Humanstate / mojolicious-plugin-oauth2-server / 129

pending completion

Build # 129

Build Type

push

travis-ci

Committed by

leejo

Commit Message

<a href="https://github.com/Humanstate/mojolicious-plugin-oauth2-server/commit/<a class=hub.com/Humanstate/mojolicious-plugin-oauth2-server/commit/<a class="double-link" href="https://git"><a class=hub.com/Humanstate/mojolicious-plugin-oauth2-server/commit/<a class="double-link" href="https://git"><a class=hub.com/Humanstate/mojolicious-plugin-oauth2-server/commit/<a class="double-link" href="https://git"><a class=hub.com/Humanstate/mojolicious-plugin-oauth2-server/commit/ea7023ce4597f8f9ac6eb5bd7181d44d401927fe">ea7023ce4">&lt;a href=&quot;https://github.com/Humanstate/mojolicious-plugin-oauth2-server/commit/</a><a class="double-link" href="https://github.com/Humanstate/mojolicious-plugin-oauth2-server/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/Humanstate/mojolicious-plugin-oauth2-server/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/Humanstate/mojolicious-plugin-oauth2-server/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/Humanstate/mojolicious-plugin-oauth2-server/commit/ea7023ce4597f8f9ac6eb5bd7181d44d401927fe">ea7023ce4</a><a href="https://github.com/Humanstate/mojolicious-plugin-oauth2-server/commit/ea7023ce4597f8f9ac6eb5bd7181d44d401927fe">&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/Humanstate/mojolicious-plugin-oauth2-server/commit/&lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/Humanstate/mojolicious-plugin-oauth2-server/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/Humanstate/mojolicious-plugin-oauth2-server/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/Humanstate/mojolicious-plugin-oauth2-server/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/Humanstate/mojolicious-plugin-oauth2-server/commit/ea7023ce4597f8f9ac6eb5bd7181d44d401927fe&quot;&gt;ea7023ce4&lt;/a&gt;&lt;a href=&quot;https://github.com/Humanstate/mojolicious-plugin-oauth2-server/commit/ea7023ce4597f8f9ac6eb5bd7181d44d401927fe&quot;&gt;&amp;quot;&amp;gt;&amp;amp;lt;a href=&amp;amp;quot;https://github.com/Humanstate/mojolicious-plugin-oauth2-server/commit/&amp;lt;/a&amp;gt;&amp;lt;a... (continued)

Run Details

2 of 2 new or added lines in 1 file covered. (100.0%)

136 of 142 relevant lines covered (95.77%)

233.72 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

95.77

/lib/Mojolicious/Plugin/OAuth2/Server.pm

package Mojolicious::Plugin::OAuth2::Server;

=head1 NAME

Mojolicious::Plugin::OAuth2::Server - Easier implementation of an OAuth2
Authorization Server / Resource Server with Mojolicious

=for html
<a href='https://travis-ci.org/Humanstate/mojolicious-plugin-oauth2-server?branch=master'><img src='https://travis-ci.org/Humanstate/mojolicious-plugin-oauth2-server.svg?branch=master' alt='Build Status' /></a>
<a href='https://coveralls.io/r/Humanstate/mojolicious-plugin-oauth2-server?branch=master'><img src='https://coveralls.io/repos/Humanstate/mojolicious-plugin-oauth2-server/badge.png?branch=master' alt='Coverage Status' /></a>

=head1 VERSION

0.42

=head1 SYNOPSIS

  use Mojolicious::Lite;

  plugin 'OAuth2::Server' => {
      ... # see SYNOPSIS in Net::OAuth2::AuthorizationServer::Manual
  };

  group {
    # /api - must be authorized
    under '/api' => sub {
      my ( $c ) = @_;

      return 1 if $c->oauth; # must be authorized via oauth

      $c->render( status => 401, text => 'Unauthorized' );
      return undef;
    };

    any '/annoy_friends' => sub { shift->render( text => "Annoyed Friends" ); };
    any '/post_image'    => sub { shift->render( text => "Posted Image" ); };
  };

  any '/track_location' => sub {
    my ( $c ) = @_;

    my $oauth_details = $c->oauth( 'track_location' )
        || return $c->render( status => 401, text => 'You cannot track location' );

    $c->render( text => "Target acquired: @{[$oauth_details->{user_id}]}" );
  };

  app->start;

Or full fat app:

  use Mojo::Base 'Mojolicious';

  ...

  sub startup {
    my $self = shift;

    ...

    $self->plugin( 'OAuth2::Server' => $oauth2_auth_code_grant_config );
  }

Then in your controller:

  sub my_route_name {
    my ( $c ) = @_;
 
    if ( my $oauth_details = $c->oauth( qw/required scopes/ ) ) {
      ... # do something, user_id, client_id, etc, available in $oauth_details
    } else {
      return $c->render( status => 401, text => 'Unauthorized' );
    }

    ...
  }

=head1 DESCRIPTION

This plugin implements the various OAuth2 grant types flow as described at
L<http://tools.ietf.org/html/rfc6749>. It is a complete implementation of
RFC6749, with the exception of the "Extension Grants" as the description of
that grant type is rather hand-wavy.

The bulk of the functionality is implemented in the L<Net::OAuth2::AuthorizationServer>
distribution, you should see that for more comprehensive documentation and
examples of usage.

The examples here use the "Authorization Code Grant" flow as that is considered
the most secure and most complete form of OAuth2.

