extension.json

{
	"name": "OAuth",
	"version": "1.1.0",
	"author": [
		"Aaron Schulz",
		"Chris Steipp",
		"Brad Jorsch",
		"Robert Vogel",
		"Dejan Savuljesku"
	],
	"url": "https://www.mediawiki.org/wiki/Extension:OAuth",
	"descriptionmsg": "mwoauth-desc",
	"license-name": "GPL-2.0-or-later",
	"type": "other",
	"requires": {
		"MediaWiki": ">= 1.43"
	},
	"ExtensionFunctions": [
		"MediaWiki\\Extension\\OAuth\\Backend\\Hooks::onExtensionFunctions"
	],
	"ServiceWiringFiles": [
		"src/ServiceWiring.php"
	],
	"DefaultUserOptions": {
		"echo-subscriptions-web-oauth-owner": true,
		"echo-subscriptions-email-oauth-owner": true,
		"echo-subscriptions-web-oauth-admin": true,
		"echo-subscriptions-email-oauth-admin": true
	},
	"GroupPermissions": {
		"user": {
			"mwoauthmanagemygrants": true
		}
	},
	"AvailableRights": [
		"mwoauthproposeconsumer",
		"mwoauthupdateownconsumer",
		"mwoauthmanageconsumer",
		"mwoauthsuppress",
		"mwoauthviewsuppressed",
		"mwoauthviewprivate",
		"mwoauthmanagemygrants"
	],
	"SessionProviders": {
		"MediaWiki\\Extension\\OAuth\\SessionProvider": {
			"class": "MediaWiki\\Extension\\OAuth\\SessionProvider",
			"args": []
		}
	},
	"SpecialPages": {
		"OAuth": {
			"class": "MediaWiki\\Extension\\OAuth\\Frontend\\SpecialPages\\SpecialMWOAuth",
			"services": [
				"GrantsLocalization",
				"SkinFactory",
				"UrlUtils"
			]
		},
		"OAuthManageMyGrants": {
			"class": "MediaWiki\\Extension\\OAuth\\Frontend\\SpecialPages\\SpecialMWOAuthManageMyGrants",
			"services": [
				"GrantsInfo",
				"GrantsLocalization"
			]
		},
		"OAuthListConsumers": {
			"class": "MediaWiki\\Extension\\OAuth\\Frontend\\SpecialPages\\SpecialMWOAuthListConsumers",
			"services": [
				"GrantsLocalization"
			]
		}
	},
	"MessagesDirs": {
		"MWOAuth": [
			"i18n"
		]
	},
	"ExtensionMessagesFiles": {
		"MWOAuthAliases": "MWOAuth.alias.php"
	},
	"AutoloadNamespaces": {
		"MediaWiki\\Extension\\OAuth\\": "src/"
	},
	"TestAutoloadNamespaces": {
		"MediaWiki\\Extension\\OAuth\\Tests\\": "tests/phpunit/"
	},
	"TestAutoloadClasses": {
		"MediaWiki\\Extension\\OAuth\\Tests\\Entity\\MockClientEntity": "tests/phpunit/Entity/MockClientEntity.php",
		"MediaWiki\\Extension\\OAuth\\Tests\\Entity\\Mock_ClientEntity": "tests/phpunit/Entity/MockClientEntity.php"
	},
	"ResourceModules": {
		"ext.MWOAuth.styles": {
			"styles": [
				"ext.MWOAuth.BasicStyles.less",
				"ext.MWOAuth.AuthorizeForm.less"
			]
		},
		"ext.MWOAuth.AuthorizeDialog": {
			"scripts": [
				"ext.MWOAuth.AuthorizeDialog.js"
			],
			"dependencies": [
				"oojs-ui-core",
				"oojs-ui-windows"
			],
			"messages": [
				"mwoauth-desc"
			]
		}
	},
	"ResourceFileModulePaths": {
		"localBasePath": "resources/modules",
		"remoteExtPath": "OAuth/resources/modules"
	},
	"callback": "MediaWiki\\Extension\\OAuth\\Backend\\Hooks::onRegistration",
	"HookHandlers": {
		"abusefilter": {
			"class": "MediaWiki\\Extension\\OAuth\\Backend\\AbuseFilterHookHandler"
		},
		"backend": {
			"class": "MediaWiki\\Extension\\OAuth\\Backend\\Hooks",
			"services": [
				"ChangeTagDefStore",
				"ConnectionProvider"
			]
		},
		"frontend": {
			"class": "MediaWiki\\Extension\\OAuth\\Frontend\\UIHooks",
			"services": [
				"PermissionManager"
			]
		},
		"setup": {
			"class": "MediaWiki\\Extension\\OAuth\\Setup"
		},
		"schema": {
			"class": "MediaWiki\\Extension\\OAuth\\Backend\\UpdaterHooks"
		}
	},
	"Hooks": {
		"AbuseFilter-builder": "abusefilter",
		"AbuseFilter-computeVariable": "abusefilter",
		"AbuseFilter-generateUserVars": "abusefilter",
		"ChangeTagCanCreate": "backend",
		"MergeAccountFromTo": "MediaWiki\\Extension\\OAuth\\Backend\\Hooks::onMergeAccountFromTo",
