+require 'oauth/controllers/provider_controller'
+
class OauthController < ApplicationController
- layout 'site'
+ include OAuth::Controllers::ProviderController
- before_filter :authorize_web, :only => [:oauthorize, :revoke]
- before_filter :set_locale, :only => [:oauthorize, :revoke]
- before_filter :require_user, :only => [:oauthorize]
- before_filter :verify_oauth_consumer_signature, :only => [:request_token]
- before_filter :verify_oauth_request_token, :only => [:access_token]
- # Uncomment the following if you are using restful_open_id_authentication
- # skip_before_filter :verify_authenticity_token
+ layout 'slim'
- def request_token
- @token = current_client_application.create_request_token
+ def login_required
+ authorize_web
+ set_locale
+ require_user
+ end
- logger.info "in REQUEST TOKEN"
- if @token
- logger.info "request token params: #{params.inspect}"
- # request tokens indicate what permissions the client *wants*, not
- # necessarily the same as those which the user allows.
- current_client_application.permissions.each do |pref|
- logger.info "PARAMS found #{pref}"
+ def user_authorizes_token?
+ any_auth = false
+
+ @token.client_application.permissions.each do |pref|
+ if params[pref]
@token.write_attribute(pref, true)
+ any_auth ||= true
+ else
+ @token.write_attribute(pref, false)
end
- @token.save!
-
- render :text => @token.to_query
- else
- render :nothing => true, :status => 401
end
+
+ any_auth
end
- def access_token
- @token = current_token && current_token.exchange!
+ def revoke
+ @token = current_user.oauth_tokens.find_by_token params[:token]
if @token
- render :text => @token.to_query
- else
- render :nothing => true, :status => 401
+ @token.invalidate!
+ flash[:notice] = t('oauth.revoke.flash', :application => @token.client_application.name)
end
+ redirect_to oauth_clients_url(:display_name => @token.user.display_name)
end
- def oauthorize
- @token = RequestToken.find_by_token params[:oauth_token]
+protected
+
+ def oauth1_authorize
+ unless @token
+ render :action=>"authorize_failure"
+ return
+ end
+
unless @token.invalidated?
if request.post?
- any_auth = false
- @token.client_application.permissions.each do |pref|
- if params[pref]
- logger.info "OAUTHORIZE PARAMS found #{pref}"
- @token.write_attribute(pref, true)
- any_auth ||= true
+ if user_authorizes_token?
+ @token.authorize!(current_user)
+ if @token.oauth10?
+ callback_url = params[:oauth_callback] || @token.client_application.callback_url
else
- @token.write_attribute(pref, false)
+ callback_url = @token.oob? ? @token.client_application.callback_url : @token.callback_url
end
- end
+ @redirect_url = URI.parse(callback_url) unless callback_url.blank?
- if any_auth
- @token.authorize!(@user)
- redirect_url = params[:oauth_callback] || @token.client_application.callback_url
- if redirect_url
- redirect_to "#{redirect_url}?oauth_token=#{@token.token}"
+ unless @redirect_url.to_s.blank?
+ @redirect_url.query = @redirect_url.query.blank? ?
+ "oauth_token=#{@token.token}" :
+ @redirect_url.query + "&oauth_token=#{@token.token}"
+ unless @token.oauth10?
+ @redirect_url.query += "&oauth_verifier=#{@token.verifier}"
+ end
+ redirect_to @redirect_url.to_s
else
render :action => "authorize_success"
end
else
@token.invalidate!
+ @message = t("oauth.oauthorize_failure.denied", :app_name => @token.client_application.name)
render :action => "authorize_failure"
end
end
else
+ @message = t "oauth.oauthorize_failure.invalid"
render :action => "authorize_failure"
end
end
-
- def revoke
- @token = @user.oauth_tokens.find_by_token params[:token]
- if @token
- @token.invalidate!
- flash[:notice] = t('oauth.revoke.flash', :application => @token.client_application.name)
- end
- logger.info "about to redirect"
- redirect_to :controller => 'oauth_clients', :action => 'index'
- end
end