forked from Gitlink/forgeplus
auth2接入
This commit is contained in:
parent
66c40d4791
commit
1f9caeece5
266
Gemfile
266
Gemfile
|
|
@ -1,130 +1,136 @@
|
|||
source 'https://gems.ruby-china.com'
|
||||
git_source(:github) { |repo| "https://github.com/#{repo}.git" }
|
||||
|
||||
gem 'rails', '~> 5.2.0'
|
||||
gem 'mysql2', '>= 0.4.4', '< 0.6.0'
|
||||
gem 'puma', '~> 3.11'
|
||||
gem 'sass-rails', '~> 5.0'
|
||||
gem 'uglifier', '>= 1.3.0'
|
||||
|
||||
# gem 'coffee-rails', '~> 4.2'
|
||||
gem 'turbolinks', '~> 5'
|
||||
gem 'jbuilder', '~> 2.5'
|
||||
gem 'groupdate', '~> 4.1.0'
|
||||
gem 'chartkick'
|
||||
gem 'grape-entity', '~> 0.7.1'
|
||||
gem 'kaminari', '~> 1.1', '>= 1.1.1'
|
||||
|
||||
gem 'bootsnap', '>= 1.1.0', require: false
|
||||
|
||||
gem 'chinese_pinyin'
|
||||
|
||||
gem 'rack-cors'
|
||||
gem 'redis-rails'
|
||||
gem 'roo-xls'
|
||||
gem 'simple_xlsx_reader'
|
||||
|
||||
gem 'rubyzip'
|
||||
|
||||
gem 'spreadsheet'
|
||||
gem 'ruby-ole'
|
||||
# 导出为xlsx
|
||||
gem 'axlsx', '~> 3.0.0.pre'
|
||||
gem 'axlsx_rails', '~> 0.5.2'
|
||||
|
||||
gem 'oauth2'
|
||||
#导出为pdf
|
||||
gem 'pdfkit'
|
||||
gem 'wkhtmltopdf-binary'
|
||||
# gem 'request_store'
|
||||
#gem 'iconv'
|
||||
# markdown 转html
|
||||
gem 'redcarpet', '~> 3.4'
|
||||
|
||||
gem 'rqrcode', '~> 0.10.1'
|
||||
gem 'rqrcode_png'
|
||||
|
||||
gem 'acts-as-taggable-on', '~> 6.0'
|
||||
|
||||
# a tree structure
|
||||
gem 'ancestry'
|
||||
gem 'acts_as_list'
|
||||
gem 'omniauth-cas'
|
||||
|
||||
# profiler Middleware
|
||||
gem 'rack-mini-profiler'
|
||||
|
||||
# object-based searching
|
||||
gem 'ransack'
|
||||
|
||||
group :development, :test do
|
||||
gem 'rspec-rails', '~> 3.8'
|
||||
end
|
||||
|
||||
group :development do
|
||||
gem 'prettier'
|
||||
gem 'rubocop', '~> 0.52.0'
|
||||
gem 'solargraph', '~> 0.38.0'
|
||||
gem 'awesome_print'
|
||||
gem 'web-console', '>= 3.3.0'
|
||||
gem 'listen', '>= 3.0.5', '< 3.2'
|
||||
gem 'spring'
|
||||
gem 'spring-watcher-listen', '~> 2.0.0'
|
||||
gem "annotate", "~> 2.6.0"
|
||||
end
|
||||
|
||||
group :test do
|
||||
gem 'capybara', '>= 2.15', '< 4.0'
|
||||
gem 'selenium-webdriver'
|
||||
gem 'chromedriver-helper'
|
||||
end
|
||||
|
||||
gem 'tzinfo-data', platforms: [:mingw, :mswin, :x64_mingw, :jruby]
|
||||
|
||||
#编码检测
|
||||
gem 'rchardet', '~> 1.8'
|
||||
|
||||
# http client
|
||||
gem 'faraday', '~> 0.15.4'
|
||||
|
||||
# view
|
||||
gem 'active_decorator'
|
||||
gem 'bootstrap', '~> 4.3.1'
|
||||
gem 'jquery-rails'
|
||||
gem 'simple_form'
|
||||
gem 'font-awesome-sass', '4.7.0'
|
||||
|
||||
# i18n
|
||||
gem 'rails-i18n', '~> 5.1'
|
||||
|
||||
# job
|
||||
gem 'sidekiq'
|
||||
gem 'sinatra'
|
||||
gem "sidekiq-cron", "~> 1.1"
|
||||
|
||||
# batch insert
|
||||
gem 'bulk_insert'
|
||||
|
||||
# elasticsearch
|
||||
gem 'searchkick'
|
||||
|
||||
gem 'aasm'
|
||||
gem 'enumerize'
|
||||
|
||||
gem 'diffy'
|
||||
|
||||
gem 'deep_cloneable', '~> 3.0.0'
|
||||
|
||||
# oauth2
|
||||
gem 'omniauth', '~> 1.9.0'
|
||||
gem 'omniauth-oauth2', '~> 1.6.0'
|
||||
|
||||
# global var
|
||||
gem 'request_store'
|
||||
|
||||
# 敏感词汇
|
||||
gem 'harmonious_dictionary', '~> 0.0.1'
|
||||
|
||||
gem 'parallel', '~> 1.19', '>= 1.19.1'
|
||||
|
||||
gem 'letter_avatar'
|
||||
source 'https://gems.ruby-china.com'
|
||||
git_source(:github) { |repo| "https://github.com/#{repo}.git" }
|
||||
|
||||
gem 'rails', '~> 5.2.0'
|
||||
gem 'mysql2', '>= 0.4.4', '< 0.6.0'
|
||||
gem 'puma', '~> 3.11'
|
||||
gem 'sass-rails', '~> 5.0'
|
||||
gem 'uglifier', '>= 1.3.0'
|
||||
|
||||
# gem 'coffee-rails', '~> 4.2'
|
||||
gem 'turbolinks', '~> 5'
|
||||
gem 'jbuilder', '~> 2.5'
|
||||
gem 'groupdate', '~> 4.1.0'
|
||||
gem 'chartkick'
|
||||
gem 'grape-entity', '~> 0.7.1'
|
||||
gem 'kaminari', '~> 1.1', '>= 1.1.1'
|
||||
|
||||
gem 'bootsnap', '>= 1.1.0', require: false
|
||||
|
||||
gem 'chinese_pinyin'
|
||||
|
||||
gem 'rack-cors'
|
||||
gem 'redis-rails'
|
||||
gem 'roo-xls'
|
||||
gem 'simple_xlsx_reader'
|
||||
|
||||
gem 'rubyzip'
|
||||
|
||||
gem 'spreadsheet'
|
||||
gem 'ruby-ole'
|
||||
# 导出为xlsx
|
||||
gem 'axlsx', '~> 3.0.0.pre'
|
||||
gem 'axlsx_rails', '~> 0.5.2'
|
||||
|
||||
gem 'oauth2'
|
||||
#导出为pdf
|
||||
gem 'pdfkit'
|
||||
gem 'wkhtmltopdf-binary'
|
||||
# gem 'request_store'
|
||||
#gem 'iconv'
|
||||
# markdown 转html
|
||||
gem 'redcarpet', '~> 3.4'
|
||||
|
||||