		"LoadExtensionSchemaUpdates": "schema",
		"GetPreferences": "frontend",
		"MessagesPreLoad": "frontend",
		"SpecialPageAfterExecute": "frontend",
		"SpecialPageBeforeFormDisplay": "frontend",
		"BeforeCreateEchoEvent": "MediaWiki\\Extension\\OAuth\\Frontend\\UIHooks::onBeforeCreateEchoEvent",
		"TestCanonicalRedirect": "setup",
		"SetupAfterCache": "backend",
		"ApiRsdServiceApis": "backend",
		"SpecialPage_initList": "frontend",
		"ListDefinedTags": "backend",
		"ChangeTagsListActive": "backend",
		"LoginFormValidErrorMessages": "frontend"
	},
	"ConfigRegistry": {
		"mwoauth": "GlobalVarConfig::newInstance"
	},
	"config": {
		"MWOAuthCentralWiki": {
			"value": false,
			"description": "Wiki ID of OAuth management wiki. On wiki farms, it makes sense to set this to a wiki that acts as a portal site, is decidated to management, or just handles login/authentication. It can, however, be set to any wiki if the farm. For single-wiki sites or farms where each wiki manages consumers separately, it should be left as false."
		},
		"MWOAuthSharedUserIDs": {
			"value": false,
			"description": "Whether shared global user IDs are stored in the oauth tables. On wiki farms with a central authentication system (with integer user IDs) that share a single OAuth management wiki, this must be set to true. If wikis have a central authentication system but have their own OAuth management, then this can be either true or false. Otherwise it should always be set to false Setting this to true requires CentralIdLookup or an MWOAuth aware authentication extension. This value should not be changed after the fact to avoid ambigious IDs. Proper user ID migration should be done before any such changes."
		},
		"MWOAuthSharedUserSource": {
			"value": null,
			"description": "Source of shared user IDs, if enabled. If CentralIdLookup is available, this is the $providerId for CentralIdLookupFactory::getLookup(). Generally null would be what you want, to use the default provider. If that class is not available or the named provider is not found, this is\n * passed to the 'OAuthGetUserNamesFromCentralIds', 'OAuthGetLocalUserFromCentralId', 'OAuthGetCentralIdFromLocalUser', and 'OAuthGetCentralIdFromUserName' hooks. This has no effect if $wgMWOAuthSharedUserIDs is set to false."
		},
		"MWOAuthRequestExpirationAge": {
			"value": 2592000,
			"description": "Seconds after which an idle consumer request is marked as \"expired\""
		},
		"MWOAuthSecureTokenTransfer": {
			"value": true,
			"description": "Require HTTPs for user transactions that might send out secret tokens"
		},
		"MWOauthDisabledApiModules": {
			"value": [],
			"description": "List of API module classes to disable when OAuth is used for the request"
		},
		"MWOAuthReadOnly": {
			"value": false,
			"description": "Prevent write activity to the database. When this is true, consumers cannot be added or updated, and new authorizations are prohibited. Authorization headers for existing authorizations will continue to work. Useful for migrating database tables"
		},
		"OAuthAutoApprove": {
			"value": [],
			"description": "Rules for automatically approving new consumers (instead of requiring manual review by an OAuth admin before they are usable). Takes a list of conditions; meeting any one of the conditions results in auto-approval. Conditions are an associative array of <rule name> => <rule value>; the condition is met if every one of its rules is satisfied. Current the only supported rule is 'grants', which takes a list of grant names, and is satisfied when all the grants requested for the consumer are within that list."
