Skip to content

Commit d57d055

Browse files
m90m90
authored
feat: allow oauth consumers to be created with consumer acceptance (#447)
* feat: allow oauth consumers to be created with consumer acceptance * fix: ownerOnly flag determines whether consumer is auto accepted * fix: ensure ownerOnly is also considered on subsequent lookup * refactor: expect matching ownerOnly param to be given on lookup * fix: access secret is expected to be used in hmac format * docs: add CHANGELOG
1 parent dbaebda commit d57d055

5 files changed

Lines changed: 77 additions & 24 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22

33
Tags have the format: `<MediaWiki core version>-<PHP Version>-<date>-<build number>`
44

5+
## 1.39-7.4-20240722-0
6+
- Add `ownerOnly` parameter to OAuth setup (#447)
7+
58
## 1.39-7.4-20240624-0
69
- Enable InstantCommons (#444)
710

‎dist-persist/wbstack/src/Internal/ApiWbStackOauthGet.php‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* This API is used by tools that need OAuth consumers.
99
* Calling this API will either give you details for the spec that you ask if they already exist.
1010
* OR it will create such a consume, and give you the details.
11-
*
11+
*
1212
* Most of the logic for OAuth stuff currently lives within WbStackPlatformReservedUser
1313
*/
1414

@@ -26,28 +26,31 @@ public function execute() {
2626
// Try and get the required consumer
2727
$consumerData = WbStackPlatformReservedUser::getOAuthConsumer(
2828
$this->getParameter('consumerName'),
29-
$this->getParameter('consumerVersion')
29+
$this->getParameter('consumerVersion'),
30+
$this->getParameter('ownerOnly'),
3031
);
3132

3233
// If it doesnt exist, make sure the user and consumer do
33-
if(!$consumerData) {
34+
if (!$consumerData) {
3435
$callbackUrl = $this->getScheme() . $GLOBALS[WBSTACK_INFO_GLOBAL]->requestDomain . $this->getParameter('callbackUrlTail');
3536

3637
WbStackPlatformReservedUser::createIfNotExists();
3738
WbStackPlatformReservedUser::createOauthConsumer(
3839
$this->getParameter('consumerName'),
3940
$this->getParameter('consumerVersion'),
4041
$this->getParameter('grants'),
41-
$callbackUrl
42+
$callbackUrl,
43+
$this->getParameter('ownerOnly'),
4244
);
4345
$consumerData = WbStackPlatformReservedUser::getOAuthConsumer(
4446
$this->getParameter('consumerName'),
45-
$this->getParameter('consumerVersion')
47+
$this->getParameter('consumerVersion'),
48+
$this->getParameter('ownerOnly'),
4649
);
4750
}
4851

4952
// Return appropriate result
50-
if(!$consumerData) {
53+
if (!$consumerData) {
5154
$res = ['success' => 0];
5255
} else {
5356
$res = [
@@ -77,6 +80,9 @@ public function getAllowedParams() {
7780
ParamValidator::PARAM_TYPE => 'string',
7881
ParamValidator::PARAM_REQUIRED => true
7982
],
83+
'ownerOnly' => [
84+
ParamValidator::PARAM_TYPE => 'boolean',
85+
],
8086
];
8187
}
8288
}

‎dist-persist/wbstack/src/Internal/WbStackPlatformReservedUser.php‎

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ public static function createIfNotExists() {
5050
return true;
5151
}
5252

53-
public static function createOauthConsumer($consumerName, $version, $grants, $callbackUrl) {
53+
public static function createOauthConsumer($consumerName, $version, $grants, $callbackUrl, $ownerOnly = false) {
5454
// ### Setup oauth consumer...
5555
// LOGIC mainly from https://github.com/wikimedia/mediawiki-extensions-OAuth/blob/master/maintenance/createOAuthConsumer.php ?
5656
// EXECUTION of script from https://github.com/wmde/wikibase-docker/blob/master/wikibase/1.33/bundle/extra-install.sh#L7 ?
@@ -65,7 +65,7 @@ public static function createOauthConsumer($consumerName, $version, $grants, $ca
6565
'callbackIsPrefix' => true,
6666
'grants' => '["' . implode( '","', $grants) . '"]',
6767
'granttype' => 'normal',
68-
'ownerOnly' => false,
68+
'ownerOnly' => $ownerOnly,
6969
'email' => WbStackPlatformReservedUser::PLATFORM_RESERVED_EMAIL,
7070
'wiki' => '*',
7171
'rsaKey' => '',
@@ -99,15 +99,14 @@ public static function createOauthConsumer($consumerName, $version, $grants, $ca
9999
$control = new \MediaWiki\Extension\OAuth\Control\ConsumerSubmitControl( $context, $data, $dbw );
100100
$approveStatus = $control->submit();
101101

