Network.OAuth.Simple

Simplified Monadic interface for managing http-client and oauthenticated state. Re-exposes all of the functionality from Network.OAuth and Network.OAuth.ThreeLegged.

A monad for authenticated requests

Network.OAuth.Simple re-exports the Network.OAuth and Network.Oauth.ThreeLegged interfaces using the obvious StateT and ReaderT wrappers for tracking configuration, credentials, and random generator state. Managing Manager state is out of scope for this module, but since OAuthT is a monad transformer, it's easy enough to add another layer with the needed state.

oauth :: MonadIO m => Request -> OAuthT ty m Request

Sign a request using fresh credentials.

runOAuthSimple :: OAuth ty a -> Cred ty -> IO a

The simplest way to execute a set of authenticated requests. Produces invalid ThreeLegged requests---use runOAuth to provide Server and ThreeLegged configuration information.

More sophisticated interface

runOAuth :: OAuth ty a -> Cred ty -> Server -> ThreeLegged -> IO a

runOAuthT :: MonadIO m => OAuthT ty m a -> Cred ty -> Server -> ThreeLegged -> m a

Run's an OAuthT using a fresh EntropyPool.

newtype OAuthT ty m a

Perform authenticated requests using a shared Manager and a particular set of Creds.

Constructors

OAuthT

Fields

unOAuthT :: ReaderT (OaConfig ty) (StateT SystemRNG m) a

Instances

Monad m => MonadState SystemRNG (OAuthT ty m)

MonadTrans (OAuthT ty)

Monad m => Monad (OAuthT ty m)

Functor m => Functor (OAuthT ty m)

(Monad m, Functor m) => Applicative (OAuthT ty m)

MonadThrow m => MonadThrow (OAuthT ty m)

MonadCatch m => MonadCatch (OAuthT ty m)

MonadIO m => MonadIO (OAuthT ty m)

type OAuth ty = OAuthT ty IO

OAuthT wrapped over IO.

Configuration management

upgradeCred :: (ResourceToken ty', Monad m) => Token ty' -> OAuthT ty m (Cred ty')

upgrade :: (ResourceToken ty', Monad m) => Token ty' -> OAuthT ty' m a -> OAuthT ty m a

Given a ResourceToken of some kind, run an inner OAuthT session with the same configuration but new credentials.

Configuration re-exports

OAuth Credentials

data Token ty

Tokens are public, private key pairs and come in many varieties, Client, Temporary, and Permanent.

Constructors

Token !Key !Secret

Instances

Eq (Token ty)

Data ty => Data (Token ty)

Ord (Token ty)

Show (Token ty)

ToJSON (Token ty)

Produces a JSON object using keys named oauth_token and oauth_token_secret.

FromJSON (Token ty)

Parses a JSON object with keys oauth_token and oauth_token_secret, the standard format for OAuth 1.0.

Typeable (* -> *) Token

data Cred ty

Credentials pair a Client Token and either a Temporary or Permanent token corresponding to a particular set of user resources on the server.

Instances

Eq (Cred ty)

Data ty => Data (Cred ty)

Ord (Cred ty)

Show (Cred ty)

Typeable (* -> *) Cred

data Client

Client Credentials and Tokens are assigned to a particular client by the server and are used for all requests sent by that client. They form the core component of resource specific credentials.

Instances

Data Client

Typeable * Client

data Temporary

Temporary Tokens and Credentials are created during authorization protocols and are rarely meant to be kept for more than a few minutes. Typically they are authorized to access only a very select set of server resources. During "three-legged authorization" in OAuth 1.0 they are used to generate the authorization request URI the client sends and, after that, in the Permanent Token request.

Instances

Data Temporary

ResourceToken Temporary

Typeable * Temporary

data Permanent

Permanent Tokens and Credentials are the primary means of accessing server resources. They must be maintained by the client for each user who authorizes that client to access resources on their behalf.

Instances

Data Permanent

ResourceToken Permanent

Typeable * Permanent

Creating Credentials

clientCred :: Token Client -> Cred Client

temporaryCred :: Token Temporary -> Cred Client -> Cred Temporary

permanentCred :: Token Permanent -> Cred Client -> Cred Permanent

fromUrlEncoded :: ByteString -> Maybe (Bool, Token ty)

Parses a www-form-urlencoded stream to produce a Token if possible. The first result value is whether or not the token data is OAuth 1.0a compatible.

>>> fromUrlEncoded "oauth_token=key&oauth_token_secret=secret"
Just (False, Token "key" "secret")

>>> fromUrlEncoded "oauth_token=key&oauth_token_secret=secret&oauth_callback_confirmed=true"
Just (True, Token "key" "secret")

OAuth Configuration

data Server

The Server information contains details which parameterize how a particular server wants to interpret OAuth requests.

Constructors

Server

Fields

parameterMethod :: ParameterMethod

signatureMethod :: SignatureMethod

oAuthVersion :: Version

Instances

Eq Server

Data Server

Ord Server

Show Server

Typeable * Server

defaultServer :: Server

The default Server parameterization uses OAuth recommended parameters.

data ParameterMethod

The OAuth spec suggest that the OAuth parameter be passed via the Authorization header, but allows for other methods of transmission (see section "3.5. Parameter Transmission") so we select the 'Server'\'s preferred method with this type.

