#
# @note A serialized client contains sensitive information. Persist or transmit with care.
#
# @return [String] A serialized JSON representation of the client.
def to_json
return MultiJson.dump({
'temporary_credential_uri' => self.temporary_credential_uri,
'authorization_uri' => self.authorization_uri,
'token_credential_uri' => self.token_credential_uri,
'callback' => self.callback,
'two_legged' => self.two_legged,
'client_credential_key' => self.client_credential_key,
'client_credential_secret' => self.client_credential_secret,
'temporary_credential_key' => self.temporary_credential_key,
'temporary_credential_secret' => self.temporary_credential_secret,
'token_credential_key' => self.token_credential_key,
'token_credential_secret' => self.token_credential_secret
})
end
##
# Generates a request for temporary credentials.
#
# @param [Hash] options
# The configuration parameters for the request.
# - :signature_method -
# The signature method. Defaults to 'HMAC-SHA1'.
# - :additional_parameters -
# Non-standard additional parameters.
# - :realm -
# The Authorization realm. See RFC 2617.
#
# @return [Array] The request object.
def generate_temporary_credential_request(options={})
verifications = {
:temporary_credential_uri => 'Temporary credentials URI',
:client_credential_key => 'Client credential key',
:client_credential_secret => 'Client credential secret'
}
# Make sure all required state is set
verifications.each do |(key, _value)|
unless self.send(key)
raise ArgumentError, "#{key} was not set."
end
end
options = {
:signature_method => 'HMAC-SHA1',
:additional_parameters => [],
:realm => nil,
:connection => Faraday.default_connection
}.merge(options)
method = :post
parameters = ::Signet::OAuth1.unsigned_temporary_credential_parameters(
:client_credential_key => self.client_credential_key,
:callback => self.callback,
:signature_method => options[:signature_method],
:additional_parameters => options[:additional_parameters]
)
signature = ::Signet::OAuth1.sign_parameters(
method,
self.temporary_credential_uri,
parameters,
self.client_credential_secret
)
parameters << ['oauth_signature', signature]
authorization_header = [
'Authorization',
::Signet::OAuth1.generate_authorization_header(
parameters, options[:realm]
)
]
headers = [authorization_header]
if method == :post
headers << ['Content-Type', 'application/x-www-form-urlencoded']
headers << ['Content-Length', '0']
end
return options[:connection].build_request(method.to_s.downcase.to_sym) do |req|
req.url(Addressable::URI.parse(
self.temporary_credential_uri.to_str
).normalize.to_s)
req.headers = Faraday::Utils::Headers.new(headers)
end
end
alias_method(
:generate_request_token_request,
:generate_temporary_credential_request
)
##
# Transmits a request for a temporary credential. This method does not
# have side-effects within the client.
#
# @param [Hash] options
# The configuration parameters for the request.
# - :signature_method -
# The signature method. Defaults to 'HMAC-SHA1'.
# - :additional_parameters -
# Non-standard additional parameters.
# - :realm -
# The Authorization realm. See RFC 2617.
# - :connection -
# The HTTP connection to use.
# Must be of type Faraday::Connection.
#
# @return [Signet::OAuth1::Credential] The temporary credential.
#
# @example
# temporary_credential = client.fetch_temporary_credential(
# :additional_parameters => {
# :scope => 'https://mail.google.com/mail/feed/atom'
# }
# )
def fetch_temporary_credential(options={})
options[:connection] ||= Faraday.default_connection
request = self.generate_temporary_credential_request(options)
request_env = request.to_env(options[:connection])
request_env[:request] ||= request
response = options[:connection].app.call(request_env)
if response.status.to_i == 200
return ::Signet::OAuth1.parse_form_encoded_credentials(response.body)
elsif [400, 401, 403].include?(response.status.to_i)
message = 'Authorization failed.'
if response.body.to_s.strip.length > 0
message += " Server message:\n#{response.body.to_s.strip}"
end
raise ::Signet::AuthorizationError.new(
message, :request => request, :response => response
)
else
message = "Unexpected status code: #{response.status}."
if response.body.to_s.strip.length > 0
message += " Server message:\n#{response.body.to_s.strip}"
end
raise ::Signet::AuthorizationError.new(
message, :request => request, :response => response
)
end
end
alias_method(
:fetch_request_token,
:fetch_temporary_credential
)
##
# Transmits a request for a temporary credential. This method updates
# the client with the new temporary credential.
#
# @param [Hash] options
# The configuration parameters for the request.
# - :signature_method -
# The signature method. Defaults to 'HMAC-SHA1'.
# - :additional_parameters -
# Non-standard additional parameters.
# - :realm -
# The Authorization realm. See RFC 2617.
# - :connection -
# The HTTP connection to use.
# Must be of type Faraday::Connection.
#
# @return [Signet::OAuth1::Credential] The temporary credential.
#
# @example
# client.fetch_temporary_credential!(:additional_parameters => {
# :scope => 'https://mail.google.com/mail/feed/atom'
# })
def fetch_temporary_credential!(options={})
credential = self.fetch_temporary_credential(options)
self.temporary_credential = credential
end
alias_method(
:fetch_request_token!,
:fetch_temporary_credential!
)
##
# Generates a request for token credentials.
#
# @param [Hash] options
# The configuration parameters for the request.
# - :verifier -
# The OAuth verifier provided by the server. Required.
# - :signature_method -
# The signature method. Defaults to 'HMAC-SHA1'.
# - :realm -
# The Authorization realm. See RFC 2617.
#
# @return [Array] The request object.
def generate_token_credential_request(options={})
verifications = {
:token_credential_uri => 'Token credentials URI',
:client_credential_key => 'Client credential key',
:client_credential_secret => 'Client credential secret',
:temporary_credential_key => 'Temporary credential key',
:temporary_credential_secret => 'Temporary credential secret'
}
# Make sure all required state is set
verifications.each do |(key, _value)|
unless self.send(key)
raise ArgumentError, "#{key} was not set."
end
end
options = {
:signature_method => 'HMAC-SHA1',
:realm => nil,
:connection => Faraday.default_connection
}.merge(options)
method = :post
parameters = ::Signet::OAuth1.unsigned_token_credential_parameters(
:client_credential_key => self.client_credential_key,
:temporary_credential_key => self.temporary_credential_key,
:signature_method => options[:signature_method],
:verifier => options[:verifier]
)
signature = ::Signet::OAuth1.sign_parameters(
method,
self.token_credential_uri,
parameters,
self.client_credential_secret,
self.temporary_credential_secret
)
parameters << ['oauth_signature', signature]
authorization_header = [
'Authorization',
::Signet::OAuth1.generate_authorization_header(
parameters, options[:realm]
)
]
headers = [authorization_header]
headers << ['Cache-Control', 'no-store']
if method == :post
headers << ['Content-Type', 'application/x-www-form-urlencoded']
headers << ['Content-Length', '0']
end
return options[:connection].build_request(method.to_s.downcase.to_sym) do |req|
req.url(Addressable::URI.parse(
self.token_credential_uri.to_str
).normalize.to_s)
req.headers = Faraday::Utils::Headers.new(headers)
end
end
alias_method(
:generate_access_token_request,
:generate_token_credential_request
)
##
# Transmits a request for a token credential. This method does not
# have side-effects within the client.
#
# @param [Hash] options
# The configuration parameters for the request.
# - :verifier -
# The OAuth verifier provided by the server. Required.
# - :signature_method -
# The signature method. Defaults to 'HMAC-SHA1'.
# - :realm -
# The Authorization realm. See RFC 2617.
# - :connection -
# The HTTP connection to use.
# Must be of type Faraday::Connection.
#
# @return [Signet::OAuth1::Credential] The token credential.
#
# @example
# token_credential = client.fetch_token_credential(
# :verifier => '12345'
# )
def fetch_token_credential(options={})
options[:connection] ||= Faraday.default_connection
request = self.generate_token_credential_request(options)
request_env = request.to_env(options[:connection])
request_env[:request] ||= request
response = options[:connection].app.call(request_env)
if response.status.to_i == 200
return ::Signet::OAuth1.parse_form_encoded_credentials(response.body)
elsif [400, 401, 403].include?(response.status.to_i)
message = 'Authorization failed.'
if response.body.to_s.strip.length > 0
message += " Server message:\n#{response.body.to_s.strip}"
end
raise ::Signet::AuthorizationError.new(
message, :request => request, :response => response
)
else
message = "Unexpected status code: #{response.status}."
if response.body.to_s.strip.length > 0
message += " Server message:\n#{response.body.to_s.strip}"
end
raise ::Signet::AuthorizationError.new(
message, :request => request, :response => response
)
end
end
alias_method(
:fetch_access_token,
:fetch_token_credential
)
##
# Transmits a request for a token credential. This method updates
# the client with the new token credential.
#
# @param [Hash] options
# The configuration parameters for the request.
# - :signature_method -
# The signature method. Defaults to 'HMAC-SHA1'.
# - :additional_parameters -
# Non-standard additional parameters.
# - :realm -
# The Authorization realm. See RFC 2617.
# - :connection -
# The HTTP connection to use.
# Must be of type Faraday::Connection.
#
# @return [Signet::OAuth1::Credential] The token credential.
#
# @example
# client.fetch_token_credential!(:verifier => '12345')
def fetch_token_credential!(options={})
credential = self.fetch_token_credential(options)
self.token_credential = credential
end
alias_method(
:fetch_access_token!,
:fetch_token_credential!
