commit 3fb651b

Added some tweaks for AndStatus, that does some things different (still non-working).

AndStatus expects a 'state' field to be propagated and doesn't send
the 'client_secret' as a GET argument, but in a Basic authorization header.

 1@@ -158,6 +158,7 @@ const char *login_page = ""
 2 "<p>Password: <input type=\"password\" name=\"passwd\"></p>\n"
 3 "<input type=\"hidden\" name=\"redir\" value=\"%s\">\n"
 4 "<input type=\"hidden\" name=\"cid\" value=\"%s\">\n"
 5+"<input type=\"hidden\" name=\"state\" value=\"%s\">\n"
 6 "<input type=\"submit\" value=\"OK\">\n"
 7 "</form><p>%s</p></body>\n"
 8 "";
 9@@ -183,6 +184,7 @@ int oauth_get_handler(const xs_dict *req, const char *q_path,
10         const char *cid   = xs_dict_get(msg, "client_id");
11         const char *ruri  = xs_dict_get(msg, "redirect_uri");
12         const char *rtype = xs_dict_get(msg, "response_type");
13+        const char *state = xs_dict_get(msg, "state");
14 
15         status = 400;
16 
17@@ -192,7 +194,10 @@ int oauth_get_handler(const xs_dict *req, const char *q_path,
18             if (app != NULL) {
19                 const char *host = xs_dict_get(srv_config, "host");
20 
21-                *body  = xs_fmt(login_page, host, "", host, ruri, cid, USER_AGENT);
22+                if (xs_is_null(state))
23+                    state = "";
24+
25+                *body  = xs_fmt(login_page, host, "", host, ruri, cid, state, USER_AGENT);
26                 *ctype = "text/html";
27                 status = 200;
28 
29@@ -232,11 +237,12 @@ int oauth_post_handler(const xs_dict *req, const char *q_path,
30         const char *passwd = xs_dict_get(msg, "passwd");
31         const char *redir  = xs_dict_get(msg, "redir");
32         const char *cid    = xs_dict_get(msg, "cid");
33+        const char *state  = xs_dict_get(msg, "state");
34 
35         const char *host = xs_dict_get(srv_config, "host");
36 
37         /* by default, generate another login form with an error */
38-        *body  = xs_fmt(login_page, host, "LOGIN INCORRECT", host, redir, cid, USER_AGENT);
39+        *body  = xs_fmt(login_page, host, "LOGIN INCORRECT", host, redir, cid, state, USER_AGENT);
40         *ctype = "text/html";
41         status = 200;
42 
43@@ -254,6 +260,12 @@ int oauth_post_handler(const xs_dict *req, const char *q_path,
44                     *body = xs_fmt("%s?code=%s", redir, code);
45                     status = 303;
46 
47+                    /* if there is a state, add it */
48+                    if (!xs_is_null(state) && *state) {
49+                        *body = xs_str_cat(*body, "&state=");
50+                        *body = xs_str_cat(*body, state);
51+                    }
52+
53                     srv_debug(0, xs_fmt("oauth x-snac-login: success, redirect to %s", *body));
54 
55                     /* assign the login to the app */
56@@ -285,6 +297,28 @@ int oauth_post_handler(const xs_dict *req, const char *q_path,
57         const char *cid   = xs_dict_get(msg, "client_id");
58         const char *csec  = xs_dict_get(msg, "client_secret");
59         const char *ruri  = xs_dict_get(msg, "redirect_uri");
60+        xs *wrk = NULL;
61+
62+        /* no client_secret? check if it's inside an authorization header
63+           (AndStatus does it this way) */
64+        if (xs_is_null(csec)) {
65+            const char *auhdr = xs_dict_get(req, "authorization");
66+
67+            if (!xs_is_null(auhdr) && xs_startswith(auhdr, "Basic ")) {
68+                xs *s1 = xs_replace(auhdr, "Basic ", "");
69+                int size;
70+                xs *s2 = xs_base64_dec(s1, &size);
71+
72+                if (!xs_is_null(s2)) {
73+                    xs *l1 = xs_split(s2, ":");
74+
75+                    if (xs_list_len(l1) == 2) {
76+                        wrk = xs_dup(xs_list_get(l1, 1));
77+                        csec = wrk;
78+                    }
79+                }
80+            }
81+        }
82 
83         if (gtype && code && cid && csec && ruri) {
84             xs *app = app_get(cid);