Move the OAuth-specific parameters to the Authorized header instead of the parameters

1 files changed, 64 insertions, 16 deletions

diff --git a/rest/oauth-proxy-call.c b/rest/oauth-proxy-call.c
index 4b4d798..6ab4ae7 100644
--- a/rest/oauth-proxy-call.c
+++ b/rest/oauth-proxy-call.c
@@ -85,8 +85,23 @@ encode_params (GHashTable *hash)
   return g_string_free (s, FALSE);
 }
 
+/*
+ * Add the keys in @from to @hash.
+ */
+static void
+merge_hashes (GHashTable *hash, GHashTable *from)
+{
+  GHashTableIter iter;
+  gpointer key, value;
+
+  g_hash_table_iter_init (&iter, from);
+  while (g_hash_table_iter_next (&iter, &key, &value)) {
+    g_hash_table_insert (hash, key, g_strdup (value));
+  }
+}
+
 static char *
-sign_hmac (OAuthProxy *proxy, RestProxyCall *call)
+sign_hmac (OAuthProxy *proxy, RestProxyCall *call, GHashTable *params)
 {
   OAuthProxyPrivate *priv;
   RestProxyCallPrivate *callpriv;
@@ -96,21 +111,24 @@ sign_hmac (OAuthProxy *proxy, RestProxyCall *call)
   priv = PROXY_GET_PRIVATE (proxy);
   callpriv = call->priv;
 
-  /* PLAINTEXT signature value is the HMAC-SHA1 key value */
-  key = sign_plaintext (priv);
-
   text = g_string_new (NULL);
   g_string_append (text, rest_proxy_call_get_method (REST_PROXY_CALL (call)));
   g_string_append_c (text, '&');
   g_string_append_uri_escaped (text, callpriv->url, NULL, FALSE);
   g_string_append_c (text, '&');
 
-  ep = encode_params (callpriv->params);
+  /* Merge the OAuth parameters with the query parameters */
+  merge_hashes (params, callpriv->params);
+
+  ep = encode_params (params);
   eep = OAUTH_ENCODE_STRING (ep);
   g_string_append (text, eep);
   g_free (ep);
   g_free (eep);
 
+  /* PLAINTEXT signature value is the HMAC-SHA1 key value */
+  key = sign_plaintext (priv);
+
   signature = hmac_sha1 (key, text->str);
 
   g_free (key);
@@ -119,43 +137,73 @@ sign_hmac (OAuthProxy *proxy, RestProxyCall *call)
   return signature;
 }
 
+/*
+ * From the OAuth parameters in @params, construct a HTTP Authorized header.
+ */
+static char *
+make_authorized_header (GHashTable *params)
+{
+  GString *auth;
+  GHashTableIter iter;
+  const char *key, *value;
+
+  g_assert (params);
+
+  /* TODO: is "" okay for the realm, or should this be magically calculated or a
+     parameter? */
+  auth = g_string_new ("OAuth realm=\"\"");
+
+  g_hash_table_iter_init (&iter, params);
+  while (g_hash_table_iter_next (&iter, (gpointer)&key, (gpointer)&value)) {
+    g_string_append_printf (auth, ", %s=\"%s\"", key, OAUTH_ENCODE_STRING (value));
+  }
+
+  return g_string_free (auth, FALSE);
+}
+
 static gboolean
 _prepare (RestProxyCall *call, GError **error)
 {
   OAuthProxy *proxy = NULL;
   OAuthProxyPrivate *priv;
   char *s;
+  GHashTable *params;
 
   g_object_get (call, "proxy", &proxy, NULL);
   priv = PROXY_GET_PRIVATE (proxy);
 
-  rest_proxy_call_add_param (call, "oauth_version", "1.0");
+  params = g_hash_table_new_full (g_str_hash, g_str_equal, NULL, g_free);
+
+  g_hash_table_insert (params, "oauth_version", g_strdup ("1.0"));
 
   s = g_strdup_printf ("%lli", (long long int) time (NULL));
-  rest_proxy_call_add_param (call, "oauth_timestamp", s);
-  g_free (s);
+  g_hash_table_insert (params, "oauth_timestamp", s);
 
   s = g_strdup_printf ("%u", g_random_int ());
-  rest_proxy_call_add_param (call, "oauth_nonce", s);
-  g_free (s);
+  g_hash_table_insert (params, "oauth_nonce", s);
 
-  rest_proxy_call_add_param (call, "oauth_consumer_key", priv->consumer_key);
+  g_hash_table_insert (params, "oauth_consumer_key",
+                       g_strdup (priv->consumer_key));
 
   if (priv->token)
-    rest_proxy_call_add_param (call, "oauth_token", priv->token);
+    g_hash_table_insert (params, "oauth_token", g_strdup (priv->token));
 
   switch (priv->method) {
   case PLAINTEXT:
-    rest_proxy_call_add_param (call, "oauth_signature_method", "PLAINTEXT");
+    g_hash_table_insert (params, "oauth_signature_method", g_strdup ("PLAINTEXT"));
     s = sign_plaintext (priv);
     break;
   case HMAC_SHA1:
-    rest_proxy_call_add_param (call, "oauth_signature_method", "HMAC-SHA1");
-    s = sign_hmac (proxy, call);
+    g_hash_table_insert (params, "oauth_signature_method", g_strdup ("HMAC-SHA1"));
+    s = sign_hmac (proxy, call, params);
     break;
   }
-  rest_proxy_call_add_param (call, "oauth_signature", s);
+  g_hash_table_insert (params, "oauth_signature", s);
+
+  s = make_authorized_header (params);
+  rest_proxy_call_add_header (call, "Authorization", s);
   g_free (s);
+  g_hash_table_destroy (params);
 
   g_object_unref (proxy);