snoopdave opened a new pull request, #165:
URL: https://github.com/apache/roller/pull/165
The OAuth 1.0a consent step should authorize the user who is signed in, the
way
the rest of Roller's admin and editor UI resolves identity from the session.
This change moves it onto that model and tightens request-token approval
into a
single conditional update.
## What changed
- Derive the authorizing identity from the Roller session and require an
enabled
user. A request with no session goes through the normal login flow.
- Keep the bound-consumer check, comparing against the session user.
- For backwards compatibility, a `userId` / `xoauth_requestor_id` request
parameter is still accepted when it agrees with the session user, and
rejected otherwise; it is not used to choose the identity.
- Approve the request token with one conditional update — success is defined
as
exactly one row changed — rather than a separate load then store, so
approval
is one-shot.
- Return a single `oauth_problem=permission_denied` (403) for every refusal,
so
the response does not vary with the reason.
- Deprecate `markAsAuthorized` in favour of `authorizeRequestToken`.
## Tests
`AuthorizationServletTest` covers identity taken from the session, a
mismatched
`userId` parameter, disabled accounts, the bound-consumer refusal, and the
generic refusal path. `JPAOAuthManagerTest` exercises the conditional update
against Derby: a mismatched token changes no row, the exact pending token
succeeds once, and a second use of the same token changes no row.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