)
##
# Generates an authenticated request for protected resources.
#
# @param [Hash] options
# The configuration parameters for the request.
# - :request -
# A pre-constructed request to sign.
# - :method -
# The HTTP method for the request. Defaults to :get.
# - :uri -
# The URI for the request.
# - :headers -
# The HTTP headers for the request.
# - :body -
# The HTTP body for the request.
# - :signature_method -
# The signature method. Defaults to 'HMAC-SHA1'.
# - :realm -
# The Authorization realm. See RFC 2617.
#
# @return [Array] The request object.
def generate_authenticated_request(options={})
verifications = {
:client_credential_key => 'Client credential key',
:client_credential_secret => 'Client credential secret'
}
unless self.two_legged
verifications.update(
:token_credential_key => 'Token credential key',
:token_credential_secret => 'Token credential secret'
)
end
# Make sure all required state is set
verifications.each do |(key, _value)|
unless self.send(key)
raise ArgumentError, "#{key} was not set."
end
end
options = {
:signature_method => 'HMAC-SHA1',
:realm => nil,
:connection => Faraday.default_connection
}.merge(options)
if options[:request].kind_of?(Faraday::Request)
request = options[:request]
else
if options[:request].kind_of?(Array)
method, uri, headers, body = options[:request]
else
method = options[:method] || :get
uri = options[:uri]
headers = options[:headers] || []
body = options[:body] || ''
end
headers = headers.to_a if headers.kind_of?(Hash)
request_components = {
:method => method,
:uri => uri,
:headers => headers,
:body => body
}
# Verify that we have all pieces required to return an HTTP request
request_components.each do |(key, value)|
unless value
raise ArgumentError, "Missing :#{key} parameter."
end
end
if !body.kind_of?(String) && body.respond_to?(:each)
# Just in case we get a chunked body
merged_body = StringIO.new
body.each do |chunk|
merged_body.write(chunk)
end
body = merged_body.string
end
if !body.kind_of?(String)
raise TypeError, "Expected String, got #{body.class}."
end
method = method.to_s.downcase.to_sym
request = options[:connection].build_request(method) do |req|
req.url(Addressable::URI.parse(uri).normalize.to_s)
req.headers = Faraday::Utils::Headers.new(headers)
req.body = body
end
end
parameters = ::Signet::OAuth1.unsigned_resource_parameters(
:client_credential_key => self.client_credential_key,
:token_credential_key => self.token_credential_key,
:signature_method => options[:signature_method],
:two_legged => self.two_legged
)
env = request.to_env(options[:connection])
content_type = request['Content-Type'].to_s
content_type = content_type.split(';', 2).first if content_type.index(';')
if request.method == :post && content_type == 'application/x-www-form-urlencoded'
# Serializes the body in case a hash/array was passed. Noop if already string like
encoder = Faraday::Request::UrlEncoded.new(lambda { |_env| })
encoder.call(env)
request.body = env[:body]
post_parameters = Addressable::URI.form_unencode(env[:body])
parameters = parameters.concat(post_parameters)
end
# No need to attach URI query parameters, the .sign_parameters
# method takes care of that automatically.
signature = ::Signet::OAuth1.sign_parameters(
env[:method],
env[:url],
parameters,
self.client_credential_secret,
self.token_credential_secret
)
parameters << ['oauth_signature', signature]
request['Authorization'] = ::Signet::OAuth1.generate_authorization_header(
parameters, options[:realm])
request['Cache-Control'] = 'no-store'
return request
end
##
# Transmits a request for a protected resource.
#
# @param [Hash] options
# The configuration parameters for the request.
# - :request -
# A pre-constructed request to sign.
# - :method -
# The HTTP method for the request. Defaults to :get.
# - :uri -
# The URI for the request.
# - :headers -
# The HTTP headers for the request.
# - :body -
# The HTTP body for the request.
# - :signature_method -
# The signature method. Defaults to 'HMAC-SHA1'.
# - :realm -
# The Authorization realm. See RFC 2617.
# - :connection -
# The HTTP connection to use.
# Must be of type Faraday::Connection.
#
# @example
# # Using Net::HTTP
# response = client.fetch_protected_resource(
# :uri => 'http://www.example.com/protected/resource'
# )
#
# @example
# # Using Typhoeus
# response = client.fetch_protected_resource(
# :request => Typhoeus::Request.new(
# 'http://www.example.com/protected/resource'
# ),
# :connection => connection
# )
#
# @return [Array] The response object.
def fetch_protected_resource(options={})
options[:connection] ||= Faraday.default_connection
request = self.generate_authenticated_request(options)
request_env = request.to_env(options[:connection])
request_env[:request] ||= request
response = options[:connection].app.call(request_env)
if response.status.to_i == 401
# When accessing a protected resource, we only want to raise an
# error for 401 responses.
message = 'Authorization failed.'
if response.body.to_s.strip.length > 0
message += " Server message:\n#{response.body.to_s.strip}"
end
raise ::Signet::AuthorizationError.new(
message, :request => request, :response => response
)
else
return response
end
end
end
end
end
signet-0.7.3/lib/signet/oauth_1/credential.rb 0000644 0001750 0001750 00000007731 13043627421 020106 0 ustar pravi pravi # Copyright (C) 2010 Google Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
module Signet #:nodoc:
module OAuth1
class Credential
##
# Creates a token object from a key and secret.
#
# @example
# Signet::OAuth1::Credential.new(
# :key => "dpf43f3p2l4k3l03",
# :secret => "kd94hf93k423kf44"
# )
#
# @example
# Signet::OAuth1::Credential.new([
# ["oauth_token", "dpf43f3p2l4k3l03"],
# ["oauth_token_secret", "kd94hf93k423kf44"]
# ])
#
# @example
# Signet::OAuth1::Credential.new(
# "dpf43f3p2l4k3l03", "kd94hf93k423kf44"
# )
def initialize(*args)
# We want to be particularly flexible in how we initialize a token
# object for maximum interoperability. However, this flexibility
# means we need to be careful about returning an unexpected value for
# key or secret to avoid difficult-to-debug situations. Thus lots
# of type-checking.
# This is cheaper than coercing to some kind of Hash with
# indifferent access. Also uglier.
key_from_hash = lambda do |parameters|
parameters["oauth_token"] ||
parameters[:oauth_token] ||
parameters["key"] ||
parameters[:key]
end
secret_from_hash = lambda do |parameters|
parameters["oauth_token_secret"] ||
parameters[:oauth_token_secret] ||
parameters["secret"] ||
parameters[:secret]
end
if args.first.respond_to?(:to_hash)
parameters = args.first.to_hash
@key = key_from_hash.call(parameters)
@secret = secret_from_hash.call(parameters)
unless @key && @secret
raise ArgumentError,
"Could not find both key and secret in #{hash.inspect}."
end
else
# Normalize to an Array
if !args.first.kind_of?(String) &&
!args.first.respond_to?(:to_str) &&
args.first.kind_of?(Enumerable)
# We need to special-case strings since they're technically
# Enumerable objects.
args = args.first.to_a
elsif args.first.respond_to?(:to_ary)
args = args.first.to_ary
end
if args.all? { |value| value.kind_of?(Array) }
parameters = args.inject({}) { |h,(k,v)| h[k]=v; h }
@key = key_from_hash.call(parameters)
@secret = secret_from_hash.call(parameters)
elsif args.size == 2
@key, @secret = args
else
raise ArgumentError,
"wrong number of arguments (#{args.size} for 2)"
end
end
if @key.respond_to?(:to_str)
@key = @key.to_str
else
raise TypeError, "Expected String, got #{@key.class}."
end
if @secret.respond_to?(:to_str)
@secret = @secret.to_str
else
raise TypeError, "Expected String, got #{@secret.class}."
