auth

     1.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     1.2 +++ b/authcode.go	Sun Dec 07 03:40:25 2014 -0500
     1.3 @@ -0,0 +1,116 @@
     1.4 +package auth
     1.5 +
     1.6 +import (
     1.7 +	"encoding/json"
     1.8 +	"errors"
     1.9 +	"net/http"
    1.10 +	"time"
    1.11 +
    1.12 +	"code.secondbit.org/uuid"
    1.13 +)
    1.14 +
    1.15 +func init() {
    1.16 +	RegisterGrantType("authorization_code", GrantType{
    1.17 +		Validate:      authCodeGrantValidate,
    1.18 +		IssuesRefresh: true,
    1.19 +		ReturnToken:   RenderJSONToken,
    1.20 +	})
    1.21 +}
    1.22 +
    1.23 +var (
    1.24 +	// ErrNoAuthorizationCodeStore is returned when a Context tries to act on a authorizationCodeStore without setting one first.
    1.25 +	ErrNoAuthorizationCodeStore = errors.New("no authorizationCodeStore was specified for the Context")
    1.26 +	// ErrAuthorizationCodeNotFound is returned when an AuthorizationCode is requested but not found in the authorizationCodeStore.
    1.27 +	ErrAuthorizationCodeNotFound = errors.New("authorization code not found in authorizationCodeStore")
    1.28 +	// ErrAuthorizationCodeAlreadyExists is returned when an AuthorizationCode is added to a authorizationCodeStore, but another AuthorizationCode with the
    1.29 +	// same Code already exists in the authorizationCodeStore.
    1.30 +	ErrAuthorizationCodeAlreadyExists = errors.New("authorization code already exists in authorizationCodeStore")
    1.31 +)
    1.32 +
    1.33 +// AuthorizationCode represents an authorization grant made by a user to a Client, to
    1.34 +// access user data within a defined Scope for a limited amount of time.
    1.35 +type AuthorizationCode struct {
    1.36 +	Code        string
    1.37 +	Created     time.Time
    1.38 +	ExpiresIn   int32
    1.39 +	ClientID    uuid.ID
    1.40 +	Scope       string
    1.41 +	RedirectURI string
    1.42 +	State       string
    1.43 +	ProfileID   uuid.ID
    1.44 +}
    1.45 +
    1.46 +type authorizationCodeStore interface {
    1.47 +	getAuthorizationCode(code string) (AuthorizationCode, error)
    1.48 +	saveAuthorizationCode(authCode AuthorizationCode) error
    1.49 +	deleteAuthorizationCode(code string) error
    1.50 +}
    1.51 +
    1.52 +func (m *memstore) getAuthorizationCode(code string) (AuthorizationCode, error) {
    1.53 +	m.authCodeLock.RLock()
    1.54 +	defer m.authCodeLock.RUnlock()
    1.55 +	authCode, ok := m.authCodes[code]
    1.56 +	if !ok {
    1.57 +		return AuthorizationCode{}, ErrAuthorizationCodeNotFound
    1.58 +	}
    1.59 +	return authCode, nil
    1.60 +}
    1.61 +
    1.62 +func (m *memstore) saveAuthorizationCode(authCode AuthorizationCode) error {
    1.63 +	m.authCodeLock.Lock()
    1.64 +	defer m.authCodeLock.Unlock()
    1.65 +	_, ok := m.authCodes[authCode.Code]
    1.66 +	if ok {
    1.67 +		return ErrAuthorizationCodeAlreadyExists
    1.68 +	}
    1.69 +	m.authCodes[authCode.Code] = authCode
    1.70 +	return nil
    1.71 +}
    1.72 +
    1.73 +func (m *memstore) deleteAuthorizationCode(code string) error {
    1.74 +	m.authCodeLock.Lock()
    1.75 +	defer m.authCodeLock.Unlock()
    1.76 +	_, ok := m.authCodes[code]
    1.77 +	if !ok {
    1.78 +		return ErrAuthorizationCodeNotFound
    1.79 +	}
    1.80 +	delete(m.authCodes, code)
    1.81 +	return nil
    1.82 +}
    1.83 +
    1.84 +func authCodeGrantValidate(w http.ResponseWriter, r *http.Request, context Context) (scope string, profileID uuid.ID, valid bool) {
    1.85 +	enc := json.NewEncoder(w)
    1.86 +	code := r.PostFormValue("code")
    1.87 +	if code == "" {
    1.88 +		w.WriteHeader(http.StatusBadRequest)
    1.89 +		renderJSONError(enc, "invalid_request")
    1.90 +		return
    1.91 +	}
    1.92 +	clientID, success := verifyClient(w, r, true, context)
    1.93 +	if !success {
    1.94 +		return
    1.95 +	}
    1.96 +	authCode, err := context.GetAuthorizationCode(code)
    1.97 +	if err != nil {
    1.98 +		if err == ErrAuthorizationCodeNotFound {
    1.99 +			w.WriteHeader(http.StatusBadRequest)
   1.100 +			renderJSONError(enc, "invalid_grant")
   1.101 +			return
   1.102 +		}
   1.103 +		w.WriteHeader(http.StatusInternalServerError)
   1.104 +		renderJSONError(enc, "server_error")
   1.105 +		return
   1.106 +	}
   1.107 +	redirectURI := r.PostFormValue("redirect_uri")
   1.108 +	if authCode.RedirectURI != redirectURI {
   1.109 +		w.WriteHeader(http.StatusBadRequest)
   1.110 +		renderJSONError(enc, "invalid_grant")
   1.111 +		return
   1.112 +	}
   1.113 +	if !authCode.ClientID.Equal(clientID) {
   1.114 +		w.WriteHeader(http.StatusBadRequest)
   1.115 +		renderJSONError(enc, "invalid_grant")
   1.116 +		return
   1.117 +	}
   1.118 +	return authCode.Scope, authCode.ProfileID, true
   1.119 +}