OAuth 1.0 working now

actions/apioauthaccesstoken.php

@@ -31,7 +31,7 @@ if (!defined('STATUSNET')) {
     exit(1);
 }
 
-require_once INSTALLDIR . '/lib/apioauthstore.php';
+require_once INSTALLDIR . '/lib/apioauth.php';
 
 /**
  * Exchange an authorized OAuth request token for an access token
@@ -43,19 +43,9 @@ require_once INSTALLDIR . '/lib/apioauthstore.php';
  * @link     http://status.net/
  */
 
-class ApiOauthAccessTokenAction extends Action
+class ApiOauthAccessTokenAction extends ApiOauthAction
 {
 
-    /**
-     * Is read only?
-     *
-     * @return boolean false
-     */
-    function isReadOnly()
-    {
-        return false;
-    }
-
     /**
      * Class handler.
      *

actions/apioauthauthorize.php

@@ -31,7 +31,7 @@ if (!defined('STATUSNET')) {
     exit(1);
 }
 
-require_once INSTALLDIR . '/lib/apioauthstore.php';
+require_once INSTALLDIR . '/lib/apioauth.php';
 
 /**
  * Authorize an OAuth request token
@@ -43,7 +43,7 @@ require_once INSTALLDIR . '/lib/apioauthstore.php';
  * @link     http://status.net/
  */
 
-class ApiOauthAuthorizeAction extends Action
+class ApiOauthAuthorizeAction extends ApiOauthAction
 {
     var $oauth_token;
     var $callback;
@@ -67,7 +67,7 @@ class ApiOauthAuthorizeAction extends Action
     {
         parent::prepare($args);
 
-        common_debug(var_export($_REQUEST, true));
+        common_debug("apioauthauthorize");
 
         $this->nickname    = $this->trimmed('nickname');
         $this->password    = $this->arg('password');
@@ -145,7 +145,8 @@ class ApiOauthAuthorizeAction extends Action
                 return;
             }
 
-            common_debug("Requesting auth for app: $app->name.");
+            $name = $this->app->name;
+            common_debug("Requesting auth for app: " . $name);
 
             $this->showForm();
         }
@@ -153,6 +154,8 @@ class ApiOauthAuthorizeAction extends Action
 
     function handlePost()
     {
+        common_debug("handlePost()");
+
         // check session token for CSRF protection.
 
         $token = $this->trimmed('token');
@@ -189,8 +192,8 @@ class ApiOauthAuthorizeAction extends Action
             $this->store->authorize_token($this->oauth_token);
 
             // Check to see if there was a previous token associated
-	    // with this user/app and kill it. If you're doing this you
+            // with this user/app and kill it. If the user is doing this she
-	    // probably don't want any old tokens anyway.
+            // probably doesn't want any old tokens anyway.
 
             $appUser = Oauth_application_user::getByKeys($user, $this->app);
 
@@ -204,13 +207,20 @@ class ApiOauthAuthorizeAction extends Action
                 }
             }
 
-	    // associated the new req token with the user and the app
+            // associated the authorized req token with the user and the app
 
             $appUser = new Oauth_application_user();
 
             $appUser->profile_id     = $user->id;
             $appUser->application_id = $this->app->id;
-	    $appUser->access_type    = $this->app->access_type;
+
+            // Note: do not copy the access type from the application.
+            // The access type should always be 0 when the OAuth app
+            // user record has a request token associated with it.
+            // Access type gets assigned once an access token has been
+            // granted.  The OAuth app user record then gets updated
+            // with the new access token and access type.
+
             $appUser->token          = $this->oauth_token;
             $appUser->created        = common_sql_now();
 
@@ -224,19 +234,34 @@ class ApiOauthAuthorizeAction extends Action
 
             // if we have a callback redirect and provide the token
 
+            // A callback specified in the app setup overrides whatever
+            // is passed in with the request.
+
+            common_debug("Req token is authorized - doing callback");
+
+            if (!empty($this->app->callback_url)) {
+                $this->callback = $this->app->callback_url;
+            }
+
             if (!empty($this->callback)) {
 
                 // XXX: Need better way to build this redirect url.
 
-                $target_url = $this->callback . '?oauth_token=' . $this->oauth_token;
+                $target_url = $this->getCallback($this->callback,
+                                                 array('oauth_token' => $this->oauth_token));
+
+                common_debug("Doing callback to $target_url");
+
                 common_redirect($target_url, 303);
+            } else {
+                common_debug("callback was empty!");
             }
 
             // otherwise inform the user that the rt was authorized
 
             $this->elementStart('p');
 
-            // XXX: Do OAuth 1.0a verifier code?
+            // XXX: Do OAuth 1.0a verifier code
 
             $this->raw(sprintf(_("The request token %s has been authorized. " .
                                  'Please exchange it for an access token.'),

actions/apioauthrequesttoken.php

@@ -31,7 +31,7 @@ if (!defined('STATUSNET')) {
     exit(1);
 }
 
-require_once INSTALLDIR . '/lib/apioauthstore.php';
+require_once INSTALLDIR . '/lib/apioauth.php';
 
 /**
  * Get an OAuth request token
@@ -43,16 +43,28 @@ require_once INSTALLDIR . '/lib/apioauthstore.php';
  * @link     http://status.net/
  */
 
-class ApiOauthRequestTokenAction extends Action
+class ApiOauthRequestTokenAction extends ApiOauthAction
 {
     /**
-     * Is read only?
+     * Take arguments for running
+     *
+     * @param array $args $_REQUEST args
+     *
+     * @return boolean success flag
      *
-     * @return boolean false
      */
-    function isReadOnly()
+
+    function prepare($args)
     {
-        return false;
+        parent::prepare($args);
+
+        $this->callback  = $this->arg('oauth_callback');
+
+        if (!empty($this->callback)) {
+            common_debug("callback: $this->callback");
+        }
+
+        return true;
     }
 
