Creating an OAuth2 server

help
7

Just a lot of sitting and thinking. I’m tempted to try to piece together an initial version as part of this weekend’s hackathon.

We’re going to try to use the NPM oauth2-server package. Using a hacky pseudocode translation of the oauth2-server example, it looks like we need something that’s architecturally handwavingly similar to this:

var restivusPackage = require('restivus'),
    bodyParser = require('body-parser'),
    oauthserver = require('oauth2-server');
 
var meteorApp = restivusPackage();
 
meteorApp.use(bodyParser.urlencoded({ extended: true }));
 
meteorApp.use(bodyParser.json());
 
meteorApp.oauth = oauthserver({
  model: {}, // See below for specification 
  grants: ['password'],
  debug: true
});
 
restivusPackage.all('/oauth/token', meteorApp.oauth.grant());
 
restivusPackage.get('/', meteorApp.oauth.authorise(), function (req, res) {
  res.send('Secret area');
});
 
restivusPackage.use(app.oauth.errorHandler());
 
restivusPackage.listen(3000);

I have no clue if the Url encoding is something that’s going to need to taken care of; if Meteor already takes care of it; etc. But the routing rules sort of make sense, and Restivus provides a similar enough API that we can sort of start to make sense of it:

  //Api.addRoute('oauth/token', {authRequired: true}, {
  Api.addRoute('oauth/token', {
    get: function () {
      return meteorApp.oauth.grant();
    }
  });  
  //Api.addRoute('/', {authRequired: true}, {
  Api.addRoute('/', {
    get: {
      //roleRequired: ['author', 'admin'],
      action: function () {
        if (meteorApp.oauth.authorise()) {
          return {status: 'success', data: {message: 'You have been granted access to a restricted area.'}};
        }
        return {
          statusCode: 404,
          body: {status: 'fail', message: 'You are denied.'}
        };
      }
    }
  });

So that’s where we’re at.