2012-02-21 23:28:05 +01:00
|
|
|
<?php
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Copyright 2012 Facebook, Inc.
|
|
|
|
*
|
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
* you may not use this file except in compliance with the License.
|
|
|
|
* You may obtain a copy of the License at
|
|
|
|
*
|
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
*
|
|
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
* See the License for the specific language governing permissions and
|
|
|
|
* limitations under the License.
|
|
|
|
*/
|
|
|
|
|
|
|
|
final class PhabricatorOAuthServerScope {
|
|
|
|
|
|
|
|
const SCOPE_OFFLINE_ACCESS = 'offline_access';
|
|
|
|
const SCOPE_WHOAMI = 'whoami';
|
|
|
|
const SCOPE_NOT_ACCESSIBLE = 'not_accessible';
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Note this does not contain SCOPE_NOT_ACCESSIBLE which is magic
|
|
|
|
* used to simplify code for data that is not currently accessible
|
|
|
|
* via OAuth.
|
|
|
|
*/
|
|
|
|
static public function getScopesDict() {
|
|
|
|
return array(
|
|
|
|
self::SCOPE_OFFLINE_ACCESS => 1,
|
|
|
|
self::SCOPE_WHOAMI => 1,
|
|
|
|
);
|
|
|
|
}
|
|
|
|
|
2012-02-22 19:21:39 +01:00
|
|
|
static public function getCheckboxControl($current_scopes) {
|
|
|
|
$scopes = self::getScopesDict();
|
|
|
|
$scope_keys = array_keys($scopes);
|
|
|
|
sort($scope_keys);
|
|
|
|
|
|
|
|
$checkboxes = new AphrontFormCheckboxControl();
|
|
|
|
foreach ($scope_keys as $scope) {
|
|
|
|
$checkboxes->addCheckbox(
|
|
|
|
$name = $scope,
|
|
|
|
$value = 1,
|
|
|
|
$label = self::getCheckboxLabel($scope),
|
|
|
|
$checked = isset($current_scopes[$scope])
|
|
|
|
);
|
|
|
|
}
|
|
|
|
$checkboxes->setLabel('Scope');
|
|
|
|
|
|
|
|
return $checkboxes;
|
|
|
|
}
|
|
|
|
|
|
|
|
static private function getCheckboxLabel($scope) {
|
|
|
|
$label = null;
|
|
|
|
switch ($scope) {
|
|
|
|
case self::SCOPE_OFFLINE_ACCESS:
|
|
|
|
$label = 'Make access tokens granted to this client never expire.';
|
|
|
|
break;
|
|
|
|
case self::SCOPE_WHOAMI:
|
|
|
|
$label = 'Read access to Conduit method user.whoami.';
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
return $label;
|
|
|
|
}
|
|
|
|
|
|
|
|
static public function getScopesFromRequest(AphrontRequest $request) {
|
|
|
|
$scopes = self::getScopesDict();
|
|
|
|
$requested_scopes = array();
|
|
|
|
foreach ($scopes as $scope => $bit) {
|
|
|
|
if ($request->getBool($scope)) {
|
|
|
|
$requested_scopes[$scope] = 1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return $requested_scopes;
|
|
|
|
}
|
|
|
|
|
OAuthServer polish and random sauce
Summary:
This diff makes the OAuthServer more compliant with the spec by
- making it return well-formatted error codes with error types from the spec.
- making it respect the "state" variable, which is a transparent variable the
client passes and the server passes back
- making it be super, duper compliant with respect to redirect uris
-- if specified in authorization step, check if its valid relative to the client
registered URI and if so save it
-- if specified in authorization step, check if its been specified in the access
step and error if it doesn't match or doesn't exist
-- note we don't make any use of it in the access step which seems strange but
hey, that's what the spec says!
This diff makes the OAuthServer suck less by
- making the "cancel" button do something in the user authorization flow
- making the client list view and client edit view be a bit more usable around
client secrets
- fixing a few bugs I managed to introduce along the way
Test Plan:
- create a test phabricator client, updated my conf, and then linked and
unlinked phabricator to itself
- wrote some tests for PhabricatorOAuthServer -- they pass!
-- these validate the various validate URI checks
- tried a few important authorization calls
--
http://phabricator.dev/oauthserver/auth/?client_id=X&state=test&redirect_uri=http://www.evil.com
--- verified error'd from mismatching redirect uri's
--- verified state parameter in response
--- verified did not redirect to client redirect uri
-- http://phabricator.dev/oauthserver/auth/?client_id=X w/ existing
authorization
--- got redirected to proper client url with error that response_type not
specified
-- http://phabricator.dev/oauthserver/auth/?client_id=X&response_type=code w/
existing authorization
--- got redirected to proper client url with pertinent code!
- tried a few important access calls
-- verified appropriate errors if missing any required parameters
-- verified good access code with appropriate other variables resulted in an
access token
- verified that if redirect_uri set correctly in authorization required for
access and errors if differs at all / only succeeds if exactly the same
Reviewers: epriestley
Reviewed By: epriestley
CC: aran, epriestley, ajtrichards
Maniphest Tasks: T889, T906, T897
Differential Revision: https://secure.phabricator.com/D1727
2012-03-01 23:46:18 +01:00
|
|
|
/**
|
|
|
|
* A scopes list is considered valid if each scope is a known scope
|
|
|
|
* and each scope is seen only once. Otherwise, the list is invalid.
|
|
|
|
*/
|
|
|
|
static public function validateScopesList($scope_list) {
|
|
|
|
$scopes = explode(' ', $scope_list);
|
|
|
|
$known_scopes = self::getScopesDict();
|
|
|
|
$seen_scopes = array();
|
|
|
|
foreach ($scopes as $scope) {
|
|
|
|
if (!isset($known_scopes[$scope])) {
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
if (isset($seen_scopes[$scope])) {
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
$seen_scopes[$scope] = 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* A scopes dictionary is considered valid if each key is a known scope.
|
|
|
|
* Otherwise, the dictionary is invalid.
|
|
|
|
*/
|
|
|
|
static public function validateScopesDict($scope_dict) {
|
|
|
|
$known_scopes = self::getScopesDict();
|
|
|
|
$unknown_scopes = array_diff_key($scope_dict,
|
|
|
|
$known_scopes);
|
|
|
|
return empty($unknown_scopes);
|
|
|
|
}
|
|
|
|
|
|
|
|
static public function scopesListToDict($scope_list) {
|
|
|
|
return array_fill_keys($scope_list, 1);
|
|
|
|
}
|
|
|
|
|
2012-02-21 23:28:05 +01:00
|
|
|
}
|