=cut

use strict;
use warnings;
use base qw/ Mojolicious::Plugin /;

use Mojo::URL;
use Mojo::Parameters;
use Mojo::Util qw/ b64_decode url_unescape /;
use Net::OAuth2::AuthorizationServer;
use Carp qw/ croak /;

our $VERSION = '0.42';

my ( $AuthCodeGrant,$PasswordGrant,$ImplicitGrant,$ClientCredentialsGrant,$Grant,$JWTCallback );

=head1 METHODS

=head2 register

Registers the plugin with your app - note that you must pass callbacks for
certain functions that the plugin expects to call if you are not using the
plugin in its simplest form.

  $self->register($app, \%config);

Registering the plugin will call the L<Net::OAuth2::AuthorizationServer>
and create a C<auth_code_grant> that can be accessed using the defined
C<authorize_route> and C<access_token_route>. The arguments passed to the
plugin are passed straight through to the C<auth_code_grant> method in
the L<Net::OAuth2::AuthorizationServer> module.

=head2 oauth

Checks if there is a valid Authorization: Bearer header with a valid access
token and if the access token has the requisite scopes. The scopes are optional:

  unless ( my $oauth_details = $c->oauth( @scopes ) ) {
    return $c->render( status => 401, text => 'Unauthorized' );
  }

This calls the L<Net::OAuth2::AuthorizationServer::AuthorizationCodeGrant>
module (C<verify_token_and_scope> method) to validate the access/refresh token.

=head2 oauth2_auth_request

This is a helper to allow you get get the redirect URI instead of directing
a user to the authorize_route - it requires the details of the client:

  my $redirect_uri = $c->oauth2_auth_request({
    client_id     => $client_id,
    redirect_uri  => 'https://foo',
    response_type => 'token',
    scope         => 'list,of,scopes',
    state         => 'foo=bar&baz=boz',
  });

  if ( $redirect_uri ) {
   # do something with $redirect_uri
  } else {
    # something didn't work, e.g. bad client, scopes, etc
  }

You can use this helper instead of directing a user to the authorize_route if
you need to do something more involved with the redirect_uri rather than
having the plugin direct to the user to the resulting redirect uri

=cut

my $warned_dep = 0;

sub register {
  my ( $self,$app,$config ) = @_;

  my $auth_route   = $config->{authorize_route}    // '/oauth/authorize';
  my $atoken_route = $config->{access_token_route} // '/oauth/access_token';

  if ( $config->{users} && ! $config->{jwt_secret} ) {
    croak "You MUST provide a jwt_secret to use the password grant (users supplied)";
  }

  my $Server = Net::OAuth2::AuthorizationServer->new;

  # note that access_tokens and refresh_tokens will not be shared between
  # the various grant type objects, so if you need to support
  # both then you *must* either supply a jwt_secret or supply callbacks
  $AuthCodeGrant = $Server->auth_code_grant(
    ( map { +"${_}_cb" => ( $config->{$_} // undef ) } qw/
      verify_client store_auth_code verify_auth_code
      store_access_token verify_access_token
      login_resource_owner confirm_by_resource_owner
    / ),
    %{ $config },
  );

  $PasswordGrant = $Server->password_grant(
    ( map { +"${_}_cb" => ( $config->{$_} // undef ) } qw/
      verify_client verify_user_password
      store_access_token verify_access_token
      login_resource_owner confirm_by_resource_owner
    / ),
    %{ $config },
  );

  $ImplicitGrant = $Server->implicit_grant(
    ( map { +"${_}_cb" => ( $config->{$_} // undef ) } qw/
      verify_client store_access_token verify_access_token
      login_resource_owner confirm_by_resource_owner
    / ),
    %{ $config },
  );

  $ClientCredentialsGrant = $Server->client_credentials_grant(
    ( map { +"${_}_cb" => ( $config->{$_} // undef ) } qw/
      verify_client store_access_token verify_access_token
    / ),
    %{ $config },
  );

  $JWTCallback = $config->{jwt_claims};

  $app->routes->get(
    $auth_route => sub { _authorization_request( @_ ) },
  );

  $app->helper( oauth2_auth_request => sub {
    my ( $c,$args ) = @_;
    _authorization_request( $c,$args,1 );
  } );

  $app->routes->post(
    $atoken_route => sub { _access_token_request( @_ ) },
  );

  $app->helper(
    oauth => sub {
      my $c = shift;
      my @scopes = @_;
      $Grant ||= $AuthCodeGrant;
      my @res = $Grant->verify_token_and_scope(
        scopes           => [ @scopes ],
        auth_header      => $c->req->headers->header( 'Authorization' ),
        mojo_controller  => $c,
      );

      my $oauth_details = $res[0];

      if ( ref( $oauth_details ) ) {
        $oauth_details->{client_id} ||= $oauth_details->{client};
      }

      return $oauth_details;
    },
  );
}

sub _authorization_request {
  my ( $self,$args,$is_helper ) = @_;

  $args //= {};

  my $client_id = $args->{client_id}     // $self->param( 'client_id' );
  my $uri       = $args->{redirect_uri}  // $self->param( 'redirect_uri' );
  my $type      = $args->{response_type} // $self->param( 'response_type' );
  my $scope     = $args->{scope}         // $self->param( 'scope' );
  my $state     = $args->{state}         // $self->param( 'state' );

  my @scopes = $scope ? split( / /,$scope ) : ();

  if (
    ! defined( $client_id )
    or ! defined( $type )
    or $type !~ /^(code|token)$/
  ) {
    $self->render(
      status => 400,
      json   => {
        error             => 'invalid_request',
        error_description => 'the request was missing one of: client_id, '
          . 'response_type;'
          . 'or response_type did not equal "code" or "token"',
        error_uri         => '',
      }
    );
    return;
  }

