Chris@909: require 'uri'
Chris@909: require 'openid/extensions/sreg'
Chris@909: require 'openid/extensions/ax'
Chris@909: require 'openid/store/filesystem'
Chris@909: 
Chris@909: require File.dirname(__FILE__) + '/open_id_authentication/db_store'
Chris@909: require File.dirname(__FILE__) + '/open_id_authentication/mem_cache_store'
Chris@909: require File.dirname(__FILE__) + '/open_id_authentication/request'
Chris@909: require File.dirname(__FILE__) + '/open_id_authentication/timeout_fixes' if OpenID::VERSION == "2.0.4"
Chris@909: 
Chris@909: module OpenIdAuthentication
Chris@909:   OPEN_ID_AUTHENTICATION_DIR = RAILS_ROOT + "/tmp/openids"
Chris@909: 
Chris@909:   def self.store
Chris@909:     @@store
Chris@909:   end
Chris@909: 
Chris@909:   def self.store=(*store_option)
Chris@909:     store, *parameters = *([ store_option ].flatten)
Chris@909: 
Chris@909:     @@store = case store
Chris@909:     when :db
Chris@909:       OpenIdAuthentication::DbStore.new
Chris@909:     when :mem_cache
Chris@909:       OpenIdAuthentication::MemCacheStore.new(*parameters)
Chris@909:     when :file
Chris@909:       OpenID::Store::Filesystem.new(OPEN_ID_AUTHENTICATION_DIR)
Chris@909:     else
Chris@909:       raise "Unknown store: #{store}"
Chris@909:     end
Chris@909:   end
Chris@909: 
Chris@909:   self.store = :db
Chris@909: 
Chris@909:   class InvalidOpenId < StandardError
Chris@909:   end
Chris@909: 
Chris@909:   class Result
Chris@909:     ERROR_MESSAGES = {
Chris@909:       :missing      => "Sorry, the OpenID server couldn't be found",
Chris@909:       :invalid      => "Sorry, but this does not appear to be a valid OpenID",
Chris@909:       :canceled     => "OpenID verification was canceled",
Chris@909:       :failed       => "OpenID verification failed",
Chris@909:       :setup_needed => "OpenID verification needs setup"
Chris@909:     }
Chris@909: 
Chris@909:     def self.[](code)
Chris@909:       new(code)
Chris@909:     end
Chris@909: 
Chris@909:     def initialize(code)
Chris@909:       @code = code
Chris@909:     end
Chris@909: 
Chris@909:     def status
Chris@909:       @code
Chris@909:     end
Chris@909: 
Chris@909:     ERROR_MESSAGES.keys.each { |state| define_method("#{state}?") { @code == state } }
Chris@909: 
Chris@909:     def successful?
Chris@909:       @code == :successful
Chris@909:     end
Chris@909: 
Chris@909:     def unsuccessful?
Chris@909:       ERROR_MESSAGES.keys.include?(@code)
Chris@909:     end
Chris@909: 
Chris@909:     def message
Chris@909:       ERROR_MESSAGES[@code]
Chris@909:     end
Chris@909:   end
Chris@909: 
Chris@909:   # normalizes an OpenID according to http://openid.net/specs/openid-authentication-2_0.html#normalization
Chris@909:   def self.normalize_identifier(identifier)
Chris@909:     # clean up whitespace
Chris@909:     identifier = identifier.to_s.strip
Chris@909: 
Chris@909:     # if an XRI has a prefix, strip it.
Chris@909:     identifier.gsub!(/xri:\/\//i, '')
Chris@909: 
Chris@909:     # dodge XRIs -- TODO: validate, don't just skip.
Chris@909:     unless ['=', '@', '+', '$', '!', '('].include?(identifier.at(0))
Chris@909:       # does it begin with http?  if not, add it.
