2017-02-13 19:34:26 +00:00
|
|
|
<!DOCTYPE html>
|
|
|
|
|
<html>
|
|
|
|
|
<head>
|
|
|
|
|
<style>
|
|
|
|
|
body {
|
|
|
|
|
background-color: #ffcccc;
|
|
|
|
|
}
|
|
|
|
|
</style>
|
|
|
|
|
</head>
|
|
|
|
|
<body>
|
|
|
|
|
OAuth3 RPC
|
|
|
|
|
|
2017-08-01 18:04:25 +00:00
|
|
|
<script src="../../assets/oauth3.org/oauth3.core.js"></script>
|
2017-02-13 19:34:26 +00:00
|
|
|
<script>
|
2017-02-21 23:54:37 +00:00
|
|
|
;(function () {
|
2017-02-13 19:34:26 +00:00
|
|
|
'use strict';
|
|
|
|
|
|
2017-02-21 23:54:37 +00:00
|
|
|
// Taken from oauth3.core.js
|
|
|
|
|
|
2017-02-13 19:34:26 +00:00
|
|
|
// TODO what about search within hash?
|
|
|
|
|
var prefix = "(" + window.location.hostname + ") [.well-known/oauth3/]";
|
2017-02-21 23:54:37 +00:00
|
|
|
var params = OAUTH3.query.parse(window.location.hash || window.location.search);
|
2017-02-13 19:34:26 +00:00
|
|
|
if (params.debug) {
|
|
|
|
|
console.warn(prefix, "DEBUG MODE ENABLED. Automatic redirects disabled.");
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
console.log(prefix, 'hash||search:');
|
|
|
|
|
console.log(window.location.hash || window.location.search);
|
|
|
|
|
|
|
|
|
|
console.log(prefix, 'params:');
|
|
|
|
|
console.log(params);
|
|
|
|
|
|
2017-11-20 16:26:52 +00:00
|
|
|
var fileWhiteList = [
|
|
|
|
|
"directives.json"
|
|
|
|
|
, "scopes.json" ];
|
|
|
|
|
|
|
|
|
|
//Serving arbitrary files/paths is probably not a good idea.
|
|
|
|
|
//Let's make sure this is something we want to serve.
|
|
|
|
|
if(fileWhiteList.indexOf(params.discoverFile) === -1) {
|
|
|
|
|
//Nope!
|
|
|
|
|
var redirect = params.redirect_uri + '?' + OAUTH3.query.stringify({
|
|
|
|
|
state: params.state
|
|
|
|
|
, error: "No access to requested file: " + params.discoverFile
|
|
|
|
|
, error_code: "E_ACCESS_DENIED"
|
|
|
|
|
, debug: params.debug || undefined
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
console.error(prefix, "Requested file is not listed as a discoverable file:"
|
|
|
|
|
, fileWhiteList);
|
|
|
|
|
console.log("Redirecting with error: ", redirect)
|
|
|
|
|
|
|
|
|
|
if (!params.debug) {
|
|
|
|
|
window.location = redirect;
|
|
|
|
|
} else {
|
|
|
|
|
// yes, we're violating the security lint with purpose
|
|
|
|
|
document.body.innerHTML += window.location.host + window.location.pathname
|
|
|
|
|
+ '<br/><br/>You\'ve passed the \'debug\' parameter so we\'re pausing'
|
|
|
|
|
+ ' to let you look at logs or whatever it is that you intended to do.'
|
|
|
|
|
+ '<br/><br/>The requested file was not a discoverable file (see console for details).'
|
|
|
|
|
+ '<br/><br/>Continue with error redirect: <a href="' + redirect + '">' + redirect + '</' + 'a>';
|
|
|
|
|
}
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
OAUTH3.request({ url: params.discoverfile }).then(function (resp) {
|
2017-02-22 00:05:23 +00:00
|
|
|
var urlsafe64 = OAUTH3._base64.encodeUrlSafe(JSON.stringify(resp.data, null, 0));
|
2017-02-13 19:34:26 +00:00
|
|
|
var redirect;
|
2017-11-20 16:26:52 +00:00
|
|
|
var returnParams;
|
2017-02-13 19:34:26 +00:00
|
|
|
|
2017-11-20 16:26:52 +00:00
|
|
|
console.log(prefix, 'file contents');
|
2017-02-13 19:34:26 +00:00
|
|
|
console.log(resp);
|
|
|
|
|
|
|
|
|
|
console.log(prefix, 'base64');
|
|
|
|
|
console.log(urlsafe64);
|
|
|
|
|
|
|
|
|
|
// TODO try postMessage back to redirect_uri domain right here
|
|
|
|
|
// window.postMessage();
|
|
|
|
|
|
|
|
|
|
// TODO make sure it's https NOT http
|
|
|
|
|
// NOTE: this can be only up to 2,083 characters
|
|
|
|
|
console.log(prefix, 'params.redirect_uri:', params.redirect_uri);
|
2017-02-21 23:54:37 +00:00
|
|
|
redirect = params.redirect_uri + '?' + OAUTH3.query.stringify({
|
2017-02-13 19:34:26 +00:00
|
|
|
state: params.state
|
2017-11-20 16:26:52 +00:00
|
|
|
, directives: urlsafe64 //kept for now, probably should remove this.
|
|
|
|
|
, result: urlsafe64
|
2017-02-13 19:34:26 +00:00
|
|
|
, debug: params.debug || undefined
|
|
|
|
|
})
|
|
|
|
|
|
|
|
|
|
console.log(prefix, 'redirect');
|
|
|
|
|
console.log(redirect);
|
|
|
|
|
if (!params.debug) {
|
|
|
|
|
window.location = redirect;
|
|
|
|
|
} else {
|
|
|
|
|
// yes, we're violating the security lint with purpose
|
|
|
|
|
document.body.innerHTML += window.location.host + window.location.pathname
|
|
|
|
|
+ '<br/><br/>You\'ve passed the \'debug\' parameter so we\'re pausing'
|
|
|
|
|
+ ' to let you look at logs or whatever it is that you intended to do.'
|
|
|
|
|
+ '<br/><br/>Continue with redirect: <a href="' + redirect + '">' + redirect + '</' + 'a>';
|
|
|
|
|
}
|
|
|
|
|
});
|
2017-02-21 23:54:37 +00:00
|
|
|
|
|
|
|
|
}());
|
2017-02-13 19:34:26 +00:00
|
|
|
</script>
|
|
|
|
|
</body>
|
|
|
|
|
</html>
|