end
end
attr_accessor :key, :secret
def to_hash
return {
"oauth_token" => self.key,
"oauth_token_secret" => self.secret
}
end
alias_method :to_h, :to_hash
def ==(other)
if other.respond_to?(:key) && other.respond_to?(:secret)
return self.key == other.key && self.secret == other.secret
else
return false
end
end
end
end
end
signet-0.7.3/lib/signet/oauth_2.rb 0000644 0001750 0001750 00000012344 13043627421 015771 0 ustar pravi pravi # Copyright (C) 2010 Google Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
require 'base64'
require 'signet'
require 'multi_json'
require 'compat/multi_json'
module Signet #:nodoc:
##
# An implementation of http://tools.ietf.org/html/draft-ietf-oauth-v2-10
#
# This module will be updated periodically to support newer drafts of the
# specification, as they become widely deployed.
module OAuth2
def self.parse_authorization_header(field_value)
auth_scheme = field_value[/^([-._0-9a-zA-Z]+)/, 1]
case auth_scheme
when /^Basic$/i
# HTTP Basic is allowed in OAuth 2
return self.parse_basic_credentials(field_value[/^Basic\s+(.*)$/i, 1])
when /^OAuth$/i
# Other token types may be supported eventually
return self.parse_bearer_credentials(field_value[/^OAuth\s+(.*)$/i, 1])
else
raise ParseError,
'Parsing non-OAuth Authorization headers is out of scope.'
end
end
def self.parse_www_authenticate_header(field_value)
auth_scheme = field_value[/^([-._0-9a-zA-Z]+)/, 1]
case auth_scheme
when /^OAuth$/i
# Other token types may be supported eventually
return self.parse_oauth_challenge(field_value[/^OAuth\s+(.*)$/i, 1])
else
raise ParseError,
'Parsing non-OAuth WWW-Authenticate headers is out of scope.'
end
end
def self.parse_basic_credentials(credential_string)
decoded = Base64.decode64(credential_string)
client_id, client_secret = decoded.split(':', 2)
return [['client_id', client_id], ['client_secret', client_secret]]
end
def self.parse_bearer_credentials(credential_string)
access_token = credential_string[/^([^,\s]+)(?:\s|,|$)/i, 1]
parameters = []
parameters << ['access_token', access_token]
auth_param_string = credential_string[/^(?:[^,\s]+)\s*,\s*(.*)$/i, 1]
if auth_param_string
# This code will rarely get called, but is included for completeness
parameters.concat(Signet.parse_auth_param_list(auth_param_string))
end
return parameters
end
def self.parse_oauth_challenge(challenge_string)
return Signet.parse_auth_param_list(challenge_string)
end
def self.parse_credentials(body, content_type)
if !body.kind_of?(String)
raise TypeError, "Expected String, got #{body.class}."
end
case content_type
when /^application\/json.*/
return MultiJson.load(body)
when /^application\/x-www-form-urlencoded.*/
return Hash[Addressable::URI.form_unencode(body)]
else
raise ArgumentError, "Invalid content type '#{content_type}'"
end
end
##
# Generates a Basic Authorization header from a client identifier and a
# client password.
#
# @param [String] client_id
# The client identifier.
# @param [String] client_password
# The client password.
#
# @return [String]
# The value for the HTTP Basic Authorization header.
def self.generate_basic_authorization_header(client_id, client_password)
if client_id =~ /:/
raise ArgumentError,
"A client identifier may not contain a ':' character."
end
return 'Basic ' + Base64.encode64(
client_id + ':' + client_password
).gsub(/\n/, '')
end
##
# Generates an authorization header for an access token
#
# @param [String] access_token
# The access token.
# @param [Hash] auth_params
# Additonal parameters to be encoded in the header
#
# @return [String]
# The value for the HTTP Basic Authorization header.
def self.generate_bearer_authorization_header(
access_token, auth_params=nil)
# TODO: escaping?
header = "Bearer #{access_token}"
if auth_params && !auth_params.empty?
header += (", " +
(auth_params.inject([]) do |accu, (key, value)|
accu << "#{key}=\"#{value}\""
accu
end).join(", ")
)
end
return header
end
##
# Appends the necessary OAuth parameters to
# the base authorization endpoint URI.
#
# @param [Addressable::URI, String, #to_str] authorization_uri
# The base authorization endpoint URI.
#
# @return [String] The authorization URI to redirect the user to.
def self.generate_authorization_uri(authorization_uri, parameters={})
for key, value in parameters
parameters.delete(key) if value == nil
end
parsed_uri = Addressable::URI.parse(authorization_uri).dup
query_values = parsed_uri.query_values || {}
query_values = query_values.merge(parameters)
parsed_uri.query_values = query_values
return parsed_uri.normalize.to_s
end
end
end
signet-0.7.3/lib/signet/version.rb 0000644 0001750 0001750 00000001527 13043627421 016116 0 ustar pravi pravi # Copyright (C) 2010 Google Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Used to prevent the class/module from being loaded more than once
unless defined? Signet::VERSION
module Signet
module VERSION
MAJOR = 0
MINOR = 7
TINY = 3
STRING = [MAJOR, MINOR, TINY].join('.')
end
end
end
signet-0.7.3/lib/signet/oauth_1.rb 0000644 0001750 0001750 00000043051 13043627421 015767 0 ustar pravi pravi require 'addressable/uri'
require 'signet'
begin
require 'securerandom'
rescue LoadError
require 'compat/securerandom'
end
module Signet #:nodoc:
module OAuth1
OUT_OF_BAND = 'oob'
##
# Converts a value to a percent-encoded String according to
# the rules given in RFC 5849. All non-unreserved characters are
# percent-encoded.
#
# @param [Symbol, #to_str] value The value to be encoded.
#
# @return [String] The percent-encoded value.
def self.encode(value)
value = value.to_s if value.kind_of?(Symbol)
return Addressable::URI.encode_component(
value,
Addressable::URI::CharacterClasses::UNRESERVED
)
end
##
# Converts a percent-encoded String to an unencoded value.
#
# @param [#to_str] value
# The percent-encoded String to be unencoded.
#
# @return [String] The unencoded value.
def self.unencode(value)
return Addressable::URI.unencode_component(value)
end
##
# Returns a timestamp suitable for use as an 'oauth_timestamp'
# value.
#
# @return [String] The current timestamp.
def self.generate_timestamp()
return Time.now.to_i.to_s
end
##
# Returns a nonce suitable for use as an 'oauth_nonce'
# value.
#
# @return [String] A random nonce.
def self.generate_nonce()
return SecureRandom.random_bytes(16).unpack('H*').join('')
end
##
# Processes an options Hash to find a credential key value.
# Allows for greater flexibility in configuration.
#
# @param [Symbol] credential_type
# One of :client, :temporary,
# :token, :consumer, :request,
# or :access.
#
# @return [String] The credential key value.
def self.extract_credential_key_option(credential_type, options)
# Normalize key to String to allow indifferent access.
options = options.inject({}) { |accu, (k, v)| accu[k.to_s] = v; accu }
credential_key = "#{credential_type}_credential_key"
credential = "#{credential_type}_credential"
if options[credential_key]
credential_key = options[credential_key]
elsif options[credential]
require 'signet/oauth_1/credential'
if !options[credential].respond_to?(:key)
raise TypeError,
"Expected Signet::OAuth1::Credential, " +
"got #{options[credential].class}."
end
credential_key = options[credential].key
elsif options["client"]
require 'signet/oauth_1/client'
if !options["client"].kind_of?(::Signet::OAuth1::Client)
raise TypeError,
"Expected Signet::OAuth1::Client, got #{options["client"].class}."
end
credential_key = options["client"].send(credential_key)
else
credential_key = nil
end
if credential_key != nil && !credential_key.kind_of?(String)
raise TypeError,
"Expected String, got #{credential_key.class}."
end
return credential_key
end
##
# Processes an options Hash to find a credential secret value.
# Allows for greater flexibility in configuration.
#
# @param [Symbol] credential_type
# One of :client, :temporary,
# :token, :consumer, :request,
# or :access.
#
# @return [String] The credential secret value.
def self.extract_credential_secret_option(credential_type, options)
# Normalize key to String to allow indifferent access.
options = options.inject({}) { |accu, (k, v)| accu[k.to_s] = v; accu }
credential_secret = "#{credential_type}_credential_secret"
credential = "#{credential_type}_credential"
if options[credential_secret]
credential_secret = options[credential_secret]
elsif options[credential]
require 'signet/oauth_1/credential'
if !options[credential].respond_to?(:secret)
raise TypeError,
"Expected Signet::OAuth1::Credential, " +
"got #{options[credential].class}."
end
credential_secret = options[credential].secret
elsif options["client"]
require 'signet/oauth_1/client'
if !options["client"].kind_of?(::Signet::OAuth1::Client)
raise TypeError,
"Expected Signet::OAuth1::Client, got #{options["client"].class}."
end
credential_secret = options["client"].send(credential_secret)
else
credential_secret = nil
end
if credential_secret != nil && !credential_secret.kind_of?(String)
raise TypeError,
"Expected String, got #{credential_secret.class}."
end
return credential_secret
end
##
# Normalizes a set of OAuth parameters according to the algorithm given
# in RFC 5849. Sorts key/value pairs lexically by byte order, first by
# key, then by value, joins key/value pairs with the '=' character, then
# joins the entire parameter list with '&' characters.
#
# @param [Enumerable] parameters The OAuth parameter list.
#
# @return [String] The normalized parameter list.
def self.normalize_parameters(parameters)
if !parameters.kind_of?(Enumerable)
raise TypeError, "Expected Enumerable, got #{parameters.class}."
