raucao
8dd0bf10ce
Implements the optional OAuth 2.0 Authorization Code grant with PKCE (RFC 7636) for remoteStorage, as described in the remoteStorage spec (section 10.1). - Advertise the authorization and token endpoints plus the supported code_challenge method (S256) in WebFinger, and bump the advertised spec version to draft-dejong-remotestorage-27 - Add RsAuthorizationCode: a short-lived (5 min), single-use authorization code stored only as a SHA256 digest - Add RsOauthManager services for issuing and exchanging codes, including S256 verification - Add a cross-origin POST /rs/oauth/token endpoint that exchanges a code (and code_verifier) for an access token, with CORS and no CSRF token - Consent dialog now carries response_type / code_challenge through the form and redirects with the code in the query string for the code flow - Remove the existing-token reuse shortcut so every authorization results in a distinct authorization (and token) Part of #254
36 lines
1.1 KiB
Ruby
36 lines
1.1 KiB
Ruby
module RsOauthManager
|
|
class ExchangeCode < RsOauthManagerService
|
|
def initialize(code:, client_id:, redirect_uri:, code_verifier:)
|
|
@code = code
|
|
@client_id = client_id
|
|
@redirect_uri = redirect_uri
|
|
@code_verifier = code_verifier
|
|
end
|
|
|
|
def call
|
|
auth_code = RsAuthorizationCode.find_by_code(@code)
|
|
raise InvalidGrant if auth_code.nil? || auth_code.expired?
|
|
|
|
raise InvalidGrant unless hostname_of(@client_id) == hostname_of(@redirect_uri)
|
|
raise InvalidGrant unless @redirect_uri == auth_code.redirect_uri
|
|
|
|
raise InvalidGrant unless VerifyPkce.call(
|
|
code_challenge: auth_code.code_challenge,
|
|
code_challenge_method: auth_code.code_challenge_method,
|
|
code_verifier: @code_verifier
|
|
)
|
|
|
|
auth = auth_code.user.remote_storage_authorizations.create!(
|
|
permissions: auth_code.permissions,
|
|
client_id: auth_code.client_id,
|
|
redirect_uri: auth_code.redirect_uri,
|
|
app_name: auth_code.client_id,
|
|
expire_at: auth_code.permission_expire_at
|
|
)
|
|
|
|
auth_code.consume!
|
|
auth
|
|
end
|
|
end
|
|
end
|