github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-30 07:11:34 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FEATURE: Make auth_redirect param options on user_api_keys

Browse Source 
This is a possible solution for https://meta.discourse.org/t/user-api-keys-specification/48536/19
This allows for user-api-key requests to not require a redirect url.
Instead, the encypted payload will just be displayed after creation  ( which can be copied
pasted into an env for a CLI, for example  )

Also: Show instructions when creating user-api-key w/out redirect

This adds a view to show instructions when requesting a user-api-key
without a redirect. It adds a erb template and json format.
Also adds a i18n user_api_key.instructions for server.en.yml
This commit is contained in:
cfitz
2019-01-04 04:46:18 +01:00
committed by Sam
parent d0f38dbb07
commit 19d7545318
5 changed files with 56 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
app/controllers/user_api_keys_controller.rb
View File

@ -51,9 +51,9 @@ class UserApiKeysController < ApplicationController
require_params
unless SiteSetting.allowed_user_api_auth_redirects
if params.key?(:auth_redirect) && SiteSetting.allowed_user_api_auth_redirects
.split('|')
.any? { |u| params[:auth_redirect] == u }
.none? { |u| params[:auth_redirect] == u }
raise Discourse::InvalidAccess
end
@ -61,12 +61,13 @@ class UserApiKeysController < ApplicationController
raise Discourse::InvalidAccess unless meets_tl?
validate_params
@application_name = params[:application_name]
# destroy any old keys we had
UserApiKey.where(user_id: current_user.id, client_id: params[:client_id]).destroy_all
key = UserApiKey.create!(
application_name: params[:application_name],
application_name: @application_name,
client_id: params[:client_id],
user_id: current_user.id,
push_url: params[:push_url],
@ -76,7 +77,7 @@ class UserApiKeysController < ApplicationController
# we keep the payload short so it encrypts easily with public key
# it is often restricted to 128 chars
payload = {
@payload = {
key: key.key,
nonce: params[:nonce],
push: key.has_push?,
@ -84,9 +85,19 @@ class UserApiKeysController < ApplicationController
}.to_json
public_key = OpenSSL::PKey::RSA.new(params[:public_key])
payload = Base64.encode64(public_key.public_encrypt(payload))
@payload = Base64.encode64(public_key.public_encrypt(@payload))
redirect_to "#{params[:auth_redirect]}?payload=#{CGI.escape(payload)}"
if params[:auth_redirect]
redirect_to("#{params[:auth_redirect]}?payload=#{CGI.escape(@payload)}")
else
respond_to do |format|
format.html { render :show }
format.json do
instructions = I18n.t("user_api_key.instructions", application_name: @application_name)
render json: { payload: @payload, instructions: instructions }
end
end
end
end
def revoke
@ -124,7 +135,6 @@ class UserApiKeysController < ApplicationController
:nonce,
:scopes,
:client_id,
:auth_redirect,
:application_name
].each { |p| params.require(p) }
end