Class: Capsium::Reactor::OAuth2

Inherits:
Object
  • Object
show all
Defined in:
lib/capsium/reactor/oauth2.rb,
sig/capsium/reactor/oauth2.rbs

Overview

OAuth2 authorization-code flow client (05x-authentication), used by the Authenticator. Talks to the provider over net/http; the client secret never comes from the package.

Defined Under Namespace

Classes: FlowError

Constant Summary collapse

GRANT_TYPE =

Returns:

  • (String) 
"authorization_code"

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(config, client_secret:, session:, base_url: nil) ⇒ OAuth2

Returns a new instance of OAuth2.



22
23
24
25
26
27
 
# File 'lib/capsium/reactor/oauth2.rb', line 22

def initialize(config, client_secret:, session:, base_url: nil)
  @config = config
  @client_secret = client_secret
  @session = session
  @base_url = base_url
end

Instance Attribute Details

#config ⇒ Package::OAuth2Config (readonly)

Returns the value of attribute config.

Returns:



20
21
22
 
# File 'lib/capsium/reactor/oauth2.rb', line 20

def config
  @config
end

Instance Method Details

#authorization_url(request) ⇒ String

The provider URL the login endpoint redirects the browser to.

Parameters:

  • request (Object)

Returns:

  • (String) 


30
31
32
33
34
35
36
37
38
39
 
# File 'lib/capsium/reactor/oauth2.rb', line 30

def authorization_url(request)
  params = {
    "response_type" => "code",
    "client_id" => @config.client_id,
    "redirect_uri" => callback_uri(request),
    "state" => generate_state
  }
  params["scope"] = @config.scopes.join(" ") unless @config.scopes.empty?
  "#{@config.authorization_url}?#{URI.encode_www_form(params)}"
end

#callback_uri(request) ⇒ String

Parameters:

  • request (Object)

Returns:

  • (String) 


55
56
57
 
# File 'lib/capsium/reactor/oauth2.rb', line 55

def callback_uri(request)
  "#{base_url_for(request)}#{@config.redirect_path}"
end

#complete(code, request) ⇒ Hash[String, untyped]

Exchanges the authorization code and fetches the userinfo claims. Returns the raw userinfo hash; raises FlowError on provider errors.

Parameters:

  • code (String, nil)
  • request (Object)

Returns:

  • (Hash[String, untyped]) 


51
52
53
 
# File 'lib/capsium/reactor/oauth2.rb', line 51

def complete(code, request)
  userinfo(exchange_code(code, callback_uri(request)))
end

#valid_state?(state) ⇒ Boolean

Parameters:

  • state (String, nil)

Returns:

  • (Boolean) 


41
42
43
44
45
46
 
# File 'lib/capsium/reactor/oauth2.rb', line 41

def valid_state?(state)
  nonce, signature = state.to_s.split(".", 2)
  return false if nonce.nil? || nonce.empty? || signature.nil?

  Reactor.secure_compare(@session.sign(nonce), signature)
end