Chris@909:       identifier = "http://#{identifier}" unless identifier =~ /^http/i
Chris@909: 
Chris@909:       # strip any fragments
Chris@909:       identifier.gsub!(/\#(.*)$/, '')
Chris@909: 
Chris@909:       begin
Chris@909:         uri = URI.parse(identifier)
Chris@909:         uri.scheme = uri.scheme.downcase if uri.scheme # URI should do this
Chris@909:         identifier = uri.normalize.to_s
Chris@909:       rescue URI::InvalidURIError
Chris@909:         raise InvalidOpenId.new("#{identifier} is not an OpenID identifier")
Chris@909:       end
Chris@909:     end
Chris@909: 
Chris@909:     return identifier
Chris@909:   end
Chris@909: 
Chris@909:   # deprecated for OpenID 2.0, where not all OpenIDs are URLs
Chris@909:   def self.normalize_url(url)
Chris@909:     ActiveSupport::Deprecation.warn "normalize_url has been deprecated, use normalize_identifier instead"
Chris@909:     self.normalize_identifier(url)
Chris@909:   end
Chris@909: 
Chris@909:   protected
Chris@909:     def normalize_url(url)
Chris@909:       OpenIdAuthentication.normalize_url(url)
Chris@909:     end
Chris@909: 
Chris@909:     def normalize_identifier(url)
Chris@909:       OpenIdAuthentication.normalize_identifier(url)
Chris@909:     end
Chris@909: 
Chris@909:     # The parameter name of "openid_identifier" is used rather than the Rails convention "open_id_identifier"
Chris@909:     # because that's what the specification dictates in order to get browser auto-complete working across sites
Chris@909:     def using_open_id?(identity_url = nil) #:doc:
Chris@909:       identity_url ||= params[:openid_identifier] || params[:openid_url]
Chris@909:       !identity_url.blank? || params[:open_id_complete]
Chris@909:     end
Chris@909: 
Chris@909:     def authenticate_with_open_id(identity_url = nil, options = {}, &block) #:doc:
Chris@909:       identity_url ||= params[:openid_identifier] || params[:openid_url]
Chris@909: 
Chris@909:       if params[:open_id_complete].nil?
Chris@909:         begin_open_id_authentication(identity_url, options, &block)
Chris@909:       else
Chris@909:         complete_open_id_authentication(&block)
Chris@909:       end
Chris@909:     end
Chris@909: 
Chris@909:   private
Chris@909:     def begin_open_id_authentication(identity_url, options = {})
Chris@909:       identity_url = normalize_identifier(identity_url)
Chris@909:       return_to    = options.delete(:return_to)
Chris@909:       method       = options.delete(:method)
Chris@909:       
Chris@909:       options[:required] ||= []  # reduces validation later
Chris@909:       options[:optional] ||= []
Chris@909: 
Chris@909:       open_id_request = open_id_consumer.begin(identity_url)
Chris@909:       add_simple_registration_fields(open_id_request, options)
Chris@909:       add_ax_fields(open_id_request, options)
Chris@909:       redirect_to(open_id_redirect_url(open_id_request, return_to, method))
Chris@909:     rescue OpenIdAuthentication::InvalidOpenId => e
Chris@909:       yield Result[:invalid], identity_url, nil
Chris@909:     rescue OpenID::OpenIDError, Timeout::Error => e
Chris@909:       logger.error("[OPENID] #{e}")
Chris@909:       yield Result[:missing], identity_url, nil
Chris@909:     end
Chris@909: 
Chris@909:     def complete_open_id_authentication
Chris@909:       params_with_path = params.reject { |key, value| request.path_parameters[key] }
Chris@909:       params_with_path.delete(:format)
Chris@909:       open_id_response = timeout_protection_from_identity_server { open_id_consumer.complete(params_with_path, requested_url) }
Chris@909:       identity_url     = normalize_identifier(open_id_response.display_identifier) if open_id_response.display_identifier
Chris@909: 
Chris@909:       case open_id_response.status
Chris@909:       when OpenID::Consumer::SUCCESS
