Class: Authorio::Request

Inherits:
ApplicationRecord show all
Defined in:
app/models/authorio/request.rb

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.user_scope_description(scope) ⇒ Object 



35
36
37
 
# File 'app/models/authorio/request.rb', line 35

def self.user_scope_description(scope)
  USER_SCOPE_DESCRIPTION[scope.to_sym] || scope
end

Instance Method Details

#client_id=(value) ⇒ Object

The IndieAuth spec uses ‘client_id’ to specify the client in the address, as a URL (eg “example.com”) But Rails uses ‘_id’ to tag associations (foreign keys). So we save that as ‘client’ here, but map client_id as an alias since that is what the HTTP parameter will be



15
16
17
 
# File 'app/models/authorio/request.rb', line 15

def client_id=(value)
  self.client = value
end

#code_challenge_matches(verifier) ⇒ Object 



27
28
29
30
31
32
33
 
# File 'app/models/authorio/request.rb', line 27

def code_challenge_matches(verifier)
  # For now, if original request did not have code challenge, then we pass by default
  return true if code_challenge.blank?

  sha256 = Digest::SHA256.digest verifier
  Base64.urlsafe_encode64(sha256).sub(/=*$/, '') == code_challenge
end

#validate_oauth(params) ⇒ Object 



19
20
21
22
23
24
25
 
# File 'app/models/authorio/request.rb', line 19

def validate_oauth(params)
  redirect_uri == params[:redirect_uri] &&
    client == params[:client_id] &&
    created_at > 10.minutes.ago &&
    code_challenge_matches(params[:code_verifier]) &&
    self
end