  $Grant = $type eq 'token' ? $ImplicitGrant : $AuthCodeGrant;

  my $mojo_url = Mojo::URL->new( $uri );
  my ( $res,$error ) = $Grant->verify_client(
    client_id       => $client_id,
    redirect_uri    => $uri,
    scopes          => [ @scopes ],
    mojo_controller => $self,
    response_type   => $type,
  );

  if ( $res ) {

    if ( ! $Grant->login_resource_owner(
      mojo_controller => $self,
      client_id => $client_id,
    ) ) {
      $self->app->log->debug( "OAuth2::Server: Resource owner not logged in" );
      # call to $resource_owner_logged_in method should have called redirect_to
      return;
    } else {
      $self->app->log->debug( "OAuth2::Server: Resource owner is logged in" );
      $res = $Grant->confirm_by_resource_owner(
        client_id       => $client_id,
        scopes          => [ @scopes ],
        mojo_controller => $self,
      );
      if ( ! defined $res ) {
        $self->app->log->debug( "OAuth2::Server: Resource owner to confirm scopes" );
        # call to $resource_owner_confirms method should have called redirect_to
        return;
      }
      elsif ( $res == 0 ) {
        $self->app->log->debug( "OAuth2::Server: Resource owner denied scopes" );
        $error = 'access_denied';
      }
    }
  }

  if ( $res ) {

    return _maybe_generate_access_token(
      $self,$mojo_url,$client_id,[ @scopes ],$state,$is_helper
    ) if $type eq 'token'; # implicit grant

    $self->app->log->debug( "OAuth2::Server: Generating auth code for $client_id" );
    my $auth_code = $Grant->token(
      client_id       => $client_id,
      scopes          => [ @scopes ],
      type            => 'auth',
      redirect_uri    => $uri,
      jwt_claims_cb   => $JWTCallback,
    );

    $Grant->store_auth_code(
      auth_code       => $auth_code,
      client_id       => $client_id,
      expires_in      => $Grant->auth_code_ttl,
      redirect_uri    => $uri,
      scopes          => [ @scopes ],
      mojo_controller => $self,
    );

    $mojo_url->query->append( code  => $auth_code );

  } elsif ( $error ) {
    $mojo_url->query->append( error => $error );
  } else {
    # callback has not returned anything, assume server error
    $mojo_url->query->append(
      error             => 'server_error',
      error_description => 'call to verify_client returned unexpected value',
    );
  }

  $mojo_url->query->append( state => $state ) if defined( $state );

  return $is_helper ? $mojo_url : $self->redirect_to( $mojo_url );
}

sub _maybe_generate_access_token {
  my ( $self,$mojo_url,$client,$scope,$state,$is_helper ) = @_;

  my $access_token  = $Grant->token(
    client_id  => $client,
    scopes     => $scope,
    type       => 'access',
    jwt_claims_cb => $JWTCallback,
  );

  $Grant->store_access_token(
    client_id         => $client,
    access_token      => $access_token,
    expires_in        => $Grant->access_token_ttl,
    scopes            => $scope,
    mojo_controller   => $self,
  );

  # http://example.com/cb#access_token=2YotnFZFEjr1zCsicMWpAA
  #     &state=xyz&token_type=example&expires_in=3600
  my $params = Mojo::Parameters->new(
     access_token => $access_token,
     token_type   => 'bearer',
     expires_in   => $Grant->access_token_ttl,
     ( $state
       ? ( state => $state )
       : (),
     )
  );

  $mojo_url->fragment( url_unescape( $params->to_string ) );
  return $is_helper ? $mojo_url : $self->redirect_to( $mojo_url );
}

sub _access_token_request {
  my ( $self ) = @_;

  my (
    $client_id,$client_secret,$grant_type,$auth_code,$uri,
    $refresh_token,$username,$password
  ) = map { $self->param( $_ ) // undef } qw/
    client_id client_secret grant_type code redirect_uri
    refresh_token username password
  /;

  $grant_type //='';

  _access_token_request_check_params(
    $self,$grant_type,$username,$password,$auth_code,$uri
  ) || return;

  my $json_response = {};
  my $status        = 400;

  $Grant = $grant_type eq 'password'
    ? $PasswordGrant : $grant_type eq 'client_credentials'
    ? $ClientCredentialsGrant : $AuthCodeGrant;

  my ( $client,$error,$scope,$user_id,$old_refresh_token ) = _verify_credentials(
    $self,$Grant,$grant_type,$refresh_token,$client_id,$client_secret,
    $auth_code,$username,$password,$uri
  );

  if ( $client ) {

    $self->app->log->debug( "OAuth2::Server: Generating access token for @{[ ref $client ? $client->{client} : $client ]}" );

    my $expires_in    = $Grant->access_token_ttl;
    my $access_token  = $Grant->token(
      client_id => $client,
      scopes    => $scope,
      type      => 'access',
      user_id   => $user_id,
      jwt_claims_cb => $JWTCallback,
    );

    my $refresh_token  = $Grant->token(
      client_id => $client,
      scopes    => $scope,
      type      => 'refresh',
      user_id   => $user_id,
      jwt_claims_cb => $JWTCallback,
    );

    $Grant->store_access_token(
      client_id         => $client,
      ( $grant_type ne 'password' ? ( auth_code => $auth_code ) : () ),
      access_token      => $access_token,
      expires_in        => $expires_in,
      scopes            => $scope,
      ( $grant_type eq 'client_credentials'
        ? ()
        : (
          refresh_token     => $refresh_token,
          old_refresh_token => $old_refresh_token,
        )
      ),
      mojo_controller   => $self,
    );

    $status        = 200;
    $json_response = {
      access_token  => $access_token,
      token_type    => 'Bearer',
      expires_in    => $expires_in,
      ( $grant_type eq 'client_credentials'
        ? ()
        : ( refresh_token => $refresh_token ),
      )
    };

