Use the current Roller session during OAuth authorization - #165
Open
snoopdave wants to merge 1 commit into
Open
Conversation
Derive the approving identity from the Roller session, as the rest of the UI does, and require the account to be enabled. Without a session the request goes to the login flow as before. A consumer key bound to a specific user may still only be approved by that user; a site-wide key is approved as whoever is logged in. Clients that continue to post the identity are accepted when the value agrees with the session and refused otherwise. Add OAuthManager.authorizeRequestToken(consumerKey, requestToken, userName), backed by a named update that matches the consumer key, the exact request token, an unauthorized record, and no access token, and reports whether one row changed. Approval is therefore one-shot, with no read-then-write window. markAsAuthorized is deprecated: it keyed on the consumer alone and did not name the token being approved. Refusals share one response so callers cannot tell refusals apart. Drop the identity field from the consent form and give it the standard salt field, and validate that token on the consent URL only. The request-token and access-token endpoints carry an OAuth signature and are left out of that mapping. Tests: AuthorizationServletTest. Claude-Session: https://claude.ai/code/session_01A1fhY1E2PCFU6UAPXu2WtV
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The OAuth 1.0a consent step should authorize the user who is signed in, the way
the rest of Roller's admin and editor UI resolves identity from the session.
This change moves it onto that model and tightens request-token approval into a
single conditional update.
What changed
user. A request with no session goes through the normal login flow.
userId/xoauth_requestor_idrequestparameter is still accepted when it agrees with the session user, and
rejected otherwise; it is not used to choose the identity.
exactly one row changed — rather than a separate load then store, so approval
is one-shot.
oauth_problem=permission_denied(403) for every refusal, sothe response does not vary with the reason.
markAsAuthorizedin favour ofauthorizeRequestToken.Tests
AuthorizationServletTestcovers identity taken from the session, a mismatcheduserIdparameter, disabled accounts, the bound-consumer refusal, and thegeneric refusal path.
JPAOAuthManagerTestexercises the conditional updateagainst Derby: a mismatched token changes no row, the exact pending token
succeeds once, and a second use of the same token changes no row.