raucao
8dd0bf10ce
Implements the optional OAuth 2.0 Authorization Code grant with PKCE (RFC 7636) for remoteStorage, as described in the remoteStorage spec (section 10.1). - Advertise the authorization and token endpoints plus the supported code_challenge method (S256) in WebFinger, and bump the advertised spec version to draft-dejong-remotestorage-27 - Add RsAuthorizationCode: a short-lived (5 min), single-use authorization code stored only as a SHA256 digest - Add RsOauthManager services for issuing and exchanging codes, including S256 verification - Add a cross-origin POST /rs/oauth/token endpoint that exchanges a code (and code_verifier) for an access token, with CORS and no CSRF token - Consent dialog now carries response_type / code_challenge through the form and redirects with the code in the query string for the code flow - Remove the existing-token reuse shortcut so every authorization results in a distinct authorization (and token) Part of #254
28 lines
814 B
Ruby
28 lines
814 B
Ruby
module RsOauthManager
|
|
class IssueCode < RsOauthManagerService
|
|
def initialize(user:, client_id:, redirect_uri:, permissions:,
|
|
code_challenge:, code_challenge_method: "S256",
|
|
expire_at: nil)
|
|
@user = user
|
|
@client_id = client_id
|
|
@redirect_uri = redirect_uri
|
|
@permissions = permissions
|
|
@code_challenge = code_challenge
|
|
@code_challenge_method = code_challenge_method
|
|
@expire_at = expire_at
|
|
end
|
|
|
|
def call
|
|
RsAuthorizationCode.create!(
|
|
user: @user,
|
|
client_id: @client_id,
|
|
redirect_uri: @redirect_uri,
|
|
permissions: @permissions,
|
|
permission_expire_at: @expire_at,
|
|
code_challenge: @code_challenge,
|
|
code_challenge_method: @code_challenge_method
|
|
)
|
|
end
|
|
end
|
|
end
|