Skip to content

#authorized? returns false for succesful authorization without refresh token #21

@khamusa

Description

@khamusa

The following pry session demonstrates a succesful authorization flow for which #authorized? returns false.

[4] pry(main)> cli = Googl.::OAuth2.server(client_id, client_secret, "http://localhost:3000/google_plus")
=> #<Googl::OAuth2::Server:0x0000000c3ba1d0
 @client_id=
  "omited",
 @client_secret="omited"
 @redirect_uri="http://localhost:3000/google_plus">
[5] pry(main)> cli.redirect_uri
=> "http://localhost:3000/google_plus"
[6] pry(main)> cli.authorize_url
=> "https://accounts.google.com/o/oauth2/auth?client_id=<<ommited>>&redirect_uri=http://localhost:3000/google_plus&scope=https://www.googleapis.com/auth/urlshortener&response_type=code"
# At this point I copied and pasted the code in the browser, authorized and then copied the params[:code] returned to paste in the following call
[7] pry(main)> cli.request_access_token("<<params[:code] returned>>")
CLI.=> #<Googl::OAuth2::Server:0x0000000c3ba1d0
 @access_token=
  "<<omited>>",
 @client_id=
  "<<omited>>",
 @client_secret="<<omited>>",
 @expires_at=2015-10-20 16:48:24 +0200,
 @expires_in=3600,
 @redirect_uri="http://localhost:3000/google_plus",
 @refresh_token=nil>
[8] pry(main)> cli.authorized?
=> false # hmm, even though we have the access token with 1hour validity

At this point any calls to the api (cli.history) would fail silently, and given the delay for the returning call, I suspect without any network request.
After playing around a little bit I decided to monkey patch the authorized? method:

[17] pry(main)> module Googl
[17] pry(main)*   module OAuth2  
[17] pry(main)*     module Utils    
[17] pry(main)*       def authorized?      
[17] pry(main)*         true
[17] pry(main)*       end  
[17] pry(main)*     end  
[17] pry(main)*   end  
[17] pry(main)* end  
=> nil
[18] pry(main)> cli.history # It works!
=> #<OpenStruct kind="urlshortener#urlHistory", total_items=1, items_per_page=30, items=[#<OpenStruct kind="urlshortener#url", label="https://goo.gl/DRakMM", long_url="https://en.wikipedia.org/wiki/Hopi_Hari", status="OK", created="2015-07-14T12:58:25.896+00:00">]>

After further checking, my issue was caused because #authorized? checks for refresh_token presence, even though my OAuth flow resulted in a valid access token, allowing me to succesfully perform requests. I wanted to know before submitting any pull requests if this is intentional or justified in some way, as I'm not really familiar with the details of the goo.gl API.

I'd gladly make a pull request to remove the check on the refresh_token presence, or maybe only check for the presence of the refresh_token in case the token has expired.

Thanks

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions