3 files changed, 300 insertions, 8 deletions

diff --git a/lib/Makefile.am b/lib/Makefile.am
index 20d15b8..6b1fad6 100644
--- a/lib/Makefile.am
+++ b/lib/Makefile.am
@@ -1,34 +1,37 @@
 lib_LTLIBRARIES = libopkele.la
 
 AM_CPPFLAGS = ${CPPFLAGS_DEBUG}
 DEFAULT_INCLUDES = -I${top_builddir}
 INCLUDES = \
            -I${top_builddir}/include/ -I${top_srcdir}/include/ \
            ${KONFORKA_CFLAGS} \
            ${OPENSSL_CFLAGS} \
            ${LIBCURL_CPPFLAGS} \
-           ${PCRE_CFLAGS} ${EXPAT_CFLAGS} ${TIDY_CFLAGS}
+           ${PCRE_CFLAGS} ${EXPAT_CFLAGS} ${TIDY_CFLAGS} \
+           ${UUID_CFLAGS}
 libopkele_la_LIBADD = \
         ${LIBCURL} \
         ${PCRE_LIBS} ${EXPAT_LIBS} \
         ${OPENSSL_LIBS} \
-        ${KONFORKA_LIBS} ${TIDY_LIBS}
+        ${KONFORKA_LIBS} ${TIDY_LIBS} \
+        ${UUID_LIBS}
 
 libopkele_la_SOURCES = \
                        params.cc \
                        util.cc \
                        server.cc \
                        secret.cc \
                        data.cc \
                        consumer.cc \
                        exception.cc \
                        extension.cc \
                        sreg.cc \
                        extension_chain.cc \
                        curl.cc expat.cc \
                        discovery.cc \
                        basic_rp.cc prequeue_rp.cc \
                        fields.cc message.cc \
-                       basic_op.cc verify_op.cc
+                       basic_op.cc verify_op.cc \
+                       oauth-consumer.cc
 libopkele_la_LDFLAGS = \
         -version-info 2:0:0
diff --git a/lib/fields.cc b/lib/fields.cc
index d494098..916b603 100644
--- a/lib/fields.cc
+++ b/lib/fields.cc
@@ -34,30 +34,34 @@ namespace opkele {
         public:
             const basic_fields& om;
             bool first;
             string& rv;
             const char *pfx;
 
             __om_query_builder(const char *p,string& r,const basic_fields& m)
                 : om(m), first(true), rv(r), pfx(p) {
                     for_each(om.fields_begin(),om.fields_end(),*this);
                 }
             __om_query_builder(const char *p,string& r,const basic_fields& m,const string& u)
                 : om(m), first(true), rv(r), pfx(p) {
+                    basic_fields::fields_iterator i=om.fields_begin(),
+                        ie=om.fields_end();
                     rv = u;
-                    if(rv.find('?')==string::npos)
-                        rv += '?';
-                    else
-                        first = false;
-                    for_each(om.fields_begin(),om.fields_end(),*this);
+                    if(i!=ie) {
+                        if(rv.find('?')==string::npos)
+                            rv += '?';
+                        else
+                            first = false;
+                        for_each(i,ie,*this);
+                    }
                 }
 
             result_type operator()(argument_type f) {
                 if(first)
                     first = false;
                 else
                     rv += '&';
                 if(pfx) rv += pfx;
                 rv+= f;
                 rv += '=';
                 rv += util::url_encode(om.get_field(f));
             }
@@ -73,14 +77,59 @@ namespace opkele {
     }
 
     void basic_fields::reset_fields() {
         throw not_implemented(OPKELE_CP_ "reset_fields() not implemented");
     }
     void basic_fields::set_field(const string&,const string&) {
         throw not_implemented(OPKELE_CP_ "set_field() not implemented");
     }
     void basic_fields::reset_field(const string&) {
         throw not_implemented(OPKELE_CP_ "reset_field() not implemented");
     }
 
+    void basic_fields::from_query(const string& qs) {
+        for(string::size_type p=0,np;;p=np+1) {
+            np = qs.find('&',p);
+            string::size_type eq = qs.find('=',p);
+            if(eq==string::npos) break;
+            if(np==string::npos) {
+                set_field(
+                        util::url_decode(qs.substr(p,eq-p)),
+                        util::url_decode(qs.substr(eq+1)) );
+                break;
+            }else if(eq<np) {
+                set_field(
+                        util::url_decode(qs.substr(p,eq-p)),
+                        util::url_decode(qs.substr(eq+1,np-eq-1)) );
+            }
+        }
+    }
+
+
+    bool fields_t::has_field(const string& n) const {
+        return find(n)!=end();
+    }
+    const string& fields_t::get_field(const string& n) const {
+        const_iterator i=find(n);
+        if(i==end())
+            throw failed_lookup(OPKELE_CP_ n+": no such field");
+        return i->second;
+    }
+
+    fields_t::fields_iterator fields_t::fields_begin() const {
+        return util::map_keys_iterator<const_iterator,string,const string&,const string*>(begin(),end());
+    }
+    fields_t::fields_iterator fields_t::fields_end() const {
+        return util::map_keys_iterator<const_iterator,string,const string&,const string*>(end(),end());
+    }
+
+    void fields_t::reset_fields() {
+        clear();
+    }
+    void fields_t::set_field(const string& n,const string& v) {
+        (*this)[n]=v;
+    }
+    void fields_t::reset_field(const string& n) {
+        erase(n);
+    }
 
