0006-oauth-Use-Redmine-s-permissions-as-OAuth2-scopes.patch - Redmine

app/controllers/application_controller.rb
127	127	# Oauth
128	128	if access_token.accessible?
129	129	user = User.active.find_by_id(access_token.resource_owner_id)
	130	user.oauth_scope = access_token.scopes.all.map(&:to_sym)
130	131	else
131	132	doorkeeper_render_error
132	133	end

     class Oauth2ApplicationsController < Doorkeeper::ApplicationsController
       private
       def application_params
         params[:doorkeeper_application] ||= {}
         params[:doorkeeper_application][:scopes] ||= []
         scopes = Redmine::AccessControl.public_permissions.map{|p| p.name.to_s}
         if params[:doorkeeper_application][:scopes].is_a?(Array)
           scopes |= params[:doorkeeper_application][:scopes]
         else
           scopes |= params[:doorkeeper_application][:scopes].split(/\s+/)
         end
         params[:doorkeeper_application][:scopes] = scopes.join(' ')
         super
       end
     end

       attr_accessor :password, :password_confirmation, :generate_password
       attr_accessor :last_before_login_on
       attr_accessor :remote_ip
       attr_writer   :oauth_scope
       LOGIN_LENGTH_LIMIT = 60
       MAIL_LENGTH_LIMIT = 60
-...
       def allowed_to?(action, context, options={}, &block)
         if context && context.is_a?(Project)
           return false unless context.allows_to?(action)
           # Admin users are authorized for anything else
           return true if admin?
           # Admin users are authorized for anything or what their oauth scope prescribes
           if admin?
             if @oauth_scope
               return Role.new(permissions: @oauth_scope).allowed_to?(action, @oauth_scope)
             else
               return true
             end
           end
           roles = roles_for_project(context)
           return false unless roles
           roles.any? {|role|
             (context.is_public? || role.member?) &&
             role.allowed_to?(action) &&
             role.allowed_to?(action, @oauth_scope) &&
             (block_given? ? yield(role, self) : true)
+          }
         elsif context && context.is_a?(Array)
-...
         elsif context
           raise ArgumentError.new("#allowed_to? context argument must be a Project, an Array of projects or nil")
         elsif options[:global]
           # Admin users are always authorized
           return true if admin?
           # Admin users are always authorized, only limited by their oauth scope
           if admin?
             if @oauth_scope
               return Role.new(permissions: @oauth_scope).allowed_to?(action, @oauth_scope)
             else
               return true
             end
           end
           # authorize if user has at least one role that has this permission
           roles = self.roles.to_a | [builtin_role]
           roles.any? {|role|
             role.allowed_to?(action) &&
             role.allowed_to?(action, @oauth_scope) &&
             (block_given? ? yield(role, self) : true)
+          }
         else

           <% end %>
         </em>
       </p>
     </div>
       <p>
         <%= f.text_field :scopes, :size => 60, :label => :'activerecord.attributes.doorkeeper/application.scopes'  %>
         <em class="info">
           <%= t('doorkeeper.applications.help.scopes') %>
         </em>
       </p>
     <h3><%= l(:'activerecord.attributes.doorkeeper/application.scopes') %></h3>
     <div class="box tabular" id="scopes">
     <% perms_by_module = Redmine::AccessControl.permissions.group_by {|p| p.project_module.to_s} %>
     <% perms_by_module.keys.sort.each do |mod| %>
         <fieldset><legend><%= mod.blank? ? l(:label_project) : l_or_humanize(mod, :prefix => 'project_module_') %></legend>
         <% perms_by_module[mod].each do |permission| %>
             <label class="floating">
             <%= check_box_tag 'doorkeeper_application[scopes][]', permission.name.to_s, (permission.public? || @application.scopes.include?( permission.name.to_s)),
                   :id => "doorkeeper_application_scopes_#{permission.name}",
                   :data => {:shows => ".#{permission.name}_shown"},
                   :disabled => permission.public? %>
             <%= l_or_humanize(permission.name, :prefix => 'permission_') %>
             </label>
         <% end %>
         </fieldset>
     <% end %>
     <br /><%= check_all_links 'scopes' %>
     <%= hidden_field_tag 'doorkeeper_application[scopes][]', '' %>
     </div>

         <tr id="application_<%= application.id %>" class="<%= cycle("odd", "even") %>">
           <td class="name"><span><%= link_to application.name, oauth_application_path(application) %></span></td>
           <td class="description"><%= truncate application.redirect_uri.split.join(', '), length: 50 %></td>
           <td class="description"><%= h application.scopes %></td>
           <td class="description"><%= safe_join application.scopes.map{|scope| h l_or_humanize(scope, prefix: 'permission_')}, ", " %></td>
           <td class="buttons">
             <%= link_to t('doorkeeper.applications.buttons.edit'), edit_oauth_application_path(application), class: 'icon icon-edit' %>
             <%= link_to t('doorkeeper.applications.buttons.destroy'), oauth_application_path(application), :data => {:confirm => t('doorkeeper.applications.confirmations.destroy')}, :method => :delete, :class => 'icon icon-del' %>

       </p>
       <p>
         <span class="label"><%= t('.scopes') %>:</span>
         <code><%= h @application.scopes %></code>
         <code><%= safe_join @application.scopes.map{|scope| h l_or_humanize(scope, prefix: 'permission_')}, ", " %></code>
       </p>
     </div>

         <p><%= t('.able_to') %>:
         <ul>
           <% @pre_auth.scopes.each do |scope| %>
             <li><%= t scope, scope: [:doorkeeper, :scopes] %></li>
             <li><%= l_or_humanize(scope, prefix: 'permission_') %></li>
           <% end %>
         </ul>
         </p>

       reuse_access_token
       realm           Redmine::Info.app_name
       base_controller 'ApplicationController'
       default_scopes  :public
       default_scopes  *Redmine::AccessControl.public_permissions.map(&:name)
       optional_scopes *Redmine::AccessControl.permissions.map(&:name)
       resource_owner_authenticator do
         if require_login

     Rails.application.routes.draw do
       use_doorkeeper
       use_doorkeeper do
         controllers :applications => 'oauth2_applications'
       end
       root :to => 'welcome#index'
       root :to => 'welcome#index', :as => 'home'

                 :html => {:class => 'icon icon-settings'}
       menu.push :ldap_authentication, {:controller => 'auth_sources', :action => 'index'},
                 :html => {:class => 'icon icon-server-authentication'}
       menu.push :applications, {:controller => 'doorkeeper/applications', :action => 'index'},
       menu.push :applications, {:controller => 'oauth2_applications', :action => 'index'},
                 :if => Proc.new { Setting.rest_api_enabled? },
                 :caption => :'doorkeeper.layouts.admin.nav.applications',
                 :html => {:class => 'icon icon-applications'}

Project

General

Profile

Redmine

Feature #24808 » 0006-oauth-Use-Redmine-s-permissions-as-OAuth2-scopes.patch