end
parameter_list = parameters.map do |k, v|
next if k == "oauth_signature"
# This is probably the wrong place to try to exclude the realm
"#{self.encode(k)}=#{self.encode(v)}"
end
return parameter_list.compact.sort.join("&")
end
##
# Generates a signature base string according to the algorithm given in
# RFC 5849. Joins the method, URI, and normalized parameter string with
# '&' characters.
#
# @param [String] method The HTTP method.
# @param [Addressable::URI, String, #to_str] uri The URI.
# @param [Enumerable] parameters The OAuth parameter list.
#
# @return [String] The signature base string.
def self.generate_base_string(method, uri, parameters)
if !parameters.kind_of?(Enumerable)
raise TypeError, "Expected Enumerable, got #{parameters.class}."
end
method = method.to_s.upcase
parsed_uri = Addressable::URI.parse(uri)
uri = Addressable::URI.new(
:scheme => parsed_uri.normalized_scheme,
:authority => parsed_uri.normalized_authority,
:path => parsed_uri.path,
:query => parsed_uri.query,
:fragment => parsed_uri.fragment
)
uri_parameters = uri.query_values.to_a
uri = uri.omit(:query, :fragment).to_s
merged_parameters =
uri_parameters.concat(parameters.map { |k, v| [k, v] })
parameter_string = self.normalize_parameters(merged_parameters)
return [
self.encode(method),
self.encode(uri),
self.encode(parameter_string)
].join('&')
end
##
# Generates an Authorization header from a parameter list
# according to the rules given in RFC 5849.
#
# @param [Enumerable] parameters The OAuth parameter list.
# @param [String] realm
# The Authorization realm. See RFC 2617.
#
# @return [String] The Authorization header.
def self.generate_authorization_header(parameters, realm=nil)
if !parameters.kind_of?(Enumerable) || parameters.kind_of?(String)
raise TypeError, "Expected Enumerable, got #{parameters.class}."
end
parameter_list = parameters.map do |k, v|
if k == 'realm'
raise ArgumentError,
'The "realm" parameter must be specified as a separate argument.'
end
"#{self.encode(k)}=\"#{self.encode(v)}\""
end
if realm
realm = realm.gsub('"', '\"')
parameter_list.unshift("realm=\"#{realm}\"")
end
return 'OAuth ' + parameter_list.join(", ")
end
##
# Parses an Authorization header into its component
# parameters. Parameter keys and values are decoded according to the
# rules given in RFC 5849.
def self.parse_authorization_header(field_value)
if !field_value.kind_of?(String)
raise TypeError, "Expected String, got #{field_value.class}."
end
auth_scheme = field_value[/^([-._0-9a-zA-Z]+)/, 1]
case auth_scheme
when /^OAuth$/i
# Other token types may be supported eventually
pairs = Signet.parse_auth_param_list(field_value[/^OAuth\s+(.*)$/i, 1])
return (pairs.inject([]) do |accu, (k, v)|
if k != 'realm'
k = self.unencode(k)
v = self.unencode(v)
end
accu << [k, v]
accu
end)
else
raise ParseError,
'Parsing non-OAuth Authorization headers is out of scope.'
end
end
##
# Parses an application/x-www-form-urlencoded HTTP response
# body into an OAuth key/secret pair.
#
# @param [String] body The response body.
#
# @return [Signet::OAuth1::Credential] The OAuth credentials.
def self.parse_form_encoded_credentials(body)
if !body.kind_of?(String)
raise TypeError, "Expected String, got #{body.class}."
end
return Signet::OAuth1::Credential.new(
Addressable::URI.form_unencode(body)
)
end
##
# Generates an OAuth signature using the signature method indicated in the
# parameter list. Unsupported signature methods will result in a
# NotImplementedError exception being raised.
#
# @param [String] method The HTTP method.
# @param [Addressable::URI, String, #to_str] uri The URI.
# @param [Enumerable] parameters The OAuth parameter list.
# @param [String] client_credential_secret The client credential secret.
# @param [String] token_credential_secret
# The token credential secret. Omitted when unavailable.
#
# @return [String] The signature.
def self.sign_parameters(method, uri, parameters,
client_credential_secret, token_credential_secret=nil)
# Technically, the token_credential_secret parameter here may actually
# be a temporary credential secret when obtaining a token credential
# for the first time
base_string = self.generate_base_string(method, uri, parameters)
parameters = parameters.inject({}) { |h,(k,v)| h[k.to_s]=v; h }
signature_method = parameters['oauth_signature_method']
case signature_method
when 'HMAC-SHA1'
require 'signet/oauth_1/signature_methods/hmac_sha1'
return Signet::OAuth1::HMACSHA1.generate_signature(
base_string, client_credential_secret, token_credential_secret
)
when 'RSA-SHA1'
require 'signet/oauth_1/signature_methods/rsa_sha1'
return Signet::OAuth1::RSASHA1.generate_signature(
base_string, client_credential_secret, token_credential_secret
)
when 'PLAINTEXT'
require 'signet/oauth_1/signature_methods/plaintext'
return Signet::OAuth1::PLAINTEXT.generate_signature(
base_string, client_credential_secret, token_credential_secret
)
else
raise NotImplementedError,
"Unsupported signature method: #{signature_method}"
end
end
##
# Generates an OAuth parameter list to be used when obtaining a set of
# temporary credentials.
#
# @param [Hash] options
# The configuration parameters for the request.
# - :client_credential_key -
# The client credential key.
# - :callback -
# The OAuth callback. Defaults to {Signet::OAuth1::OUT_OF_BAND}.
# - :signature_method -
# The signature method. Defaults to 'HMAC-SHA1'.
# - :additional_parameters -
# Non-standard additional parameters.
#
# @return [Array]
# The parameter list as an Array of key/value pairs.
def self.unsigned_temporary_credential_parameters(options={})
options = {
:callback => ::Signet::OAuth1::OUT_OF_BAND,
:signature_method => 'HMAC-SHA1',
:additional_parameters => []
}.merge(options)
client_credential_key =
self.extract_credential_key_option(:client, options)
if client_credential_key == nil
raise ArgumentError, "Missing :client_credential_key parameter."
end
parameters = [
["oauth_consumer_key", client_credential_key],
["oauth_signature_method", options[:signature_method]],
["oauth_timestamp", self.generate_timestamp()],
["oauth_nonce", self.generate_nonce()],
["oauth_version", "1.0"],
["oauth_callback", options[:callback]]
]
# Works for any Enumerable
options[:additional_parameters].each do |key, value|
parameters << [key, value]
end
return parameters
end
##
# Appends the optional 'oauth_token' and 'oauth_callback' parameters to
# the base authorization URI.
#
# @param [Addressable::URI, String, #to_str] authorization_uri
# The base authorization URI.
#
# @return [String] The authorization URI to redirect the user to.
def self.generate_authorization_uri(authorization_uri, options={})
options = {
:callback => nil,
:additional_parameters => {}
}.merge(options)
temporary_credential_key =
self.extract_credential_key_option(:temporary, options)
parsed_uri = Addressable::URI.parse(authorization_uri).dup
query_values = parsed_uri.query_values || {}
if options[:additional_parameters]
query_values = query_values.merge(
options[:additional_parameters].inject({}) { |h,(k,v)| h[k]=v; h }
)
end
if temporary_credential_key
query_values['oauth_token'] = temporary_credential_key
end
if options[:callback]
query_values['oauth_callback'] = options[:callback]
end
parsed_uri.query_values = query_values
return parsed_uri.normalize.to_s
end
##
# Generates an OAuth parameter list to be used when obtaining a set of
# token credentials.
#
# @param [Hash] options
# The configuration parameters for the request.
# - :client_credential_key -
# The client credential key.
# - :temporary_credential_key -
# The temporary credential key.
# - :verifier -
# The OAuth verifier.
# - :signature_method -
# The signature method. Defaults to 'HMAC-SHA1'.
#
# @return [Array]
# The parameter list as an Array of key/value pairs.
def self.unsigned_token_credential_parameters(options={})
options = {
:signature_method => 'HMAC-SHA1',
:verifier => nil
}.merge(options)
client_credential_key =
self.extract_credential_key_option(:client, options)
temporary_credential_key =
self.extract_credential_key_option(:temporary, options)
if client_credential_key == nil
raise ArgumentError, "Missing :client_credential_key parameter."
end
if temporary_credential_key == nil
raise ArgumentError, "Missing :temporary_credential_key parameter."
end
if options[:verifier] == nil
raise ArgumentError, "Missing :verifier parameter."
end
parameters = [
["oauth_consumer_key", client_credential_key],
["oauth_token", temporary_credential_key],
["oauth_signature_method", options[:signature_method]],
["oauth_timestamp", self.generate_timestamp()],
["oauth_nonce", self.generate_nonce()],
["oauth_verifier", options[:verifier]],
["oauth_version", "1.0"]
]
# No additional parameters allowed here
return parameters
end
##
# Generates an OAuth parameter list to be used when requesting a
# protected resource.
#
# @param [Hash] options
# The configuration parameters for the request.
# - :client_credential_key -
# The client credential key.
# - :token_credential_key -
# The token credential key.
# - :signature_method -
# The signature method. Defaults to 'HMAC-SHA1'.
# - :two_legged -
# A switch for two-legged OAuth. Defaults to false.
#
# @return [Array]
# The parameter list as an Array of key/value pairs.
def self.unsigned_resource_parameters(options={})
options = {
:signature_method => 'HMAC-SHA1',
:two_legged => false
}.merge(options)
client_credential_key =
self.extract_credential_key_option(:client, options)
if client_credential_key == nil
raise ArgumentError, "Missing :client_credential_key parameter."
end
unless options[:two_legged]
token_credential_key =
self.extract_credential_key_option(:token, options)
if token_credential_key == nil
raise ArgumentError, "Missing :token_credential_key parameter."
end
end
parameters = [
["oauth_consumer_key", client_credential_key],
["oauth_signature_method", options[:signature_method]],
["oauth_timestamp", self.generate_timestamp()],
["oauth_nonce", self.generate_nonce()],
["oauth_version", "1.0"]
]
unless options[:two_legged]
parameters << ["oauth_token", token_credential_key]
end
# No additional parameters allowed here
return parameters
end
end
end
signet-0.7.3/lib/signet/errors.rb 0000644 0001750 0001750 00000005157 13043627421 015750 0 ustar pravi pravi # Copyright (C) 2010 Google Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
require 'addressable/uri'
module Signet
##
# An error indicating that the client has aborted an operation that
# would have been unsafe to perform.
class UnsafeOperationError < StandardError
end
##
# An error indicating the client failed to parse a value.
class ParseError < StandardError
end
##
# An error indicating that the server considers the Authorization header to
# be malformed(missing/unsupported/invalid parameters), and the request
# should be considered invalid.
class MalformedAuthorizationError < StandardError
end
##
# An error indicating the remote server refused to authorize the client.
class AuthorizationError < StandardError
##
# Creates a new authentication error.
#
# @param [String] message
# A message describing the error.
# @param [Hash] options
# The configuration parameters for the request.
# - :request -
# A Faraday::Request object. Optional.
# - :response -
# A Faraday::Response object. Optional.
# - :code -
# An error code.
# - :description -
# Human-readable text intended to be used to assist in resolving the
# error condition.
# - :uri -
# A URI identifying a human-readable web page with additional
# information about the error, indended for the resource owner.
def initialize(message, options={})
super(message)
@options = options
@request = options[:request]
@response = options[:response]
@code = options[:code]
@description = options[:description]
@uri = Addressable::URI.parse(options[:uri])
end
##
# The HTTP request that triggered this authentication error.
#
# @return [Array] A tuple of method, uri, headers, and body.
attr_reader :request
##
# The HTTP response that triggered this authentication error.
#
# @return [Array] A tuple of status, headers, and body.
attr_reader :response
end
end
signet-0.7.3/lib/signet/oauth_2/ 0000755 0001750 0001750 00000000000 13043627421 015440 5 ustar pravi pravi signet-0.7.3/lib/signet/oauth_2/client.rb 0000644 0001750 0001750 00000116533 13043627421 017254 0 ustar pravi pravi # Copyright (C) 2010 Google Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
require 'faraday'
require 'stringio'
require 'addressable/uri'
require 'signet'
require 'signet/errors'
require 'signet/oauth_2'
require 'jwt'
module Signet
module OAuth2
class Client
OOB_MODES = %w(urn:ietf:wg:oauth:2.0:oob:auto urn:ietf:wg:oauth:2.0:oob oob)
##
# Creates an OAuth 2.0 client.
#
# @param [Hash] options
# The configuration parameters for the client.
# - :authorization_uri -
# The authorization server's HTTP endpoint capable of
# authenticating the end-user and obtaining authorization.
# - :token_credential_uri -
# The authorization server's HTTP endpoint capable of issuing
# tokens and refreshing expired tokens.
# - :client_id -
# A unique identifier issued to the client to identify itself to the
# authorization server.
# - :client_secret -
# A shared symmetric secret issued by the authorization server,
# which is used to authenticate the client.
# - :scope -
# The scope of the access request, expressed either as an Array
# or as a space-delimited String.
# - :state -
# An arbitrary string designed to allow the client to maintain state.
# - :code -
# The authorization code received from the authorization server.
# - :redirect_uri -
# The redirection URI used in the initial request.
# - :username -
# The resource owner's username.
# - :password -
# The resource owner's password.
# - :issuer -
# Issuer ID when using assertion profile
# - :person -
# Target user for assertions
# - :expiry -
# Number of seconds assertions are valid for
# - :signing_key -
# Signing key when using assertion profile
# - :refresh_token -
# The refresh token associated with the access token
# to be refreshed.
# - :access_token -
# The current access token for this client.
# - :id_token -
# The current ID token for this client.
# - :extension_parameters -
# When using an extension grant type, this the set of parameters used
# by that extension.
#
# @example
# client = Signet::OAuth2::Client.new(
# :authorization_uri =>
# 'https://example.server.com/authorization',
# :token_credential_uri =>
# 'https://example.server.com/token',
# :client_id => 'anonymous',
# :client_secret => 'anonymous',
# :scope => 'example',
# :redirect_uri => 'https://example.client.com/oauth'
# )
#
# @see Signet::OAuth2::Client#update!
def initialize(options={})
@authorization_uri = nil
@token_credential_uri = nil
@client_id = nil
@client_secret = nil
@code = nil
@expires_at = nil
@expires_in = nil
@issued_at = nil
@issuer = nil
@password = nil
@principal = nil
@redirect_uri = nil
@scope = nil
@state = nil
@username = nil
self.update!(options)
end
##
# Updates an OAuth 2.0 client.
#
# @param [Hash] options
# The configuration parameters for the client.
# - :authorization_uri -
# The authorization server's HTTP endpoint capable of
# authenticating the end-user and obtaining authorization.
# - :token_credential_uri -
# The authorization server's HTTP endpoint capable of issuing
# tokens and refreshing expired tokens.
# - :client_id -
# A unique identifier issued to the client to identify itself to the
# authorization server.
# - :client_secret -
# A shared symmetric secret issued by the authorization server,
# which is used to authenticate the client.
# - :scope -
# The scope of the access request, expressed either as an Array
# or as a space-delimited String.
# - :state -
# An arbitrary string designed to allow the client to maintain state.
# - :code -
# The authorization code received from the authorization server.
# - :redirect_uri -
# The redirection URI used in the initial request.
# - :username -
# The resource owner's username.
# - :password -
# The resource owner's password.
# - :issuer -
# Issuer ID when using assertion profile
# - :audience -
# Target audience for assertions
# - :person -
# Target user for assertions
# - :expiry -
# Number of seconds assertions are valid for
# - :signing_key -
# Signing key when using assertion profile
# - :refresh_token -
# The refresh token associated with the access token
# to be refreshed.
# - :access_token -
# The current access token for this client.
# - :id_token -
# The current ID token for this client.
# - :extension_parameters -
# When using an extension grant type, this is the set of parameters used
# by that extension.
#
# @example
# client.update!(
# :code => 'i1WsRn1uB1',
# :access_token => 'FJQbwq9',
# :expires_in => 3600
# )
#
# @see Signet::OAuth2::Client#initialize
# @see Signet::OAuth2::Client#update_token!
def update!(options={})
# Normalize all keys to symbols to allow indifferent access.
options = deep_hash_normalize(options)
self.authorization_uri = options[:authorization_uri] if options.has_key?(:authorization_uri)
self.token_credential_uri = options[:token_credential_uri] if options.has_key?(:token_credential_uri)
self.client_id = options[:client_id] if options.has_key?(:client_id)
self.client_secret = options[:client_secret] if options.has_key?(:client_secret)
self.scope = options[:scope] if options.has_key?(:scope)
self.state = options[:state] if options.has_key?(:state)
self.code = options[:code] if options.has_key?(:code)
self.redirect_uri = options[:redirect_uri] if options.has_key?(:redirect_uri)
self.username = options[:username] if options.has_key?(:username)
self.password = options[:password] if options.has_key?(:password)
self.issuer = options[:issuer] if options.has_key?(:issuer)
self.person = options[:person] if options.has_key?(:person)
self.sub = options[:sub] if options.has_key?(:sub)
self.expiry = options[:expiry] || 60
self.audience = options[:audience] if options.has_key?(:audience)
self.signing_key = options[:signing_key] if options.has_key?(:signing_key)
self.extension_parameters = options[:extension_parameters] || {}
self.additional_parameters = options[:additional_parameters] || {}
self.update_token!(options)
