Contents

require 'omniauth'

module TDiary
	module Rack
		module Auth
			class OmniAuth
				def initialize(app, provider, &block)
					@app = app
					@provider = provider
					@authz = block
				end

				def call(env)
					auth = env['rack.session']['auth']
					return login(env) unless auth
					env['REMOTE_USER'] = "#{auth.uid}@#{auth.provider}"
					return forbidden unless @authz.call(auth)
					@app.call(env)
				end

				def login(env)
					env['rack.session']['tdiary.auth.redirect'] =
						"#{env['REQUEST_PATH']}?#{env['QUERY_STRING']}"
					redirect = "#{::OmniAuth.config.path_prefix}/#{@provider}"
					[302, {'Content-Type' => 'text/plain', 'Location' => redirect}, []]
				end

				def logout(env)
					env['rack.session']['user_id'] = nil
				end

				def forbidden
					[403, {'Content-Type' => 'text/plain'}, ['forbidden']]
				end

				class CallbackHandler
					def call(env)
						# reset sesstion to prevend session fixation attack
						# see: http://www.ipa.go.jp/security/vuln/documents/website_security.pdf (section 1.4)
						env['rack.session.options'][:renew] = true
						auth = env['omniauth.auth']
						env['rack.session']['auth'] = auth
						env['REMOTE_USER'] = "#{auth.uid}@#{auth.provider}"
						redirect = env['rack.session']['tdiary.auth.redirect'] || '/'
						[302, {'Content-Type' => 'text/plain', 'Location' => redirect}, []]
					end
				end
			end
		end
	end
end

Version data entries

24 entries across 24 versions & 1 rubygems

Version	Path
tdiary-4.1.0	lib/tdiary/rack/auth/omniauth.rb
tdiary-4.1.0.20141126	lib/tdiary/rack/auth/omniauth.rb
tdiary-4.0.5.1	tdiary/rack/auth/omniauth.rb
tdiary-4.0.5	tdiary/rack/auth/omniauth.rb
tdiary-4.0.4	tdiary/rack/auth/omniauth.rb
tdiary-4.0.3	tdiary/rack/auth/omniauth.rb
tdiary-4.0.2.20140201	tdiary/rack/auth/omniauth.rb
tdiary-4.0.2	tdiary/rack/auth/omniauth.rb
tdiary-4.0.1.20131102	tdiary/rack/auth/omniauth.rb
tdiary-4.0.1.20130929	tdiary/rack/auth/omniauth.rb
tdiary-4.0.1.20130903	tdiary/rack/auth/omniauth.rb
tdiary-4.0.1	tdiary/rack/auth/omniauth.rb
tdiary-4.0.0.20130826	tdiary/rack/auth/omniauth.rb
tdiary-4.0.0	tdiary/rack/auth/omniauth.rb
tdiary-3.2.2.20130727	tdiary/rack/auth/omniauth.rb
tdiary-3.2.2.20130722	tdiary/rack/auth/omniauth.rb
tdiary-3.2.2.20130720	tdiary/rack/auth/omniauth.rb
tdiary-3.2.2.20130617	tdiary/rack/auth/omniauth.rb
tdiary-3.2.2.20130614	tdiary/rack/auth/omniauth.rb
tdiary-3.2.2.20130604	tdiary/rack/auth/omniauth.rb