739 lines
23 KiB
JavaScript
739 lines
23 KiB
JavaScript
(function (exports) {
|
|
'use strict';
|
|
|
|
var oauth3 = {};
|
|
var logins = {};
|
|
oauth3.requests = logins;
|
|
|
|
if ('undefined' !== typeof Promise) {
|
|
oauth3.PromiseA = Promise;
|
|
} else {
|
|
console.warn("[oauth3.js] Remember to call oauth3.providePromise(Promise) with a proper Promise implementation");
|
|
}
|
|
|
|
// TODO move to a test / lint suite?
|
|
oauth3._testPromise = function (PromiseA) {
|
|
var promise;
|
|
var x = 1;
|
|
|
|
// tests that this promise has all of the necessary api
|
|
promise = new PromiseA(function (resolve, reject) {
|
|
if (x === 1) {
|
|
throw new Error("bad promise, create not asynchronous");
|
|
}
|
|
|
|
PromiseA.resolve().then(function () {
|
|
var promise2;
|
|
|
|
if (x === 1 || x === 2) {
|
|
throw new Error("bad promise, resolve not asynchronous");
|
|
}
|
|
|
|
promise2 = PromiseA.reject().then(reject, function () {
|
|
if (x === 1 || x === 2 || x === 3) {
|
|
throw new Error("bad promise, reject not asynchronous");
|
|
}
|
|
|
|
if ('undefined' === typeof angular) {
|
|
throw new Error("[NOT AN ERROR] Dear angular users: ignore this error-handling test");
|
|
} else {
|
|
return PromiseA.reject(new Error("[NOT AN ERROR] ignore this error-handling test"));
|
|
}
|
|
});
|
|
|
|
x = 4;
|
|
|
|
return promise2;
|
|
}).catch(function (e) {
|
|
if (e.message.match('NOT AN ERROR')) {
|
|
resolve({ success: true });
|
|
} else {
|
|
reject(e);
|
|
}
|
|
});
|
|
|
|
x = 3;
|
|
});
|
|
|
|
x = 2;
|
|
return promise;
|
|
};
|
|
|
|
oauth3.providePromise = function (PromiseA) {
|
|
oauth3.PromiseA = PromiseA;
|
|
return oauth3._testPromise(PromiseA).then(function () {
|
|
oauth3.PromiseA = PromiseA;
|
|
});
|
|
};
|
|
|
|
oauth3.provideRequest = function (request, opts) {
|
|
opts = opts || {};
|
|
var Recase = exports.Recase || require('recase');
|
|
// TODO make insensitive to providing exceptions
|
|
var recase = Recase.create({ exceptions: {} });
|
|
|
|
if (opts.rawCase) {
|
|
oauth3.request = request;
|
|
return;
|
|
}
|
|
|
|
// Wrap oauth3 api calls in snake_case / camelCase conversion
|
|
oauth3.request = function (req, opts) {
|
|
//console.log('[D] [oauth3 req.url]', req.url);
|
|
opts = opts || {};
|
|
|
|
if (opts.rawCase) {
|
|
return request(req);
|
|
}
|
|
|
|
// convert JavaScript camelCase to oauth3 snake_case
|
|
if (req.data && 'object' === typeof req.data) {
|
|
req.originalData = req.data;
|
|
req.data = recase.snakeCopy(req.data);
|
|
}
|
|
|
|
//console.log('[F] [oauth3 req.url]', req.url);
|
|
return request(req).then(function (resp) {
|
|
// convert oauth3 snake_case to JavaScript camelCase
|
|
if (resp.data && 'object' === typeof resp.data) {
|
|
resp.originalData = resp.data;
|
|
resp.data = recase.camelCopy(resp.data);
|
|
}
|
|
return resp;
|
|
});
|
|
};
|
|
|
|
/*
|
|
return oauth3._testRequest(request).then(function () {
|
|
oauth3.request = request;
|
|
});
|
|
*/
|
|
};
|
|
|
|
logins.authorizationRedirect = function (providerUri, opts) {
|
|
// TODO get own directives
|
|
return oauth3.authorizationRedirect(
|
|
providerUri
|
|
, opts.authorizationRedirect
|
|
, opts
|
|
).then(function (prequest) {
|
|
if (!prequest.state) {
|
|
throw new Error("[Devolper Error] [authorization redirect] prequest.state is empty");
|
|
}
|
|
|
|
return oauth3.frameRequest(prequest.url, prequest.state, opts);
|
|
});
|
|
};
|
|
|
|
logins.implicitGrant = function (providerUri, opts) {
|
|
// TODO OAuth3 provider should use the redirect URI as the appId?