return self
end
##
# Updates an OAuth 2.0 client.
#
# @param [Hash] options
# The configuration parameters related to the token.
# - :refresh_token -
# The refresh token associated with the access token
# to be refreshed.
# - :access_token -
# The current access token for this client.
# - :id_token -
# The current ID token for this client.
# - :expires_in -
# The time in seconds until access token expiration.
# - :expires_at -
# The time as an integer number of seconds since the Epoch
# - :issued_at -
# The timestamp that the token was issued at.
#
# @example
# client.update!(
# :refresh_token => 'n4E9O119d',
# :access_token => 'FJQbwq9',
# :expires_in => 3600
# )
#
# @see Signet::OAuth2::Client#initialize
# @see Signet::OAuth2::Client#update!
def update_token!(options={})
# Normalize all keys to symbols to allow indifferent access internally
options = deep_hash_normalize(options)
self.expires_in = options[:expires] if options.has_key?(:expires)
self.expires_in = options[:expires_in] if options.has_key?(:expires_in)
self.expires_at = options[:expires_at] if options.has_key?(:expires_at)
# By default, the token is issued at `Time.now` when `expires_in` is
# set, but this can be used to supply a more precise time.
self.issued_at = options[:issued_at] if options.has_key?(:issued_at)
self.access_token = options[:access_token] if options.has_key?(:access_token)
self.refresh_token = options[:refresh_token] if options.has_key?(:refresh_token)
self.id_token = options[:id_token] if options.has_key?(:id_token)
return self
end
##
# Returns the authorization URI that the user should be redirected to.
#
# @return [Addressable::URI] The authorization URI.
#
# @see Signet::OAuth2.generate_authorization_uri
def authorization_uri(options={})
# Normalize external input
options = deep_hash_normalize(options)
return nil if @authorization_uri == nil
unless options[:response_type]
options[:response_type] = :code
end
unless options[:access_type]
options[:access_type] = :offline
end
options[:client_id] ||= self.client_id
options[:redirect_uri] ||= self.redirect_uri
if options[:prompt] && options[:approval_prompt]
raise ArgumentError, "prompt and approval_prompt are mutually exclusive parameters"
end
if !options[:client_id]
raise ArgumentError, "Missing required client identifier."
end
unless options[:redirect_uri]
raise ArgumentError, "Missing required redirect URI."
end
if !options[:scope] && self.scope
options[:scope] = self.scope.join(' ')
end
options[:state] = self.state unless options[:state]
options.merge!(self.additional_parameters.merge(options[:additional_parameters] || {}))
options.delete(:additional_parameters)
options = Hash[options.map do |key, option|
[key.to_s, option]
end]
uri = Addressable::URI.parse(
::Signet::OAuth2.generate_authorization_uri(
@authorization_uri, options
)
)
if uri.normalized_scheme != 'https'
raise Signet::UnsafeOperationError,
'Authorization endpoint must be protected by TLS.'
end
return uri
end
##
# Sets the authorization URI for this client.
#
# @param [Addressable::URI, Hash, String, #to_str] new_authorization_uri
# The authorization URI.
def authorization_uri=(new_authorization_uri)
@authorization_uri = coerce_uri(new_authorization_uri)
end
##
# Returns the token credential URI for this client.
#
# @return [Addressable::URI] The token credential URI.
def token_credential_uri
return @token_credential_uri
end
##
# Sets the token credential URI for this client.
#
# @param [Addressable::URI, Hash, String, #to_str] new_token_credential_uri
# The token credential URI.
def token_credential_uri=(new_token_credential_uri)
@token_credential_uri = coerce_uri(new_token_credential_uri)
end
# Addressable expects URIs formatted as hashes to come in with symbols as keys.
# Returns nil implicitly for the nil case.
def coerce_uri(incoming_uri)
if incoming_uri.is_a? Hash
Addressable::URI.new(deep_hash_normalize(incoming_uri))
elsif incoming_uri
Addressable::URI.parse(incoming_uri)
end
end
##
# Returns the client identifier for this client.
#
# @return [String] The client identifier.
def client_id
return @client_id
end
##
# Sets the client identifier for this client.
#
# @param [String] new_client_id
# The client identifier.
def client_id=(new_client_id)
@client_id = new_client_id
end
##
# Returns the client secret for this client.
#
# @return [String] The client secret.
def client_secret
return @client_secret
end
##
# Sets the client secret for this client.
#
# @param [String] new_client_secret
# The client secret.
def client_secret=(new_client_secret)
@client_secret = new_client_secret
end
##
# Returns the scope for this client. Scope is a list of access ranges
# defined by the authorization server.
#
# @return [Array] The scope of access the client is requesting.
def scope
return @scope
end
##
# Sets the scope for this client.
#
# @param [Array, String] new_scope
# The scope of access the client is requesting. This may be
# expressed as either an Array of String objects or as a
# space-delimited String.
def scope=(new_scope)
case new_scope
when Array
new_scope.each do |scope|
if scope.include?(' ')
raise ArgumentError,
"Individual scopes cannot contain the space character."
end
end
@scope = new_scope
when String
@scope = new_scope.split(' ')
when nil
@scope = nil
else
raise TypeError, "Expected Array or String, got #{new_scope.class}"
end
end
##
# Returns the client's current state value.
#
# @return [String] The state value.
def state
return @state
end
##
# Sets the client's current state value.
#
# @param [String] new_state
# The state value.
def state=(new_state)
@state = new_state
end
##
# Returns the authorization code issued to this client.
# Used only by the authorization code access grant type.
#
# @return [String] The authorization code.
def code
return @code
end
##
# Sets the authorization code issued to this client.
# Used only by the authorization code access grant type.
#
# @param [String] new_code
# The authorization code.
def code=(new_code)
@code = new_code
end
##
# Returns the redirect URI for this client.
#
# @return [String] The redirect URI.
def redirect_uri
return @redirect_uri
end
##
# Sets the redirect URI for this client.
#
# @param [String] new_redirect_uri
# The redirect URI.
def redirect_uri=(new_redirect_uri)
new_redirect_uri = Addressable::URI.parse(new_redirect_uri)
#TODO - Better solution to allow google postmessage flow. For now, make an exception to the spec.
if new_redirect_uri == nil|| new_redirect_uri.absolute? || uri_is_postmessage?(new_redirect_uri) || uri_is_oob?(new_redirect_uri)
@redirect_uri = new_redirect_uri
else
raise ArgumentError, "Redirect URI must be an absolute URI."
end
end
##
# Returns the username associated with this client.
# Used only by the resource owner password credential access grant type.
#
# @return [String] The username.
def username
return @username
end
##
# Sets the username associated with this client.
# Used only by the resource owner password credential access grant type.
#
# @param [String] new_username
# The username.
def username=(new_username)
@username = new_username
end
##
# Returns the password associated with this client.
# Used only by the resource owner password credential access grant type.
#
# @return [String] The password.
def password
return @password
end
##
# Sets the password associated with this client.
# Used only by the resource owner password credential access grant type.
#
# @param [String] new_password
# The password.
def password=(new_password)
@password = new_password
end
##
# Returns the issuer ID associated with this client.
# Used only by the assertion grant type.
#
# @return [String] Issuer id.
def issuer
return @issuer
end
##
# Sets the issuer ID associated with this client.
# Used only by the assertion grant type.
#
# @param [String] new_issuer
# Issuer ID (typical in email adddress form).
def issuer=(new_issuer)
@issuer = new_issuer
end
##
# Returns the issuer ID associated with this client.
# Used only by the assertion grant type.
#
# @return [String] Target audience ID.
def audience
return @audience
end
##
# Sets the target audience ID when issuing assertions.
# Used only by the assertion grant type.
#
# @param [String] new_audience
# Target audience ID
def audience=(new_audience)
@audience = new_audience
end
##
# Returns the target resource owner for impersonation.
# Used only by the assertion grant type.
#
# @return [String] Target user for impersonation.
def principal
return @principal
end
##
# Sets the target resource owner for impersonation.
# Used only by the assertion grant type.
#
# @param [String] new_person
# Target user for impersonation
def principal=(new_person)
@principal = new_person
end
alias_method :person, :principal
alias_method :person=, :principal=
##
# The target "sub" when issuing assertions.
# Used in some Admin SDK APIs.
#
attr_accessor :sub
##
# Returns the number of seconds assertions are valid for
# Used only by the assertion grant type.
#
# @return [Fixnum] Assertion expiry, in seconds
def expiry
return @expiry
end
##
# Sets the number of seconds assertions are valid for
# Used only by the assertion grant type.
#
# @param [Fixnum, String] new_expiry
# Assertion expiry, in seconds
def expiry=(new_expiry)
@expiry = new_expiry ? new_expiry.to_i : nil
end
##
# Returns the signing key associated with this client.
# Used only by the assertion grant type.
#
# @return [String,OpenSSL::PKey] Signing key
def signing_key
return @signing_key
end
##
# Sets the signing key when issuing assertions.
# Used only by the assertion grant type.
#
# @param [String, OpenSSL::Pkey] new_key
# Signing key. Either private key for RSA or string for HMAC algorithm
def signing_key=(new_key)
@signing_key = new_key
end
##
# Algorithm used for signing JWTs
# @return [String] Signing algorithm
def signing_algorithm
self.signing_key.is_a?(String) ? "HS256" : "RS256"
end
##
# Returns the set of extension parameters used by the client.
# Used only by extension access grant types.
#
# @return [Hash] The extension parameters.
def extension_parameters
return @extension_parameters ||= {}
end
##
# Sets extension parameters used by the client.
# Used only by extension access grant types.
#
# @param [Hash] new_extension_parameters
# The parameters.
def extension_parameters=(new_extension_parameters)
if new_extension_parameters.respond_to?(:to_hash)
@extension_parameters = new_extension_parameters.to_hash
else
raise TypeError,
"Expected Hash, got #{new_extension_parameters.class}."
