Class: Hitch::ActivationsController

Inherits:
ApplicationController
  • Object
show all
Includes:
DeviceAuthorizationGate, OauthFormAdmission
Defined in:
app/controllers/hitch/activations_controller.rb

Overview

GET /activate — enter a device code (RFC 8628 §3.3) POST /activate — verify the code, then approve or deny

The one browser piece of the device flow. Session-authenticated through the host's ApplicationController like the consent screen: the host's sign-in gates it, and current_principal is who the approval binds.

The page's words are part of the security boundary (§5.4): the flow is "a stranger asks you to approve a code", so the screen says plainly that a code should only be entered by the person who asked a device for it, and a ?user_code= prefill only fills the field — approving always takes the person's own submit.

Constant Summary

Constants included from RequestAdmission

RequestAdmission::MAX_REQUEST_BODY_BYTES

Instance Method Summary collapse

Instance Method Details

#create ⇒ Object 



50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
 
# File 'app/controllers/hitch/activations_controller.rb', line 50

def create
  return require_principal! unless current_principal

  oauth = oauth_parameters(:user_code, :decision, form_only: true)
  # Absent field, same answer as a blank one — and before the quota:
  # neither is a guess.
  return render_new(alert: "Enter the code your device is showing.") if oauth[:user_code].blank?
  return unless admit_verification_rate!

  grant = DeviceGrant.find_pending_by_user_code(oauth[:user_code])
  return unknown_code unless grant

  case oauth[:decision]
  when nil then confirm(grant, oauth[:user_code])
  when "approve" then approve(grant, oauth[:user_code])
  when "deny" then deny(oauth[:user_code])
  else
    render_new alert: "Something went wrong with that submission. Enter the code again."
  end
end

#new ⇒ Object 



40
41
42
43
44
45
46
47
48
 
# File 'app/controllers/hitch/activations_controller.rb', line 40

def new
  return unless admit_oauth_endpoint!
  return require_principal! unless current_principal

  # Prefill from verification_uri_complete. Display only — §5.4 wants
  # the person to see the code and confirm it matches their device, so
  # a prefilled form still submits by hand.
  @user_code = DeviceGrant.display_user_code(params[:user_code])
end