|
|
return oauth3.implicitGrant(
|
|
providerUri
|
|
// TODO OAuth3 provider should referer / origin as the appId?
|
|
, opts
|
|
).then(function (prequest) {
|
|
// console.log('[debug] prequest', prequest);
|
|
if (!prequest.state) {
|
|
throw new Error("[Devolper Error] [implicit grant] prequest.state is empty");
|
|
}
|
|
|
|
return oauth3.frameRequest(prequest.url, prequest.state, opts);
|
|
});
|
|
};
|
|
|
|
logins.resourceOwnerPassword = function (providerUri, username, passphrase, opts) {
|
|
console.log('DEBUG logins.resourceOwnerPassword opts', opts);
|
|
//var scope = opts.scope;
|
|
//var appId = opts.appId;
|
|
return oauth3.resourceOwnerPassword(
|
|
providerUri
|
|
, username
|
|
, passphrase
|
|
, opts
|
|
//, scope
|
|
//, appId
|
|
).then(function (request) {
|
|
console.log('DEBUG oauth3.resourceOwnerPassword', request);
|
|
return oauth3.request({
|
|
url: request.url
|
|
, method: request.method
|
|
, data: request.data
|
|
});
|
|
});
|
|
};
|
|
|
|
oauth3.frameRequest = function (url, state, opts) {
|
|
var promise;
|
|
|
|
if ('background' === opts.type) {
|
|
promise = oauth3.insertIframe(url, state, opts);
|
|
} else if ('popup' === opts.type) {
|
|
promise = oauth3.openWindow(url, state, opts);
|
|
} else {
|
|
throw new Error("login framing method not specified or not type yet implemented");
|
|
}
|
|
|
|
return promise.then(function (params) {
|
|
var err;
|
|
|
|
if (params.error || params.error_description) {
|
|
err = new Error(params.error_description || "Unknown response error");
|
|
err.code = params.error || "E_UKNOWN_ERROR";
|
|
err.params = params;
|
|
return oauth3.PromiseA.reject(err);
|
|
}
|
|
|
|
return params;
|
|
});
|
|
};
|
|
|
|
oauth3.login = function (providerUri, opts) {
|
|
console.log('##### DEBUG oauth3.login providerUri, opts');
|
|
console.log(providerUri);
|
|
console.log(opts);
|
|
// Four styles of login:
|
|
// * background (hidden iframe)
|
|
// * iframe (visible iframe, needs border color and width x height params)
|
|
// * popup (needs width x height and positioning? params)
|
|
// * window (params?)
|
|
|
|
// Two strategies
|
|
// * authorization_redirect (to server authorization code)
|
|
// * implicit_grant (default, browser-only)
|
|
// If both are selected, implicit happens first and then the other happens in background
|
|
|
|
var promise;
|
|
|
|
if (opts.username || opts.password) {
|
|
/* jshint ignore:start */
|
|
// ingore "confusing use of !"
