raucao
25856a7ca7
CI / Test (pull_request) Successful in 2m11s
- Add user_agent to remote_storage_authorizations and rs_authorization_codes - Capture the browser's user agent at consent, carry it on the authorization code, and store it on the authorization when the code is exchanged - Store it directly for the implicit flow too With the reuse shortcut gone, each authorization is already a distinct per-device token; this adds the metadata needed to label and display them. Part of #254
37 lines
1.1 KiB
Ruby
37 lines
1.1 KiB
Ruby
module RsOauthManager
|
|
class ExchangeCode < RsOauthManagerService
|
|
def initialize(code:, client_id:, redirect_uri:, code_verifier:)
|
|
@code = code
|
|
@client_id = client_id
|
|
@redirect_uri = redirect_uri
|
|
@code_verifier = code_verifier
|
|
end
|
|
|
|
def call
|
|
auth_code = RsAuthorizationCode.find_by_code(@code)
|
|
raise InvalidGrant if auth_code.nil? || auth_code.expired?
|
|
|
|
raise InvalidGrant unless hostname_of(@client_id) == hostname_of(@redirect_uri)
|
|
raise InvalidGrant unless @redirect_uri == auth_code.redirect_uri
|
|
|
|
raise InvalidGrant unless VerifyPkce.call(
|
|
code_challenge: auth_code.code_challenge,
|
|
code_challenge_method: auth_code.code_challenge_method,
|
|
code_verifier: @code_verifier
|
|
)
|
|
|
|
auth = auth_code.user.remote_storage_authorizations.create!(
|
|
permissions: auth_code.permissions,
|
|
client_id: auth_code.client_id,
|
|
redirect_uri: auth_code.redirect_uri,
|
|
app_name: auth_code.client_id,
|
|
expire_at: auth_code.permission_expire_at,
|
|
user_agent: auth_code.user_agent
|
|
)
|
|
|
|
auth_code.consume!
|
|
auth
|
|
end
|
|
end
|
|
end
|