end
end
##
# Returns the set of additional (non standard) parameters to be used by the client.
#
# @return [Hash] The pass through parameters.
def additional_parameters
return @additional_parameters ||= {}
end
##
# Sets additional (non standard) parameters to be used by the client.
#
# @param [Hash] new_additional_parameters
# The parameters.
def additional_parameters=(new_additional_parameters)
if new_additional_parameters.respond_to?(:to_hash)
@additional_parameters = new_additional_parameters.to_hash
else
raise TypeError,
"Expected Hash, got #{new_additional_parameters.class}."
end
end
##
# Returns the refresh token associated with this client.
#
# @return [String] The refresh token.
def refresh_token
return @refresh_token ||= nil
end
##
# Sets the refresh token associated with this client.
#
# @param [String] new_refresh_token
# The refresh token.
def refresh_token=(new_refresh_token)
@refresh_token = new_refresh_token
end
##
# Returns the access token associated with this client.
#
# @return [String] The access token.
def access_token
return @access_token ||= nil
end
##
# Sets the access token associated with this client.
#
# @param [String] new_access_token
# The access token.
def access_token=(new_access_token)
@access_token = new_access_token
end
##
# Returns the ID token associated with this client.
#
# @return [String] The ID token.
def id_token
return @id_token ||= nil
end
##
# Sets the ID token associated with this client.
#
# @param [String] new_id_token
# The ID token.
def id_token=(new_id_token)
@id_token = new_id_token
end
##
# Returns the decoded ID token associated with this client.
#
# @param [OpenSSL::PKey::RSA, Object] public_key
# The public key to use to verify the ID token. Skips verification if
# omitted.
#
# @return [String] The decoded ID token.
def decoded_id_token(public_key=nil, options = {})
payload, _header = JWT.decode(self.id_token, public_key, !!public_key, options)
if !payload.has_key?('aud')
raise Signet::UnsafeOperationError, 'No ID token audience declared.'
elsif payload['aud'] != self.client_id
raise Signet::UnsafeOperationError,
'ID token audience did not match Client ID.'
end
return payload
end
##
# Returns the lifetime of the access token in seconds.
#
# @return [Fixnum] The access token lifetime.
def expires_in
return @expires_in
end
##
# Sets the lifetime of the access token in seconds. Resets the issued
# timestamp.
#
# @param [String, Fixnum] new_expires_in
# The access token lifetime.
def expires_in=(new_expires_in)
if new_expires_in != nil
@expires_in = new_expires_in.to_i
@issued_at = Time.now
else
@expires_in, @issued_at, @expires_at = nil, nil, nil
end
end
##
# Returns the timestamp the access token was issued at.
#
# @return [Time] The access token issuance time.
def issued_at
return @issued_at
end
##
# Sets the timestamp the access token was issued at.
#
# @param [String,Fixnum,Time] new_issued_at
# The access token issuance time.
def issued_at=(new_issued_at)
@issued_at = normalize_timestamp(new_issued_at)
end
##
# Returns the timestamp the access token will expire at.
#
# @return [Time] The access token lifetime.
def expires_at
if @expires_at
@expires_at
elsif @issued_at && @expires_in
return @issued_at + @expires_in
else
return nil
end
end
##
# Limits the lifetime of the access token as number of seconds since
# the Epoch
# @param [String,Fixnum,Time] new_expires_at
# The access token issuance time.
def expires_at=(new_expires_at)
@expires_at = normalize_timestamp(new_expires_at)
end
##
# Returns true if the access token has expired.
#
# @return [TrueClass, FalseClass]
# The expiration state of the access token.
def expired?
return self.expires_at != nil && Time.now >= self.expires_at
end
##
# Returns true if the access token has expired or expires within
# the next n seconds
#
# @param [Fixnum] sec
# Max number of seconds from now where a token is still considered
# expired.
# @return [TrueClass, FalseClass]
# The expiration state of the access token.
def expires_within?(sec)
return self.expires_at.nil? || Time.now >= (self.expires_at - sec)
end
##
# Removes all credentials from the client.
def clear_credentials!
@access_token = nil
@refresh_token = nil
@id_token = nil
@username = nil
@password = nil
@code = nil
@issued_at = nil
@expires_in = nil
end
##
# Returns the inferred grant type, based on the current state of the
# client object. Returns `"none"` if the client has insufficient
# information to make an in-band authorization request.
#
# @return [String]
# The inferred grant type.
def grant_type
@grant_type ||= nil
if @grant_type
return @grant_type
else
if self.code && self.redirect_uri
'authorization_code'
elsif self.refresh_token
'refresh_token'
elsif self.username && self.password
'password'
elsif self.issuer && self.signing_key
'urn:ietf:params:oauth:grant-type:jwt-bearer'
else
# We don't have sufficient auth information, assume an out-of-band
# authorization arrangement between the client and server, or an
# extension grant type.
nil
end
end
end
def grant_type=(new_grant_type)
case new_grant_type
when 'authorization_code', 'refresh_token',
'password', 'client_credentials'
@grant_type = new_grant_type
else
@grant_type = Addressable::URI.parse(new_grant_type)
end
end
def to_jwt(options={})
options = deep_hash_normalize(options)
now = Time.new
skew = options[:skew] || 60
assertion = {
"iss" => self.issuer,
"aud" => self.audience,
"exp" => (now + self.expiry).to_i,
"iat" => (now - skew).to_i
}
assertion['scope'] = self.scope.join(' ') unless self.scope.nil?
assertion['prn'] = self.person unless self.person.nil?
assertion['sub'] = self.sub unless self.sub.nil?
JWT.encode(assertion, self.signing_key, self.signing_algorithm)
end
##
# Serialize the client object to JSON.
#
# @note A serialized client contains sensitive information. Persist or transmit with care.
#
# @return [String] A serialized JSON representation of the client.
def to_json
return MultiJson.dump({
'authorization_uri' => self.authorization_uri ? self.authorization_uri.to_s : nil,
'token_credential_uri' => self.token_credential_uri ? self.token_credential_uri.to_s : nil,
'client_id' => self.client_id,
'client_secret' => self.client_secret,
'scope' => self.scope,
'state' => self.state,
'code' => self.code,
'redirect_uri' => self.redirect_uri ? self.redirect_uri.to_s : nil,
'username' => self.username,
'password' => self.password,
'issuer' => self.issuer,
'audience' => self.audience,
'person' => self.person,
'expiry' => self.expiry,
'expires_at' => self.expires_at ? self.expires_at.to_i : nil,
'signing_key' => self.signing_key,
'refresh_token' => self.refresh_token,
'access_token' => self.access_token,
'id_token' => self.id_token,
'extension_parameters' => self.extension_parameters
})
end
##
# Generates a request for token credentials.
#
# @param [Hash] options
# The configuration parameters for the request.
# - :code -
# The authorization code.
#
# @private
# @return [Array] The request object.
def generate_access_token_request(options={})
options = deep_hash_normalize(options)
parameters = {"grant_type" => self.grant_type}
case self.grant_type
when 'authorization_code'
parameters['code'] = self.code
parameters['redirect_uri'] = self.redirect_uri
when 'password'
parameters['username'] = self.username
parameters['password'] = self.password
when 'refresh_token'
parameters['refresh_token'] = self.refresh_token
when 'urn:ietf:params:oauth:grant-type:jwt-bearer'
parameters['assertion'] = self.to_jwt(options)
else
if self.redirect_uri
# Grant type was intended to be `authorization_code` because of
# the presence of the redirect URI.
raise ArgumentError, 'Missing authorization code.'
end
parameters.merge!(self.extension_parameters)
end
parameters['client_id'] = self.client_id unless self.client_id.nil?
parameters['client_secret'] = self.client_secret unless self.client_secret.nil?
parameters['scope'] = options[:scope] if options[:scope]
additional = self.additional_parameters.merge(options[:additional_parameters] || {})
additional.each { |k, v| parameters[k.to_s] = v }
parameters
end
def fetch_access_token(options={})
if self.token_credential_uri == nil
raise ArgumentError, 'Missing token endpoint URI.'
