From 995d0a4a14494ca956a1edc6a2b01c3aa890035d Mon Sep 17 00:00:00 2001 From: Matt Jones Date: Sat, 3 Feb 2018 16:29:26 +0000 Subject: [PATCH 1/3] Example without using NoBody or GetBody --- oauth.go | 24 ++++++++---------------- 1 file changed, 8 insertions(+), 16 deletions(-) diff --git a/oauth.go b/oauth.go index 7a28861..d8a1374 100644 --- a/oauth.go +++ b/oauth.go @@ -676,7 +676,7 @@ func (c *Consumer) makeAuthorizedRequestReader(method string, urlString string, // TODO(mrjones): validate that we're not overrideing an exising body? request.ContentLength = int64(len(vals.Encode())) if request.ContentLength == 0 { - request.Body = http.NoBody + request.Body = nil } else { request.Body = ioutil.NopCloser(strings.NewReader(vals.Encode())) } @@ -786,29 +786,21 @@ func canonicalizeUrl(u *url.URL) string { } func getBody(request *http.Request) ([]byte, error) { - if request.Body == nil || request.Body == http.NoBody { + if request.Body == nil { return nil, nil } - if request.GetBody != nil { - bodyReader, err := request.GetBody() - if err != nil { - return nil, err - } - defer bodyReader.Close() - return ioutil.ReadAll(bodyReader) - } defer request.Body.Close() originalBody, err := ioutil.ReadAll(request.Body) if err != nil { return nil, err } - // If there was no GetBody func, we have to re-install the body. - // (because we've ruined it by reading it). - // Set GetBody so that we don't have to repeat this process. - request.GetBody = func() (io.ReadCloser, error) { - return ioutil.NopCloser(bytes.NewReader(originalBody)), nil + + // We have to re-install the body (because we've ruined it by reading it). + if len(originalBody) > 0 { + request.Body = ioutil.NopCloser(bytes.NewReader(originalBody)) + } else { + request.Body = nil } - request.Body, _ = request.GetBody() return originalBody, nil } From e3894242d63de1581f770e618f30920407957c4e Mon Sep 17 00:00:00 2001 From: Mircea Cosbuc Date: Fri, 15 Jun 2018 15:53:48 +0200 Subject: [PATCH 2/3] Ignore missing verification code when authorizing token --- oauth.go | 6 ++++-- oauth_test.go | 30 ++++++++++++++++++++++++++++++ 2 files changed, 34 insertions(+), 2 deletions(-) diff --git a/oauth.go b/oauth.go index d8a1374..f16edb8 100644 --- a/oauth.go +++ b/oauth.go @@ -451,8 +451,10 @@ func (c *Consumer) AuthorizeToken(rtoken *RequestToken, verificationCode string) func (c *Consumer) AuthorizeTokenWithParams(rtoken *RequestToken, verificationCode string, additionalParams map[string]string) (atoken *AccessToken, err error) { params := map[string]string{ - VERIFIER_PARAM: verificationCode, - TOKEN_PARAM: rtoken.Token, + TOKEN_PARAM: rtoken.Token, + } + if verificationCode != "" { + params[VERIFIER_PARAM] = verificationCode } return c.makeAccessTokenRequestWithParams(params, rtoken.Secret, additionalParams) } diff --git a/oauth_test.go b/oauth_test.go index 0366861..63d37b4 100644 --- a/oauth_test.go +++ b/oauth_test.go @@ -192,6 +192,36 @@ func TestSuccessfulTokenAuthorization(t *testing.T) { assertEq(t, "consumersecret&RSECRET", m.signer.UsedKey) } +func TestSuccessfulTokenAuthorizationWithoutVerifier(t *testing.T) { + c := basicConsumer() + m := newMocks(t) + m.install(c) + + m.httpClient.ExpectGet( + "http://www.mrjon.es/accesstoken", + map[string]string{ + "oauth_consumer_key": "consumerkey", + "oauth_nonce": "2", + "oauth_signature": "MOCK_SIGNATURE", + "oauth_signature_method": "HMAC-SHA1", + "oauth_timestamp": "1", + "oauth_token": "RTOKEN", + "oauth_version": "1.0", + }, + "oauth_token=ATOKEN&oauth_token_secret=ATOKEN_SECRET&oauth_session_handle=SESSION_HANDLE") + + rtoken := &RequestToken{Token: "RTOKEN", Secret: "RSECRET"} + atoken, err := c.AuthorizeToken(rtoken, "") + if err != nil { + t.Fatal(err) + } + + assertEq(t, "ATOKEN", atoken.Token) + assertEq(t, "ATOKEN_SECRET", atoken.Secret) + assertEq(t, "SESSION_HANDLE", atoken.AdditionalData["oauth_session_handle"]) + assertEq(t, "consumersecret&RSECRET", m.signer.UsedKey) +} + func TestSuccessfulTokenRefresh(t *testing.T) { c := basicConsumer() m := newMocks(t) From a7f4d47589e28dc20449c7ed9ba23823321c8cca Mon Sep 17 00:00:00 2001 From: Changqi Chen Date: Wed, 19 Jun 2019 20:05:58 -0400 Subject: [PATCH 3/3] support mutil values for single group_id --- oauth.go | 29 +++++++++++------------------ provider.go | 9 ++++++--- 2 files changed, 17 insertions(+), 21 deletions(-) diff --git a/oauth.go b/oauth.go index f16edb8..250e849 100644 --- a/oauth.go +++ b/oauth.go @@ -806,19 +806,15 @@ func getBody(request *http.Request) ([]byte, error) { return originalBody, nil } -func parseBody(request *http.Request) (map[string]string, error) { - userParams := map[string]string{} +func parseBody(request *http.Request) (map[string][]string, error) { + userParams := map[string][]string{} // TODO(mrjones): factor parameter extraction into a separate method if request.Header.Get("Content-Type") != "application/x-www-form-urlencoded" { // Most of the time we get parameters from the query string: for k, vs := range request.URL.Query() { - if len(vs) != 1 { - return nil, fmt.Errorf("Must have exactly one value per param") - } - - userParams[k] = vs[0] + userParams[k] = vs } } else { // x-www-form-urlencoded parameters come from the body instead: @@ -833,24 +829,21 @@ func parseBody(request *http.Request) (map[string]string, error) { } for k, vs := range params { - if len(vs) != 1 { - return nil, fmt.Errorf("Must have exactly one value per param") - } - - userParams[k] = vs[0] + userParams[k] = vs } } return userParams, nil } -func paramsToSortedPairs(params map[string]string) pairs { +func paramsToSortedPairs(params map[string][]string) pairs { // Sort parameters alphabetically - paramPairs := make(pairs, len(params)) - i := 0 - for key, value := range params { - paramPairs[i] = pair{key: key, value: value} - i++ + paramPairs := pairs([]pair{}) + + for key, values := range params { + for _, value := range values { + paramPairs = append(paramPairs, pair{key: key, value: value}) + } } sort.Sort(paramPairs) diff --git a/provider.go b/provider.go index 3a37e38..73ef5a4 100644 --- a/provider.go +++ b/provider.go @@ -58,13 +58,16 @@ func makeURLAbs(url *url.URL, request *http.Request) { // IsAuthorized takes an *http.Request and returns a pointer to a string containing the consumer key, // or nil if not authorized func (provider *Provider) IsAuthorized(request *http.Request) (*string, error) { + var userParams = map[string]string{} var err error - var userParams map[string]string // start with the body/query params - userParams, err = parseBody(request) - if err != nil { + if params_temp, err := parseBody(request); err != nil { return nil, err + } else { + for k, v := range params_temp { + userParams[k] = v[0] + } } // if the oauth params are in the Authorization header, grab them, and