Module: UDAPSecurityTestKit::MockUDAPServer::UDAPAuthorizationResponseCreation

Included in:
AuthorizationEndpoint
Defined in:
lib/udap_security_test_kit/endpoints/mock_udap_server/udap_authorization_response_creation.rb

Instance Method Summary collapse

Instance Method Details

#make_udap_authorization_response ⇒ Object 



7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
 
# File 'lib/udap_security_test_kit/endpoints/mock_udap_server/udap_authorization_response_creation.rb', line 7

def make_udap_authorization_response
  redirect_uri = request.params[:redirect_uri]
  registered_redirect_uri_list = udap_registered_redirect_uris

  if redirect_uri.blank?
    # need one from the registered list
    if registered_redirect_uri_list.blank?
      response.status = 400
      response.body = {
        error: 'Bad request',
        message: 'Missing required redirect_uri parameter with no default provided in the registration.'
      }.to_json
      response.content_type = 'application/json'
      return
    elsif registered_redirect_uri_list.length > 1
      response.status = 400
      response.body = {
        error: 'Bad request',
        message: 'Missing required redirect_uri parameter with multiple options provided in the registration.'
      }.to_json
      response.content_type = 'application/json'
      return
    else
      redirect_uri = registered_redirect_uri_list.first
    end
  end

  client_id = request.params[:client_id]
  state = request.params[:state]

  exp_min = 10
  token = MockUDAPServer.client_id_to_token(client_id, exp_min)
  code_query_string = "code=#{ERB::Util.url_encode(token)}"
  query_string =
    if state.present?
      "#{code_query_string}&state=#{ERB::Util.url_encode(state)}"
    else
      code_query_string
    end
  response.headers['Location'] = "#{redirect_uri}#{redirect_uri.include?('?') ? '&' : '?'}#{query_string}"
  response.status = 302
end

#udap_registered_redirect_uris ⇒ Object 



50
51
52
53
54
55
56
57
58
59
60
 
# File 'lib/udap_security_test_kit/endpoints/mock_udap_server/udap_authorization_response_creation.rb', line 50

def udap_registered_redirect_uris
  registered_software_statement = MockUDAPServer.udap_registration_software_statement(test_run.test_session_id)
  return unless registered_software_statement.present?

  registration_jwt_body, _registration_jwt_header = JWT.decode(registered_software_statement, nil, false)
  return [] unless registration_jwt_body['redirect'].present?
  return registration_jwt_body['redirect'] if registration_jwt_body['redirect'].is_a?(Array)

  # invalid registration, but we'll succeed here and fail during registration verification
  [registration_jwt_body['redirect']]
end