46d8c52a08
* initial token-based-api login handler * add token schema and validation * initial import of pyro3d api code * basic Swagger spec support * Merge in working copy of API/Device.pm * Fix some error handling for API/Device.pm * Break out utility functions into separate file, to allow other api portions to use * Add NodeIP support. * Add nodeip plugin to config * remove double define of "plugin:" (#448) disclaimer: i did not test this is any way, came across it when looking for something else. * only AuthZ header for api use, and alway regen key on login * use RFC7235 * workaround for Swagger plugin weird response body * do not autodiscover swagger routes * code formatting only * move api util to utils area * initial full swagger spec for nodeip search * add api user role and fix api auth failure response * update version of swagger-ui to 3.20.3 * add more openapi defs * fixes to SQL and api spec * clean up subs * improvements to login/logout for API * make api logout work * add openapi tags to group operations * allow api params to be generated from DBIC schema spec * remove API calls for nodes and devices * remove some poor assumptions about api calls * tidy up * remove DDP * make login and logout similar * example of api call being handled by ajax call * make the branch authonly
68 lines
2.3 KiB
HTML
68 lines
2.3 KiB
HTML
<!doctype html>
|
|
<html lang="en-US">
|
|
<body onload="run()">
|
|
</body>
|
|
</html>
|
|
<script>
|
|
'use strict';
|
|
function run () {
|
|
var oauth2 = window.opener.swaggerUIRedirectOauth2;
|
|
var sentState = oauth2.state;
|
|
var redirectUrl = oauth2.redirectUrl;
|
|
var isValid, qp, arr;
|
|
|
|
if (/code|token|error/.test(window.location.hash)) {
|
|
qp = window.location.hash.substring(1);
|
|
} else {
|
|
qp = location.search.substring(1);
|
|
}
|
|
|
|
arr = qp.split("&")
|
|
arr.forEach(function (v,i,_arr) { _arr[i] = '"' + v.replace('=', '":"') + '"';})
|
|
qp = qp ? JSON.parse('{' + arr.join() + '}',
|
|
function (key, value) {
|
|
return key === "" ? value : decodeURIComponent(value)
|
|
}
|
|
) : {}
|
|
|
|
isValid = qp.state === sentState
|
|
|
|
if ((
|
|
oauth2.auth.schema.get("flow") === "accessCode"||
|
|
oauth2.auth.schema.get("flow") === "authorizationCode"
|
|
) && !oauth2.auth.code) {
|
|
if (!isValid) {
|
|
oauth2.errCb({
|
|
authId: oauth2.auth.name,
|
|
source: "auth",
|
|
level: "warning",
|
|
message: "Authorization may be unsafe, passed state was changed in server Passed state wasn't returned from auth server"
|
|
});
|
|
}
|
|
|
|
if (qp.code) {
|
|
delete oauth2.state;
|
|
oauth2.auth.code = qp.code;
|
|
oauth2.callback({auth: oauth2.auth, redirectUrl: redirectUrl});
|
|
} else {
|
|
let oauthErrorMsg
|
|
if (qp.error) {
|
|
oauthErrorMsg = "["+qp.error+"]: " +
|
|
(qp.error_description ? qp.error_description+ ". " : "no accessCode received from the server. ") +
|
|
(qp.error_uri ? "More info: "+qp.error_uri : "");
|
|
}
|
|
|
|
oauth2.errCb({
|
|
authId: oauth2.auth.name,
|
|
source: "auth",
|
|
level: "error",
|
|
message: oauthErrorMsg || "[Authorization failed]: no accessCode received from the server"
|
|
});
|
|
}
|
|
} else {
|
|
oauth2.callback({auth: oauth2.auth, token: qp, isValid: isValid, redirectUrl: redirectUrl});
|
|
}
|
|
window.close();
|
|
}
|
|
</script>
|