end
options = deep_hash_normalize(options)
client = options[:connection] ||= Faraday.default_connection
url = Addressable::URI.parse(self.token_credential_uri).normalize.to_s
parameters = self.generate_access_token_request(options)
if client.is_a?(Faraday::Connection)
response = client.post url,
Addressable::URI.form_encode(parameters),
{ 'Content-Type' => 'application/x-www-form-urlencoded' }
status = response.status.to_i
body = response.body
content_type = response.headers['Content-type']
else
# Hurley
response = client.post url, parameters
status = response.status_code.to_i
body = response.body
content_type = response.header[:content_type]
end
if status == 200
return ::Signet::OAuth2.parse_credentials(body, content_type)
elsif [400, 401, 403].include?(status)
message = 'Authorization failed.'
if body.to_s.strip.length > 0
message += " Server message:\n#{response.body.to_s.strip}"
end
raise ::Signet::AuthorizationError.new(
message, :response => response
)
else
message = "Unexpected status code: #{response.status}."
if body.to_s.strip.length > 0
message += " Server message:\n#{response.body.to_s.strip}"
end
raise ::Signet::AuthorizationError.new(
message, :response => response
)
end
end
def fetch_access_token!(options={})
options = deep_hash_normalize(options)
token_hash = self.fetch_access_token(options)
if token_hash
# No-op for grant types other than `authorization_code`.
# An authorization code is a one-time use token and is immediately
# revoked after usage.
self.code = nil
self.issued_at = Time.now
self.update_token!(token_hash)
end
return token_hash
end
##
# Refresh the access token, if possible
def refresh!(options={})
options = deep_hash_normalize(options)
self.fetch_access_token!(options)
end
##
# Generates an authenticated request for protected resources.
#
# @param [Hash] options
# The configuration parameters for the request.
# - :request -
# A pre-constructed request. An OAuth 2 Authorization header
# will be added to it, as well as an explicit Cache-Control
# `no-store` directive.
# - :method -
# The HTTP method for the request. Defaults to 'GET'.
# - :uri -
# The URI for the request.
# - :headers -
# The HTTP headers for the request.
# - :body -
# The HTTP body for the request.
# - :realm -
# The Authorization realm. See RFC 2617.
# @return [Faraday::Request] The request object.
def generate_authenticated_request(options={})
options = deep_hash_normalize(options)
if self.access_token == nil
raise ArgumentError, 'Missing access token.'
end
options = {
:realm => nil
}.merge(options)
if options[:request].kind_of?(Faraday::Request)
request = options[:request]
else
if options[:request].kind_of?(Array)
method, uri, headers, body = options[:request]
else
method = options[:method] || :get
uri = options[:uri]
headers = options[:headers] || []
body = options[:body] || ''
end
headers = headers.to_a if headers.kind_of?(Hash)
request_components = {
:method => method,
:uri => uri,
:headers => headers,
:body => body
}
# Verify that we have all pieces required to return an HTTP request
request_components.each do |(key, value)|
unless value
raise ArgumentError, "Missing :#{key} parameter."
end
end
method = method.to_s.downcase.to_sym
request = options[:connection].build_request(method.to_s.downcase.to_sym) do |req|
req.url(Addressable::URI.parse(uri).normalize.to_s)
req.headers = Faraday::Utils::Headers.new(headers)
req.body = body
end
end
request['Authorization'] = ::Signet::OAuth2.generate_bearer_authorization_header(
self.access_token,
options[:realm] ? [['realm', options[:realm]]] : nil
)
request['Cache-Control'] = 'no-store'
return request
end
##
# Transmits a request for a protected resource.
#
# @param [Hash] options
# The configuration parameters for the request.
# - :request -
# A pre-constructed request. An OAuth 2 Authorization header
# will be added to it, as well as an explicit Cache-Control
# `no-store` directive.
# - :method -
# The HTTP method for the request. Defaults to 'GET'.
# - :uri -
# The URI for the request.
# - :headers -
# The HTTP headers for the request.
# - :body -
# The HTTP body for the request.
# - :realm -
# The Authorization realm. See RFC 2617.
# - :connection -
# The HTTP connection to use.
# Must be of type Faraday::Connection.
#
# @example
# # Using Net::HTTP
# response = client.fetch_protected_resource(
# :uri => 'http://www.example.com/protected/resource'
# )
#
# @return [Array] The response object.
def fetch_protected_resource(options={})
options = deep_hash_normalize(options)
options[:connection] ||= Faraday.default_connection
request = self.generate_authenticated_request(options)
request_env = request.to_env(options[:connection])
request_env[:request] ||= request
response = options[:connection].app.call(request_env)
if response.status.to_i == 401
# When accessing a protected resource, we only want to raise an
# error for 401 responses.
message = 'Authorization failed.'
if response.body.to_s.strip.length > 0
message += " Server message:\n#{response.body.to_s.strip}"
end
raise ::Signet::AuthorizationError.new(
message, :request => request, :response => response
)
else
return response
end
end
private
##
# Check if URI is Google's postmessage flow (not a valid redirect_uri by spec, but allowed)
# @private
def uri_is_postmessage?(uri)
return uri.to_s.casecmp('postmessage') == 0
end
##
# Check if the URI is a out-of-band
# @private
def uri_is_oob?(uri)
return OOB_MODES.include?(uri.to_s)
end
# Convert all keys in this hash (nested) to symbols for uniform retrieval
def recursive_hash_normalize_keys(val)
if val.is_a? Hash
deep_hash_normalize(val)
else
val
end
end
def deep_hash_normalize(old_hash)
sym_hash = {}
old_hash and old_hash.each {|k,v| sym_hash[k.to_sym] = recursive_hash_normalize_keys(v)}
sym_hash
end
def normalize_timestamp(time)
case time
when NilClass
nil
when Time
time
when String
Time.parse(time)
when Fixnum, Bignum
Time.at(time)
else
fail "Invalid time value #{time}"
end
end
end
end
end
signet-0.7.3/lib/signet.rb 0000644 0001750 0001750 00000005454 13043627421 014434 0 ustar pravi pravi # Copyright (C) 2010 Google Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
require 'signet/version'
module Signet #:nodoc:
def self.parse_auth_param_list(auth_param_string)
# Production rules from:
# http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging-12
token = /[-!#$\%&'*+.^_`|~0-9a-zA-Z]+/
d_qdtext = /[\s\x21\x23-\x5B\x5D-\x7E\x80-\xFF]/n
d_quoted_pair = /\\[\s\x21-\x7E\x80-\xFF]/n
d_qs = /"(?:#{d_qdtext}|#{d_quoted_pair})*"/
# Production rules that allow for more liberal parsing, i.e. single quotes
s_qdtext = /[\s\x21-\x26\x28-\x5B\x5D-\x7E\x80-\xFF]/n
s_quoted_pair = /\\[\s\x21-\x7E\x80-\xFF]/n
s_qs = /'(?:#{s_qdtext}|#{s_quoted_pair})*'/
# Combine the above production rules to find valid auth-param pairs.
auth_param = /((?:#{token})\s*=\s*(?:#{d_qs}|#{s_qs}|#{token}))/
auth_param_pairs = []
last_match = nil
remainder = auth_param_string
# Iterate over the string, consuming pair matches as we go. Verify that
# pre-matches and post-matches contain only allowable characters.
#
# This would be way easier in Ruby 1.9, but we want backwards
# compatibility.
while (match = remainder.match(auth_param))
if match.pre_match && match.pre_match !~ /^[\s,]*$/
raise ParseError,
"Unexpected auth param format: '#{auth_param_string}'."
end
auth_param_pairs << match.captures[0] # Appending pair
remainder = match.post_match
last_match = match
end
if last_match.post_match && last_match.post_match !~ /^[\s,]*$/
raise ParseError,
"Unexpected auth param format: '#{auth_param_string}'."
end
# Now parse the auth-param pair strings & turn them into key-value pairs.
return (auth_param_pairs.inject([]) do |accu, pair|
name, value = pair.split('=', 2)
if value =~ /^".*"$/
value = value.gsub(/^"(.*)"$/, '\1').gsub(/\\(.)/, '\1')
elsif value =~ /^'.*'$/
value = value.gsub(/^'(.*)'$/, '\1').gsub(/\\(.)/, '\1')
elsif value =~ /[\(\)<>@,;:\\\"\/\[\]?={}]/
# Certain special characters are not allowed
raise ParseError, (
"Unexpected characters in auth param " +
"list: '#{auth_param_string}'."
)
end
accu << [name, value]
accu
end)
end
end
signet-0.7.3/website/ 0000755 0001750 0001750 00000000000 13043627421 013502 5 ustar pravi pravi signet-0.7.3/website/index.html 0000644 0001750 0001750 00000003430 13043627421 015477 0 ustar pravi pravi
Signet is an OAuth 1.0 / OAuth 2.0 implementation.
You know what to do:
sudo gem install signet