102-
if ( !$approveStatus->isGood() ) {
103-
// TODO return more info...
102+
if ( !$approveStatus->isOK() ) {
104103
return false;
105104
}
106105

107106
return true;
108107
}
109108

110-
public static function getOAuthConsumer($consumerName, $version) {
109+
public static function getOAuthConsumer($consumerName, $version, $ownerOnly = false) {
111110
$user = self::getUser();
112111
// TODO create the oauth consumer on the fly if it doesn't exist (needs grants and callbackurl)
113112

@@ -131,10 +130,30 @@ public static function getOAuthConsumer($consumerName, $version) {
131130
return false;
132131
}
133132

134-
return [
133+
if ($c->getOwnerOnly() !== $ownerOnly) {
134+
return false;
135+
}
136+
137+
$data = [
135138
'agent' => $c->getName(),
136139
'consumerKey' => $c->getConsumerKey(),
137140
'consumerSecret' => \MediaWiki\Extension\OAuth\Backend\Utils::hmacDBSecret( $c->getSecretKey() ),
138141
];
142+
143+
$a = \MediaWiki\Extension\OAuth\Backend\ConsumerAcceptance::newFromUserConsumerWiki(
144+
$db,
145+
$user->getId(),
146+
$c,
147+
$c->getWiki(),
148+
\MediaWiki\Extension\OAuth\Backend\ConsumerAcceptance::READ_NORMAL,
149+
$c->getOAuthVersion(),
150+
);
151+
152+
if ( $a !== false ) {
153+
$data['accessKey'] = $a->getAccessToken();
154+
$data['accessSecret'] = \MediaWiki\Extension\OAuth\Backend\Utils::hmacDBSecret( $a->getAccessSecret() );
155+
}
156+
157+
return $data;
139158
}
140159
}

‎dist/wbstack/src/Internal/ApiWbStackOauthGet.php‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* This API is used by tools that need OAuth consumers.
99
* Calling this API will either give you details for the spec that you ask if they already exist.
1010
* OR it will create such a consume, and give you the details.
11-
*
11+
*
1212
* Most of the logic for OAuth stuff currently lives within WbStackPlatformReservedUser
1313
*/
1414

@@ -26,28 +26,31 @@ public function execute() {
2626
// Try and get the required consumer
2727
$consumerData = WbStackPlatformReservedUser::getOAuthConsumer(
2828
$this->getParameter('consumerName'),
29-
$this->getParameter('consumerVersion')
29+
$this->getParameter('consumerVersion'),
30+
$this->getParameter('ownerOnly'),
3031
);
3132

3233
// If it doesnt exist, make sure the user and consumer do
33-
if(!$consumerData) {
34+
if (!$consumerData) {
3435
$callbackUrl = $this->getScheme() . $GLOBALS[WBSTACK_INFO_GLOBAL]->requestDomain . $this->getParameter('callbackUrlTail');
3536

3637
WbStackPlatformReservedUser::createIfNotExists();
3738
WbStackPlatformReservedUser::createOauthConsumer(
3839
$this->getParameter('consumerName'),
3940
$this->getParameter('consumerVersion'),
4041
$this->getParameter('grants'),
41-
$callbackUrl
42+
$callbackUrl,
43+
$this->getParameter('ownerOnly'),
4244
);
4345
$consumerData = WbStackPlatformReservedUser::getOAuthConsumer(
4446
$this->getParameter('consumerName'),
45-
$this->getParameter('consumerVersion')
47+
$this->getParameter('consumerVersion'),
48+
$this->getParameter('ownerOnly'),
4649
);
4750
}
4851

