node-oauth2-server - npm Package Compare versions

Comparing version 2.0.0-beta3 to 2.0.0-beta5

examples/postgresql/model.js

@@ -30,2 +30,3 @@ /**
 				'WHERE access_token = $1', [bearerToken], function (err, result) {
+			if (err || !result.rowCount) return callback(err);
 			// This object will be exposed in req.oauth.token
@@ -35,3 +36,9 @@ // The user_id field will be exposed in req.user (req.user = { id: "..." }) however if
 			// in req.user instead
-			callback(err, result.rowCount ? result.rows[0] : false);
+			var token = result.rows[0];
+			callback(null, {
+				accessToken: token.access_token,
+				clientId: token.client_id,
+				expires: token.expires,
+				userId: token.userId
+			});
 			done();
@@ -45,7 +52,16 @@ });
 		if (err) return callback(err);
+
 		client.query('SELECT client_id, client_secret, redirect_uri FROM oauth_clients WHERE ' +
-				'client_id = $1 AND client_secret = $2', [clientId, clientSecret],
-				function (err, result) {
+			'client_id = $1', [clientId], function (err, result) {
+			if (err || !result.rowCount) return callback(err);
+
+			var client = result.rows[0];
+
+			if (clientSecret !== null && client.client_secret !== clientSecret) return callback();
+
 			// This object will be exposed in req.oauth.client
-			callback(err, result.rowCount ? result.rows[0] : false);
+			callback(null, {
+				clientId: client.client_id,
+				clientSecret: client.client_secret
+			});
 			done();
@@ -103,2 +119,2 @@ });
 	});
-};
+};

lib/authCodeGrant.js

@@ -56,3 +56,3 @@ /**
       // Custom redirect error handler
-      return res.redirect(self.client.redirect_uri + '?error=' + err.error +
+      return res.redirect(self.client.redirectUri + '?error=' + err.error +
         '&error_description=' + err.error_description + '&code=' + err.code);
@@ -89,4 +89,4 @@ }
   // Redirect URI
-  this.redirectURI = this.req.body.redirect_uri;
-  if (!this.redirectURI) {
+  this.redirectUri = this.req.body.redirect_uri;
+  if (!this.redirectUri) {
     return done(error('invalid_request',
@@ -107,3 +107,3 @@ 'Invalid or missing redirect_uri parameter'));
   var self = this;
-  this.model.getClient(this.clientId, function (err, client) {
+  this.model.getClient(this.clientId, null, function (err, client) {
     if (err) return done(error('server_error', false, err));
@@ -113,3 +113,3 @@
       return done(error('invalid_client', 'Invalid client credentials'));
-    } else if (client.redirect_uri !== self.redirectURI) {
+    } else if (client.redirectUri !== self.redirectUri) {
       return done(error('invalid_request', 'redirect_uri does not match'));
@@ -172,10 +172,4 @@ }
 
-  var data = {
-    auth_code: this.authCode,
-    client_id: this.client.client_id,
-    expires: expires,
-    user: this.user
-  };
-
-  this.model.saveAuthCode(data, function (err) {
+  this.model.saveAuthCode(this.authCode, this.client.clientId, expires,
+      this.user, function (err) {
     if (err) return done(error('server_error', false, err));
@@ -193,3 +187,3 @@ done();
 function redirect (done) {
-  this.res.redirect(this.client.redirect_uri + '?code=' + this.authCode);
+  this.res.redirect(this.client.redirectUri + '?code=' + this.authCode);
 }

lib/authorise.js

@@ -59,3 +59,3 @@ /**
     getToken =  this.req.query.access_token,
-    postToken = this.req.body.access_token;
+    postToken = this.req.body && this.req.body.access_token;
 
@@ -127,3 +127,3 @@ // Check exactly one method was used
     self.req.oauth = { bearerToken: token };
-    self.req.user = token.user ? token.user : { id: token.user_id };
+    self.req.user = token.user ? token.user : { id: token.userId };
 