gem 'rqrcode', '~> 0.10.1'
|
||||
gem 'rqrcode_png'
|
||||
|
||||
gem 'acts-as-taggable-on', '~> 6.0'
|
||||
|
||||
# a tree structure
|
||||
gem 'ancestry'
|
||||
gem 'acts_as_list'
|
||||
gem 'omniauth-cas'
|
||||
|
||||
# profiler Middleware
|
||||
gem 'rack-mini-profiler'
|
||||
|
||||
# object-based searching
|
||||
gem 'ransack'
|
||||
|
||||
group :development, :test do
|
||||
gem 'rspec-rails', '~> 3.8'
|
||||
end
|
||||
|
||||
group :development do
|
||||
gem 'prettier'
|
||||
gem 'rubocop', '~> 0.52.0'
|
||||
gem 'solargraph', '~> 0.38.0'
|
||||
gem 'awesome_print'
|
||||
gem 'web-console', '>= 3.3.0'
|
||||
gem 'listen', '>= 3.0.5', '< 3.2'
|
||||
gem 'spring'
|
||||
gem 'spring-watcher-listen', '~> 2.0.0'
|
||||
gem "annotate", "~> 2.6.0"
|
||||
end
|
||||
|
||||
group :test do
|
||||
gem 'capybara', '>= 2.15', '< 4.0'
|
||||
gem 'selenium-webdriver'
|
||||
gem 'chromedriver-helper'
|
||||
end
|
||||
|
||||
gem 'tzinfo-data', platforms: [:mingw, :mswin, :x64_mingw, :jruby]
|
||||
|
||||
#编码检测
|
||||
gem 'rchardet', '~> 1.8'
|
||||
|
||||
# http client
|
||||
gem 'faraday', '~> 0.15.4'
|
||||
|
||||
# view
|
||||
gem 'active_decorator'
|
||||
gem 'bootstrap', '~> 4.3.1'
|
||||
gem 'jquery-rails'
|
||||
gem 'simple_form'
|
||||
gem 'font-awesome-sass', '4.7.0'
|
||||
|
||||
# i18n
|
||||
gem 'rails-i18n', '~> 5.1'
|
||||
|
||||
# job
|
||||
gem 'sidekiq'
|
||||
gem 'sinatra'
|
||||
gem "sidekiq-cron", "~> 1.1"
|
||||
|
||||
# batch insert
|
||||
gem 'bulk_insert'
|
||||
|
||||
# elasticsearch
|
||||
gem 'searchkick'
|
||||
|
||||
gem 'aasm'
|
||||
gem 'enumerize'
|
||||
|
||||
gem 'diffy'
|
||||
|
||||
gem 'deep_cloneable', '~> 3.0.0'
|
||||
|
||||
# oauth2
|
||||
gem 'omniauth', '~> 1.9.0'
|
||||
gem 'omniauth-oauth2', '~> 1.6.0'
|
||||
|
||||
# global var
|
||||
gem 'request_store'
|
||||
|
||||
# 敏感词汇
|
||||
gem 'harmonious_dictionary', '~> 0.0.1'
|
||||
|
||||
gem 'parallel', '~> 1.19', '>= 1.19.1'
|
||||
|
||||
gem 'letter_avatar'
|
||||
|
||||
gem 'jwt'
|
||||
|
||||
gem 'doorkeeper'
|
||||
|
||||
gem 'doorkeeper-jwt'
|
||||
|
|
|
|||
|
|
@ -265,9 +265,11 @@ class ApplicationController < ActionController::Base
|
|||
end
|
||||
end
|
||||
|
||||
# if !User.current.logged? && Rails.env.development?
|
||||
# User.current = User.find 1
|
||||
# end
|
||||
if !User.current.logged? && Rails.env.development?
|
||||
user = User.find 1
|
||||
User.current = user
|
||||
start_user_session(user)
|
||||
end
|
||||
|
||||
|
||||
# 测试版前端需求
|
||||
|
|
|
|||
|
|
@ -671,6 +671,21 @@ class User < Owner
|
|||
raise text
|
||||
end
|
||||
|
||||
def self.authenticate!(login, password)
|
||||
user = self.where("login = ? or mail = ? or phone = ? ", login.to_s.gsub(" ",''),login.to_s.gsub(" ",''),login.downcase.to_s.gsub(" ",'')).limit(1).first
|
||||
return (user.check_password?(password) ? user : nil) unless user.nil?
|
||||
nil
|
||||
end
|
||||
|
||||
# Generate public/private keys
|
||||
def generate_keys
|
||||
key_size = (Rails.env == 'test' ? 512 : 2048)
|
||||
|
||||
serialized_private_key = OpenSSL::PKey::RSA::generate(key_size).to_s
|
||||
serialized_public_key = OpenSSL::PKey::RSA.new(serialized_private_key)
|
||||
[serialized_private_key, serialized_public_key]
|
||||
end
|
||||
|
||||
def show_real_name
|
||||
name = lastname + firstname
|
||||
if name.blank?
|
||||
|
|
|
|||
|
|
@ -0,0 +1,553 @@
|
|||
# frozen_string_literal: true
|
||||
|
||||
Doorkeeper.configure do
|
||||
# Change the ORM that doorkeeper will use (requires ORM extensions installed).
|
||||
# Check the list of supported ORMs here: https://github.com/doorkeeper-gem/doorkeeper#orms
|
||||
orm :active_record
|
||||
|
||||
# This block will be called to check whether the resource owner is authenticated or not.
|
||||
resource_owner_authenticator do
|
||||
raise "Please configure doorkeeper resource_owner_authenticator block located in #{__FILE__}"
|
||||
# Put your resource owner authentication logic here.
|
||||
# Example implementation:
|
||||
User.find_by(id: session[:www_user_id]) || redirect_to(new_user_session_url)
|
||||
end
|
||||
|
||||
resource_owner_from_credentials do |routes|
|
||||
User.authenticate!(params[:username], params[:password])
|
||||
end
|
||||
|
||||
access_token_generator '::Doorkeeper::JWT'
|
||||
|
||||
admin_authenticator do
|
||||
user = User.find_by_id(session[:www_user_id])
|
||||
unless user #&& user.admin_or_business?
