forked from vikunja/vikunja
103 lines
4.1 KiB
Go
103 lines
4.1 KiB
Go
/*
|
|
* Copyright © 2015-2018 Aeneas Rekkas <aeneas+oss@aeneas.io>
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*
|
|
* @author Aeneas Rekkas <aeneas+oss@aeneas.io>
|
|
* @copyright 2015-2018 Aeneas Rekkas <aeneas+oss@aeneas.io>
|
|
* @license Apache-2.0
|
|
*
|
|
*/
|
|
|
|
package fosite
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"strings"
|
|
|
|
"github.com/pkg/errors"
|
|
)
|
|
|
|
// Implements
|
|
// * https://tools.ietf.org/html/rfc6749#section-2.3.1
|
|
// Clients in possession of a client password MAY use the HTTP Basic
|
|
// authentication scheme as defined in [RFC2617] to authenticate with
|
|
// the authorization server. The client identifier is encoded using the
|
|
// "application/x-www-form-urlencoded" encoding algorithm per
|
|
// Appendix B, and the encoded value is used as the username; the client
|
|
// password is encoded using the same algorithm and used as the
|
|
// password. The authorization server MUST support the HTTP Basic
|
|
// authentication scheme for authenticating clients that were issued a
|
|
// client password.
|
|
// Including the client credentials in the request-body using the two
|
|
// parameters is NOT RECOMMENDED and SHOULD be limited to clients unable
|
|
// to directly utilize the HTTP Basic authentication scheme (or other
|
|
// password-based HTTP authentication schemes). The parameters can only
|
|
// be transmitted in the request-body and MUST NOT be included in the
|
|
// request URI.
|
|
// * https://tools.ietf.org/html/rfc6749#section-3.2.1
|
|
// - Confidential clients or other clients issued client credentials MUST
|
|
// authenticate with the authorization server as described in
|
|
// Section 2.3 when making requests to the token endpoint.
|
|
// - If the client type is confidential or the client was issued client
|
|
// credentials (or assigned other authentication requirements), the
|
|
// client MUST authenticate with the authorization server as described
|
|
// in Section 3.2.1.
|
|
func (f *Fosite) NewAccessRequest(ctx context.Context, r *http.Request, session Session) (AccessRequester, error) {
|
|
var err error
|
|
accessRequest := NewAccessRequest(session)
|
|
|
|
if r.Method != "POST" {
|
|
return accessRequest, errors.WithStack(ErrInvalidRequest.WithHintf("HTTP method is \"%s\", expected \"POST\".", r.Method))
|
|
} else if err := r.ParseMultipartForm(1 << 20); err != nil && err != http.ErrNotMultipart {
|
|
return accessRequest, errors.WithStack(ErrInvalidRequest.WithHint("Unable to parse HTTP body, make sure to send a properly formatted form request body.").WithDebug(err.Error()))
|
|
} else if len(r.PostForm) == 0 {
|
|
return accessRequest, errors.WithStack(ErrInvalidRequest.WithHint("The POST body can not be empty."))
|
|
}
|
|
|
|
accessRequest.Form = r.PostForm
|
|
if session == nil {
|
|
return accessRequest, errors.New("Session must not be nil")
|
|
}
|
|
|
|
accessRequest.SetRequestedScopes(RemoveEmpty(strings.Split(r.PostForm.Get("scope"), " ")))
|
|
accessRequest.SetRequestedAudience(RemoveEmpty(strings.Split(r.PostForm.Get("audience"), " ")))
|
|
accessRequest.GrantTypes = RemoveEmpty(strings.Split(r.PostForm.Get("grant_type"), " "))
|
|
if len(accessRequest.GrantTypes) < 1 {
|
|
return accessRequest, errors.WithStack(ErrInvalidRequest.WithHint(`Request parameter "grant_type"" is missing`))
|
|
}
|
|
|
|
client, err := f.AuthenticateClient(ctx, r, r.PostForm)
|
|
if err != nil {
|
|
return accessRequest, err
|
|
}
|
|
accessRequest.Client = client
|
|
|
|
var found bool = false
|
|
for _, loader := range f.TokenEndpointHandlers {
|
|
if err := loader.HandleTokenEndpointRequest(ctx, accessRequest); err == nil {
|
|
found = true
|
|
} else if errors.Cause(err).Error() == ErrUnknownRequest.Error() {
|
|
// do nothing
|
|
} else if err != nil {
|
|
return accessRequest, err
|
|
}
|
|
}
|
|
|
|
if !found {
|
|
return nil, errors.WithStack(ErrInvalidRequest)
|
|
}
|
|
return accessRequest, nil
|
|
}
|