@@ -130,0 +130,0 @@ done();

lib/grant.js

@@ -82,7 +82,7 @@ /**
   this.client = credsFromBasic(this.req) || credsFromBody(this.req);
-  if (!this.client.client_id ||
-      !this.client.client_id.match(this.config.regex.client_id)) {
+  if (!this.client.clientId ||
+      !this.client.clientId.match(this.config.regex.clientId)) {
     return done(error('invalid_client',
       'Invalid or missing client_id parameter'));
-  } else if (!this.client.client_secret) {
+  } else if (!this.client.clientSecret) {
     return done(error('invalid_client', 'Missing client_secret parameter'));
@@ -101,4 +101,4 @@ }
 function Client (id, secret) {
-  this.client_id = id;
-  this.client_secret = secret;
+  this.clientId = id;
+  this.clientSecret = secret;
 }
@@ -146,3 +146,3 @@
 function checkClient (done) {
-  this.model.getClient(this.client.client_id, this.client.client_secret,
+  this.model.getClient(this.client.clientId, this.client.clientSecret,
       function (err, client) {
@@ -199,3 +199,3 @@ if (err) return done(error('server_error', false, err));
 
-    if (!authCode || authCode.client_id !== self.client.client_id) {
+    if (!authCode || authCode.clientId !== self.client.clientId) {
       return done(error('invalid_grant', 'Invalid code'));
@@ -206,6 +206,6 @@ } else if (authCode.expires < self.now) {
 
-    self.user = authCode.user || { id: authCode.user_id };
+    self.user = authCode.user || { id: authCode.userId };
     if (!self.user.id) {
       return done(error('server_error', false,
-        'No user/user_id parameter returned from getauthCode'));
+        'No user/userId parameter returned from getauthCode'));
     }
@@ -217,3 +217,2 @@
 
-
 /**
@@ -261,3 +260,3 @@ * Grant for password grant type
 
-    if (!refreshToken || refreshToken.client_id !== self.client.client_id) {
+    if (!refreshToken || refreshToken.clientId !== self.client.clientId) {
       return done(error('invalid_grant', 'Invalid refresh token'));
@@ -269,7 +268,9 @@ } else if (refreshToken.expires !== null &&
 
-    if (!refreshToken.user_id) {
+    if (!refreshToken.user && !refreshToken.userId) {
       return done(error('server_error', false,
-        'No user/user_id parameter returned from getRefreshToken'));
+        'No user/userId parameter returned from getRefreshToken'));
     }
 
+    self.user = refreshToken.user || { id: refreshToken.userId };
+
     if (self.model.revokeRefreshToken) {
@@ -282,3 +283,2 @@ return self.model.revokeRefreshToken(token, function (err) {
 
-    self.user = refreshToken.user || { id: refreshToken.user_id };
     done();
@@ -321,3 +321,3 @@ });
 function checkGrantTypeAllowed (done) {
-  this.model.grantTypeAllowed(this.client.client_id, this.grantType,
+  this.model.grantTypeAllowed(this.client.clientId, this.grantType,
       function (err, allowed) {
@@ -343,3 +343,3 @@ if (err) return done(error('server_error', false, err));
   var self = this;
-  token(this, 'access_token', function (err, token) {
+  token(this, 'accessToken', function (err, token) {
     self.accessToken = token;
@@ -360,4 +360,4 @@ done(err);
   // Object idicates a reissue
-  if (typeof accessToken === 'object' && accessToken.access_token) {
-    this.accessToken = accessToken.access_token;
+  if (typeof accessToken === 'object' && accessToken.accessToken) {
+    this.accessToken = accessToken.accessToken;
     return done();
@@ -372,10 +372,4 @@ }
 
-  var data = {
-    access_token: accessToken,
-    client_id: this.client.client_id,
-    expires: expires,
-    user: this.user
-  };
-
-  this.model.saveAccessToken(data, function (err) {
+  this.model.saveAccessToken(accessToken, this.client.clientId, expires,
+      this.user, function (err) {
     if (err) return done(error('server_error', false, err));
@@ -396,3 +390,3 @@ done();
   var self = this;
-  token(this, 'refresh_token', function (err, token) {
+  token(this, 'refreshToken', function (err, token) {
     self.refreshToken = token;
@@ -415,4 +409,4 @@ done(err);
   // Object idicates a reissue
-  if (typeof refreshToken === 'object' && refreshToken.refresh_token) {
-    this.refreshToken = refreshToken.refresh_token;
+  if (typeof refreshToken === 'object' && refreshToken.refreshToken) {
+    this.refreshToken = refreshToken.refreshToken;
     return done();
@@ -427,10 +421,4 @@ }
 
