auth: client.go diff

Break client verification out, break token returns out. Break client verification out into a helper function to avoid rewriting it for pretty much every grant. Break token returns out into a new function as part of the GrantType, so that implicit grants can redirect with the token value. Split returning the token as JSON into its own exported function, which can be used in multiple grants. Return more relevant information to the template when a user is deciding whether or not to authorize a grant.

     1.1 --- a/client.go	Sat Dec 06 03:33:11 2014 -0500
     1.2 +++ b/client.go	Sun Dec 07 02:52:39 2014 -0500
     1.3 @@ -1,7 +1,9 @@
     1.4  package auth
     1.5  
     1.6  import (
     1.7 +	"encoding/json"
     1.8  	"errors"
     1.9 +	"net/http"
    1.10  	"net/url"
    1.11  	"time"
    1.12  
    1.13 @@ -109,6 +111,50 @@
    1.14  	return nil
    1.15  }
    1.16  
    1.17 +func verifyClient(w http.ResponseWriter, r *http.Request, allowPublic bool, context Context) (uuid.ID, bool) {
    1.18 +	enc := json.NewEncoder(w)
    1.19 +	clientIDStr, clientSecret, fromAuthHeader := r.BasicAuth()
    1.20 +	if !fromAuthHeader {
    1.21 +		if !allowPublic {
    1.22 +			w.WriteHeader(http.StatusBadRequest)
    1.23 +			renderJSONError(enc, "unauthorized_client")
    1.24 +			return nil, false
    1.25 +		}
    1.26 +		clientIDStr = r.PostFormValue("client_id")
    1.27 +	}
    1.28 +	clientID, err := uuid.Parse(clientIDStr)
    1.29 +	if err != nil {
    1.30 +		w.WriteHeader(http.StatusUnauthorized)
    1.31 +		if fromAuthHeader {
    1.32 +			w.Header().Set("WWW-Authenticate", "Basic")
    1.33 +		}
    1.34 +		renderJSONError(enc, "invalid_client")
    1.35 +		return nil, false
    1.36 +	}
    1.37 +	client, err := context.GetClient(clientID)
    1.38 +	if err == ErrClientNotFound {
    1.39 +		w.WriteHeader(http.StatusUnauthorized)
    1.40 +		if fromAuthHeader {
    1.41 +			w.Header().Set("WWW-Authenticate", "Basic")
    1.42 +		}
    1.43 +		renderJSONError(enc, "invalid_client")
    1.44 +		return nil, false
    1.45 +	} else if err != nil {
    1.46 +		w.WriteHeader(http.StatusInternalServerError)
    1.47 +		renderJSONError(enc, "server_error")
    1.48 +		return nil, false
    1.49 +	}
    1.50 +	if client.Secret != clientSecret {
    1.51 +		w.WriteHeader(http.StatusUnauthorized)
    1.52 +		if fromAuthHeader {
    1.53 +			w.Header().Set("WWW-Authenticate", "Basic")
    1.54 +		}
    1.55 +		renderJSONError(enc, "invalid_client")
    1.56 +		return nil, false
    1.57 +	}
    1.58 +	return clientID, true
    1.59 +}
    1.60 +
    1.61  // Endpoint represents a single URI that a Client
    1.62  // controls. Users will be redirected to these URIs
    1.63  // following successful authorization grants and

auth

auth/client.go