d276cd5b32
If an endpoint specifies more than one scope and none of the scopes from access token matches, return oauth headers for the first of the scopes
70 lines
1.8 KiB
Ruby
70 lines
1.8 KiB
Ruby
require 'travis/api/app'
|
|
|
|
class Travis::Api::App
|
|
module Extensions
|
|
module Scoping
|
|
module Helpers
|
|
def scope
|
|
env['travis.scope'].to_sym
|
|
end
|
|
|
|
def public?
|
|
scope == :public
|
|
end
|
|
|
|
def required_params_match?
|
|
return true unless token = env['travis.access_token']
|
|
|
|
if token.extra && (required_params = token.extra['required_params'])
|
|
required_params.all? { |name, value| params[name] == value }
|
|
else
|
|
true
|
|
end
|
|
end
|
|
end
|
|
|
|
def self.registered(app)
|
|
app.set default_scope: :public, anonymous_scopes: [:public]
|
|
app.helpers(Helpers)
|
|
end
|
|
|
|
def scope(*names)
|
|
condition do
|
|
names = [settings.default_scope] if names == [:default]
|
|
scopes = env['travis.access_token'].try(:scopes) || settings.anonymous_scopes
|
|
|
|
result = names.any? do |name|
|
|
if scopes.include?(name) && required_params_match?
|
|
headers['X-OAuth-Scopes'] = scopes.map(&:to_s).join(',')
|
|
headers['X-Accepted-OAuth-Scopes'] = name.to_s
|
|
|
|
env['travis.scope'] = name
|
|
headers['Vary'] = 'Accept'
|
|
headers['Vary'] << ', Authorization' unless public?
|
|
true
|
|
end
|
|
end
|
|
|
|
if !result
|
|
headers['X-OAuth-Scopes'] = scopes.map(&:to_s).join(',')
|
|
headers['X-Accepted-OAuth-Scopes'] = names.first.to_s
|
|
|
|
if env['travis.access_token']
|
|
pass { halt 403, "insufficient access" }
|
|
else
|
|
pass { halt 401, "no access token supplied" }
|
|
end
|
|
end
|
|
|
|
result
|
|
end
|
|
end
|
|
|
|
def route(verb, path, options = {}, &block)
|
|
options[:scope] ||= :default
|
|
super(verb, path, options, &block)
|
|
end
|
|
end
|
|
end
|
|
end
|