|
|
if (!opts.username !== !opts.password) {
|
|
throw new Error("you did not specify both username and password");
|
|
}
|
|
/* jshint ignore:end */
|
|
|
|
var username = opts.username;
|
|
var password = opts.password;
|
|
delete opts.username;
|
|
delete opts.password;
|
|
|
|
return logins.resourceOwnerPassword(providerUri, username, password, opts).then(function (resp) {
|
|
if (!resp || !resp.data) {
|
|
var err = new Error("bad response");
|
|
err.response = resp;
|
|
err.data = resp && resp.data || undefined;
|
|
return oauth3.PromiseA.reject(err);
|
|
}
|
|
return resp.data;
|
|
});
|
|
}
|
|
|
|
// TODO support dual-strategy login
|
|
// by default, always get implicitGrant (for client)
|
|
// and optionally do authorizationCode (for server session)
|
|
if ('background' === opts.type || opts.background) {
|
|
opts.type = 'background';
|
|
opts.background = true;
|
|
}
|
|
else {
|
|
opts.type = 'popup';
|
|
opts.popup = true;
|
|
}
|
|
if (opts.authorizationRedirect) {
|
|
promise = logins.authorizationRedirect(providerUri, opts);
|
|
}
|
|
else {
|
|
promise = logins.implicitGrant(providerUri, opts);
|
|
}
|
|
|
|
return promise;
|
|
};
|
|
|
|
oauth3.backgroundLogin = function (providerUri, opts) {
|
|
opts = opts || {};
|
|
opts.type = 'background';
|
|
return oauth3.login(providerUri, opts);
|
|
};
|
|
|
|
oauth3.insertIframe = function (url, state, opts) {
|
|
opts = opts || {};
|
|
var promise = new oauth3.PromiseA(function (resolve, reject) {
|
|
var tok;
|
|
var $iframe;
|
|
|
|
function cleanup() {
|
|
delete window['__oauth3_' + state];
|
|
$iframe.remove();
|
|
clearTimeout(tok);
|
|
tok = null;
|
|
}
|
|
|
|
window['__oauth3_' + state] = function (params) {
|
|
//console.info('[iframe] complete', params);
|
|
resolve(params);
|
|
cleanup();
|
|
};
|
|
|
|
tok = setTimeout(function () {
|
|
var err = new Error("the iframe request did not complete within 15 seconds");
|
|
err.code = "E_TIMEOUT";
|
|
reject(err);
|
|
cleanup();
|
|
}, opts.timeout || 15000);
|
|
|
|
// TODO hidden / non-hidden (via directive even)
|
|
$iframe = $(
|
|
'<iframe src="' + url
|
|
//+ '" width="800px" height="800px" style="opacity: 0.8;" frameborder="1"></iframe>'
|
|
+ '" width="1px" height="1px" frameborder="0"></iframe>'
|
|
);
|
|
|
|
$('body').append($iframe);
|
|
});
|
|
|
|
// TODO periodically garbage collect expired handlers from window object
|
|
return promise;
|
|
};
|
|
|
|
oauth3.openWindow = function (url, state, opts) {
|
|
var promise = new oauth3.PromiseA(function (resolve, reject) {
|
|
var winref;
|
|
var tok;
|
|
|
|
function cleanup() {
|
|
delete window['__oauth3_' + state];
|
|
clearTimeout(tok);
|
|
tok = null;
|
|
// this is last in case the window self-closes synchronously
|
|
// (should never happen, but that's a negotiable implementation detail)
|
|
//winref.close();
|
|
}
|
|
|
|
window['__oauth3_' + state] = function (params) {
|
|
//console.info('[popup] (or window) complete', params);
|
|
resolve(params);
|
|
cleanup();
|
|
};
|
|
|
|
tok = setTimeout(function () {
|
|
var err = new Error("the windowed request did not complete within 3 minutes");
|
|
err.code = "E_TIMEOUT";
|
|
reject(err);
|
|
cleanup();
|
|
}, opts.timeout || 3 * 60 * 1000);
|
|
|
|
// TODO allow size changes (via directive even)
|
|
winref = window.open(url, 'oauth3-login-' + state, 'height=720,width=620');
|
|
if (!winref) {
|
|
reject("TODO: open the iframe first and discover oauth3 directives before popup");