		},
		"OAuthGroupsToNotify": {
			"value": [],
			"description": "User groups to notify about new consumers that need to be reviewed"
		},
		"MWOAuthSessionCacheType": {
			"value": null,
			"description": "The cache type used for most temporary data storage. An index into $wgObjectCaches. The default is $wgSessionCacheType."
		},
		"MWOAuthNonceCacheType": {
			"value": null,
			"description": "The cache type used for OAuth 1.0 nonces. An index into $wgObjectCaches. The default is $wgMWOAuthSessionCacheType."
		},
		"OAuthSecretKey": {
			"value": null,
			"description": "Random 32-bit string used to encrypt OAuth requests. Generate using \"base64_encode(random_bytes(32))\""
		},
		"OAuth2EnabledGrantTypes": {
			"value": [
				"authorization_code",
				"refresh_token",
				"client_credentials"
			],
			"description": "List of OAuth2 grants that client applications can use"
		},
		"OAuth2PrivateKey": {
			"value": "",
			"description": "Private key or a path to the private key used to sign OAuth2 JWT being transmitted"
		},
		"OAuth2PublicKey": {
			"value": "",
			"description": "Public key or a path to the public key used to verify OAuth2 resource requests"
		},
		"OAuth2RequireCodeChallengeForPublicClients": {
			"value": true,
			"description": "Controls whether clients are required to send code challenges with OAuth2 requests. This only applies to non-confidential clients"
		},
		"OAuth2GrantExpirationInterval": {
			"description": "Controls validity period for access tokens (stored in the cache configured in MWOAuthSessionCacheType). Does not apply to owner-only clients, whose access tokens are always non-expiring. Accepts ISO 8601 durations or can be set to \"infinity\" or false for non-expiring tokens. Defaults to one hour.",
			"value": "PT1H"
		},
		"OAuth2RefreshTokenTTL": {
			"description": "Controls validity period for refresh tokens (stored in the cache configured in MWOAuthSessionCacheType). Accepts ISO 8601 durations or can be set to \"infinity\" or false for non-expiring tokens. Defaults to one month.",
			"value": "P1M"
		}
	},
	"GrantPermissions": {
		"oauthmanageownclient": {
			"mwoauthproposeconsumer": true,
			"mwoauthupdateownconsumer": true,
			"mwoauthmanagemygrants": true
		}
	},
	"GrantPermissionGroups": {
		"oauthmanageownclient": "administration"
	},
	"GrantRiskGroups": {
		"oauthmanageownclient": "internal"
	},
	"RestRoutes": [
		{
			"path": "/oauth2/authorize",
			"factory": "MediaWiki\\Extension\\OAuth\\Rest\\Handler\\Authorize::factory"
		},
		{
			"path": "/oauth2/access_token",
			"factory": "MediaWiki\\Extension\\OAuth\\Rest\\Handler\\AccessToken::factory",
			"method": "POST"
		},
		{
			"path": "/oauth2/resource/{type}",
			"factory": "MediaWiki\\Extension\\OAuth\\Rest\\Handler\\Resource::factory"
		},
		{
			"path": "/oauth2/client",
			"class": "MediaWiki\\Extension\\OAuth\\Rest\\Handler\\RequestClient",
			"method": "POST"
		},
		{
			"path": "/oauth2/client/{client_key}/reset_secret",
			"class": "MediaWiki\\Extension\\OAuth\\Rest\\Handler\\ResetClientSecret",
			"method": "POST"
		},
		{
			"path": "/oauth2/client",
			"class": "MediaWiki\\Extension\\OAuth\\Rest\\Handler\\ListClients",
			"services": [
				"DBLoadBalancer"
			],
			"method": "GET"
		}
	],
	"load_composer_autoloader": true,
	"manifest_version": 2
}