|
||||
redirect_to root_url
|
||||
end
|
||||
end
|
||||
|
||||
# If you didn't skip applications controller from Doorkeeper routes in your application routes.rb
|
||||
# file then you need to declare this block in order to restrict access to the web interface for
|
||||
# adding oauth authorized applications. In other case it will return 403 Forbidden response
|
||||
# every time somebody will try to access the admin web interface.
|
||||
#
|
||||
# admin_authenticator do
|
||||
# # Put your admin authentication logic here.
|
||||
# # Example implementation:
|
||||
#
|
||||
# if current_user
|
||||
# head :forbidden unless current_user.admin?
|
||||
# else
|
||||
# redirect_to sign_in_url
|
||||
# end
|
||||
# end
|
||||
|
||||
# You can use your own model classes if you need to extend (or even override) default
|
||||
# Doorkeeper models such as `Application`, `AccessToken` and `AccessGrant.
|
||||
#
|
||||
# Be default Doorkeeper ActiveRecord ORM uses it's own classes:
|
||||
#
|
||||
# access_token_class "Doorkeeper::AccessToken"
|
||||
# access_grant_class "Doorkeeper::AccessGrant"
|
||||
# application_class "Doorkeeper::Application"
|
||||
#
|
||||
# Don't forget to include Doorkeeper ORM mixins into your custom models:
|
||||
#
|
||||
# * ::Doorkeeper::Orm::ActiveRecord::Mixins::AccessToken - for access token
|
||||
# * ::Doorkeeper::Orm::ActiveRecord::Mixins::AccessGrant - for access grant
|
||||
# * ::Doorkeeper::Orm::ActiveRecord::Mixins::Application - for application (OAuth2 clients)
|
||||
#
|
||||
# For example:
|
||||
#
|
||||
# access_token_class "MyAccessToken"
|
||||
#
|
||||
# class MyAccessToken < ApplicationRecord
|
||||
# include ::Doorkeeper::Orm::ActiveRecord::Mixins::AccessToken
|
||||
#
|
||||
# self.table_name = "hey_i_wanna_my_name"
|
||||
#
|
||||
# def destroy_me!
|
||||
# destroy
|
||||
# end
|
||||
# end
|
||||
|
||||
# Enables polymorphic Resource Owner association for Access Tokens and Access Grants.
|
||||
# By default this option is disabled.
|
||||
#
|
||||
# Make sure you properly setup you database and have all the required columns (run
|
||||
# `bundle exec rails generate doorkeeper:enable_polymorphic_resource_owner` and execute Rails
|
||||
# migrations).
|
||||
#
|
||||
# If this option enabled, Doorkeeper will store not only Resource Owner primary key
|
||||
# value, but also it's type (class name). See "Polymorphic Associations" section of
|
||||
# Rails guides: https://guides.rubyonrails.org/association_basics.html#polymorphic-associations
|
||||
#
|
||||
# [NOTE] If you apply this option on already existing project don't forget to manually
|
||||
# update `resource_owner_type` column in the database and fix migration template as it will
|
||||
# set NOT NULL constraint for Access Grants table.
|
||||
#
|
||||
# use_polymorphic_resource_owner
|
||||
|
||||
# If you are planning to use Doorkeeper in Rails 5 API-only application, then you might
|
||||
# want to use API mode that will skip all the views management and change the way how
|
||||
# Doorkeeper responds to a requests.
|
||||
#
|
||||
# api_only
|
||||
|
||||
# Enforce token request content type to application/x-www-form-urlencoded.
|
||||
# It is not enabled by default to not break prior versions of the gem.
|
||||
#
|
||||
# enforce_content_type
|
||||
|
||||
# Authorization Code expiration time (default: 10 minutes).
|
||||
#
|
||||
# authorization_code_expires_in 10.minutes
|
||||
|
||||
# Access token expiration time (default: 2 hours).
|
||||
# If you want to disable expiration, set this to `nil`.
|
||||
#
|
||||
# access_token_expires_in 2.hours
|
||||
|
||||
# Assign custom TTL for access tokens. Will be used instead of access_token_expires_in
|
||||
# option if defined. In case the block returns `nil` value Doorkeeper fallbacks to
|
||||
# +access_token_expires_in+ configuration option value. If you really need to issue a
|
||||
# non-expiring access token (which is not recommended) then you need to return
|
||||
# Float::INFINITY from this block.
|
||||
#
|
||||
# `context` has the following properties available:
|
||||
#
|
||||
# * `client` - the OAuth client application (see Doorkeeper::OAuth::Client)
|
||||
# * `grant_type` - the grant type of the request (see Doorkeeper::OAuth)
|
||||
# * `scopes` - the requested scopes (see Doorkeeper::OAuth::Scopes)
|
||||
# * `resource_owner` - authorized resource owner instance (if present)
|
||||
#
|
||||
# custom_access_token_expires_in do |context|
|
||||
# context.client.additional_settings.implicit_oauth_expiration
|
||||
# end
|
||||
|
||||
# Use a custom class for generating the access token.
|
||||
# See https://doorkeeper.gitbook.io/guides/configuration/other-configurations#custom-access-token-generator
|
||||
#
|
||||
# access_token_generator '::Doorkeeper::JWT'
|
||||
|
||||
# The controller +Doorkeeper::ApplicationController+ inherits from.
|
||||
# Defaults to +ActionController::Base+ unless +api_only+ is set, which changes the default to
|
||||
# +ActionController::API+. The return value of this option must be a stringified class name.
|
||||
# See https://doorkeeper.gitbook.io/guides/configuration/other-configurations#custom-controllers
|
||||
#
|
||||
# base_controller 'ApplicationController'
|
||||
|
||||
# Reuse access token for the same resource owner within an application (disabled by default).
|
||||
#
|
||||
# This option protects your application from creating new tokens before old valid one becomes
|
||||
# expired so your database doesn't bloat. Keep in mind that when this option is `on` Doorkeeper
|
||||
# doesn't updates existing token expiration time, it will create a new token instead.
|
||||
# Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/383
|
||||
#
|
||||
# You can not enable this option together with +hash_token_secrets+.
|
||||
#
|
||||
# reuse_access_token
|
||||
|
||||
# In case you enabled `reuse_access_token` option Doorkeeper will try to find matching
|
||||
# token using `matching_token_for` Access Token API that searches for valid records
|
||||
# in batches in order not to pollute the memory with all the database records. By default
|
||||
# Doorkeeper uses batch size of 10 000 records. You can increase or decrease this value
|
||||
# depending on your needs and server capabilities.
|
||||
#
|
||||
# token_lookup_batch_size 10_000
|
||||
|
||||
# Set a limit for token_reuse if using reuse_access_token option
|
||||
#
|
||||
# This option limits token_reusability to some extent.
|
||||
# If not set then access_token will be reused unless it expires.
|
||||
# Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/1189
|
||||
#
|
||||
# This option should be a percentage(i.e. (0,100])
|
||||
#
|
||||
# token_reuse_limit 100
|
||||
|
||||
# Only allow one valid access token obtained via client credentials
|
||||
# per client. If a new access token is obtained before the old one
|
||||
# expired, the old one gets revoked (disabled by default)
|
||||
#
|
||||
# When enabling this option, make sure that you do not expect multiple processes
|
||||
# using the same credentials at the same time (e.g. web servers spanning
|
||||
# multiple machines and/or processes).
|
||||
#
|
||||
# revoke_previous_client_credentials_token
|
||||
|
||||
# Hash access and refresh tokens before persisting them.
|
||||
# This will disable the possibility to use +reuse_access_token+
|
||||
# since plain values can no longer be retrieved.
|
||||
#
|
||||
# Note: If you are already a user of doorkeeper and have existing tokens
|
||||
# in your installation, they will be invalid without adding 'fallback: :plain'.
|
||||
#
|
||||
# hash_token_secrets
|
||||
# By default, token secrets will be hashed using the
|
||||
# +Doorkeeper::Hashing::SHA256+ strategy.
|
||||
#
|
||||
# If you wish to use another hashing implementation, you can override
|
||||
# this strategy as follows:
|
||||
#
|
||||
# hash_token_secrets using: '::Doorkeeper::Hashing::MyCustomHashImpl'
|