-  var data = {
-    refresh_token: refreshToken,
-    client_id: this.client.client_id,
-    expires: expires,
-    user: this.user
-  };
-
-  this.model.saveAccessToken(data, function (err) {
+  this.model.saveRefreshToken(refreshToken, this.client.clientId, expires,
+      this.user, function (err) {
     if (err) return done(error('server_error', false, err));
@@ -437,0 +425,0 @@ done();

package.json

 {
   "name": "node-oauth2-server",
   "description": "Complete, compliant and well tested module for implementing an OAuth2 Server/Provider with express in node.js",
-  "version": "2.0.0-beta3",
+  "version": "2.0.0-beta5",
   "keywords": [
@@ -6,0 +6,0 @@ "oauth",

Readme.md

@@ -98,8 +98,9 @@ # Node OAuth2 Server [![Build Status](https://travis-ci.org/nightworld/node-oauth2-server.png?branch=master)](https://travis-ci.org/nightworld/node-oauth2-server)
              - `null` to indicate the token **never expires**
-         - *string|number* **user_id**
-             - The user_id (saved in req.user.id)
+         - *string|number* **userId**
+             - The user id (saved in req.user.id)
 
 #### getClient (clientId, clientSecret, callback)
 - *string* **clientId**
-- *string* **clientSecret**
+- *string|null* **clientSecret**
+ - If null, omit from search query (only search by clientId)
 - *function* **callback (error, client)**
@@ -112,3 +113,3 @@ - *mixed* **error**
      - Must contain the following keys:
-         - *string* **client_id**
+         - *string* **clientId**
 
@@ -124,8 +125,7 @@ #### grantTypeAllowed (clientId, grantType, callback)
 
-#### saveAccessToken (accessToken, callback)
-- *object* **accessToken**
-  - *string* **accessToken**
-  - *string* **clientId**
-  - *string|number* **userId**
-  - *date* **expires**
+#### saveAccessToken (accessToken, clientId, expires, user, callback)
+- *string* **accessToken**
+- *string* **clientId**
+- *string|number* **userId**
+- *date* **expires**
 - *function* **callback (error)**
@@ -146,16 +146,15 @@ - *mixed* **error**
      - Must contain the following keys:
-         - *string|number* **client_id**
-             - client_id associated with this auth code
+         - *string|number* **clientId**
+             - client id associated with this auth code
          - *date* **expires**
              - The date when it expires
-         - *string|number* **user_id**
-             - The user_id
+         - *string|number* **userId**
+             - The userId
 
-#### saveAuthCode (authCode, callback)
-- *object* **authCode**
-  - *string* **auth_code**
-  - *string* **client_id**
-  - *date* **expires**
-  - *mixed* **user**
-     - Whatever was passed as `user` to the codeGrant function (see example)
+#### saveAuthCode (authCode, clientId, expires, user, callback)
+- *string* **authCode**
+- *string* **clientId**
+- *date* **expires**
+- *mixed* **user**
+   - Whatever was passed as `user` to the codeGrant function (see example)
 - *function* **callback (error)**
@@ -182,8 +181,7 @@ - *mixed* **error**
 
-#### saveRefreshToken (refreshToken, callback)
-- *object* **refreshToken**
-  - *string* **refreshToken**
-  - *string* **clientId**
-  - *string|number* **userId**
-  - *date* **expires**
+#### saveRefreshToken (refreshToken, clientId, expires, user, callback)
+- *string* **refreshToken**
+- *string* **clientId**
+- *string|number* **userId**
+- *date* **expires**
 - *function* **callback (error)**
@@ -202,9 +200,9 @@ - *mixed* **error**
      - Must contain the following keys:
-         - *string|number* **client_id**
-             - client_id associated with this token
+         - *string|number* **clientId**
+             - client id associated with this token
          - *date* **expires**
              - The date when it expires
              - `null` to indicate the token **never expires**
-         - *string|number* **user_id**
-             - The user_id
+         - *string|number* **userId**
+             - The userId
 