|
|
cleanup();
|
|
}
|
|
});
|
|
|
|
// TODO periodically garbage collect expired handlers from window object
|
|
return promise;
|
|
};
|
|
|
|
oauth3.logout = function (providerUri, opts) {
|
|
opts = opts || {};
|
|
|
|
// Oauth3.init({ logout: function () {} });
|
|
//return Oauth3.logout();
|
|
|
|
var state = parseInt(Math.random().toString().replace('0.', ''), 10).toString('36');
|
|
var url = providerUri.replace(/\/$/, '') + (opts.providerOauth3Html || '/oauth3.html');
|
|
var redirectUri = opts.redirectUri
|
|
|| (window.location.protocol + '//' + (window.location.host + window.location.pathname) + 'oauth3.html')
|
|
;
|
|
var params = {
|
|
// logout=true for all logins/accounts
|
|
// logout=app-scoped-login-id for a single login
|
|
action: 'logout'
|
|
// TODO specify specific accounts / logins to delete from session
|
|
, accounts: true
|
|
, logins: true
|
|
, redirect_uri: redirectUri
|
|
, state: state
|
|
};
|
|
|
|
//console.log('DEBUG oauth3.logout NIX insertIframe');
|
|
//console.log(url, params.redirect_uri);
|
|
//console.log(state);
|
|
//console.log(params); // redirect_uri
|
|
//console.log(opts);
|
|
|
|
if (url === params.redirect_uri) {
|
|
return oauth3.PromiseA.resolve();
|
|
}
|
|
|
|
url += '#' + oauth3.querystringify(params);
|
|
|
|
return oauth3.insertIframe(url, state, opts);
|
|
};
|
|
|
|
oauth3.stringifyscope = function (scope) {
|
|
if (Array.isArray(scope)) {
|
|
scope = scope.join(' ');
|
|
}
|
|
return scope;
|
|
};
|
|
|
|
oauth3.querystringify = function (params) {
|
|
var qs = [];
|
|
|
|
Object.keys(params).forEach(function (key) {
|
|
if ('scope' === key) {
|
|
params[key] = oauth3.stringifyscope(params[key]);
|
|
}
|
|
qs.push(encodeURIComponent(key) + '=' + encodeURIComponent(params[key]));
|
|
});
|
|
|
|
return qs.join('&');
|
|
};
|
|
|
|
oauth3.createState = function () {
|
|
// TODO mo' betta' random function
|
|
// maybe gather some entropy from mouse / keyboard events?
|
|
// (probably not, just use webCrypto or be sucky)
|
|
return parseInt(Math.random().toString().replace('0.', ''), 10).toString('36');
|
|
};
|
|
|
|
oauth3.normalizeProviderUri = function (providerUri) {
|
|
// tested with
|
|
// example.com
|
|
// example.com/
|
|
// http://example.com
|
|
// https://example.com/
|
|
providerUri = providerUri
|
|
.replace(/^(https?:\/\/)?/, 'https://')
|
|
.replace(/\/?$/, '')
|
|
;
|
|
|
|
return providerUri;
|
|
};
|
|
|
|
oauth3._discoverHelper = function (providerUri, opts) {
|
|
opts = opts || {};
|
|
var state = oauth3.createState();
|
|
var params;
|
|
var url;
|
|
|
|
params = {
|
|
action: 'directives'
|
|
, state: state
|
|
// TODO this should be configurable (i.e. I want a dev vs production oauth3.html)
|
|
, redirect_uri: window.location.protocol + '//' + window.location.host
|
|
+ window.location.pathname + 'oauth3.html'
|
|
};
|
|
|
|
url = providerUri + '/oauth3.html#' + oauth3.querystringify(params);
|
|
|
|
return oauth3.insertIframe(url, state, opts).then(function (directives) {
|
|
return directives;
|
|
}, function (err) {
|
|
return oauth3.PromiseA.reject(err);
|
|
});
|
|
};
|
|
|
|
oauth3.discover = function (providerUri, opts) {
|
|
opts = opts || {};
|
|
|
|
console.log('DEBUG oauth3.discover', providerUri);
|
|
console.log(opts);
|
|
if (opts.directives) {
|
|
return oauth3.PromiseA.resolve(opts.directives);
|
|
}
|
|
|
|
var promise;
|
|
var promise2;
|
|