Chris@909:         profile_data = {}
Chris@909: 
Chris@909:         # merge the SReg data and the AX data into a single hash of profile data
Chris@909:         [ OpenID::SReg::Response, OpenID::AX::FetchResponse ].each do |data_response|
Chris@909:           if data_response.from_success_response( open_id_response )
Chris@909:             profile_data.merge! data_response.from_success_response( open_id_response ).data
Chris@909:           end
Chris@909:         end
Chris@909:         
Chris@909:         yield Result[:successful], identity_url, profile_data
Chris@909:       when OpenID::Consumer::CANCEL
Chris@909:         yield Result[:canceled], identity_url, nil
Chris@909:       when OpenID::Consumer::FAILURE
Chris@909:         yield Result[:failed], identity_url, nil
Chris@909:       when OpenID::Consumer::SETUP_NEEDED
Chris@909:         yield Result[:setup_needed], open_id_response.setup_url, nil
Chris@909:       end
Chris@909:     end
Chris@909: 
Chris@909:     def open_id_consumer
Chris@909:       OpenID::Consumer.new(session, OpenIdAuthentication.store)
Chris@909:     end
Chris@909: 
Chris@909:     def add_simple_registration_fields(open_id_request, fields)
Chris@909:       sreg_request = OpenID::SReg::Request.new
Chris@909:       
Chris@909:       # filter out AX identifiers (URIs)
Chris@909:       required_fields = fields[:required].collect { |f| f.to_s unless f =~ /^https?:\/\// }.compact
Chris@909:       optional_fields = fields[:optional].collect { |f| f.to_s unless f =~ /^https?:\/\// }.compact
Chris@909:       
Chris@909:       sreg_request.request_fields(required_fields, true) unless required_fields.blank?
Chris@909:       sreg_request.request_fields(optional_fields, false) unless optional_fields.blank?
Chris@909:       sreg_request.policy_url = fields[:policy_url] if fields[:policy_url]
Chris@909:       open_id_request.add_extension(sreg_request)
Chris@909:     end
Chris@909:     
Chris@909:     def add_ax_fields( open_id_request, fields )
Chris@909:       ax_request = OpenID::AX::FetchRequest.new
Chris@909:       
Chris@909:       # look through the :required and :optional fields for URIs (AX identifiers)
Chris@909:       fields[:required].each do |f|
Chris@909:         next unless f =~ /^https?:\/\//
Chris@909:         ax_request.add( OpenID::AX::AttrInfo.new( f, nil, true ) )
Chris@909:       end
Chris@909: 
Chris@909:       fields[:optional].each do |f|
Chris@909:         next unless f =~ /^https?:\/\//
Chris@909:         ax_request.add( OpenID::AX::AttrInfo.new( f, nil, false ) )
Chris@909:       end
Chris@909:       
Chris@909:       open_id_request.add_extension( ax_request )
Chris@909:     end
Chris@909:         
Chris@909:     def open_id_redirect_url(open_id_request, return_to = nil, method = nil)
Chris@909:       open_id_request.return_to_args['_method'] = (method || request.method).to_s
Chris@909:       open_id_request.return_to_args['open_id_complete'] = '1'
Chris@909:       open_id_request.redirect_url(root_url, return_to || requested_url)
Chris@909:     end
Chris@909: 
Chris@909:     def requested_url
Chris@909:       relative_url_root = self.class.respond_to?(:relative_url_root) ?
Chris@909:         self.class.relative_url_root.to_s :
Chris@909:         request.relative_url_root
Chris@909:       "#{request.protocol}#{request.host_with_port}#{relative_url_root}#{request.path}"
Chris@909:     end
Chris@909: 
Chris@909:     def timeout_protection_from_identity_server
Chris@909:       yield
Chris@909:     rescue Timeout::Error
Chris@909:       Class.new do
Chris@909:         def status
Chris@909:           OpenID::FAILURE
Chris@909:         end
Chris@909: 
Chris@909:         def msg
Chris@909:           "Identity server timed out"
Chris@909:         end
Chris@909:       end.new
Chris@909:     end
Chris@909: end