gem 'grape', '~> 1.0' gem 'grape_oauth2', '~> 0.2' # or gem 'grape_oauth2', git: 'https://github.com/nbulaj/grape_oauth2.git'

require 'bundler/setup' Bundler.setup

Grape::OAuth2.configure do |config| # Access Tokens lifetime (expires in) config.access_token_lifetime = 7200 # in seconds (2.hours for Rails), `nil` if never expires # Authorization Code lifetime # config.authorization_code_lifetime = 7200 # in seconds (2.hours for Rails) # Allowed OAuth2 Authorization Grants (default is %w(password client_credentials) config.allowed_grant_types = %w(password client_credentials refresh_token) # Issue access tokens with refresh token (default is false) config.issue_refresh_token = true # Process Access Token that was used for the Refresh Token Flow (default is :nothing). # Could be a symbol (Access Token instance must respond to it) # or block with refresh token as an argument. # config.on_refresh = :nothing # WWW-Authenticate Realm (default is "OAuth 2.0") # config.realm = 'My API' # Access Token authenticator block. # config.token_authenticator do |request| # AccessToken.authenticate(request.access_token) || request.invalid_token! # end # Scopes validator class (default is Grape::OAuth2::Scopes). # config.scopes_validator_class_name = 'MyCustomValidator' # Token generator class (default is Grape::OAuth2::UniqueToken). # Must respond to `self.generate(payload = {}, options = {})`. # config.token_generator_class_name = 'JWTGenerator' # Classes for OAuth2 Roles config.client_class_name = 'Application' config.access_token_class_name = 'AccessToken' config.resource_owner_class_name = 'User' end

# app/models/user.rb class User < ApplicationRecord has_secure_password def self.oauth_authenticate(_client, username, password) # find the user by it username user = find_by(username: username) return if user.nil? # check the password user.authenticate(password) end end

# app/models/access_token.rb class AccessToken < ApplicationRecord include Grape::OAuth2::ActiveRecord::AccessToken end # app/models/application.rb class Application < ApplicationRecord include Grape::OAuth2::ActiveRecord::Client end

ActiveRecord::Schema.define(version: 3) do # All the columns are custom create_table :users do |t| t.string :name t.string :username t.string :password_digest end # Required columns: :key & :secret create_table :applications do |t| t.string :name t.string :key t.string :secret t.timestamps null: false end add_index :applications, :key, unique: true # Required columns: :client_id, :resource_owner_id, :token, :expires_at, :revoked_at, :refresh_token create_table :access_tokens do |t| t.integer :resource_owner_id t.integer :client_id t.string :token, null: false t.string :refresh_token t.string :scopes, default: '' t.datetime :expires_at t.datetime :revoked_at t.datetime :created_at, null: false end add_index :access_tokens, :token, unique: true add_index :access_tokens, :resource_owner_id add_index :access_tokens, :client_id add_index :access_tokens, :refresh_token, unique: true end

# app/models/access_token.rb class AccessToken < Sequel::Model include Grape::OAuth2::Sequel::AccessToken end # app/models/application.rb class Application < Sequel::Model include Grape::OAuth2::Sequel::Client end

DB.create_table :applications do primary_key :id column :name, String, size: 255, null: false column :key, String, size: 255, null: false, index: { unique: true } column :secret, String, size: 255, null: false column :redirect_uri, String column :created_at, DateTime column :updated_at, DateTime end DB.create_table :access_tokens do primary_key :id column :client_id, Integer column :resource_owner_id, Integer, index: true column :token, String, size: 255, null: false, index: { unique: true } column :refresh_token, String, size: 255, index: { unique: true } column :expires_at, DateTime column :revoked_at, DateTime column :created_at, DateTime, null: false column :scopes, String, size: 255 end DB.create_table :users do primary_key :id column :name, String, size: 255 column :username, String, size: 255 column :created_at, DateTime column :updated_at, DateTime column :password_digest, String, size: 255 end

# app/models/access_token.rb class AccessToken include Grape::OAuth2::Mongoid::AccessToken end # app/models/application.rb class Application include Grape::OAuth2::Mongoid::Client end # app/models/user.rb class User include Mongoid::Document include Mongoid::Timestamps field :username, type: String field :password, type: String def self.oauth_authenticate(_client, username, password) find_by(username: username, password: password) end end

class Client # ... def self.authenticate(key, secret = nil) # Should return a Client instance matching the  # key & secret provided (`secret` is optional). end end

class AccessToken # ... def self.create_for(client, resource_owner, scopes = nil) # Creates the record in the database for the provided client and # resource owner with specific scopes (if present). # Returns an instance of that record. end def self.authenticate(token, type: :access_token) # Returns an Access Token instance matching the token provided. # Access Token can be searched by token or refresh token value. In the # first case :type option must be set to :access_token (default), in # the second case - to the :refresh_token. # Note that you MAY include expired access tokens in the result # of this method so long as you implement an instance `#expired?` # method. end def client # Returns associated Client instance. Always must be present! # For ORM objects it can be an association (`belongs_to :client` for ActiveRecord). end def resource_owner # Returns associated Resource Owner instance. # Can return `nil` (for Client Credentials flow as an example). # For ORM objects it can be an association (`belongs_to :resource_owner` for ActiveRecord). end def scopes # Returns Access Token authorised set of scopes. Can be a space-separated String,  # Array or any object, that responds to `to_a`. end def expired? # true if the Access Token has reached its expiration. end def revoked? # true if the Access Token was revoked. end def revoke!(revoked_at = Time.now) # Revokes an Access Token (by setting its :revoked_at attribute to the # specific time for example). end def to_bearer_token # Returns a Hash of Bearer token attributes like the following: # access_token: '', # - required # refresh_token: '', # - optional # token_type: 'bearer', # - required # expires_in: '', # - required # scope: '' # - optional end end

class User # ... def self.oauth_authenticate(client, username, password) # Returns an instance of the User class with matching username # and password. If there is no such User or password doesn't match # then returns nil. end end

# app/models/access_token.rb class AccessToken < ApplicationRecord include Grape::OAuth2::ActiveRecord::AccessToken end # app/models/application.rb class Application < ApplicationRecord include Grape::OAuth2::ActiveRecord::Client end # app/models/user.rb class User < ApplicationRecord has_secure_password # Don't forget to setup this method for your Resource Owner model! def self.oauth_authenticate(_client, username, password) user = find_by(username: username) return if user.nil? user.authenticate(password) end end # config/oauth2.rb Grape::OAuth2.configure do |config| # Classes for OAuth2 Roles config.client_class_name = 'Application' config.access_token_class_name = 'AccessToken' config.resource_owner_class_name = 'User' end

# app/twitter.rb module Twitter class API < Grape::API version 'v1', using: :path format :json prefix :api # Mount all endpoints by default. # You can define a custom one you want to use by providing them # as an argument: # include Grape::OAuth2.api :token, :authorize # include Grape::OAuth2.api # mount any other endpoints # ... end end

# app/twitter.rb module Twitter class API < Grape::API version 'v1', using: :path format :json prefix :api # Add OAuth2 helpers helpers Grape::OAuth2::Helpers::AccessTokenHelpers # Inject token authentication middleware use *Grape::OAuth2.middleware # Mount default Grape::OAuth2 Token endpoint mount Grape::OAuth2::Endpoints::Token # Mount default Grape::OAuth2 Authorization endpoint mount Grape::OAuth2::Endpoints::Authorize # mount any other endpoints # ... end end

module Twitter module Endpoints class Status < Grape::API resources :status do get do # public resource, no scopes required access_token_required! present(:status, current_user.status) end post do # requires 'write' scope to exist in Access Token access_token_required! :write status = current_user.statuses.create!(body: 'Hi man!') present(:status, status, with: V1::Entities::Status) end end end end end

module Twitter module Endpoints class Status < Grape::API before do access_token_required! end resources :status do # public endpoint - no scopes required get do present(:status, current_user.status) end # private endpoint - requires :write scope put ':id', scopes: [:write] do status = current_user.statuses.create!(body: 'Hi man!') present(:status, status, with: V1::Entities::Status) end end end end end

# app/models/application.rb class Application < ApplicationRecord include Grape::OAuth2::ActiveRecord::Client class << self def self.authenticate(key, secret = nil) # My custom condition for successful authentication return nil unless key.start_with?('MyAPI') if secret.present? find_by(key: key, secret: secret) else find_by(key: key) end end end end

# api/oauth2.rb module MyAPI class OAuth2 < Grape::API helpers Grape::OAuth2::Helpers::OAuthParams namespace :oauth do params do use :oauth_token_params end post :token do token_response = Grape::OAuth2::Generators::Token.generate_for(env) do |request, response| # You can use default authentication if you don't need to change this part: # client = Grape::OAuth2::Strategies::Base.authenticate_client(request) # Or write your custom client authentication: client = Application.find_by(key: request.client_id, active: true) request.invalid_client! unless client # You can use default Resource Owner authentication if you don't need to change this part: # resource_owner = Grape::OAuth2::Strategies::Base.authenticate_resource_owner(client, request) # Or define your custom resource owner authentication: resource_owner = User.find_by(username: request.username) request.invalid_grant! if resource_owner.nil? || resource_owner.inactive? # You can create an Access Token as you want: token = MyAwesomeAccessToken.create(client: client, resource_owner: resource_owner, scope: request.scope) response.access_token = Grape::OAuth2::Strategies::Base.expose_to_bearer_token(token) end # If request is successful, then return it status token_response.status token_response.headers.each do |key, value| header key, value end body token_response.access_token end desc 'OAuth 2.0 Token Revocation' params do use :oauth_token_revocation_params end post :revoke do # ... end end end end

Grape::OAuth2.configure do |config| config.token_authenticator do |request| AccessToken.find_by(token: request.access_token) || request.invalid_token! end # or config.token_authenticator = lambda { |request| ... } end

class CustomScopesValidator # `scopes' is the set of required scopes that must be # present in the Access Token instance. def initialize(scopes) @scopes = scopes || [] # ...some custom processing of scopes if required ... end def valid_for?(access_token) # custom scopes validation implementation... end end

Grape::OAuth2.configure do |config| # ... config.scopes_validator_class_name = 'CustomScopesValidator' end

class SomeTokenGenerator # @param payload [Hash] # Access Token payload (attributes before creation for example) # # @param options [Hash] # Options for Generator # def self.generate(payload = {}, options = {}) # Returns a generated token string. end end

Grape::OAuth2.configure do |config| # ... config.token_generator_class_name = 'SomeTokenGenerator' end

Grape::OAuth2.configure do |config| # ... config.on_refresh = :destroy # will call :destroy method (`refresh_token.destroy`) end

Grape::OAuth2.configure do |config| # ... config.on_refresh do |refresh_token| refresh_token.destroy MyAwesomeLogger.info("Token ##{refresh_token.id} was destroyed on refresh!") end end

module Twitter class API < Grape::API include Grape::OAuth2.api # ... rescue_from Rack::OAuth2::Server::Authorize::BadRequest do |e| error!({ status: e.status, description: e.description, error: e.error}, 400) end end end