||||
#
|
||||
# Keep in mind that changing the hashing function will invalidate all existing
|
||||
# secrets, if there are any.
|
||||
|
||||
# Hash application secrets before persisting them.
|
||||
#
|
||||
# hash_application_secrets
|
||||
#
|
||||
# By default, applications will be hashed
|
||||
# with the +Doorkeeper::SecretStoring::SHA256+ strategy.
|
||||
#
|
||||
# If you wish to use bcrypt for application secret hashing, uncomment
|
||||
# this line instead:
|
||||
#
|
||||
# hash_application_secrets using: '::Doorkeeper::SecretStoring::BCrypt'
|
||||
|
||||
# When the above option is enabled, and a hashed token or secret is not found,
|
||||
# you can allow to fall back to another strategy. For users upgrading
|
||||
# doorkeeper and wishing to enable hashing, you will probably want to enable
|
||||
# the fallback to plain tokens.
|
||||
#
|
||||
# This will ensure that old access tokens and secrets
|
||||
# will remain valid even if the hashing above is enabled.
|
||||
#
|
||||
# This can be done by adding 'fallback: plain', e.g. :
|
||||
#
|
||||
# hash_application_secrets using: '::Doorkeeper::SecretStoring::BCrypt', fallback: :plain
|
||||
|
||||
# Issue access tokens with refresh token (disabled by default), you may also
|
||||
# pass a block which accepts `context` to customize when to give a refresh
|
||||
# token or not. Similar to +custom_access_token_expires_in+, `context` has
|
||||
# the following properties:
|
||||
#
|
||||
# `client` - the OAuth client application (see Doorkeeper::OAuth::Client)
|
||||
# `grant_type` - the grant type of the request (see Doorkeeper::OAuth)
|
||||
# `scopes` - the requested scopes (see Doorkeeper::OAuth::Scopes)
|
||||
#
|
||||
# use_refresh_token
|
||||
|
||||
# Provide support for an owner to be assigned to each registered application (disabled by default)
|
||||
# Optional parameter confirmation: true (default: false) if you want to enforce ownership of
|
||||
# a registered application
|
||||
# NOTE: you must also run the rails g doorkeeper:application_owner generator
|
||||
# to provide the necessary support
|
||||
#
|
||||
# enable_application_owner confirmation: false
|
||||
|
||||
# Define access token scopes for your provider
|
||||
# For more information go to
|
||||
# https://doorkeeper.gitbook.io/guides/ruby-on-rails/scopes
|
||||
#
|
||||
# default_scopes :public
|
||||
# optional_scopes :write, :update
|
||||
|
||||
# Allows to restrict only certain scopes for grant_type.
|
||||
# By default, all the scopes will be available for all the grant types.
|
||||
#
|
||||
# Keys to this hash should be the name of grant_type and
|
||||
# values should be the array of scopes for that grant type.
|
||||
# Note: scopes should be from configured_scopes (i.e. default or optional)
|
||||
#
|
||||
# scopes_by_grant_type password: [:write], client_credentials: [:update]
|
||||
|
||||
# Forbids creating/updating applications with arbitrary scopes that are
|
||||
# not in configuration, i.e. +default_scopes+ or +optional_scopes+.
|
||||
# (disabled by default)
|
||||
#
|
||||
# enforce_configured_scopes
|
||||
|
||||
# Change the way client credentials are retrieved from the request object.
|
||||
# By default it retrieves first from the `HTTP_AUTHORIZATION` header, then
|
||||
# falls back to the `:client_id` and `:client_secret` params from the `params` object.
|
||||
# Check out https://github.com/doorkeeper-gem/doorkeeper/wiki/Changing-how-clients-are-authenticated
|
||||
# for more information on customization
|
||||
#
|
||||
# client_credentials :from_basic, :from_params
|
||||
|
||||
# Change the way access token is authenticated from the request object.
|
||||
# By default it retrieves first from the `HTTP_AUTHORIZATION` header, then
|
||||
# falls back to the `:access_token` or `:bearer_token` params from the `params` object.
|
||||
# Check out https://github.com/doorkeeper-gem/doorkeeper/wiki/Changing-how-clients-are-authenticated
|
||||
# for more information on customization
|
||||
#
|
||||
# access_token_methods :from_bearer_authorization, :from_access_token_param, :from_bearer_param
|
||||
|
||||
# Forces the usage of the HTTPS protocol in non-native redirect uris (enabled
|
||||
# by default in non-development environments). OAuth2 delegates security in
|
||||
# communication to the HTTPS protocol so it is wise to keep this enabled.
|
||||
#
|
||||
# Callable objects such as proc, lambda, block or any object that responds to
|
||||
# #call can be used in order to allow conditional checks (to allow non-SSL
|
||||
# redirects to localhost for example).
|
||||
#
|
||||
# force_ssl_in_redirect_uri !Rails.env.development?
|
||||
#
|
||||
# force_ssl_in_redirect_uri { |uri| uri.host != 'localhost' }
|
||||
|
||||
# Specify what redirect URI's you want to block during Application creation.
|
||||
# Any redirect URI is allowed by default.
|
||||
#
|
||||
# You can use this option in order to forbid URI's with 'javascript' scheme
|
||||
# for example.
|
||||
#
|
||||
# forbid_redirect_uri { |uri| uri.scheme.to_s.downcase == 'javascript' }
|
||||
|
||||
# Allows to set blank redirect URIs for Applications in case Doorkeeper configured
|
||||
# to use URI-less OAuth grant flows like Client Credentials or Resource Owner
|
||||
# Password Credentials. The option is on by default and checks configured grant
|
||||
# types, but you **need** to manually drop `NOT NULL` constraint from `redirect_uri`
|
||||
# column for `oauth_applications` database table.
|
||||
#
|
||||
# You can completely disable this feature with:
|
||||
#
|
||||
# allow_blank_redirect_uri false
|
||||
#
|
||||
# Or you can define your custom check:
|
||||
#
|
||||
# allow_blank_redirect_uri do |grant_flows, client|
|
||||
# client.superapp?
|
||||
# end
|
||||
|
||||
# Specify how authorization errors should be handled.
|
||||
# By default, doorkeeper renders json errors when access token
|
||||
# is invalid, expired, revoked or has invalid scopes.
|
||||
#
|
||||
# If you want to render error response yourself (i.e. rescue exceptions),
|
||||
# set +handle_auth_errors+ to `:raise` and rescue Doorkeeper::Errors::InvalidToken
|
||||
# or following specific errors:
|
||||
#
|
||||
# Doorkeeper::Errors::TokenForbidden, Doorkeeper::Errors::TokenExpired,
|
||||
# Doorkeeper::Errors::TokenRevoked, Doorkeeper::Errors::TokenUnknown
|
||||
#
|
||||
# handle_auth_errors :raise
|
||||
|
||||
# Customize token introspection response.
|
||||
# Allows to add your own fields to default one that are required by the OAuth spec
|
||||
# for the introspection response. It could be `sub`, `aud` and so on.
|
||||
# This configuration option can be a proc, lambda or any Ruby object responds
|
||||
# to `.call` method and result of it's invocation must be a Hash.
|
||||
#
|
||||
# custom_introspection_response do |token, context|
|
||||
# {
|
||||
# "sub": "Z5O3upPC88QrAjx00dis",
|
||||
# "aud": "https://protected.example.net/resource",
|
||||
# "username": User.find(token.resource_owner_id).username
|
||||
# }
|
||||
# end
|
||||
#
|
||||
# or
|
||||
#
|
||||
# custom_introspection_response CustomIntrospectionResponder
|
||||
|
||||
# Specify what grant flows are enabled in array of Strings. The valid
|
||||
# strings and the flows they enable are:
|
||||
#
|
||||
# "authorization_code" => Authorization Code Grant Flow
|
||||
# "implicit" => Implicit Grant Flow
|
||||
# "password" => Resource Owner Password Credentials Grant Flow
|
||||
# "client_credentials" => Client Credentials Grant Flow
|
||||
#
|
||||
# If not specified, Doorkeeper enables authorization_code and
|
||||
# client_credentials.
|
||||
#
|
||||
# implicit and password grant flows have risks that you should understand
|
||||
# before enabling:
|
||||
# https://datatracker.ietf.org/doc/html/rfc6819#section-4.4.2
|
||||
# https://datatracker.ietf.org/doc/html/rfc6819#section-4.4.3
|
||||
#
|
||||
#
|
||||
grant_flows %w[authorization_code client_credentials password]
