class Capsium::Reactor::OAuth2

OAuth2 authorization-code flow client (05x-authentication), used by the Authenticator. Talks to the provider over net/http; the client secret never comes from the package. State is a random nonce signed with the session HMAC key (CSRF protection, self-contained).

Constants

GRANT_TYPE

Attributes

config [R] Package::OAuth2Config

Public Class Methods

new (config, client_secret:, session:, base_url: nil)

(Package::OAuth2Config config, client_secret: String client_secret, session: Session session, ?base_url: String? base_url) → void

Source

# File lib/capsium/reactor/oauth2.rb, line 22
def initialize(config, client_secret:, session:, base_url: nil)
  @config = config
  @client_secret = client_secret
  @session = session
  @base_url = base_url
end

Public Instance Methods

authorization_url (request)

(untyped request) → String

Source

# File lib/capsium/reactor/oauth2.rb, line 30
def authorization_url(request)
  params = {
    "response_type" => "code",
    "client_id" => @config.client_id,
    "redirect_uri" => callback_uri(request),
    "state" => generate_state
  }
  params["scope"] = @config.scopes.join(" ") unless @config.scopes.empty?
  "#{@config.authorization_url}?#{URI.encode_www_form(params)}"
end

The provider URL the login endpoint redirects the browser to.

callback_uri (request)

(untyped request) → String

Source

# File lib/capsium/reactor/oauth2.rb, line 55
def callback_uri(request)
  "#{base_url_for(request)}#{@config.redirect_path}"
end

complete (code, request)

(String? code, untyped request) → Hash[String, untyped]

Source

# File lib/capsium/reactor/oauth2.rb, line 51
def complete(code, request)
  userinfo(exchange_code(code, callback_uri(request)))
end

Exchanges the authorization code and fetches the userinfo claims. Returns the raw userinfo hash; raises FlowError on provider errors.

valid_state? (state)

(String? state) → bool

Source

# File lib/capsium/reactor/oauth2.rb, line 41
def valid_state?(state)
  nonce, signature = state.to_s.split(".", 2)
  return false if nonce.nil? || nonce.empty? || signature.nil?

  Reactor.secure_compare(@session.sign(nonce), signature)
end