var directives;
|
|
var updatedAt;
|
|
var fresh;
|
|
|
|
providerUri = oauth3.normalizeProviderUri(providerUri);
|
|
try {
|
|
directives = JSON.parse(localStorage.getItem('oauth3.' + providerUri + '.directives'));
|
|
console.log('DEBUG oauth3.discover cache', directives);
|
|
updatedAt = localStorage.getItem('oauth3.' + providerUri + '.directives.updated_at');
|
|
console.log('DEBUG oauth3.discover updatedAt', updatedAt);
|
|
updatedAt = new Date(updatedAt).valueOf();
|
|
console.log('DEBUG oauth3.discover updatedAt', updatedAt);
|
|
} catch(e) {
|
|
// ignore
|
|
}
|
|
|
|
fresh = (Date.now() - updatedAt) < (24 * 60 * 60 * 1000);
|
|
|
|
if (directives) {
|
|
promise = oauth3.PromiseA.resolve(directives);
|
|
|
|
if (fresh) {
|
|
//console.log('[local] [fresh directives]', directives);
|
|
return promise;
|
|
}
|
|
}
|
|
|
|
promise2 = oauth3._discoverHelper(providerUri, opts).then(function (params) {
|
|
console.log('DEBUG oauth3._discoverHelper', params);
|
|
var err;
|
|
|
|
if (!params.directives) {
|
|
err = new Error(params.error_description || "Unknown error when discoving provider '" + providerUri + "'");
|
|
err.code = params.error || "E_UNKNOWN_ERROR";
|
|
return oauth3.PromiseA.reject(err);
|
|
}
|
|
|
|
try {
|
|
directives = JSON.parse(atob(params.directives));
|
|
console.log('DEBUG oauth3._discoverHelper directives', directives);
|
|
} catch(e) {
|
|
err = new Error(params.error_description || "could not parse directives for provider '" + providerUri + "'");
|
|
err.code = params.error || "E_PARSE_DIRECTIVE";
|
|
return oauth3.PromiseA.reject(err);
|
|
}
|
|
|
|
if (
|
|
(directives.authorization_dialog && directives.authorization_dialog.url)
|
|
|| (directives.access_token && directives.access_token.url)
|
|
) {
|
|
// TODO lint directives
|
|
localStorage.setItem('oauth3.' + providerUri + '.directives', JSON.stringify(directives));
|
|
localStorage.setItem('oauth3.' + providerUri + '.directives.updated_at', new Date().toISOString());
|
|
|
|
return oauth3.PromiseA.resolve(directives);
|
|
} else {
|
|
// ignore
|
|
console.error("the directives provided by '" + providerUri + "' were invalid.");
|
|
params.error = params.error || "E_INVALID_DIRECTIVE";
|
|
params.error_description = params.error_description
|
|
|| "directives did not include authorization_dialog.url";
|
|
err = new Error(params.error_description || "Unknown error when discoving provider '" + providerUri + "'");
|
|
err.code = params.error;
|
|
return oauth3.PromiseA.reject(err);
|
|
}
|
|
});
|
|
|
|
return promise || promise2;
|
|
};
|
|
|
|
oauth3.authorizationRedirect = function (providerUri, authorizationRedirect, opts) {
|
|
//console.log('[authorizationRedirect]');
|
|
//
|
|
// Example Authorization Redirect - from Browser to Consumer API
|
|
// (for generating a session securely on your own server)
|
|
//
|
|
// i.e. GET https://<<CONSUMER>>.com/api/org.oauth3.consumer/authorization_redirect/<<PROVIDER>>.com
|
|
//
|
|
// GET https://myapp.com/api/org.oauth3.consumer/authorization_redirect/`encodeURIComponent('example.com')`
|
|
// &scope=`encodeURIComponent('profile.login profile.email')`
|
|
//
|
|
// (optional)
|
|
// &state=`Math.random()`
|
|
// &redirect_uri=`encodeURIComponent('https://myapp.com/oauth3.html')`
|
|
//
|
|
// NOTE: This is not a request sent to the provider, but rather a request sent to the
|
|
// consumer (your own API) which then sets some state and redirects.