     /**

lib/apiauth.php

@@ -39,7 +39,7 @@ if (!defined('STATUSNET')) {
 }
 
 require_once INSTALLDIR . '/lib/api.php';
-require_once INSTALLDIR . '/lib/apioauthstore.php';
+require_once INSTALLDIR . '/lib/apioauth.php';
 
 /**
  * Actions extending this class will require auth
@@ -94,7 +94,7 @@ class ApiAuthAction extends ApiAction
 
         $server->add_signature_method($hmac_method);
 
-	$this->cleanRequest();
+        ApiOauthAction::cleanRequest();
 
         try {
 
@@ -165,24 +165,6 @@ class ApiAuthAction extends ApiAction
         print $msg . "\n";
     }
 
-    function cleanRequest()
-    {
-	// kill evil effects of magical slashing
-
-	if(get_magic_quotes_gpc() == 1) {
-	    $_POST = array_map('stripslashes', $_POST);
-	    $_GET = array_map('stripslashes', $_GET);
-	}
-
-	// strip out the p param added in index.php
-
-	// XXX: should we strip anything else?  Or alternatively
-	// only allow a known list of params?
-
-	unset($_GET['p']);
-	unset($_POST['p']);
-    }
-
     /**
      * Does this API resource require authentication?
      *

lib/apioauth.php

@@ -0,0 +1,122 @@
+<?php
+/**
+ * StatusNet, the distributed open-source microblogging tool
+ *
+ * Base action for OAuth API endpoints
+ *
+ * PHP version 5
+ *
+ * LICENCE: This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  API
+ * @package   StatusNet
+ * @author    Zach Copley <zach@status.net>
+ * @copyright 2010 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET')) {
+    exit(1);
+}
+
+require_once INSTALLDIR . '/lib/apioauthstore.php';
+
+/**
+ * Base action for API OAuth enpoints.  Clean up the
+ * the request, and possibly some other common things
+ * here.
+ *
+ * @category API
+ * @package  StatusNet
+ * @author   Zach Copley <zach@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link     http://status.net/
+ */
+
+class ApiOauthAction extends Action
+{
+    /**
+     * Is this a read-only action?
+     *
+     * @return boolean false
+     */
+
+    function isReadOnly($args)
+    {
+        return false;
+    }
+
+    function prepare($args)
+    {
+        parent::prepare($args);
+        return true;
+    }
+
+    /**
+     * Handle input, produce output
+     *
+     * Switches on request method; either shows the form or handles its input.
+     *
+     * @param array $args $_REQUEST data
+     *
+     * @return void
+     */
+
+    function handle($args)
+    {
+        parent::handle($args);
+        self::cleanRequest();
+    }
+
+    static function cleanRequest()
+    {
+        // kill evil effects of magical slashing
+
+        if (get_magic_quotes_gpc() == 1) {
+            $_POST = array_map('stripslashes', $_POST);
+            $_GET = array_map('stripslashes', $_GET);
+        }
+
+        // strip out the p param added in index.php
+
+        // XXX: should we strip anything else?  Or alternatively
+        // only allow a known list of params?
+
+        unset($_GET['p']);
+        unset($_POST['p']);
+    }
+
+    function getCallback($url, $params)
+    {
+        foreach ($params as $k => $v) {
+            $url = $this->appendQueryVar($url,
+                                         OAuthUtil::urlencode_rfc3986($k),
+                                         OAuthUtil::urlencode_rfc3986($v));
+        }
+
+        return $url;
+    }
+
+    function appendQueryVar($url, $k, $v) {
+        $url = preg_replace('/(.*)(\?|&)' . $k . '=[^&]+?(&)(.*)/i', '$1$2$4', $url . '&');
+        $url = substr($url, 0, -1);
+        if (strpos($url, '?') === false) {
+            return ($url . '?' . $k . '=' . $v);
+        } else {
+            return ($url . '&' . $k . '=' . $v);
+        }
+    }
+
+}

lib/apioauthstore.php

@@ -95,6 +95,15 @@ class ApiStatusNetOAuthDataStore extends StatusNetOAuthDataStore
 
                 $orig = clone($appUser);
                 $appUser->token = $at->tok;
+
+                // It's at this point that we change the access type
+                // to whatever the application's access is.  Request
+                // tokens should always have an access type of 0, and
+                // therefore be unuseable for making requests for
+                // protected resources.
+
+                $appUser->access_type = $app->access_type;
+
                 $result = $appUser->update($orig);
 
                 if (empty($result)) {

lib/router.php

@@ -50,8 +50,7 @@ class Router
     var $m = null;
     static $inst = null;
     static $bare = array('requesttoken', 'accesstoken', 'userauthorization',
-                         'postnotice', 'updateprofile', 'finishremotesubscribe',
+                         'postnotice', 'updateprofile', 'finishremotesubscribe');
-			 'apioauthrequesttoken', 'apioauthaccesstoken');
 
     static function get()
     {
@@ -659,7 +658,13 @@ class Router
                       'id' => '[0-9]+')
             );
 
-            $m->connect('oauth/authorize',
+            $m->connect('api/oauth/request_token',
+                        array('action' => 'apioauthrequesttoken'));
+
+            $m->connect('api/oauth/access_token',
+                        array('action' => 'apioauthaccesstoken'));
+
+            $m->connect('api/oauth/authorize',
                         array('action' => 'apioauthauthorize'));
 
             foreach (array('subscriptions', 'subscribers') as $a) {