@@ -250,3 +248,3 @@
          - Must contain the following keys (if object):
-           - *string* **access_token** OR **refresh_token** dependant on type
+           - *string* **accessToken** OR **refreshToken** dependant on type
 
@@ -253,0 +251,0 @@ ## Extension Grants

test/authCodeGrant.js

@@ -81,3 +81,3 @@ /**
     var app = bootstrap({
-      getClient: function (clientId, callback) {
+      getClient: function (clientId, clientSecret, callback) {
         callback(); // Fake invalid
@@ -99,6 +99,6 @@ }
     var app = bootstrap({
-      getClient: function (clientId, callback) {
+      getClient: function (clientId, clientSecret, callback) {
         callback(false, {
-          client_id: 'thom',
-          redirect_uri: 'http://nightworld.com'
+          clientId: 'thom',
+          redirectUri: 'http://nightworld.com'
         });
@@ -120,6 +120,6 @@ }
     var app = bootstrap({
-      getClient: function (clientId, callback) {
+      getClient: function (clientId, clientSecret, callback) {
         callback(false, {
-          client_id: 'thom',
-          redirect_uri: 'http://nightworld.com'
+          clientId: 'thom',
+          redirectUri: 'http://nightworld.com'
         });
@@ -142,13 +142,13 @@ }
     var app = bootstrap({
-      getClient: function (clientId, callback) {
+      getClient: function (clientId, clientSecret, callback) {
         callback(false, {
-          client_id: 'thom',
-          redirect_uri: 'http://nightworld.com'
+          clientId: 'thom',
+          redirectUri: 'http://nightworld.com'
         });
       },
-      saveAuthCode: function (data, callback) {
-        should.exist(data.auth_code);
-        data.auth_code.should.have.lengthOf(40);
-        data.client_id.should.equal('thom');
-        (+data.expires).should.be.within(2, (+new Date()) + 30000);
+      saveAuthCode: function (authCode, clientId, expires, user, callback) {
+        should.exist(authCode);
+        authCode.should.have.lengthOf(40);
+        clientId.should.equal('thom');
+        (+expires).should.be.within(2, (+new Date()) + 30000);
         done();
@@ -172,11 +172,11 @@ }
     var app = bootstrap({
-      getClient: function (clientId, callback) {
+      getClient: function (clientId, clientSecret, callback) {
         callback(false, {
-          client_id: 'thom',
-          redirect_uri: 'http://nightworld.com'
+          clientId: 'thom',
+          redirectUri: 'http://nightworld.com'
         });
       },
-      saveAuthCode: function (data, callback) {
-        should.exist(data.auth_code);
-        code = data.auth_code;
+      saveAuthCode: function (authCode, clientId, expires, user, callback) {
+        should.exist(authCode);
+        code = authCode;
         callback();
@@ -183,0 +183,0 @@ }

test/authorise.js

@@ -204,3 +204,3 @@ /**
           expires.setSeconds(expires.getSeconds() + 20);
-          callback(false, { expires: expires , user_id: 1 });
+          callback(false, { expires: expires , userId: 1 });
         }
@@ -207,0 +207,0 @@ }

test/grant.authorization_code.js

@@ -133,3 +133,3 @@ /**
           callback(false, {
-            client_id: 'thom',
+            clientId: 'thom',
             expires: new Date(+new Date() - 60)
@@ -165,3 +165,3 @@ });
           callback(false, {
-            client_id: 'thom',
+            clientId: 'thom',
             expires: null // This is invalid
@@ -199,8 +199,8 @@ });
           callback(false, {
-            client_id: 'thom',
+            clientId: 'thom',
             expires: new Date(),
-            user_id: '123'
+            userId: '123'
           });
         },
-        saveAccessToken: function (data, cb) {
+        saveAccessToken: function (token, clientId, expires, user, cb) {
           cb();
@@ -207,0 +207,0 @@ },

