Skip to content

Commit 759b6a1

Browse files
apostolterzievapostolterziev
authored
Merge pull request #93 from rossitsaborissova/issue_56_redirect_uri
[Issue #56] redirect_uri should be optional in case of auth code generation
2 parents fcefbe6 + 43dda41 commit 759b6a1

File tree

4 files changed

+76
-21
lines changed

4 files changed

+76
-21
lines changed

‎apifest-oauth20/src/main/java/com/apifest/oauth20/AuthRequest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ public void validate() throws OAuthException {
9595
throw new OAuthException(Response.RESPONSE_TYPE_NOT_SUPPORTED,
9696
HttpResponseStatus.BAD_REQUEST);
9797
}
98-
if (!isValidURI(redirectUri)) {
98+
if (redirectUri != null && !isValidURI(redirectUri)) {
9999
throw new OAuthException(Response.INVALID_REDIRECT_URI, HttpResponseStatus.BAD_REQUEST);
100100
}
101101
}

‎apifest-oauth20/src/main/java/com/apifest/oauth20/AuthorizationServer.java‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,8 @@ private boolean areClientCredentialsValid(String clientId, String clientSecret)
120120
public String issueAuthorizationCode(HttpRequest req) throws OAuthException {
121121
AuthRequest authRequest = new AuthRequest(req);
122122
log.debug("received client_id:" + authRequest.getClientId());
123-
if (!isActiveClientId(authRequest.getClientId())) {
123+
ClientCredentials activeClientCredentials = getActiveClientCredentials(authRequest.getClientId());
124+
if (activeClientCredentials == null) {
124125
throw new OAuthException(Response.INVALID_CLIENT_ID, HttpResponseStatus.BAD_REQUEST);
125126
}
126127
authRequest.validate();
@@ -136,13 +137,17 @@ public String issueAuthorizationCode(HttpRequest req) throws OAuthException {
136137
db.storeAuthCode(authCode);
137138

138139
// return redirect URI, append param code=[Authcode]
139-
QueryStringEncoder enc = new QueryStringEncoder(authRequest.getRedirectUri());
140+
String redirectUri = authRequest.getRedirectUri();
141+
if (redirectUri == null) {
142+
redirectUri = activeClientCredentials.getUri();
143+
}
144+
QueryStringEncoder enc = new QueryStringEncoder(redirectUri);
140145
enc.addParam("code", authCode.getCode());
141146

142147
if(authCode.getState()!=null){
143148
enc.addParam("state", authCode.getState());
144149
}
145-
150+
146151
return enc.toString();
147152
}
148153

@@ -365,12 +370,12 @@ protected String generateCode() {
365370
return AuthCode.generate();
366371
}
367372

368-
protected boolean isActiveClientId(String clientId) {
373+
protected ClientCredentials getActiveClientCredentials(String clientId) {
369374
ClientCredentials creds = db.findClientCredentials(clientId);
370375
if (creds != null && creds.getStatus() == ClientCredentials.ACTIVE_STATUS) {
371-
return true;
376+
return creds;
372377
}
373-
return false;
378+
return null;
374379
}
375380

376381
// check only that clientId and clientSecret are valid, NOT that the status is active

‎apifest-oauth20/src/test/java/com/apifest/oauth20/AuthorizationServerTest.java‎

Lines changed: 62 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,8 @@ public void when_response_type_not_supported_return_error_unsupported_response_t
108108
HttpRequest req = mock(HttpRequest.class);
109109
willReturn("http://localhost/oauth20/authorize?client_id=1232&response_type=no").given(req)
110110
.getUri();
111-
willReturn(true).given(authServer).isActiveClientId("1232");
111+
ClientCredentials client = new ClientCredentials();
112+
willReturn(client).given(authServer).getActiveClientCredentials("1232");
112113

113114
// WHEN
114115
HttpResponseStatus status = null;
@@ -132,7 +133,8 @@ public void when_redirect_uri_not_valid_return_error_invalid_redirect_uri() {
132133
willReturn(
133134
"http://localhost/oauth20/authorize?client_id=1232&response_type=code&redirect_uri=tp%3A%2F%2Fexample.com")
134135
.given(req).getUri();
135-
willReturn(true).given(authServer).isActiveClientId("1232");
136+
ClientCredentials client = new ClientCredentials();
137+
willReturn(client).given(authServer).getActiveClientCredentials("1232");
136138

137139
// WHEN
138140
HttpResponseStatus status = null;
@@ -201,36 +203,36 @@ public void when_valid_client_id_and_active_status_return_true() throws Exceptio
201203
given(authServer.db.findClientCredentials(clientId)).willReturn(creds);
202204

203205
// WHEN
204-
boolean result = authServer.isActiveClientId(clientId);
206+
ClientCredentials result = authServer.getActiveClientCredentials(clientId);
205207

206208
// THEN
207-
assertTrue(result);
209+
assertNotNull(result);
208210
}
209211

210212
@Test
211-
public void when_valid_client_id_and_inactive_status_return_true() throws Exception {
213+
public void when_valid_client_id_and_inactive_status_return_null() throws Exception {
212214
// GIVEN
213215
ClientCredentials creds = mock(ClientCredentials.class);
214216
given(creds.getStatus()).willReturn(ClientCredentials.INACTIVE_STATUS);
215217
given(authServer.db.findClientCredentials(clientId)).willReturn(creds);
216218

217219
// WHEN
218-
boolean result = authServer.isActiveClientId(clientId);
220+
ClientCredentials result = authServer.getActiveClientCredentials(clientId);
219221

220222
// THEN
221-
assertFalse(result);
223+
assertNull(result);
222224
}
223225

224226
@Test
225-
public void when_not_valid_client_id_return_false() throws Exception {
227+
public void when_not_valid_client_id_return_null() throws Exception {
226228
// GIVEN
227229
String clienId = "203598599234220";
228230

229231
// WHEN
230-
boolean result = authServer.isActiveClientId(clienId);
232+
ClientCredentials result = authServer.getActiveClientCredentials(clientId);
231233

232234
// THEN
233-
assertFalse(result);
235+
assertNull(result);
234236
}
235237

236238
@Test
@@ -241,7 +243,6 @@ public void when_issue_auth_code_validate_client_id() throws Exception {
241243
mock(ClientCredentials.class));
242244
given(req.getUri())
243245
.willReturn("http://example.com/oauth20/authorize?client_id=" + clientId);
244-
String response ="";
245246

246247
// WHEN
247248
try {
@@ -251,7 +252,7 @@ public void when_issue_auth_code_validate_client_id() throws Exception {
251252
}
252253

253254
// THEN
254-
verify(authServer).isActiveClientId(clientId);
255+
verify(authServer).getActiveClientCredentials(clientId);
255256
}
256257

257258
@Test
@@ -298,6 +299,55 @@ public void when_issue_auth_code_verify_state_returned() throws Exception {
298299
assertTrue(response.contains(state));
299300
}
300301

302+
@Test
303+
public void when_issue_auth_code_if_no_redirect_uri_use_client_app_redirect_uri() throws Exception {
304+
// GIVEN
305+
HttpRequest req = mock(HttpRequest.class);
306+
ClientCredentials client = mock(ClientCredentials.class);
307+
String state = "someState";
308+
given(client.getStatus()).willReturn(ClientCredentials.ACTIVE_STATUS);
309+
given(client.getUri()).willReturn("http://localhost:8080");
310+
given(authServer.db.findClientCredentials(clientId)).willReturn(client);
311+
312+
given(req.getUri())
313+
.willReturn(
314+
"http://example.com/oauth20/authorize?response_type=code&client_id=" +
315+
clientId + "&state=" + state);
316+
willReturn("basic").given(authServer.scopeService).getValidScope(null, clientId);
317+
318+
// WHEN
319+
String response = authServer.issueAuthorizationCode(req);
320+
321+
// THEN
322+
verify(authServer).generateCode();
323+
assertTrue(response.contains("http://localhost:8080"));
324+
}
325+
326+
@Test
327+
public void when_issue_auth_code_with_redirect_uri_use_that_uri_in_response() throws Exception {
328+
// GIVEN
329+
HttpRequest req = mock(HttpRequest.class);
330+
ClientCredentials client = mock(ClientCredentials.class);
331+
String state = "someState";
332+
given(client.getStatus()).willReturn(ClientCredentials.ACTIVE_STATUS);
333+
given(client.getUri()).willReturn("http://localhost:8080");
334+
given(authServer.db.findClientCredentials(clientId)).willReturn(client);
335+
String redirectUri = "http://localhost:5000";
336+
337+
given(req.getUri())
338+
.willReturn(
339+
"http://example.com/oauth20/authorize?response_type=code&redirect_uri=" + redirectUri +
340+
"&client_id=" + clientId + "&state=" + state);
341+
willReturn("basic").given(authServer.scopeService).getValidScope(null, clientId);
342+
343+
// WHEN
344+
String response = authServer.issueAuthorizationCode(req);
345+
346+
// THEN
347+
verify(authServer).generateCode();
348+
assertTrue(response.contains(redirectUri));
349+
}
350+
301351
@Test
302352
public void when_issue_token_and_client_id_not_the_same_as_token_return_error()
303353
throws Exception {

‎apifest-oauth20/src/test/java/com/apifest/oauth20/HttpRequestHandlerTest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -733,15 +733,15 @@ public void when_get_tokens_and_user_id_is_empty_return_missing_param_user_id()
733733
}
734734

735735
@Test
736-
public void when_get_tokens_client_id_invalid_return_invalid_client_id() throws Exception {
736+
public void when_get_tokens_client_id_is_invalid_return_invalid_client_id() throws Exception {
737737
// GIVEN
738738
HttpRequest req = mock(HttpRequest.class);
739739
String userId = "214331231";
740740
String clientId = "218900b6c8d973881cf4185ecf";
741741
willReturn(HttpRequestHandler.ACCESS_TOKEN_URI + "?client_id=" + clientId + "&user_id=" + userId).given(req).getUri();
742742
AuthorizationServer auth = mock(AuthorizationServer.class);
743743
handler.auth = auth;
744-
willReturn(false).given(handler.auth).isActiveClientId(clientId);
744+
willReturn(false).given(handler.auth).isExistingClient(clientId);
745745

746746

747747
// WHEN

0 commit comments

Comments
 (0)