|
||||
|
||||
# Allows to customize OAuth grant flows that +each+ application support.
|
||||
# You can configure a custom block (or use a class respond to `#call`) that must
|
||||
# return `true` in case Application instance supports requested OAuth grant flow
|
||||
# during the authorization request to the server. This configuration +doesn't+
|
||||
# set flows per application, it only allows to check if application supports
|
||||
# specific grant flow.
|
||||
#
|
||||
# For example you can add an additional database column to `oauth_applications` table,
|
||||
# say `t.array :grant_flows, default: []`, and store allowed grant flows that can
|
||||
# be used with this application there. Then when authorization requested Doorkeeper
|
||||
# will call this block to check if specific Application (passed with client_id and/or
|
||||
# client_secret) is allowed to perform the request for the specific grant type
|
||||
# (authorization, password, client_credentials, etc).
|
||||
#
|
||||
# Example of the block:
|
||||
#
|
||||
# ->(flow, client) { client.grant_flows.include?(flow) }
|
||||
#
|
||||
# In case this option invocation result is `false`, Doorkeeper server returns
|
||||
# :unauthorized_client error and stops the request.
|
||||
#
|
||||
# @param allow_grant_flow_for_client [Proc] Block or any object respond to #call
|
||||
# @return [Boolean] `true` if allow or `false` if forbid the request
|
||||
#
|
||||
# allow_grant_flow_for_client do |grant_flow, client|
|
||||
# # `grant_flows` is an Array column with grant
|
||||
# # flows that application supports
|
||||
#
|
||||
# client.grant_flows.include?(grant_flow)
|
||||
# end
|
||||
|
||||
# If you need arbitrary Resource Owner-Client authorization you can enable this option
|
||||
# and implement the check your need. Config option must respond to #call and return
|
||||
# true in case resource owner authorized for the specific application or false in other
|
||||
# cases.
|
||||
#
|
||||
# Be default all Resource Owners are authorized to any Client (application).
|
||||
#
|
||||
# authorize_resource_owner_for_client do |client, resource_owner|
|
||||
# resource_owner.admin? || client.owners_allowlist.include?(resource_owner)
|
||||
# end
|
||||
|
||||
# Hook into the strategies' request & response life-cycle in case your
|
||||
# application needs advanced customization or logging:
|
||||
#
|
||||
# before_successful_strategy_response do |request|
|
||||
# puts "BEFORE HOOK FIRED! #{request}"
|
||||
# end
|
||||
#
|
||||
# after_successful_strategy_response do |request, response|
|
||||
# puts "AFTER HOOK FIRED! #{request}, #{response}"
|
||||
# end
|
||||
|
||||
# Hook into Authorization flow in order to implement Single Sign Out
|
||||
# or add any other functionality. Inside the block you have an access
|
||||
# to `controller` (authorizations controller instance) and `context`
|
||||
# (Doorkeeper::OAuth::Hooks::Context instance) which provides pre auth
|
||||
# or auth objects with issued token based on hook type (before or after).
|
||||
#
|
||||
# before_successful_authorization do |controller, context|
|
||||
# Rails.logger.info(controller.request.params.inspect)
|
||||
#
|
||||
# Rails.logger.info(context.pre_auth.inspect)
|
||||
# end
|
||||
#
|
||||
# after_successful_authorization do |controller, context|
|
||||
# controller.session[:logout_urls] <<
|
||||
# Doorkeeper::Application
|
||||
# .find_by(controller.request.params.slice(:redirect_uri))
|
||||
# .logout_uri
|
||||
#
|
||||
# Rails.logger.info(context.auth.inspect)
|
||||
# Rails.logger.info(context.issued_token)
|
||||
# end
|
||||
|
||||
# Under some circumstances you might want to have applications auto-approved,
|
||||
# so that the user skips the authorization step.
|
||||
# For example if dealing with a trusted application.
|
||||
#
|
||||
# skip_authorization do |resource_owner, client|
|
||||
# client.superapp? or resource_owner.admin?
|
||||
# end
|
||||
|
||||
# Configure custom constraints for the Token Introspection request.
|
||||
# By default this configuration option allows to introspect a token by another
|
||||
# token of the same application, OR to introspect the token that belongs to
|
||||
# authorized client (from authenticated client) OR when token doesn't
|
||||
# belong to any client (public token). Otherwise requester has no access to the
|
||||
# introspection and it will return response as stated in the RFC.
|
||||
#
|
||||
# Block arguments:
|
||||
#
|
||||
# @param token [Doorkeeper::AccessToken]
|
||||
# token to be introspected
|
||||
#
|
||||
# @param authorized_client [Doorkeeper::Application]
|
||||
# authorized client (if request is authorized using Basic auth with
|
||||
# Client Credentials for example)
|
||||
#
|
||||
# @param authorized_token [Doorkeeper::AccessToken]
|
||||
# Bearer token used to authorize the request
|
||||
#
|
||||
# In case the block returns `nil` or `false` introspection responses with 401 status code
|
||||
# when using authorized token to introspect, or you'll get 200 with { "active": false } body
|
||||
# when using authorized client to introspect as stated in the
|
||||
# RFC 7662 section 2.2. Introspection Response.
|
||||
#
|
||||
# Using with caution:
|
||||
# Keep in mind that these three parameters pass to block can be nil as following case:
|
||||
# `authorized_client` is nil if and only if `authorized_token` is present, and vice versa.
|