  } elsif ( $error ) {
      $json_response->{error} = $error;
  } else {
    # callback has not returned anything, assume server error
    my $method = $grant_type eq 'password'
      ? 'verify_user_password' : $grant_type eq 'client_credentials'
      ? 'verify_client' : 'verify_auth_code';

    $json_response = {
      error             => 'server_error',
      error_description => "call to $method returned unexpected value",
    };
  }

  $self->res->headers->header( 'Cache-Control' => 'no-store' );
  $self->res->headers->header( 'Pragma'        => 'no-cache' );

  $self->render(
    status => $status,
    json   => $json_response,
  );
}

sub _access_token_request_check_params {
  my ( $self,$grant_type,$username,$password,$auth_code,$uri ) = @_;

  if (
    $grant_type eq 'password'
  ) {
    if ( ! $username && ! $password ) {
      $self->render(
        status => 400,
        json   => {
          error             => 'invalid_request',
          error_description => 'the request was missing one of: '
            . 'client_id, client_secret, username, password',
          error_uri         => '',
        }
      );
      return 0;
    }
  } elsif (
    $grant_type eq 'client_credentials'
  ) {
    my ( $client_id,$client_secret ) = _client_credentials_from_header( $self );

    if ( ! $client_id || ! $client_secret ) {
      $self->render(
        status => 400,
        json   => {
          error             => 'invalid_request',
          error_description => 'the request was missing an Authorization: Basic'
            . ' header or it was missing the encoded client_id:client_secret data',
          error_uri         => '',
        }
      );
      return 0;
    }
  } elsif (
    ( $grant_type ne 'authorization_code' and $grant_type ne 'refresh_token' )
    or ( $grant_type eq 'authorization_code' and ! defined( $auth_code ) )
    or ( $grant_type eq 'authorization_code' and ! defined( $uri ) )
  ) {
    $self->render(
      status => 400,
      json   => {
        error             => 'invalid_request',
        error_description => 'the request was missing one of: grant_type, '
          . 'client_id, client_secret, code, redirect_uri;'
          . 'or grant_type did not equal "authorization_code" '
          . 'or "refresh_token"',
        error_uri         => '',
      }
    );
    return 0;
  }

  return 1;
}

sub _client_credentials_from_header {
  my ( $self ) = @_;

  if ( my $auth_header = $self->req->headers->header( 'Authorization' ) ) {
    if ( my ( $encoded_details ) = ( split( 'Basic ',$auth_header ) )[1] ) {
      my $decoded_details = b64_decode( $encoded_details // '' );
      my ( $client_id,$client_secret ) = split( ':',$decoded_details );
      return ( $client_id,$client_secret );
    }
  }
}

sub _verify_credentials {
  my (
    $self,$Grant,$grant_type,$refresh_token,$client_id,$client_secret,
    $auth_code,$username,$password,$uri
  ) = @_;

  my ( $client,$error,$scope,$user_id,$old_refresh_token );

  if ( $grant_type eq 'refresh_token' ) {
    ( $client,$error,$scope,$user_id ) = $Grant->verify_token_and_scope(
      refresh_token    => $refresh_token,
      auth_header      => $self->req->headers->header( 'Authorization' ),
      mojo_controller  => $self,
    );
    $old_refresh_token = $refresh_token;

  } elsif ( $grant_type eq 'password' ) {
    $scope = $self->every_param( 'scope' );

    ( $client,$error,$scope,$user_id ) = $Grant->verify_user_password(
      client_id       => $client_id,
      client_secret   => $client_secret,
      username        => $username,
      password        => $password,
      mojo_controller => $self,
      scopes          => $scope,
    );
  } elsif ( $grant_type eq 'client_credentials' ) {

    my $client_secret;

    ( $client,$client_secret ) = _client_credentials_from_header( $self );

    $scope = $self->every_param( 'scope' );
    my $res;

    ( $res,$error ) = $Grant->verify_client(
      client_id       => $client,
      client_secret   => $client_secret,
      scopes          => $scope,
    );

    undef( $client ) if ! $res;

  } else {
    ( $client,$error,$scope,$user_id ) = $Grant->verify_auth_code(
      client_id       => $client_id,
      client_secret   => $client_secret,
      auth_code       => $auth_code,
      redirect_uri    => $uri,
      mojo_controller => $self,
    );
  }

  $client = ! ref $client
    ? $client
    : ( $client->{client_id} || $client->{client} );

  return ( $client,$error,$scope,$user_id,$old_refresh_token );
}

=head1 SEE ALSO

L<Net::OAuth2::AuthorizationServer> - The dist that handles the bulk of the
functionality used by this plugin

=head1 AUTHOR & CONTRIBUTORS

Lee Johnson - C<leejo@cpan.org>

With contributions from:

Nick Logan C<nlogan@gmail.com>

Pierre VIGIER C<pierre.vigier@gmail.com>

Renee C<reb@perl-services.de>

=head1 LICENSE

This library is free software; you can redistribute it and/or modify it under
the same terms as Perl itself. If you would like to contribute documentation
or file a bug report then please raise an issue / pull request:

    https://github.com/Humanstate/mojolicious-plugin-oauth2-server

=cut

1;