Constructors

AuthorizationHeader

Place the Oa parameters in the Authorization HTTP header.

RequestEntityBody

Augment the www-form-urlencoded request body with Oa parameters.

QueryString

Augment the www-form-urlencoded query string with Oa parameters.

Instances

Eq ParameterMethod

Data ParameterMethod

Ord ParameterMethod

Show ParameterMethod

Typeable * ParameterMethod

data SignatureMethod

OAuth culminates in the creation of the oauth_signature which signs and authenticates the request using the secret components of a particular OAuth Cred.

Several methods exist for generating these signatures, the most popular being HmacSha1.

Constructors

HmacSha1

Plaintext

Instances

Eq SignatureMethod

Data SignatureMethod

Ord SignatureMethod

Show SignatureMethod

QueryValueLike SignatureMethod

Typeable * SignatureMethod

data Version

OAuth has progressed through several versions since its inception. In particular, there are two community editions "OAuth Core 1.0" (2007) and "OAuth Core 1.0a" (2009) along with the IETF Official version RFC 5849 (2010) which is confusingly named "OAuth 1.0".

/Servers which only implement the obsoleted community edition "OAuth Core 1.0" are susceptible to a session fixation attack./

If at all possible, choose the RFC 5849 version (the OAuth1 value) as it is the modern standard. Some servers may only be compliant with an earlier OAuth version---this should be tested against each server, in particular the protocols defined in Network.OAuth.ThreeLegged.

Constructors

OAuthCommunity1

OAuth Core 1.0 Community Edition

OAuthCommunity1a

OAuth Core 1.0 Community Edition, Revision A

OAuth1

RFC 5849

Instances

Eq Version

Data Version

Ord Version

Show Version

QueryValueLike Version

All three OAuth 1.0 versions confusingly report the same version number.

Typeable * Version

Three-Legged Authorization

Configuration types

data ThreeLegged

Data parameterizing the "Three-legged OAuth" redirection-based authorization protocol. These parameters cover the protocol as described in the community editions OAuth Core 1.0 and OAuth Core 1.0a as well as RFC 5849.

Constructors

ThreeLegged

Fields

temporaryTokenRequest :: Request

Base Request for the "endpoint used by the client to obtain a set of Temporary Credentials" in the form of a Temporary Token. This request is automatically instantiated and performed during the first leg of the ThreeLegged authorization protocol.

resourceOwnerAuthorization :: Request

Base Request for the "endpoint to which the resource owner is redirected to grant authorization". This request must be performed by the user granting token authorization to the client. Transmitting the parameters of this request to the user is out of scope of oauthenticated, but functions are provided to make it easier.

permanentTokenRequest :: Request

Base Request for the "endpoint used by the client to request a set of token credentials using the set of Temporary Credentials". This request is also instantiated and performed by oauthenticated in order to produce a Permanent Token.

callback :: Callback

The Callback parameter configures how the user is intended to communicate the Verifier back to the client.

Instances

Show ThreeLegged

Typeable * ThreeLegged

parseThreeLegged :: String -> String -> String -> Callback -> Maybe ThreeLegged

Convenience method for creating a ThreeLegged configuration from a trio of URLs and a Callback. Returns Nothing if one of the callback URLs could not be parsed correctly.

data Callback

When performing the second leg of the three-leg token request workflow, the user must pass the oauth_verifier code back to the client. In order to ensure that this protocol is secure, OAuth demands that the client associates this "callback method" with the temporary credentials generated for the workflow. This Callback method may be a URL where the parameters are returned to or the string "oob" which indicates that the user is responsible for returning the oauth_verifier to the client OutOfBand.

Constructors

OutOfBand

Callback Request

Instances

Show Callback

QueryValueLike Callback

Prints out in Epoch time format, a printed integer

Typeable * Callback

type Verifier = ByteString

A Verifier is produced when a user authorizes a set of Temporary Creds. Using the Verifier allows the client to request Permanent Creds.

Actions

requestTemporaryToken :: MonadIO m => Manager -> OAuthT Client m (Response (Either ByteString (Token Temporary)))

buildAuthorizationUrl :: Monad m => OAuthT Temporary m URI

requestPermanentToken :: MonadIO m => Manager -> Verifier -> OAuthT Temporary m (Response (Either ByteString (Token Permanent)))

Example System

requestTokenProtocol :: (Functor m, MonadIO m, MonadCatch m) => Manager -> (URI -> m Verifier) -> OAuthT Client m (Either TokenRequestFailure (Cred Permanent))

Run a full Three-legged authorization protocol using the simple interface of this module. This is similar to the requestTokenProtocol in Network.OAuth.ThreeLegged, but offers better error handling due in part to the easier management of configuration state.

data TokenRequestFailure

Constructors

OnTemporaryRequest HttpException

BadTemporaryToken ByteString

OnPermanentRequest HttpException

BadPermanentToken ByteString

Instances

Show TokenRequestFailure