 }
diff --git a/lib/oauth-consumer.cc b/lib/oauth-consumer.cc
new file mode 100644
index 0000000..d717ed3
--- a/dev/null
+++ b/lib/oauth-consumer.cc
@@ -0,0 +1,240 @@
+#include <openssl/sha.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <opkele/oauth/consumer.h>
+#include <opkele/exception.h>
+#include <opkele/util.h>
+#include <opkele/curl.h>
+#include <opkele/debug.h>
+
+#include "config.h"
+#ifdef HAVE_LIBUUID
+# include <uuid/uuid.h>
+#endif
+
+namespace opkele {
+    namespace oauth {
+
+        const service_endpoint_t&
+            simple_provider_endpoints::get_request_token_endpoint() const {
+            return sep_request_token; }
+        const service_endpoint_t&
+            simple_provider_endpoints::get_authorize_user_endpoint() const {
+            return sep_authorize_user; }
+        const service_endpoint_t&
+            simple_provider_endpoints::get_access_token_endpoint() const {
+            return sep_access_token; }
+        service_endpoint_t&
+            simple_provider_endpoints::get_url_endpoint(service_endpoint_t& sep,
+                    const string& url) const {
+            sep = sep_generic;
+            sep.url = url;
+            return sep; }
+
+        token_t basic_consumer::get_request_token() {
+            return acquire_token(get_endpoints().get_request_token_endpoint());
+        }
+
+        const string basic_consumer::get_authorize_url(const token_t& rt,const string& callback) {
+            fields_t f;
+            f.set_field("oauth_token",rt.key);
+            if(!callback.empty())
+                f.set_field("oauth_callback",callback);
+            return f.append_query(
+                    get_endpoints().get_authorize_user_endpoint().url );
+        }
+
+        token_t basic_consumer::get_access_token(const token_t& rt) {
+            return acquire_token(get_endpoints().get_access_token_endpoint(),&rt);
+        }
+
+        const string basic_consumer::signature(
+                const string& method, const string& url,
+                const basic_fields& fields,
+                const token_t* at) {
+            if(fields.get_field("oauth_signature_method")!="HMAC-SHA1")
+                throw opkele::not_implemented(OPKELE_CP_
+                        "only HMAC-SHA1 signature is implemented");
+            string key = util::url_encode(consumer_token.secret);
+            key += '&';
+            if(at)
+                key += util::url_encode(at->secret);
+            /* TODO: do not build the whole subject */
+            string subject = method;
+            subject += '&';
+            string u = util::rfc_3986_normalize_uri(url);
+            string::size_type uco = u.find_first_of("#?");
+            if(uco!=string::npos) u.erase(uco);
+            subject += util::url_encode(u);
+            subject += '&';
+            subject += util::url_encode( fields.query_string() );
+            unsigned char md[SHA_DIGEST_LENGTH];
+            unsigned int md_len = 0;
+            HMAC( EVP_sha1(),
+                    key.c_str(),key.size(),
+                    (const unsigned char *)subject.c_str(),subject.size(),
+                    md,&md_len );
+            assert(md_len==sizeof(md));
+            return util::encode_base64(md,md_len);
+        }
+
+        static void noquerize_url(string& url,const string& sepurl,basic_fields& f) {
+            string::size_type q = sepurl.find('?'),
+                p = sepurl.find('#');
+            if(q==string::npos) {
+                url = sepurl.substr(0,p);
+            }else{
+                fields_t tmp;
+                tmp.from_query(sepurl.substr(
+                            q+1,
+                            (p==string::npos)?string::npos:(p-q-q)));
+                tmp.append_to(f);
+                url = sepurl.substr(0,(p==string::npos)?q:min(p,q));
+            }
+        }
+
+        token_t basic_consumer::acquire_token(
+                const service_endpoint_t& sep,
+                const token_t* rt) {
+            util::curl_pick_t curl = util::curl_t::easy_init();
+            CURLcode r;
+            (r=curl.misc_sets())
+                || (r=curl.set_write());
+            if(r)
+                throw exception_curl(OPKELE_CP_ "failed to set basic curly options",r);
+            http_request_t hr(
+                    (sep.oauth_method==oauth_post_body)?"POST":"GET",
+                    "");
+            fields_t uq;
+            noquerize_url(hr.url,sep.url,uq);
+            prepare_request(hr,uq,fields_t(),sep,rt);
+            switch(sep.oauth_method) {
+                case oauth_auth_header:
+                    throw opkele::not_implemented(OPKELE_CP_
+                            "auth header for token acquisition isn't (yet?) supported");
+                    break;
+                case oauth_post_body:
+                    (r=curl.easy_setopt(CURLOPT_POST,1))
+                        || (r=curl.easy_setopt(CURLOPT_POSTFIELDS,hr.body.c_str()))
+                        || (r=curl.easy_setopt(CURLOPT_POSTFIELDSIZE,hr.body.size()));
+                    break;
+                case oauth_url_query:
+                    break;
+                default:
+                    throw opkele::exception(OPKELE_CP_ /* TODO: specialize */