# vim: ts=2:sw=2:et

1	package Mojolicious::Plugin::OAuth2::Server;
2
3	=head1 NAME
4
5	Mojolicious::Plugin::OAuth2::Server - Easier implementation of an OAuth2
6	Authorization Server / Resource Server with Mojolicious
7
8	=for html
9	<a href='https://travis-ci.org/Humanstate/mojolicious-plugin-oauth2-server?branch=master'><img src='https://travis-ci.org/Humanstate/mojolicious-plugin-oauth2-server.svg?branch=master' alt='Build Status' /></a>
10	<a href='https://coveralls.io/r/Humanstate/mojolicious-plugin-oauth2-server?branch=master'><img src='https://coveralls.io/repos/Humanstate/mojolicious-plugin-oauth2-server/badge.png?branch=master' alt='Coverage Status' /></a>
11
12	=head1 VERSION
13
14	0.42
15
16	=head1 SYNOPSIS
17
18	use Mojolicious::Lite;
19
20	plugin 'OAuth2::Server' => {
21	... # see SYNOPSIS in Net::OAuth2::AuthorizationServer::Manual
22	};
23
24	group {
25	# /api - must be authorized
26	under '/api' => sub {
27	my ( $c ) = @_;
28
29	return 1 if $c->oauth; # must be authorized via oauth
30
31	$c->render( status => 401, text => 'Unauthorized' );
32	return undef;
33	};
34
35	any '/annoy_friends' => sub { shift->render( text => "Annoyed Friends" ); };
36	any '/post_image' => sub { shift->render( text => "Posted Image" ); };
37	};
38
39	any '/track_location' => sub {
40	my ( $c ) = @_;
41
42	my $oauth_details = $c->oauth( 'track_location' )
43	\|\| return $c->render( status => 401, text => 'You cannot track location' );
44
45	$c->render( text => "Target acquired: @{[$oauth_details->{user_id}]}" );
46	};
47
48	app->start;
49
50	Or full fat app:
51
52	use Mojo::Base 'Mojolicious';
53
54	...
55
56	sub startup {
57	my $self = shift;
58
59	...
60
61	$self->plugin( 'OAuth2::Server' => $oauth2_auth_code_grant_config );
62	}
63
64	Then in your controller:
65
66	sub my_route_name {
67	my ( $c ) = @_;
68
69	if ( my $oauth_details = $c->oauth( qw/required scopes/ ) ) {
70	... # do something, user_id, client_id, etc, available in $oauth_details
71	} else {
72	return $c->render( status => 401, text => 'Unauthorized' );
73	}
74
75	...
76	}
77
78	=head1 DESCRIPTION
79
80	This plugin implements the various OAuth2 grant types flow as described at
81	L<http://tools.ietf.org/html/rfc6749>. It is a complete implementation of
82	RFC6749, with the exception of the "Extension Grants" as the description of
83	that grant type is rather hand-wavy.
84
85	The bulk of the functionality is implemented in the L<Net::OAuth2::AuthorizationServer>
86	distribution, you should see that for more comprehensive documentation and
87	examples of usage.
88
89	The examples here use the "Authorization Code Grant" flow as that is considered
90	the most secure and most complete form of OAuth2.
91
92	=cut
93
94	use strict;	160✔
95	use warnings;	160✔
96	use base qw/ Mojolicious::Plugin /;	160✔
97
98	use Mojo::URL;	160✔
99	use Mojo::Parameters;	160✔
100	use Mojo::Util qw/ b64_decode url_unescape /;	160✔
101	use Net::OAuth2::AuthorizationServer;	160✔
102	use Carp qw/ croak /;	160✔
103
104	our $VERSION = '0.42';
105
106	my ( $AuthCodeGrant,$PasswordGrant,$ImplicitGrant,$ClientCredentialsGrant,$Grant,$JWTCallback );
107
108	=head1 METHODS
109
110	=head2 register
111
112	Registers the plugin with your app - note that you must pass callbacks for
113	certain functions that the plugin expects to call if you are not using the
114	plugin in its simplest form.
115
116	$self->register($app, \%config);
117
118	Registering the plugin will call the L<Net::OAuth2::AuthorizationServer>
119	and create a C<auth_code_grant> that can be accessed using the defined
120	C<authorize_route> and C<access_token_route>. The arguments passed to the
121	plugin are passed straight through to the C<auth_code_grant> method in
122	the L<Net::OAuth2::AuthorizationServer> module.
123
124	=head2 oauth
125
126	Checks if there is a valid Authorization: Bearer header with a valid access
127	token and if the access token has the requisite scopes. The scopes are optional:
128
129	unless ( my $oauth_details = $c->oauth( @scopes ) ) {
130	return $c->render( status => 401, text => 'Unauthorized' );
131	}
132
133	This calls the L<Net::OAuth2::AuthorizationServer::AuthorizationCodeGrant>
134	module (C<verify_token_and_scope> method) to validate the access/refresh token.
135
136	=head2 oauth2_auth_request
137
138	This is a helper to allow you get get the redirect URI instead of directing
139	a user to the authorize_route - it requires the details of the client:
140
141	my $redirect_uri = $c->oauth2_auth_request({
142	client_id => $client_id,
143	redirect_uri => 'https://foo',
144	response_type => 'token',
145	scope => 'list,of,scopes',
146	state => 'foo=bar&baz=boz',
147	});
148
149	if ( $redirect_uri ) {
150	# do something with $redirect_uri
151	} else {
152	# something didn't work, e.g. bad client, scopes, etc
153	}
154
155	You can use this helper instead of directing a user to the authorize_route if
156	you need to do something more involved with the redirect_uri rather than
