Class: Hitch::TokensController

Inherits:
PublicEndpointController
  • Object
show all
Includes:
ClientResolution, CorsSupport, OauthFormAdmission, UriValidation
Defined in:
app/controllers/hitch/tokens_controller.rb

Overview

POST /oauth/token — exchange auth code for access token.

Public endpoint (no session auth — clients calling from CLI / browser / desktop reach this without a Rails session). PKCE verifier is the credential.

Constant Summary collapse

TOKEN_PARAMETER_NAMES = 
%i[
  grant_type
  code
  client_id
  client_secret
  code_verifier
  device_code
  resource
  redirect_uri
  refresh_token
  scope
].freeze

Constants included from RequestAdmission

RequestAdmission::MAX_REQUEST_BODY_BYTES

Instance Method Summary collapse

Instance Method Details

#create ⇒ Object 



28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
 
# File 'app/controllers/hitch/tokens_controller.rb', line 28

def create
  unless request.media_type == Hitch::OauthRequestParameters::FORM_MEDIA_TYPE
    return oauth_error("invalid_request", "token requests must use application/x-www-form-urlencoded")
  end

  oauth = oauth_parameters(*TOKEN_PARAMETER_NAMES, form_only: true)
  case oauth[:grant_type]
  when "authorization_code" then authorization_code_grant(oauth)
  when "refresh_token" then refresh_token_grant(oauth)
  when Hitch::GrantTypes::DEVICE_CODE then device_code_grant(oauth)
  else
    oauth_error("invalid_request", "grant_type must be #{Hitch::GrantTypes.supported.join(' or ')}")
  end
rescue Hitch::AccessToken::OAuthError => e
  oauth_error(e.oauth_code, e.description)
end