Class: TDiary::Rack::Auth::OmniAuth::Authorization

Inherits:
Object
  • Object
show all
Defined in:
lib/tdiary/rack/auth/omniauth/authorization.rb

Instance Method Summary collapse

Constructor Details

#initialize(app, provider, &block) ⇒ Authorization

Returns a new instance of Authorization.



8
9
10
11
12
 
# File 'lib/tdiary/rack/auth/omniauth/authorization.rb', line 8

def initialize(app, provider, &block)
  @app = app
  @provider = provider
  @authz = block
end

Instance Method Details

#authenticate?(env) ⇒ Boolean

Returns:

  • (Boolean) 


57
58
59
 
# File 'lib/tdiary/rack/auth/omniauth/authorization.rb', line 57

def authenticate?(env)
  env['omniauth.auth'] || env['rack.session']['auth']
end

#call(env) ⇒ Object 



14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
 
# File 'lib/tdiary/rack/auth/omniauth/authorization.rb', line 14

def call(env)
  if not authenticate?(env)
    # phase 1: request phase
    (env)
  elsif env['REQUEST_PATH'].match(%r|auth/#{@provider}/callback|)
    # phase 2: callback phase
    callback(env)
  else
    # phase 3: authorization phase
    auth = env['rack.session']['auth']
    env['REMOTE_USER'] = "#{auth.uid}@#{auth.provider}"
    return forbidden unless @authz.call(auth)
    @app.call(env)
  end
end

#callback(env) ⇒ Object 



46
47
48
49
50
51
52
53
54
55
 
# File 'lib/tdiary/rack/auth/omniauth/authorization.rb', line 46

def callback(env)
  # reset sesstion to prevend session fixation attack
  # see: http://www.ipa.go.jp/security/vuln/documents/website_security.pdf (section 1.4)
  env['rack.session.options'][:renew] = true
  auth = env['omniauth.auth']
  env['rack.session']['auth'] = auth
  env['REMOTE_USER'] = "#{auth.uid}@#{auth.provider}"
  redirect = env['rack.session']['tdiary.auth.redirect'] || '/'
  [302, {'Content-Type' => 'text/plain', 'Location' => redirect}, []]
end

#forbidden ⇒ Object 



42
43
44
 
# File 'lib/tdiary/rack/auth/omniauth/authorization.rb', line 42

def forbidden
  [403, {'Content-Type' => 'text/plain'}, ['forbidden']]
end

#login(env) ⇒ Object 



30
31
32
33
34
35
36
 
# File 'lib/tdiary/rack/auth/omniauth/authorization.rb', line 30

def (env)
  STDERR.puts "use #{@provider} authentication strategy"
  req = ::Rack::Request.new(env)
  env['rack.session']['tdiary.auth.redirect'] = "#{req.base_url}#{req.fullpath}"
  redirect = File.join("#{req.base_url}#{req.path}", "#{::OmniAuth.config.path_prefix}/#{@provider}")
  [302, {'Content-Type' => 'text/plain', 'Location' => redirect}, []]
end

#logout(env) ⇒ Object 



38
39
40
 
# File 'lib/tdiary/rack/auth/omniauth/authorization.rb', line 38

def logout(env)
  env['rack.session']['user_id'] = nil
end