157	having the plugin direct to the user to the resulting redirect uri
158
159	=cut
160
161	my $warned_dep = 0;
162
163	sub register {
164	my ( $self,$app,$config ) = @_;	152✔
165
166	my $auth_route = $config->{authorize_route} // '/oauth/authorize';	152✔
167	my $atoken_route = $config->{access_token_route} // '/oauth/access_token';	152✔
168
169	if ( $config->{users} && ! $config->{jwt_secret} ) {	152✔
170	croak "You MUST provide a jwt_secret to use the password grant (users supplied)";	×
171	}
172
173	my $Server = Net::OAuth2::AuthorizationServer->new;	152✔
174
175	# note that access_tokens and refresh_tokens will not be shared between
176	# the various grant type objects, so if you need to support
177	# both then you must either supply a jwt_secret or supply callbacks
178	$AuthCodeGrant = $Server->auth_code_grant(	798 all except 129.1 and 129.2 ✔
179	( map { +"${_}_cb" => ( $config->{$_} // undef ) } qw/	380✔
180	verify_client store_auth_code verify_auth_code
181	store_access_token verify_access_token
182	login_resource_owner confirm_by_resource_owner
183	/ ),
184	%{ $config },	152✔
185	);
186
187	$PasswordGrant = $Server->password_grant(	648 all except 129.1 and 129.2 ✔
188	( map { +"${_}_cb" => ( $config->{$_} // undef ) } qw/	324✔
189	verify_client verify_user_password
190	store_access_token verify_access_token
191	login_resource_owner confirm_by_resource_owner
192	/ ),
193	%{ $config },	144✔
194	);
195
196	$ImplicitGrant = $Server->implicit_grant(	540 all except 129.1 and 129.2 ✔
197	( map { +"${_}_cb" => ( $config->{$_} // undef ) } qw/	288✔
198	verify_client store_access_token verify_access_token
199	login_resource_owner confirm_by_resource_owner
200	/ ),
201	%{ $config },	144✔
202	);
203
204	$ClientCredentialsGrant = $Server->client_credentials_grant(	324 all except 129.1 and 129.2 ✔
205	( map { +"${_}_cb" => ( $config->{$_} // undef ) } qw/	216✔
206	verify_client store_access_token verify_access_token
207	/ ),
208	%{ $config },	144✔
209	);
210
211	$JWTCallback = $config->{jwt_claims};	144✔
212
213	$app->routes->get(
214	$auth_route => sub { _authorization_request( @_ ) },	344✔
215	);	144✔
216
217	$app->helper( oauth2_auth_request => sub {
218	my ( $c,$args ) = @_;	8✔
219	_authorization_request( $c,$args,1 );	8✔
220	} );	144✔
221
222	$app->routes->post(
223	$atoken_route => sub { _access_token_request( @_ ) },	512✔
224	);	144✔
225
226	$app->helper(
227	oauth => sub {
228	my $c = shift;	800✔
229	my @scopes = @_;	800✔
230	$Grant \|\|= $AuthCodeGrant;	800✔
231	my @res = $Grant->verify_token_and_scope(	800✔
232	scopes => [ @scopes ],
233	auth_header => $c->req->headers->header( 'Authorization' ),
234	mojo_controller => $c,
235	);
236
237	my $oauth_details = $res[0];	800✔
238
239	if ( ref( $oauth_details ) ) {	800✔
240	$oauth_details->{client_id} \|\|= $oauth_details->{client};	256✔
241	}
242
243	return $oauth_details;	800✔
244	},
245	);	144✔
246	}
247
248	sub _authorization_request {
249	my ( $self,$args,$is_helper ) = @_;	352✔
250
251	$args //= {};	352✔
252
253	my $client_id = $args->{client_id} // $self->param( 'client_id' );	352✔
254	my $uri = $args->{redirect_uri} // $self->param( 'redirect_uri' );	352✔
255	my $type = $args->{response_type} // $self->param( 'response_type' );	352✔
256	my $scope = $args->{scope} // $self->param( 'scope' );	352✔
257	my $state = $args->{state} // $self->param( 'state' );	352✔
258
259	my @scopes = $scope ? split( / /,$scope ) : ();	352✔
260
261	if (	352✔
262	! defined( $client_id )
263	or ! defined( $type )
264	or $type !~ /^(code\|token)$/
265	) {
266	$self->render(	96✔
267	status => 400,
268	json => {
269	error => 'invalid_request',
270	error_description => 'the request was missing one of: client_id, '
271	. 'response_type;'
272	. 'or response_type did not equal "code" or "token"',
273	error_uri => '',
274	}
275	);
276	return;	96✔
277	}
278
279	$Grant = $type eq 'token' ? $ImplicitGrant : $AuthCodeGrant;	256✔
280
281	my $mojo_url = Mojo::URL->new( $uri );	256✔
282	my ( $res,$error ) = $Grant->verify_client(	256✔
283	client_id => $client_id,
284	redirect_uri => $uri,
285	scopes => [ @scopes ],
286	mojo_controller => $self,
287	response_type => $type,
288	);
289
290	if ( $res ) {	256✔
291
292	if ( ! $Grant->login_resource_owner(	128✔
293	mojo_controller => $self,
294	client_id => $client_id,
295	) ) {
296	$self->app->log->debug( "OAuth2::Server: Resource owner not logged in" );	16✔
297	# call to $resource_owner_logged_in method should have called redirect_to
298	return;	16✔
299	} else {
300	$self->app->log->debug( "OAuth2::Server: Resource owner is logged in" );	112✔
301	$res = $Grant->confirm_by_resource_owner(	112✔
302	client_id => $client_id,
303	scopes => [ @scopes ],
304	mojo_controller => $self,
305	);
306	if ( ! defined $res ) {	112✔
307	$self->app->log->debug( "OAuth2::Server: Resource owner to confirm scopes" );	8✔
308	# call to $resource_owner_confirms method should have called redirect_to
309	return;	8✔
310	}
311	elsif ( $res == 0 ) {