||||
# `token` will be nil if and only if `authorized_token` is present.
|
||||
# So remember to use `&` or check if it is present before calling method on
|
||||
# them to make sure you doesn't get NoMethodError exception.
|
||||
#
|
||||
# You can define your custom check:
|
||||
#
|
||||
# allow_token_introspection do |token, authorized_client, authorized_token|
|
||||
# if authorized_token
|
||||
# # customize: require `introspection` scope
|
||||
# authorized_token.application == token&.application ||
|
||||
# authorized_token.scopes.include?("introspection")
|
||||
# elsif token.application
|
||||
# # `protected_resource` is a new database boolean column, for example
|
||||
# authorized_client == token.application || authorized_client.protected_resource?
|
||||
# else
|
||||
# # public token (when token.application is nil, token doesn't belong to any application)
|
||||
# true
|
||||
# end
|
||||
# end
|
||||
#
|
||||
# Or you can completely disable any token introspection:
|
||||
#
|
||||
# allow_token_introspection false
|
||||
#
|
||||
# If you need to block the request at all, then configure your routes.rb or web-server
|
||||
# like nginx to forbid the request.
|
||||
|
||||
# WWW-Authenticate Realm (default: "Doorkeeper").
|
||||
#
|
||||
# realm "Doorkeeper"
|
||||
end
|
||||
|
||||
|
||||
Doorkeeper::JWT.configure do
|
||||
# Set the payload for the JWT token. This should contain unique information
|
||||
# about the user. Defaults to a randomly generated token in a hash:
|
||||
# { token: "RANDOM-TOKEN" }
|
||||
token_payload do |opts|
|
||||
user = User.find(opts[:resource_owner_id])
|
||||
|
||||
{
|
||||
iss: 'My App',
|
||||
iat: Time.current.utc.to_i,
|
||||
|
||||
# @see JWT reserved claims - https://tools.ietf.org/html/draft-jones-json-web-token-07#page-7
|
||||
jti: SecureRandom.uuid,
|
||||
|
||||
user: {
|
||||
id: user.id,
|
||||
login: user.login,
|
||||
mail: user.mail
|
||||
}
|
||||
}
|
||||
end
|
||||
|
||||
# Optionally set additional headers for the JWT. See
|
||||
# https://tools.ietf.org/html/rfc7515#section-4.1
|
||||
token_headers do |opts|
|
||||
{ kid: opts[:application][:uid] }
|
||||
end
|
||||
|
||||
# Use the application secret specified in the access grant token. Defaults to
|
||||
# `false`. If you specify `use_application_secret true`, both `secret_key` and
|
||||
# `secret_key_path` will be ignored.
|
||||
use_application_secret false
|
||||
|
||||
# Set the encryption secret. This would be shared with any other applications
|
||||
# that should be able to read the payload of the token. Defaults to "secret".
|
||||
secret_key ENV['JWT_SECRET']
|
||||
|
||||
# If you want to use RS* encoding specify the path to the RSA key to use for
|
||||
# signing. If you specify a `secret_key_path` it will be used instead of
|
||||
# `secret_key`.
|
||||
secret_key_path File.join('path', 'to', 'file.pem')
|
||||
|
||||
# Specify encryption type (https://github.com/progrium/ruby-jwt). Defaults to
|
||||
# `nil`.
|
||||
encryption_method :hs512
|
||||
end
|
||||
|
|
@ -0,0 +1,151 @@
|
|||
en:
|
||||
activerecord:
|
||||
attributes:
|
||||
doorkeeper/application:
|
||||
name: 'Name'
|
||||
redirect_uri: 'Redirect URI'
|
||||
errors:
|
||||
models:
|
||||
doorkeeper/application:
|
||||
attributes:
|
||||
redirect_uri:
|
||||
fragment_present: 'cannot contain a fragment.'
|
||||
invalid_uri: 'must be a valid URI.'
|
||||
unspecified_scheme: 'must specify a scheme.'
|
||||
relative_uri: 'must be an absolute URI.'
|
||||
secured_uri: 'must be an HTTPS/SSL URI.'
|
||||
forbidden_uri: 'is forbidden by the server.'
|
||||
scopes:
|
||||
not_match_configured: "doesn't match configured on the server."
|
||||
|
||||
doorkeeper:
|
||||
applications:
|
||||
confirmations:
|
||||
destroy: 'Are you sure?'
|
||||
buttons:
|
||||
edit: 'Edit'
|
||||
destroy: 'Destroy'
|
||||
submit: 'Submit'
|
||||
cancel: 'Cancel'
|
||||
authorize: 'Authorize'
|
||||
form:
|
||||
error: 'Whoops! Check your form for possible errors'
|
||||
help:
|
||||
confidential: 'Application will be used where the client secret can be kept confidential. Native mobile apps and Single Page Apps are considered non-confidential.'
|
||||
redirect_uri: 'Use one line per URI'
|
||||
blank_redirect_uri: "Leave it blank if you configured your provider to use Client Credentials, Resource Owner Password Credentials or any other grant type that doesn't require redirect URI."
|
||||
scopes: 'Separate scopes with spaces. Leave blank to use the default scopes.'
|
||||
edit:
|
||||
title: 'Edit application'
|
||||
index:
|
||||
title: 'Your applications'
|
||||
new: 'New Application'
|
||||
name: 'Name'
|
||||
callback_url: 'Callback URL'
|
||||
confidential: 'Confidential?'
|
||||
actions: 'Actions'
|
||||
confidentiality:
|
||||
'yes': 'Yes'
|
||||
'no': 'No'
|
||||
new:
|
||||
title: 'New Application'
|
||||
show:
|
||||
title: 'Application: %{name}'
|
||||
application_id: 'UID'
|
||||
secret: 'Secret'
|
||||
secret_hashed: 'Secret hashed'
|
||||
scopes: 'Scopes'
|
||||
confidential: 'Confidential'
|
||||
callback_urls: 'Callback urls'
|
||||
actions: 'Actions'
|
||||
not_defined: 'Not defined'
|
||||
|
||||
authorizations:
|
||||
buttons:
|
||||
authorize: 'Authorize'
|
||||
deny: 'Deny'
|
||||
error:
|
||||
title: 'An error has occurred'
|
||||
new:
|
||||
title: 'Authorization required'
|
||||
prompt: 'Authorize %{client_name} to use your account?'