|
|
// This will initiate the `authorization_code` request on your server
|
|
//
|
|
opts = opts || {};
|
|
|
|
return oauth3.discover(providerUri, opts).then(function (directive) {
|
|
if (!directive) {
|
|
throw new Error("Developer Error: directive should exist when discovery is successful");
|
|
}
|
|
|
|
var scope = opts.scope || directive.authn_scope;
|
|
|
|
var state = Math.random().toString().replace(/^0\./, '');
|
|
var params = {};
|
|
var slimProviderUri = encodeURIComponent(providerUri.replace(/^(https?|spdy):\/\//, ''));
|
|
|
|
params.state = state;
|
|
if (scope) {
|
|
params.scope = scope;
|
|
}
|
|
if (opts.redirectUri) {
|
|
// this is really only for debugging
|
|
params.redirect_uri = opts.redirectUri;
|
|
}
|
|
// Note: the type check is necessary because we allow 'true'
|
|
// as an automatic mechanism when it isn't necessary to specify
|
|
if ('string' !== typeof authorizationRedirect) {
|
|
// TODO oauth3.json for self?
|
|
authorizationRedirect = 'https://' + window.location.host
|
|
+ '/api/org.oauth3.consumer/authorization_redirect/:provider_uri';
|
|
}
|
|
authorizationRedirect = authorizationRedirect
|
|
.replace(/!(provider_uri)/, slimProviderUri)
|
|
.replace(/:provider_uri/, slimProviderUri)
|
|
.replace(/#{provider_uri}/, slimProviderUri)
|
|
.replace(/{{provider_uri}}/, slimProviderUri)
|
|
;
|
|
|
|
return oauth3.PromiseA.resolve({
|
|
url: authorizationRedirect + '?' + oauth3.querystringify(params)
|
|
, method: 'GET'
|
|
, state: state // this becomes browser_state
|
|
, params: params // includes scope, final redirect_uri?
|
|
});
|
|
});
|
|
};
|
|
|
|
oauth3.authorizationCode = function (/*providerUri, scope, redirectUri, clientId*/) {
|
|
//
|
|
// Example Authorization Code Request
|
|
// (not for use in the browser)
|
|
//
|
|
// GET https://example.com/api/org.oauth3.provider/authorization_dialog
|
|
// ?response_type=code
|
|
// &scope=`encodeURIComponent('profile.login profile.email')`
|
|
// &state=`Math.random()`
|
|
// &client_id=xxxxxxxxxxx
|
|
// &redirect_uri=`encodeURIComponent('https://myapp.com/oauth3.html')`
|
|
//
|
|
// NOTE: `redirect_uri` itself may also contain URI-encoded components
|
|
//
|
|
// NOTE: This probably shouldn't be done in the browser because the server
|
|
// needs to initiate the state. If it is done in a browser, the browser
|
|
// should probably request 'state' from the server beforehand
|
|
//
|
|
|
|
throw new Error("not implemented");
|
|
};
|
|
|
|
oauth3.implicitGrant = function (providerUri, opts) {
|
|
//console.log('[implicitGrant]');
|
|
//
|
|
// Example Implicit Grant Request
|
|
// (for generating a browser-only session, not a session on your server)
|
|
//
|
|
// GET https://example.com/api/org.oauth3.provider/authorization_dialog
|
|
// ?response_type=token
|
|
// &scope=`encodeURIComponent('profile.login profile.email')`
|
|
// &state=`Math.random()`
|
|
// &client_id=xxxxxxxxxxx
|
|
// &redirect_uri=`encodeURIComponent('https://myapp.com/oauth3.html')`
|
|
//
|
|
// NOTE: `redirect_uri` itself may also contain URI-encoded components
|
|
//
|
|
|
|
opts = opts || {};
|
|
