oauth.js 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147
  1. 'use strict'
  2. var url = require('url')
  3. , qs = require('qs')
  4. , caseless = require('caseless')
  5. , uuid = require('uuid')
  6. , oauth = require('oauth-sign')
  7. , crypto = require('crypto')
  8. function OAuth (request) {
  9. this.request = request
  10. this.params = null
  11. }
  12. OAuth.prototype.buildParams = function (_oauth, uri, method, query, form, qsLib) {
  13. var oa = {}
  14. for (var i in _oauth) {
  15. oa['oauth_' + i] = _oauth[i]
  16. }
  17. if (!oa.oauth_version) {
  18. oa.oauth_version = '1.0'
  19. }
  20. if (!oa.oauth_timestamp) {
  21. oa.oauth_timestamp = Math.floor( Date.now() / 1000 ).toString()
  22. }
  23. if (!oa.oauth_nonce) {
  24. oa.oauth_nonce = uuid().replace(/-/g, '')
  25. }
  26. if (!oa.oauth_signature_method) {
  27. oa.oauth_signature_method = 'HMAC-SHA1'
  28. }
  29. var consumer_secret_or_private_key = oa.oauth_consumer_secret || oa.oauth_private_key
  30. delete oa.oauth_consumer_secret
  31. delete oa.oauth_private_key
  32. var token_secret = oa.oauth_token_secret
  33. delete oa.oauth_token_secret
  34. var realm = oa.oauth_realm
  35. delete oa.oauth_realm
  36. delete oa.oauth_transport_method
  37. var baseurl = uri.protocol + '//' + uri.host + uri.pathname
  38. var params = qsLib.parse([].concat(query, form, qsLib.stringify(oa)).join('&'))
  39. oa.oauth_signature = oauth.sign(
  40. oa.oauth_signature_method,
  41. method,
  42. baseurl,
  43. params,
  44. consumer_secret_or_private_key,
  45. token_secret)
  46. if (realm) {
  47. oa.realm = realm
  48. }
  49. return oa
  50. }
  51. OAuth.prototype.buildBodyHash = function(_oauth, body) {
  52. if (['HMAC-SHA1', 'RSA-SHA1'].indexOf(_oauth.signature_method || 'HMAC-SHA1') < 0) {
  53. this.request.emit('error', new Error('oauth: ' + _oauth.signature_method +
  54. ' signature_method not supported with body_hash signing.'))
  55. }
  56. var shasum = crypto.createHash('sha1')
  57. shasum.update(body || '')
  58. var sha1 = shasum.digest('hex')
  59. return new Buffer(sha1).toString('base64')
  60. }
  61. OAuth.prototype.concatParams = function (oa, sep, wrap) {
  62. wrap = wrap || ''
  63. var params = Object.keys(oa).filter(function (i) {
  64. return i !== 'realm' && i !== 'oauth_signature'
  65. }).sort()
  66. if (oa.realm) {
  67. params.splice(0, 0, 'realm')
  68. }
  69. params.push('oauth_signature')
  70. return params.map(function (i) {
  71. return i + '=' + wrap + oauth.rfc3986(oa[i]) + wrap
  72. }).join(sep)
  73. }
  74. OAuth.prototype.onRequest = function (_oauth) {
  75. var self = this
  76. self.params = _oauth
  77. var uri = self.request.uri || {}
  78. , method = self.request.method || ''
  79. , headers = caseless(self.request.headers)
  80. , body = self.request.body || ''
  81. , qsLib = self.request.qsLib || qs
  82. var form
  83. , query
  84. , contentType = headers.get('content-type') || ''
  85. , formContentType = 'application/x-www-form-urlencoded'
  86. , transport = _oauth.transport_method || 'header'
  87. if (contentType.slice(0, formContentType.length) === formContentType) {
  88. contentType = formContentType
  89. form = body
  90. }
  91. if (uri.query) {
  92. query = uri.query
  93. }
  94. if (transport === 'body' && (method !== 'POST' || contentType !== formContentType)) {
  95. self.request.emit('error', new Error('oauth: transport_method of body requires POST ' +
  96. 'and content-type ' + formContentType))
  97. }
  98. if (!form && typeof _oauth.body_hash === 'boolean') {
  99. _oauth.body_hash = self.buildBodyHash(_oauth, self.request.body.toString())
  100. }
  101. var oa = self.buildParams(_oauth, uri, method, query, form, qsLib)
  102. switch (transport) {
  103. case 'header':
  104. self.request.setHeader('Authorization', 'OAuth ' + self.concatParams(oa, ',', '"'))
  105. break
  106. case 'query':
  107. var href = self.request.uri.href += (query ? '&' : '?') + self.concatParams(oa, '&')
  108. self.request.uri = url.parse(href)
  109. self.request.path = self.request.uri.path
  110. break
  111. case 'body':
  112. self.request.body = (form ? form + '&' : '') + self.concatParams(oa, '&')
  113. break
  114. default:
  115. self.request.emit('error', new Error('oauth: transport_method invalid'))
  116. }
  117. }
  118. exports.OAuth = OAuth