+                            "invalid oauth_method for request_token endpoint");
+            };
+            if(r)
+                throw exception_curl(OPKELE_CP_ "failed to set curly options",r);
+            if( (r=curl.easy_setopt(CURLOPT_URL,hr.url.c_str())) )
+                throw exception_curl(OPKELE_CP_ "failed to set curly urlie",r);
+            if( (r=curl.easy_perform()) )
+                throw exception_curl(OPKELE_CP_ "failed to perform curly request",r);
+            token_t rv;
+            string::size_type p=0;
+            while(p!=string::npos) {
+                string::size_type np = curl.response.find('&',p);
+                string part;
+                if(np==string::npos) {
+                    part.assign(curl.response.c_str()+p); p = string::npos;
+                }else{
+                    part.assign(curl.response,p,np-p); p = np+1;
+                }
+                string::size_type eq = part.find('=');
+                if(eq==string::npos) continue;
+                string n(part,0,eq);
+                if(n=="oauth_token") {
+                    if(!rv.key.empty()) /* TODO: specialize */
+                        throw opkele::exception(OPKELE_CP_ "found oauth_token twice");
+                    rv.key = util::url_decode(part.substr(eq+1));
+                }else if(n=="oauth_token_secret") {
+                    if(!rv.secret.empty()) /* TODO: specialize */
+                        throw opkele::exception(OPKELE_CP_ "found oauth_secret twice");
+                    rv.secret = util::url_decode(part.substr(eq+1));
+                }
+            }
+            return rv;
+        }
+
+        void basic_consumer::prepare_request(
+                http_request_t& req,
+                const basic_fields& qf,const basic_fields& pf,
+                oauth_method_t om,const string& sm,
+                const token_t *t,const string& realm) {
+            fields_t op;
+            op.set_field("oauth_consumer_key",consumer_token.key);
+            if(t) op.set_field("oauth_token",t->key);
+            op.set_field("oauth_signature_method",sm);
+            time_t now;
+            op.set_field("oauth_timestamp",
+                    util::long_to_string(time(&now)));
+            op.set_field("oauth_nonce",allocate_nonce(now));
+            op.set_field("oauth_version","1.0");
+            /* TODO: normalize and strip down url */
+            {
+                fields_t af; /* TODO: optimize, I don't want it to be copied */
+                qf.copy_to(af); pf.append_to(af); op.append_to(af);
+                op.set_field("oauth_signature", signature(
+                            req.method,req.url,af,t) );
+            }
+            req.authorize_header.clear();
+            if(om==oauth_auth_header) {
+                req.authorize_header = "OAuth ";
+                req.authorize_header += "realm=\"";
+                req.authorize_header += util::url_encode(realm);
+                req.authorize_header += '\"';
+                for(basic_fields::fields_iterator
+                        i=op.fields_begin(),ie=op.fields_end();
+                        i!=ie;++i) {
+                    req.authorize_header += ", ";
+                    req.authorize_header += *i;
+                    req.authorize_header += "=\"";
+                    req.authorize_header += util::url_encode(op.get_field(*i));
+                    req.authorize_header += "\"";
+                }
+                req.url = qf.append_query(req.url);
+                req.body = pf.query_string();
+            }else if(om==oauth_post_body) {
+                assert(req.method=="POST");
+                /* TODO: optimize, don't copy it over and over */
+                fields_t p;
+                pf.append_to(p); op.append_to(p);
+                req.url = qf.append_query(req.url);
+                req.body = p.query_string();
+            }else if(om==oauth_url_query) {
+                fields_t q;
+                qf.append_to(q); op.append_to(q);
+                req.url = q.append_query(req.url);
+                req.body = pf.query_string();
+            }else
+                throw opkele::exception(OPKELE_CP_ /* TODO: specialize */
+                        "Unknown oauth method");
+        }
+
+        void basic_consumer::prepare_request(
+                http_request_t& req,
+                const basic_fields& qf,const basic_fields& pf,
+                const service_endpoint_t& sep,
+                const token_t *t,const string& realm) {
+            prepare_request(
+                    req, qf, pf,
+                    sep.oauth_method,sep.signature_method,
+                    t,realm);
+        }
+
+
+        const basic_provider_endpoints& simple_consumer::get_endpoints() const {
+            return peps; }
+
+        const string simple_consumer::allocate_nonce(time_t ts) {
+#           ifndef HAVE_LIBUUID
+                throw opkele::not_implemented(OPKELE_CP_
+                        "not implemented consumer's allocate_nonce()");
+#           else /* HAVE_LIBUUID */
+                uuid_t uuid; uuid_generate(uuid);
+                return util::encode_base64(uuid,sizeof(uuid));
+#           endif /* HAVE_LIBUUID */
+        }
+
+    }
+}