var type = 'authorization_dialog';
|
|
var responseType = 'token';
|
|
|
|
return oauth3.discover(providerUri, opts).then(function (directive) {
|
|
var redirectUri = opts.redirectUri;
|
|
var scope = opts.scope || directive.authn_scope;
|
|
var clientId = opts.appId;
|
|
var args = directive[type];
|
|
var uri = args.url;
|
|
var state = Math.random().toString().replace(/^0\./, '');
|
|
var params = {};
|
|
var loc;
|
|
var result;
|
|
|
|
params.state = state;
|
|
params.response_type = responseType;
|
|
if (scope) {
|
|
if (Array.isArray(scope)) {
|
|
scope = scope.join(' ');
|
|
}
|
|
params.scope = scope;
|
|
}
|
|
if (clientId) {
|
|
// In OAuth3 client_id is optional for implicit grant
|
|
params.client_id = clientId;
|
|
}
|
|
if (!redirectUri) {
|
|
loc = window.location;
|
|
redirectUri = loc.protocol + '//' + loc.host + loc.pathname;
|
|
if ('/' !== redirectUri[redirectUri.length - 1]) {
|
|
redirectUri += '/';
|
|
}
|
|
redirectUri += 'oauth3.html';
|
|
}
|
|
params.redirect_uri = redirectUri;
|
|
|
|
uri += '?' + oauth3.querystringify(params);
|
|
|
|
result = {
|
|
url: uri
|
|
, state: state
|
|
, method: args.method
|
|
, query: params
|
|
};
|
|
return oauth3.PromiseA.resolve(result);
|
|
});
|
|
};
|
|
|
|
oauth3.resourceOwnerPassword = function (providerUri, username, passphrase, opts) {
|
|
//
|
|
// Example Resource Owner Password Request
|
|
// (generally for 1st party and direct-partner mobile apps, and webapps)
|
|
//
|
|
// POST https://example.com/api/org.oauth3.provider/access_token
|
|
// { "grant_type": "password", "client_id": "<<id>>", "scope": "<<scope>>"
|
|
// , "username": "<<username>>", "password": "password" }
|
|
//
|
|
opts = opts || {};
|
|
var type = 'access_token';
|
|
var grantType = 'password';
|
|
|
|
return oauth3.discover(providerUri, opts).then(function (directive) {
|
|
var scope = opts.scope || directive.authn_scope;
|
|
var clientId = opts.appId;
|
|
var clientAgreeTos = opts.clientAgreeTos;
|
|
var clientUri = opts.clientUri;
|
|
var args = directive[type];
|
|
var params = {
|
|
"grant_type": grantType
|
|
, "username": username
|
|
, "password": passphrase
|
|
//, "totp": opts.totp
|
|
};
|
|
var uri = args.url;
|
|
var body;
|
|
if (opts.totp) {
|
|
params.totp = opts.totp;
|
|
}
|
|
|
|
if (clientId) {
|
|
params.clientId = clientId;
|
|
}
|
|
if (clientUri) {
|
|
params.clientUri = clientUri;
|
|
params.clientAgreeTos = clientAgreeTos;
|
|
if (!clientAgreeTos) {
|
|
throw new Error('Developer Error: missing clientAgreeTos uri');
|
|
}
|
|
}
|
|
|
|
if (scope) {
|
|
if (Array.isArray(scope)) {
|
|
scope = scope.join(' ');
|
|
}
|
|
params.scope = scope;
|
|
}
|
|
|
|
if ('GET' === args.method.toUpperCase()) {
|
|
uri += '?' + oauth3.querystringify(params);
|
|
} else {
|
|
body = params;
|
|
}
|
|
|
|
return {
|
|
url: uri
|
|
, method: args.method
|
|
, data: body
|
|
};
|
|
});
|
|
};
|
|
|
|
exports.OAUTH3 = oauth3.oauth3 = oauth3.OAUTH3 = oauth3;
|
|
exports.oauth3 = exports.OAUTH3;
|
|
|
|
if ('undefined' !== typeof module) {
|
|
module.exports = oauth3;
|
|
}
|
|
}('undefined' !== typeof exports ? exports : window));
|