|
||||
able_to: 'This application will be able to'
|
||||
show:
|
||||
title: 'Authorization code'
|
||||
form_post:
|
||||
title: 'Submit this form'
|
||||
|
||||
authorized_applications:
|
||||
confirmations:
|
||||
revoke: 'Are you sure?'
|
||||
buttons:
|
||||
revoke: 'Revoke'
|
||||
index:
|
||||
title: 'Your authorized applications'
|
||||
application: 'Application'
|
||||
created_at: 'Created At'
|
||||
date_format: '%Y-%m-%d %H:%M:%S'
|
||||
|
||||
pre_authorization:
|
||||
status: 'Pre-authorization'
|
||||
|
||||
errors:
|
||||
messages:
|
||||
# Common error messages
|
||||
invalid_request:
|
||||
unknown: 'The request is missing a required parameter, includes an unsupported parameter value, or is otherwise malformed.'
|
||||
missing_param: 'Missing required parameter: %{value}.'
|
||||
request_not_authorized: 'Request need to be authorized. Required parameter for authorizing request is missing or invalid.'
|
||||
invalid_redirect_uri: "The requested redirect uri is malformed or doesn't match client redirect URI."
|
||||
unauthorized_client: 'The client is not authorized to perform this request using this method.'
|
||||
access_denied: 'The resource owner or authorization server denied the request.'
|
||||
invalid_scope: 'The requested scope is invalid, unknown, or malformed.'
|
||||
invalid_code_challenge_method: 'The code challenge method must be plain or S256.'
|
||||
server_error: 'The authorization server encountered an unexpected condition which prevented it from fulfilling the request.'
|
||||
temporarily_unavailable: 'The authorization server is currently unable to handle the request due to a temporary overloading or maintenance of the server.'
|
||||
|
||||
# Configuration error messages
|
||||
credential_flow_not_configured: 'Resource Owner Password Credentials flow failed due to Doorkeeper.configure.resource_owner_from_credentials being unconfigured.'
|
||||
resource_owner_authenticator_not_configured: 'Resource Owner find failed due to Doorkeeper.configure.resource_owner_authenticator being unconfigured.'
|
||||
admin_authenticator_not_configured: 'Access to admin panel is forbidden due to Doorkeeper.configure.admin_authenticator being unconfigured.'
|
||||
|
||||
# Access grant errors
|
||||
unsupported_response_type: 'The authorization server does not support this response type.'
|
||||
unsupported_response_mode: 'The authorization server does not support this response mode.'
|
||||
|
||||
# Access token errors
|
||||
invalid_client: 'Client authentication failed due to unknown client, no client authentication included, or unsupported authentication method.'
|
||||
invalid_grant: 'The provided authorization grant is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client.'
|
||||
unsupported_grant_type: 'The authorization grant type is not supported by the authorization server.'
|
||||
|
||||
invalid_token:
|
||||
revoked: "The access token was revoked"
|
||||
expired: "The access token expired"
|
||||
unknown: "The access token is invalid"
|
||||
revoke:
|
||||
unauthorized: "You are not authorized to revoke this token"
|
||||
|
||||
forbidden_token:
|
||||
missing_scope: 'Access to this resource requires scope "%{oauth_scopes}".'
|
||||
|
||||
flash:
|
||||
applications:
|
||||
create:
|
||||
notice: 'Application created.'
|
||||
destroy:
|
||||
notice: 'Application deleted.'
|
||||
update:
|
||||
notice: 'Application updated.'
|
||||
authorized_applications:
|
||||
destroy:
|
||||
notice: 'Application revoked.'
|
||||
|
||||
layouts:
|
||||
admin:
|
||||
title: 'Doorkeeper'
|
||||
nav:
|
||||
oauth2_provider: 'OAuth2 Provider'
|
||||
applications: 'Applications'
|
||||
home: 'Home'
|
||||
application:
|
||||
title: 'OAuth authorization required'
|
||||
|
|
@ -0,0 +1,126 @@
|
|||
zh-CN:
|
||||
activerecord:
|
||||
attributes:
|
||||
doorkeeper/application:
|
||||
name: '名称'
|
||||
redirect_uri: '登录回调地址'
|
||||
scopes: '权限范围'
|
||||
errors:
|
||||
models:
|
||||
doorkeeper/application:
|
||||
attributes:
|
||||
redirect_uri:
|
||||
fragment_present: '不能包含片段（#）'
|
||||
invalid_uri: '必须是有效的 URL 格式'
|
||||
relative_uri: '必须是绝对的 URL 地址'
|
||||
secured_uri: '必须是 HTTPS/SSL 的 URL 地址'
|
||||
|
||||
doorkeeper:
|
||||
applications:
|
||||
confirmations:
|
||||
destroy: '确定要删除应用吗？'
|
||||
buttons:
|
||||
edit: '编辑'
|
||||
destroy: '删除'
|
||||
submit: '提交'
|
||||
cancel: '取消'
|
||||
authorize: '授权'
|
||||
form:
|
||||
error: '抱歉! 提交信息的时候遇到了下面的错误'
|
||||
help:
|
||||
redirect_uri: '每行只能有一个 URL'
|
||||
native_redirect_uri: '使用 %{native_redirect_uri} 作为本地测试'
|
||||
scopes: '用空格隔开权限范围，留空则使用默认设置'
|
||||
edit:
|
||||
title: '修改应用'
|
||||
index:
|
||||
title: '你的应用'
|
||||
new: '创建新应用'
|
||||
name: '名称'
|
||||
callback_url: '登录回调地址'
|
||||
new:
|
||||
title: '创建新应用'
|
||||
show:
|
||||
title: '应用：%{name}'
|
||||
application_id: '应用 ID'
|
||||
secret: '私钥'
|
||||
scopes: '权限范围'
|
||||
callback_urls: '登录回调地址'
|
||||
confidential: 'Confidential'
|
||||
actions: '操作'
|
||||
|
||||
authorizations:
|
||||
buttons:
|
||||
authorize: '授权'
|
||||
deny: '拒绝'
|
||||
error:
|
||||
title: '存在错误'
|
||||
new:
|
||||
title: '需要你授权'
|
||||
prompt: '授权 %{client_name} 使用你的帐号?'
|
||||
able_to: '此应用将会'
|
||||
show:
|
||||
title: '授权码'
|
||||
|
||||
authorized_applications:
|
||||
confirmations:
|
||||
revoke: '确定要注销此应用的认证信息吗?'