test/grant.js

@@ -98,2 +98,16 @@ /**
 
+    it('should check client_id matches regex', function (done) {
+      var app = bootstrap({
+        clientIdRegex: /match/,
+        model: {},
+        grants: ['password', 'refresh_token']
+      });
+
+      request(app)
+        .post('/oauth/token')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .send({ grant_type: 'password', client_id: 'thom' })
+        .expect(400, /invalid or missing client_id parameter/i, done);
+    });
+
     it('should check client_secret exists', function (done) {
@@ -226,5 +240,5 @@ var app = bootstrap();
           },
-          saveAccessToken: function (data, callback) {
-            data.access_token.should.equal('thommy');
-            callback();
+          saveAccessToken: function (token, clientId, expires, user, cb) {
+            token.should.equal('thommy');
+            cb();
           }
@@ -256,6 +270,6 @@ },
           generateToken: function (type, req, callback) {
-            callback(false, { access_token: 'thommy' });
+            callback(false, { accessToken: 'thommy' });
           },
-          saveAccessToken: function (data, callback) {
-            callback(new Error('Should not be saving'));
+          saveAccessToken: function (token, clientId, expires, user, cb) {
+            cb(new Error('Should not be saving'));
           }
@@ -288,9 +302,9 @@ },
           },
-          saveAccessToken: function (data, callback) {
-            data.access_token.should.be.a('string');
-            data.access_token.should.have.length(40);
-            data.client_id.should.equal('thom');
-            data.user.id.should.equal(1);
-            (+data.expires).should.be.within(10, (+new Date()) + 3600000);
-            callback();
+          saveAccessToken: function (token, clientId, expires, user, cb) {
+            token.should.be.a('string');
+            token.should.have.length(40);
+            clientId.should.equal('thom');
+            user.id.should.equal(1);
+            (+expires).should.be.within(10, (+new Date()) + 3600000);
+            cb();
           }
@@ -321,12 +335,12 @@ },
           },
-          saveAccessToken: function (data, callback) {
-            callback();
+          saveAccessToken: function (token, clientId, expires, user, cb) {
+            cb();
           },
-          saveRefreshToken: function (data, callback) {
-            data.refresh_token.should.be.a('string');
-            data.refresh_token.should.have.length(40);
-            data.client_id.should.equal('thom');
-            data.user_id.should.equal(1);
-            (+data.expires).should.be.within(10, (+new Date()) + 1209600000);
-            callback();
+          saveRefreshToken: function (token, clientId, expires, user, cb) {
+            token.should.be.a('string');
+            token.should.have.length(40);
+            clientId.should.equal('thom');
+            user.id.should.equal(1);
+            (+expires).should.be.within(10, (+new Date()) + 1209600000);
+            cb();
           }
@@ -351,3 +365,3 @@ },
           getClient: function (id, secret, callback) {
-            callback(false, { client_id: 'thom' });
+            callback(false, { clientId: 'thom' });
           },
@@ -360,4 +374,4 @@ grantTypeAllowed: function (clientId, grantType, callback) {
           },
-          saveAccessToken: function (data, callback) {
-            callback();
+          saveAccessToken: function (token, clientId, expires, user, cb) {
+            cb();
           }
@@ -399,7 +413,7 @@ },
           },
-          saveAccessToken: function (data, callback) {
-            callback();
+          saveAccessToken: function (token, clientId, expires, user, cb) {
+            cb();
           },
-          saveRefreshToken: function (data, callback) {
-            callback();
+          saveRefreshToken: function (token, clientId, expires, user, cb) {
+            cb();
           }
@@ -436,3 +450,3 @@ },
           getClient: function (id, secret, callback) {
-            callback(false, { client_id: 'thom' });
+            callback(false, { clientId: 'thom' });
           },
@@ -445,9 +459,9 @@ grantTypeAllowed: function (clientId, grantType, callback) {
           },
-          saveAccessToken: function (data, callback) {
-            should.strictEqual(null, data.expires);
-            callback();
+          saveAccessToken: function (token, clientId, expires, user, cb) {
+            should.strictEqual(null, expires);
+            cb();
           },
-          saveRefreshToken: function (data, callback) {
-            should.strictEqual(null, data.expires);
-            callback();
+          saveRefreshToken: function (token, clientId, expires, user, cb) {
+            should.strictEqual(null, expires);
+            cb();
           }
@@ -454,0 +468,0 @@ },

