class OmniAuth::Strategies::Duodealer

Constants

CODE_EXPIRES_AFTER
DEFAULT_SCOPE

Available scopes: content themes products customers orders script_tags shipping read_* or write_*

MINUTE
SCOPE_DELIMITER

Public Class Methods

encoded_params_for_signature(params) click to toggle source
# File lib/omniauth/strategies/duodealer.rb, line 87
def self.encoded_params_for_signature(params)
  params = params.dup
  params.delete('hmac')
  params.delete('signature') # deprecated signature
  Rack::Utils.build_query(params.sort)
end
hmac_sign(encoded_params, secret) click to toggle source
# File lib/omniauth/strategies/duodealer.rb, line 94
def self.hmac_sign(encoded_params, secret)
  OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new, secret, encoded_params)
end

Public Instance Methods

authorize_params() click to toggle source
Calls superclass method
# File lib/omniauth/strategies/duodealer.rb, line 140
def authorize_params
  super.tap do |params|
    params[:scope] = normalized_scopes(params[:scope] || DEFAULT_SCOPE).join(SCOPE_DELIMITER)
    params[:grant_options] = ['per-user'] if options[:per_user_permissions]
  end
end
build_access_token() click to toggle source
Calls superclass method
# File lib/omniauth/strategies/duodealer.rb, line 136
def build_access_token
  @built_access_token ||= super
end
callback_phase() click to toggle source
Calls superclass method
# File lib/omniauth/strategies/duodealer.rb, line 119
def callback_phase
  return fail!(:invalid_site, CallbackError.new(:invalid_site, "OAuth endpoint is not a duodealer site.")) unless valid_site?
  return fail!(:invalid_signature, CallbackError.new(:invalid_signature, "Signature does not match, it may have been tampered with.")) unless valid_signature?

  token = build_access_token
  unless valid_scope?(token)
    return fail!(:invalid_scope, CallbackError.new(:invalid_scope, "Scope does not match, it may have been tampered with."))
  end
  unless valid_permissions?(token)
    return fail!(:invalid_permissions, CallbackError.new(:invalid_permissions, "Requested API access mode does not match."))
  end

  super
rescue ::OAuth2::Error => e
  fail!(:invalid_credentials, e)
end
callback_url() click to toggle source
# File lib/omniauth/strategies/duodealer.rb, line 147
def callback_url
  options[:callback_url] || full_host + script_name + callback_path
end
fix_https() click to toggle source
# File lib/omniauth/strategies/duodealer.rb, line 102
def fix_https
  options[:client_options][:site] = options[:client_options][:site].gsub(/\Ahttp\:/, 'https:')
end
normalized_scopes(scopes) click to toggle source
# File lib/omniauth/strategies/duodealer.rb, line 81
def normalized_scopes(scopes)
  scope_list = scopes.to_s.split(SCOPE_DELIMITER).map(&:strip).reject(&:empty?).uniq
  ignore_scopes = scope_list.map { |scope| scope =~ /\Awrite_(.*)\z/ && "read_#{$1}" }.compact
  scope_list - ignore_scopes
end
request_phase() click to toggle source
Calls superclass method
# File lib/omniauth/strategies/duodealer.rb, line 111
def request_phase
  if valid_site?
    super
  else
    fail!(:invalid_site)
  end
end
setup_phase() click to toggle source
Calls superclass method
# File lib/omniauth/strategies/duodealer.rb, line 106
def setup_phase
  super
  fix_https
end
valid_permissions?(token) click to toggle source
# File lib/omniauth/strategies/duodealer.rb, line 98
def valid_permissions?(token)
  token && (options[:per_user_permissions] == !token['associated_user'].nil?)
end
valid_scope?(token) click to toggle source
# File lib/omniauth/strategies/duodealer.rb, line 74
def valid_scope?(token)
  params = options.authorize_params.merge(options_for("authorize"))
  return false unless token && params[:scope] && token['scope']
  expected_scope = normalized_scopes(params[:scope]).sort
  (expected_scope == token['scope'].split(SCOPE_DELIMITER).sort)
end
valid_signature?() click to toggle source
# File lib/omniauth/strategies/duodealer.rb, line 58
def valid_signature?
  return false unless request.POST.empty?

  params = request.GET
  signature = params['hmac']
  timestamp = params['timestamp']
  return false unless signature && timestamp

  return false unless timestamp.to_i > Time.now.to_i - CODE_EXPIRES_AFTER

  new_secret = options.client_secret
  old_secret = options.old_client_secret

  validate_signature(new_secret) || (old_secret && validate_signature(old_secret))
end
valid_site?() click to toggle source
# File lib/omniauth/strategies/duodealer.rb, line 54
def valid_site?
  !!(/\A(https|http)\:\/\/[a-zA-Z0-9][a-zA-Z0-9\-]*\.#{Regexp.quote(options[:duodealer_domain])}[\/]?\z/ =~ options[:client_options][:site])
end

Private Instance Methods

validate_signature(secret) click to toggle source
# File lib/omniauth/strategies/duodealer.rb, line 153
def validate_signature(secret)
  params = request.GET
  calculated_signature = self.class.hmac_sign(self.class.encoded_params_for_signature(params), secret)
  Rack::Utils.secure_compare(calculated_signature, params['hmac'])
end