|
||||
buttons:
|
||||
revoke: '注销'
|
||||
index:
|
||||
title: '你授权的应用列表'
|
||||
application: '应用'
|
||||
created_at: '授权时间'
|
||||
date_format: '%Y-%m-%d %H:%M:%S'
|
||||
|
||||
errors:
|
||||
messages:
|
||||
# Common error messages
|
||||
invalid_request: '这个请求缺少必要的参数，或者参数值、格式不正确'
|
||||
invalid_redirect_uri: '无效的登录回调地址'
|
||||
unauthorized_client: '未授权的应用，请求无法执行'
|
||||
access_denied: '用户或服务器拒绝了请求'
|
||||
invalid_scope: '请求范围无效、未知或格式不正确'
|
||||
server_error: '服务器异常，无法处理请求'
|
||||
temporarily_unavailable: '服务器维护中或负载过高，暂时无法处理请求'
|
||||
|
||||
#configuration error messages
|
||||
credential_flow_not_configured: 'Resource Owner Password Credentials flow failed，原因是 Doorkeeper.configure.resource_owner_from_credentials 尚未设置。'
|
||||
resource_owner_authenticator_not_configured: 'Resource Owner find failed，原因是 Doorkeeper.configure.resource_owner_authenticator 尚未设置。'
|
||||
|
||||
# Access grant errors
|
||||
unsupported_response_type: '服务器不支持这种响应类型'
|
||||
|
||||
# Access token errors
|
||||
invalid_client: '由于未知、不支持或没有客户端，认证失败'
|
||||
invalid_grant: '授权方式无效，或者登录回调地址无效、过期或已被撤销'
|
||||
unsupported_grant_type: '服务器不支持此类型的授权方式'
|
||||
|
||||
# Password Access token errors
|
||||
invalid_resource_owner: '资源所有者认证无效或没有所有者'
|
||||
|
||||
invalid_token:
|
||||
revoked: "访问令牌已被吊销"
|
||||
expired: "访问令牌已过期"
|
||||
unknown: "访问令牌无效"
|
||||
|
||||
flash:
|
||||
applications:
|
||||
create:
|
||||
notice: '应用创建成功'
|
||||
destroy:
|
||||
notice: '应用删除成功'
|
||||
update:
|
||||
notice: '应用修改成功'
|
||||
authorized_applications:
|
||||
destroy:
|
||||
notice: '已成功注销了应用的认证信息'
|
||||
|
||||
layouts:
|
||||
admin:
|
||||
nav:
|
||||
oauth2_provider: 'OAuth2 提供商'
|
||||
applications: '应用'
|
||||
home: '首页'
|
||||
application:
|
||||
title: 'OAuth 认证'
|
||||
|
|
@ -1,5 +1,6 @@
|
|||
Rails.application.routes.draw do
|
||||
|
||||
use_doorkeeper
|
||||
require 'sidekiq/web'
|
||||
require 'sidekiq/cron/web'
|
||||
require 'admin_constraint'
|
||||
|
|
|
|||
|
|
@ -0,0 +1,88 @@
|
|||
# frozen_string_literal: true
|
||||
|
||||
class CreateDoorkeeperTables < ActiveRecord::Migration[5.2]
|
||||
def change
|
||||
create_table :oauth_applications do |t|
|
||||
t.string :name, null: false
|
||||
t.string :uid, null: false
|
||||
t.string :secret, null: false
|
||||
|
||||
# Remove `null: false` if you are planning to use grant flows
|
||||
# that doesn't require redirect URI to be used during authorization
|
||||
# like Client Credentials flow or Resource Owner Password.
|
||||
t.text :redirect_uri, null: false
|
||||
t.string :scopes, null: false, default: ''
|
||||
t.boolean :confidential, null: false, default: true
|
||||
t.timestamps null: false
|
||||
end
|
||||
|
||||
add_index :oauth_applications, :uid, unique: true
|
||||
|
||||
create_table :oauth_access_grants do |t|
|
||||
t.references :resource_owner, null: false
|
||||
t.references :application, null: false
|
||||
t.string :token, null: false
|
||||
t.integer :expires_in, null: false
|
||||
t.text :redirect_uri, null: false
|
||||
t.datetime :created_at, null: false
|
||||
t.datetime :revoked_at
|
||||
t.string :scopes, null: false, default: ''
|
||||
end
|
||||
|
||||
add_index :oauth_access_grants, :token, unique: true
|
||||
add_foreign_key(
|
||||
:oauth_access_grants,
|
||||
:oauth_applications,
|
||||
column: :application_id
|
||||
)
|
||||
|
||||
create_table :oauth_access_tokens do |t|
|
||||
t.references :resource_owner, index: true
|
||||
|
||||
# Remove `null: false` if you are planning to use Password
|
||||
# Credentials Grant flow that doesn't require an application.
|
||||
t.references :application, null: false
|
||||
|
||||
# If you use a custom token generator you may need to change this column
|
||||
# from string to text, so that it accepts tokens larger than 255
|
||||
# characters. More info on custom token generators in:
|
||||
# https://github.com/doorkeeper-gem/doorkeeper/tree/v3.0.0.rc1#custom-access-token-generator
|
||||
#
|
||||
# t.text :token, null: false
|
||||
t.string :token, null: false
|
||||
|
||||
t.string :refresh_token
|
||||
t.integer :expires_in
|
||||
t.datetime :revoked_at
|
||||
t.datetime :created_at, null: false
|
||||
t.string :scopes
|
||||
|
||||
# The authorization server MAY issue a new refresh token, in which case
|
||||
# *the client MUST discard the old refresh token* and replace it with the
|
||||
# new refresh token. The authorization server MAY revoke the old
|
||||
# refresh token after issuing a new refresh token to the client.
|
||||
# @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
|
||||
#
|
||||
# Doorkeeper implementation: if there is a `previous_refresh_token` column,
|
||||
# refresh tokens will be revoked after a related access token is used.
|
||||
# If there is no `previous_refresh_token` column, previous tokens are
|
||||
# revoked as soon as a new access token is created.
|
||||
#
|
||||
# Comment out this line if you want refresh tokens to be instantly
|
||||
# revoked after use.
|
||||
t.string :previous_refresh_token, null: false, default: ""
|
||||
end
|
||||
|
||||
add_index :oauth_access_tokens, :token, unique: true
|
||||
add_index :oauth_access_tokens, :refresh_token, unique: true
|
||||
add_foreign_key(
|
||||
:oauth_access_tokens,
|
||||
:oauth_applications,
|
||||
column: :application_id
|
||||
)
|
||||
|
||||
# Uncomment below to ensure a valid reference to the resource owner's table
|
||||
# add_foreign_key :oauth_access_grants, <model>, column: :resource_owner_id
|
||||
# add_foreign_key :oauth_access_tokens, <model>, column: :resource_owner_id
|
||||
end
|
||||
end
|
||||
Loading…
Reference in New Issue