test/grant.refresh_token.js

@@ -128,3 +128,3 @@ /**
         getClient: function (id, secret, callback) {
-          callback(false, { client_id: 'thom' });
+          callback(false, { clientId: 'thom' });
         },
@@ -136,3 +136,3 @@ grantTypeAllowed: function (clientId, grantType, callback) {
           callback(false, {
-            client_id: 'thom',
+            clientId: 'thom',
             expires: new Date(+new Date() - 60)
@@ -162,3 +162,3 @@ });
         getClient: function (id, secret, callback) {
-          callback(false, { client_id: 'thom' });
+          callback(false, { clientId: 'thom' });
         },
@@ -171,11 +171,11 @@ grantTypeAllowed: function (clientId, grantType, callback) {
           callback(false, {
-            client_id: 'thom',
+            clientId: 'thom',
             expires: new Date(),
-            user_id: '123'
+            userId: '123'
           });
         },
-        saveAccessToken: function (data, cb) {
+        saveAccessToken: function (token, clientId, expires, user, cb) {
           cb();
         },
-        saveRefreshToken: function (data, cb) {
+        saveRefreshToken: function (token, clientId, expires, user, cb) {
           cb();
@@ -203,2 +203,47 @@ },
 
+  it('should allow valid request with user object', function (done) {
+    var app = bootstrap({
+      model: {
+        getClient: function (id, secret, callback) {
+          callback(false, { clientId: 'thom' });
+        },
+        grantTypeAllowed: function (clientId, grantType, callback) {
+          callback(false, true);
+        },
+        getRefreshToken: function (refreshToken, callback) {
+          refreshToken.should.equal('abc123');
+          callback(false, {
+            clientId: 'thom',
+            expires: new Date(),
+            user: {
+              id: '123'
+            }
+          });
+        },
+        saveAccessToken: function (token, clientId, expires, user, cb) {
+          cb();
+        },
+        saveRefreshToken: function (token, clientId, expires, user, cb) {
+          cb();
+        },
+        expireRefreshToken: function (refreshToken, callback) {
+          callback();
+        }
+      },
+      grants: ['password', 'refresh_token']
+    });
+
+    request(app)
+      .post('/oauth/token')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
+      .send({
+        grant_type: 'refresh_token',
+        client_id: 'thom',
+        client_secret: 'nightworld',
+        refresh_token: 'abc123'
+      })
+      .expect(200, /"access_token":"(.*)",(.*)"refresh_token":"(.*)"/i, done);
+
+  });
+
   it('should allow valid request with non-expiring token (token= null)', function (done) {
@@ -208,3 +253,3 @@ var app = bootstrap({
         getClient: function (id, secret, callback) {
-          callback(false, { client_id: 'thom' });
+          callback(false, { clientId: 'thom' });
         },
@@ -216,11 +261,11 @@ grantTypeAllowed: function (clientId, grantType, callback) {
           callback(false, {
-            client_id: 'thom',
+            clientId: 'thom',
             expires: null,
-            user_id: '123'
+            userId: '123'
           });
         },
-        saveAccessToken: function (data, cb) {
+        saveAccessToken: function (token, clientId, expires, user, cb) {
           cb();
         },
-        saveRefreshToken: function (data, cb) {
+        saveRefreshToken: function (token, clientId, expires, user, cb) {
           cb();
@@ -227,0 +272,0 @@ },

Fixed alerts

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

128430

increased by13.38%

Number of package files

33

increased by17.86%

Lines of code

3026

increased by12.49%

Number of medium supply chain risk alerts

0

decreased by-100%

Worsened metrics

Number of lines in readme file

301

decreased by-0.66%

No dependency changes