312	$self->app->log->debug( "OAuth2::Server: Resource owner denied scopes" );	8✔
313	$error = 'access_denied';	8✔
314	}
315	}
316	}
317
318	if ( $res ) {	232✔
319
320	return _maybe_generate_access_token(	96✔
321	$self,$mojo_url,$client_id,[ @scopes ],$state,$is_helper
322	) if $type eq 'token'; # implicit grant
323
324	$self->app->log->debug( "OAuth2::Server: Generating auth code for $client_id" );	72✔
325	my $auth_code = $Grant->token(	72✔
326	client_id => $client_id,
327	scopes => [ @scopes ],
328	type => 'auth',
329	redirect_uri => $uri,
330	jwt_claims_cb => $JWTCallback,
331	);
332
333	$Grant->store_auth_code(	72✔
334	auth_code => $auth_code,
335	client_id => $client_id,
336	expires_in => $Grant->auth_code_ttl,
337	redirect_uri => $uri,
338	scopes => [ @scopes ],
339	mojo_controller => $self,
340	);
341
342	$mojo_url->query->append( code => $auth_code );	72✔
343
344	} elsif ( $error ) {
345	$mojo_url->query->append( error => $error );	136✔
346	} else {
347	# callback has not returned anything, assume server error
348	$mojo_url->query->append(	×
349	error => 'server_error',
350	error_description => 'call to verify_client returned unexpected value',
351	);
352	}
353
354	$mojo_url->query->append( state => $state ) if defined( $state );	208✔
355
356	return $is_helper ? $mojo_url : $self->redirect_to( $mojo_url );	208✔
357	}
358
359	sub _maybe_generate_access_token {
360	my ( $self,$mojo_url,$client,$scope,$state,$is_helper ) = @_;	24✔
361
362	my $access_token = $Grant->token(	24✔
363	client_id => $client,
364	scopes => $scope,
365	type => 'access',
366	jwt_claims_cb => $JWTCallback,
367	);
368
369	$Grant->store_access_token(	24✔
370	client_id => $client,
371	access_token => $access_token,
372	expires_in => $Grant->access_token_ttl,
373	scopes => $scope,
374	mojo_controller => $self,
375	);
376
377	# http://example.com/cb#access_token=2YotnFZFEjr1zCsicMWpAA
378	# &state=xyz&token_type=example&expires_in=3600
379	my $params = Mojo::Parameters->new(	24✔
380	access_token => $access_token,
381	token_type => 'bearer',
382	expires_in => $Grant->access_token_ttl,
383	( $state
384	? ( state => $state )
385	: (),
386	)
387	);
388
389	$mojo_url->fragment( url_unescape( $params->to_string ) );	24✔
390	return $is_helper ? $mojo_url : $self->redirect_to( $mojo_url );	24✔
391	}
392
393	sub _access_token_request {
394	my ( $self ) = @_;	512✔
395
396	my (
397	$client_id,$client_secret,$grant_type,$auth_code,$uri,	3,072 all except 129.1 and 129.2 ✔
398	$refresh_token,$username,$password
399	) = map { $self->param( $_ ) // undef } qw/	512✔
400	client_id client_secret grant_type code redirect_uri
401	refresh_token username password
402	/;
403
404	$grant_type //='';	512✔
405
406	_access_token_request_check_params(	512✔
407	$self,$grant_type,$username,$password,$auth_code,$uri
408	) \|\| return;
409
410	my $json_response = {};	312✔
411	my $status = 400;	312✔
412
413	$Grant = $grant_type eq 'password'	312✔
414	? $PasswordGrant : $grant_type eq 'client_credentials'
415	? $ClientCredentialsGrant : $AuthCodeGrant;
416
417	my ( $client,$error,$scope,$user_id,$old_refresh_token ) = _verify_credentials(	312✔
418	$self,$Grant,$grant_type,$refresh_token,$client_id,$client_secret,
419	$auth_code,$username,$password,$uri
420	);
421
422	if ( $client ) {	312✔
423
424	$self->app->log->debug( "OAuth2::Server: Generating access token for @{[ ref $client ? $client->{client} : $client ]}" );	160✔
425
426	my $expires_in = $Grant->access_token_ttl;	160✔
427	my $access_token = $Grant->token(	160✔
428	client_id => $client,
429	scopes => $scope,
430	type => 'access',
431	user_id => $user_id,
432	jwt_claims_cb => $JWTCallback,
433	);
434
435	my $refresh_token = $Grant->token(	160✔
436	client_id => $client,
437	scopes => $scope,
438	type => 'refresh',
439	user_id => $user_id,
440	jwt_claims_cb => $JWTCallback,
441	);
442
443	$Grant->store_access_token(	160✔
444	client_id => $client,
445	( $grant_type ne 'password' ? ( auth_code => $auth_code ) : () ),
446	access_token => $access_token,
447	expires_in => $expires_in,
448	scopes => $scope,
449	( $grant_type eq 'client_credentials'
450	? ()
451	: (
452	refresh_token => $refresh_token,
453	old_refresh_token => $old_refresh_token,
454	)
455	),
456	mojo_controller => $self,
457	);
458
459	$status = 200;	160✔
460	$json_response = {	160✔
461	access_token => $access_token,
462	token_type => 'Bearer',
463	expires_in => $expires_in,
464	( $grant_type eq 'client_credentials'
465	? ()
466	: ( refresh_token => $refresh_token ),
467	)
468	};
469
470	} elsif ( $error ) {
471	$json_response->{error} = $error;	152✔
472	} else {
473	# callback has not returned anything, assume server error
474	my $method = $grant_type eq 'password'	×
475	? 'verify_user_password' : $grant_type eq 'client_credentials'
476	? 'verify_client' : 'verify_auth_code';
477
478	$json_response = {	×
479	error => 'server_error',
480	error_description => "call to $method returned unexpected value",
481	};
482	}
483
