|
| 1 | +require 'base64' |
| 2 | +require 'warden' |
| 3 | +require 'roda' |
| 4 | + |
| 5 | +class Roda |
| 6 | + |
| 7 | + module RodaPlugins |
| 8 | + |
| 9 | + module Auth |
| 10 | + |
| 11 | + def self.load_dependencies(app, *args, &block) |
| 12 | + Warden::Strategies.add(:token, Strategies::Token) |
| 13 | + Warden::Strategies.add(:password, Strategies::Password) |
| 14 | + Warden::Strategies.add(:basic, Strategies::Basic) |
| 15 | + end |
| 16 | + |
| 17 | + def self.configure(app, *args) |
| 18 | + options = args.last.is_a?(Hash) ? args.pop : {} |
| 19 | + user_class = options.delete(:user_class) || ::User |
| 20 | + type = args[0] || :basic |
| 21 | + redirect = options.delete(:redirect) || '/unautenticated' |
| 22 | + case type |
| 23 | + when :basic |
| 24 | + strategies = [:basic] |
| 25 | + when :form |
| 26 | + strategies = [:password] |
| 27 | + app.use Rack::Session::Cookie, secret:'foo' |
| 28 | + when :token |
| 29 | + strategies = [:token, :password] |
| 30 | + end |
| 31 | + app.use Warden::Manager do |config| |
| 32 | + config.default_scope = :user |
| 33 | + config.failure_app = self.fail(type) |
| 34 | + config[:user_class] = user_class |
| 35 | + config.scope_defaults( |
| 36 | + :user, |
| 37 | + :strategies => strategies, |
| 38 | + :action => redirect |
| 39 | + ) |
| 40 | + end |
| 41 | + end |
| 42 | + |
| 43 | + def self.fail(type) |
| 44 | + auth_fail = case type |
| 45 | + when :basic |
| 46 | + ->(env) {[401, {"WWW-AUTHENTICATE" => "Basic: Realm=\"#{env['warden.options'][:attempted_path]}\""}, []] } |
| 47 | + when :form |
| 48 | + ->(env) {[302, {"HTTP-LOCATION" => env['warden.options'][:action]} , []] } |
| 49 | + when :token |
| 50 | + ->(env) {[401, {"WWW-AUTHENTICATE" => "\"Token\""}, []] } |
| 51 | + end |
| 52 | + ->(env) { auth_fail.call(env) } |
| 53 | + end |
| 54 | + |
| 55 | + module InstanceMethods |
| 56 | + |
| 57 | + def authenticate! |
| 58 | + user = warden.authenticate! |
| 59 | + warden.set_user(user) |
| 60 | + end |
| 61 | + |
| 62 | + def current_user |
| 63 | + warden.user |
| 64 | + end |
| 65 | + |
| 66 | + def sign_in &block |
| 67 | + raise RodaError 'sign_in with POST only' unless request.env['REQUEST_METHOD'] == "POST" |
| 68 | + user = warden.authenticate! |
| 69 | + warden.set_user(user) |
| 70 | + request.is(&block) if block |
| 71 | + request.response.status = 201 |
| 72 | + user |
| 73 | + end |
| 74 | + |
| 75 | + def sign_out &block |
| 76 | + warden.set_user(nil) |
| 77 | + request.is(&block) if block |
| 78 | + request.response.status = 204 |
| 79 | + end |
| 80 | + |
| 81 | + private |
| 82 | + |
| 83 | + def warden |
| 84 | + request.env['warden'] |
| 85 | + end |
| 86 | + |
| 87 | + def session_path |
| 88 | + roda_class.opts[:session_path].to_s |
| 89 | + end |
| 90 | + |
| 91 | + end |
| 92 | + |
| 93 | + end |
| 94 | + |
| 95 | + module Strategies |
| 96 | + |
| 97 | + class Base < Warden::Strategies::Base |
| 98 | + |
| 99 | + def success!(u) |
| 100 | + u.authentic! if u.respond_to?(:authentic!) |
| 101 | + super |
| 102 | + end |
| 103 | + |
| 104 | + def authenticate! |
| 105 | + u = warden.config[:user_class].authentic?(credentials) |
| 106 | + u.nil? ? fail!("Could not log in") : success!(u) |
| 107 | + end |
| 108 | + |
| 109 | + private |
| 110 | + |
| 111 | + def warden |
| 112 | + @env['warden'] |
| 113 | + end |
| 114 | + |
| 115 | + def credentials_from_basic |
| 116 | + header = authorization_header |
| 117 | + return unless header && header =~ /\ABasic (.*)/m |
| 118 | + username, password = Base64.decode64($1).split(/:/, 2) |
| 119 | + return unless username and password |
| 120 | + { 'username' => username, 'password' => password } |
| 121 | + end |
| 122 | + |
| 123 | + def credentials_from_form |
| 124 | + request.media_type == "application/x-www-form-urlencoded" && params |
| 125 | + end |
| 126 | + |
| 127 | + def credentials_from_body |
| 128 | + request.body && JSON.parse(request.body.string) |
| 129 | + end |
| 130 | + |
| 131 | + def token_from_auth_header |
| 132 | + return unless header = authorization_header |
| 133 | + match = header =~ /\AAuth (.*)/m |
| 134 | + match && { 'token' => $1 } |
| 135 | + end |
| 136 | + |
| 137 | + def authorization_header |
| 138 | + @env['HTTP_AUTHORIZATION'] || @env['X-HTTP_AUTHORIZATION'] || @env['X_HTTP_AUTHORIZATION'] || @env['REDIRECT_X_HTTP_AUTHORIZATION'] |
| 139 | + end |
| 140 | + |
| 141 | + end |
| 142 | + |
| 143 | + |
| 144 | + class Password < Base |
| 145 | + |
| 146 | + def valid? |
| 147 | + credentials['username'] && credentials['password'] |
| 148 | + end |
| 149 | + |
| 150 | + private |
| 151 | + |
| 152 | + def credentials |
| 153 | + @credentials if @credentials |
| 154 | + @credentials = credentials_from_form || credentials_from_body || {} |
| 155 | + end |
| 156 | + |
| 157 | + end |
| 158 | + |
| 159 | + class Basic < Password |
| 160 | + |
| 161 | + def valid? |
| 162 | + credentials['username'] && credentials['password'] |
| 163 | + end |
| 164 | + |
| 165 | + private |
| 166 | + |
| 167 | + def credentials |
| 168 | + @credentials if @credentials |
| 169 | + @credentials = credentials_from_basic || {} |
| 170 | + end |
| 171 | + |
| 172 | + end |
| 173 | + |
| 174 | + |
| 175 | + class Token < Base |
| 176 | + |
| 177 | + def valid? |
| 178 | + credentials['token'] |
| 179 | + end |
| 180 | + |
| 181 | + private |
| 182 | + |
| 183 | + def credentials |
| 184 | + @credentials if @credentials |
| 185 | + @credentials = token_from_auth_header || {} |
| 186 | + end |
| 187 | + |
| 188 | + end |
| 189 | + |
| 190 | + end |
| 191 | + |
| 192 | + register_plugin(:auth, Auth) |
| 193 | + |
| 194 | + end |
| 195 | + |
| 196 | + |
| 197 | +end |
0 commit comments