4952
// Return appropriate result
50-
if(!$consumerData) {
53+
if (!$consumerData) {
5154
$res = ['success' => 0];
5255
} else {
5356
$res = [
@@ -77,6 +80,9 @@ public function getAllowedParams() {
7780
ParamValidator::PARAM_TYPE => 'string',
7881
ParamValidator::PARAM_REQUIRED => true
7982
],
83+
'ownerOnly' => [
84+
ParamValidator::PARAM_TYPE => 'boolean',
85+
],
8086
];
8187
}
8288
}

‎dist/wbstack/src/Internal/WbStackPlatformReservedUser.php‎

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ public static function createIfNotExists() {
5050
return true;
5151
}
5252

53-
public static function createOauthConsumer($consumerName, $version, $grants, $callbackUrl) {
53+
public static function createOauthConsumer($consumerName, $version, $grants, $callbackUrl, $ownerOnly = false) {
5454
// ### Setup oauth consumer...
5555
// LOGIC mainly from https://github.com/wikimedia/mediawiki-extensions-OAuth/blob/master/maintenance/createOAuthConsumer.php ?
5656
// EXECUTION of script from https://github.com/wmde/wikibase-docker/blob/master/wikibase/1.33/bundle/extra-install.sh#L7 ?
@@ -65,7 +65,7 @@ public static function createOauthConsumer($consumerName, $version, $grants, $ca
6565
'callbackIsPrefix' => true,
6666
'grants' => '["' . implode( '","', $grants) . '"]',
6767
'granttype' => 'normal',
68-
'ownerOnly' => false,
68+
'ownerOnly' => $ownerOnly,
6969
'email' => WbStackPlatformReservedUser::PLATFORM_RESERVED_EMAIL,
7070
'wiki' => '*',
7171
'rsaKey' => '',
@@ -99,15 +99,14 @@ public static function createOauthConsumer($consumerName, $version, $grants, $ca
9999
$control = new \MediaWiki\Extension\OAuth\Control\ConsumerSubmitControl( $context, $data, $dbw );
100100
$approveStatus = $control->submit();
101101

102-
if ( !$approveStatus->isGood() ) {
103-
// TODO return more info...
102+
if ( !$approveStatus->isOK() ) {
104103
return false;
105104
}
106105

107106
return true;
108107
}
109108

110-
public static function getOAuthConsumer($consumerName, $version) {
109+
public static function getOAuthConsumer($consumerName, $version, $ownerOnly = false) {
111110
$user = self::getUser();
112111
// TODO create the oauth consumer on the fly if it doesn't exist (needs grants and callbackurl)
113112

@@ -131,10 +130,30 @@ public static function getOAuthConsumer($consumerName, $version) {
131130
return false;
132131
}
133132

134-
return [
133+
if ($c->getOwnerOnly() !== $ownerOnly) {
134+
return false;
135+
}
136+
137+
$data = [
135138
'agent' => $c->getName(),
136139
'consumerKey' => $c->getConsumerKey(),
137140
'consumerSecret' => \MediaWiki\Extension\OAuth\Backend\Utils::hmacDBSecret( $c->getSecretKey() ),
138141
];
142+
143+
$a = \MediaWiki\Extension\OAuth\Backend\ConsumerAcceptance::newFromUserConsumerWiki(
144+
$db,
145+
$user->getId(),
146+
$c,
147+
$c->getWiki(),
148+
\MediaWiki\Extension\OAuth\Backend\ConsumerAcceptance::READ_NORMAL,
149+
$c->getOAuthVersion(),
150+
);
151+
152+
if ( $a !== false ) {
153+
$data['accessKey'] = $a->getAccessToken();
154+
$data['accessSecret'] = \MediaWiki\Extension\OAuth\Backend\Utils::hmacDBSecret( $a->getAccessSecret() );
155+
}
156+
157+
return $data;
139158
}
140159
}

0 commit comments

Comments
 (0)