484	$self->res->headers->header( 'Cache-Control' => 'no-store' );	312✔
485	$self->res->headers->header( 'Pragma' => 'no-cache' );	312✔
486
487	$self->render(	312✔
488	status => $status,
489	json => $json_response,
490	);
491	}
492
493	sub _access_token_request_check_params {
494	my ( $self,$grant_type,$username,$password,$auth_code,$uri ) = @_;	512✔
495
496	if (	512✔
497	$grant_type eq 'password'
498	) {
499	if ( ! $username && ! $password ) {	56✔
500	$self->render(	×
501	status => 400,
502	json => {
503	error => 'invalid_request',
504	error_description => 'the request was missing one of: '
505	. 'client_id, client_secret, username, password',
506	error_uri => '',
507	}
508	);
509	return 0;	×
510	}
511	} elsif (
512	$grant_type eq 'client_credentials'
513	) {
514	my ( $client_id,$client_secret ) = _client_credentials_from_header( $self );	80✔
515
516	if ( ! $client_id \|\| ! $client_secret ) {	80✔
517	$self->render(	56✔
518	status => 400,
519	json => {
520	error => 'invalid_request',
521	error_description => 'the request was missing an Authorization: Basic'
522	. ' header or it was missing the encoded client_id:client_secret data',
523	error_uri => '',
524	}
525	);
526	return 0;	56✔
527	}
528	} elsif (
529	( $grant_type ne 'authorization_code' and $grant_type ne 'refresh_token' )
530	or ( $grant_type eq 'authorization_code' and ! defined( $auth_code ) )
531	or ( $grant_type eq 'authorization_code' and ! defined( $uri ) )
532	) {
533	$self->render(	144✔
534	status => 400,
535	json => {
536	error => 'invalid_request',
537	error_description => 'the request was missing one of: grant_type, '
538	. 'client_id, client_secret, code, redirect_uri;'
539	. 'or grant_type did not equal "authorization_code" '
540	. 'or "refresh_token"',
541	error_uri => '',
542	}
543	);
544	return 0;	144✔
545	}
546
547	return 1;	312✔
548	}
549
550	sub _client_credentials_from_header {
551	my ( $self ) = @_;	104✔
552
553	if ( my $auth_header = $self->req->headers->header( 'Authorization' ) ) {	104✔
554	if ( my ( $encoded_details ) = ( split( 'Basic ',$auth_header ) )[1] ) {	56✔
555	my $decoded_details = b64_decode( $encoded_details // '' );	50✔
556	my ( $client_id,$client_secret ) = split( ':',$decoded_details );	50✔
557	return ( $client_id,$client_secret );	50✔
558	}
559	}
560	}
561
562	sub _verify_credentials {
563	my (
564	$self,$Grant,$grant_type,$refresh_token,$client_id,$client_secret,	312✔
565	$auth_code,$username,$password,$uri
566	) = @_;
567
568	my ( $client,$error,$scope,$user_id,$old_refresh_token );	312✔
569
570	if ( $grant_type eq 'refresh_token' ) {	312✔
571	( $client,$error,$scope,$user_id ) = $Grant->verify_token_and_scope(	72✔
572	refresh_token => $refresh_token,
573	auth_header => $self->req->headers->header( 'Authorization' ),
574	mojo_controller => $self,
575	);
576	$old_refresh_token = $refresh_token;	72✔
577
578	} elsif ( $grant_type eq 'password' ) {
579	$scope = $self->every_param( 'scope' );	56✔
580
581	( $client,$error,$scope,$user_id ) = $Grant->verify_user_password(	56✔
582	client_id => $client_id,
583	client_secret => $client_secret,
584	username => $username,
585	password => $password,
586	mojo_controller => $self,
587	scopes => $scope,
588	);
589	} elsif ( $grant_type eq 'client_credentials' ) {
590
591	my $client_secret;	24✔
592
593	( $client,$client_secret ) = _client_credentials_from_header( $self );	24✔
594
595	$scope = $self->every_param( 'scope' );	24✔
596	my $res;	24✔
597
598	( $res,$error ) = $Grant->verify_client(	24✔
599	client_id => $client,
600	client_secret => $client_secret,
601	scopes => $scope,
602	);
603
604	undef( $client ) if ! $res;	24✔
605
606	} else {
607	( $client,$error,$scope,$user_id ) = $Grant->verify_auth_code(	160✔
608	client_id => $client_id,
609	client_secret => $client_secret,
610	auth_code => $auth_code,
611	redirect_uri => $uri,
612	mojo_controller => $self,
613	);
614	}
615
616	$client = ! ref $client	234 all except 129.1 and 129.2 ✔
617	? $client
618	: ( $client->{client_id} \|\| $client->{client} );	78 only 129.1 and 129.2 ✔
619
620	return ( $client,$error,$scope,$user_id,$old_refresh_token );	312✔
621	}
622
623	=head1 SEE ALSO
624
625	L<Net::OAuth2::AuthorizationServer> - The dist that handles the bulk of the
626	functionality used by this plugin
627
628	=head1 AUTHOR & CONTRIBUTORS
629
630	Lee Johnson - C<leejo@cpan.org>
631
632	With contributions from:
633
634	Nick Logan C<nlogan@gmail.com>
635
636	Pierre VIGIER C<pierre.vigier@gmail.com>
637
638	Renee C<reb@perl-services.de>
639
640	=head1 LICENSE
641
642	This library is free software; you can redistribute it and/or modify it under
643	the same terms as Perl itself. If you would like to contribute documentation
644	or file a bug report then please raise an issue / pull request:
645
646	https://github.com/Humanstate/mojolicious-plugin-oauth2-server
647
648	=cut
649
650	1;
651
652	# vim: ts=2:sw=2:et

Humanstate / mojolicious-plugin-oauth2-server / 129

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous