view release on metacpan or  search on metacpan

lib/Net/OAuth2Server/OIDC.pm  view on Meta::CPAN

use strict; use warnings;

package Net::OAuth2Server::OIDC;
our $VERSION = '0.006';

package Net::OAuth2Server::Request::Authorization::Role::OIDC;
our $VERSION = '0.006';

use Role::Tiny;
use Class::Method::Modifiers 'fresh';

sub fresh__response_type_requiring_nonce { qw( token id_token ) }
sub fresh__valid_parameter_values { (
	display => [qw( page popup touch wap )],
	prompt  => [qw( none login consent select_account )],
) }
fresh response_type_requiring_nonce => \&fresh__response_type_requiring_nonce;
fresh valid_parameter_values => \&fresh__valid_parameter_values;
undef *fresh__response_type_requiring_nonce;
undef *fresh__valid_parameter_values;

sub around__new {
	my $orig = shift;
	my $class = shift;
	my $self = $class->$orig( @_ );
	return $self if $self->error;
	if ( $self->scope->contains( 'openid' ) ) {
		return $self->set_error_invalid_request( 'missing parameter: nonce' )
			if ( not defined $self->param('nonce') )
			and $self->response_type->contains( $self->response_type_requiring_nonce );

		my %validate = $self->valid_parameter_values;
		my @invalid = sort grep {
			my $name = $_;
			my $value = $self->param( $name );
			defined $value and not grep $value eq $_, @{ $validate{ $name } };
		} keys %validate;
		return $self->set_error_invalid_request( "invalid value for parameter: @invalid" ) if @invalid;
	}
	else {
		return $self->set_error_invalid_request( 'id_token requested outside of openid scope' )
			if $self->response_type->contains( 'id_token' );
	}
	$self;
}
around 'new' => \&around__new;
undef *around__new;

package Net::OAuth2Server::Response::Role::OIDC;
our $VERSION = '0.006';

use Role::Tiny;
use Class::Method::Modifiers 'fresh';
use MIME::Base64 ();
use JSON::WebToken ();
use Digest::SHA ();
use Carp ();

# copy-paste from newer MIME::Base64 for older versions without it
my $b64url_enc = MIME::Base64->can( 'encode_base64url' ) || sub {
	my $e = MIME::Base64::encode_base64( shift, '' );
	$e =~ s/=+\z//;
	$e =~ tr[+/][-_];
	return $e;
};

sub fresh__supported_response_types { qw( code id_token token ) }
fresh supported_response_types => \&fresh__supported_response_types;
undef *fresh__supported_response_types;

sub around__for_authorization {
	my $orig = shift;
	my ( $class, $req, $grant ) = ( shift, @_ );
	my $self = $class->$orig( @_ );