OAuth - Phabricator OAuth server and Phabricator client for new Phabricator OAuth Server

Summary:
adds a Phabricator OAuth server, which has three big commands:
 - auth - allows $user to authorize a given client or application.  if $user has already authorized, it hands an authoization code back to $redirect_uri
 - token - given a valid authorization code, this command returns an authorization token
 - whoami - Conduit.whoami, all nice and purdy relative to the oauth server.
Also has a "test" handler, which I used to create some test data.  T850 will
delete this as it adds the ability to create this data in the Phabricator
product.

This diff also adds the corresponding client in Phabricator for the Phabricator
OAuth Server.  (Note that clients are known as "providers" in the Phabricator
codebase but client makes more sense relative to the server nomenclature)

Also, related to make this work well
 - clean up the diagnostics page by variabilizing the provider-specific
information and extending the provider classes as appropriate.
 - augment Conduit.whoami for more full-featured OAuth support, at least where
the Phabricator client is concerned

What's missing here...   See T844, T848, T849, T850, and T852.

Test Plan:
- created a dummy client via the test handler.   setup development.conf to have
have proper variables for this dummy client.  went through authorization and
de-authorization flows
- viewed the diagnostics page for all known oauth providers and saw
provider-specific debugging information

Reviewers: epriestley

CC: aran, epriestley

Maniphest Tasks: T44, T797

Differential Revision: https://secure.phabricator.com/D1595

src/applications/oauthserver/controller/auth/PhabricatorOAuthServerAuthController.php

@@ -0,0 +1,130 @@
+<?php
+
+/*
+ * Copyright 2012 Facebook, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @group oauthserver
+ */
+final class PhabricatorOAuthServerAuthController
+extends PhabricatorAuthController {
+
+  public function shouldRequireLogin() {
+    return true;
+  }
+
+  public function processRequest() {
+    $request      = $this->getRequest();
+    $current_user = $request->getUser();
+    $server       = new PhabricatorOAuthServer($current_user);
+    $client_phid  = $request->getStr('client_id');
+    $scope        = $request->getStr('scope');
+    $redirect_uri = $request->getStr('redirect_uri');
+    $response     = new PhabricatorOAuthResponse();
+    $errors       = array();
+
+    if (!$client_phid) {
+      return $response->setMalformed(
+        'Required parameter client_id not specified.'
+      );
+    }
+    $client = id(new PhabricatorOAuthServerClient())
+      ->loadOneWhere('phid = %s', $client_phid);
+    if (!$client) {
+      return $response->setNotFound(
+        'Client with id '.$client_phid.' not found. '
+      );
+    }
+
+    if ($server->userHasAuthorizedClient($client)) {
+      $return_auth_code = true;
+      $unguarded_write  = AphrontWriteGuard::beginScopedUnguardedWrites();
+    } else if ($request->isFormPost()) {
+      $server->authorizeClient($client);
+      $return_auth_code = true;
+      $unguarded_write  = null;
+    } else {
+      $return_auth_code = false;
+      $unguarded_write  = null;
+    }
+
+    if ($return_auth_code) {
+      // step 1 -- generate authorization code
+      $auth_code =
+        $server->generateAuthorizationCode($client);
+
+      // step 2 -- error or return it
+      if (!$auth_code) {
+        $errors[] = 'Failed to generate an authorization code. '.
+                    'Try again.';
+      } else {
+        $client_uri = new PhutilURI($client->getRedirectURI());
+        if (!$redirect_uri) {
+          $uri = $client_uri;
+        } else {
+          $redirect_uri = new PhutilURI($redirect_uri);
+          if ($redirect_uri->getDomain() !=
+              $client_uri->getDomain()) {
+            $uri = $client_uri;
+          } else {
+            $uri = $redirect_uri;
+          }
+        }
+
+        $uri->setQueryParam('code', $auth_code->getCode());
+        return $response->setRedirect($uri);
+      }
+    }
+    unset($unguarded_write);
+
+    $error_view = null;
+    if ($errors) {
+      $error_view = new AphrontErrorView();
+      $error_view->setTitle('Authorization Code Errors');
+      $error_view->setErrors($errors);
+    }
+
+    $name  = phutil_escape_html($client->getName());
+    $title = 'Authorize ' . $name . '?';
+    $panel = new AphrontPanelView();
+    $panel->setWidth(AphrontPanelView::WIDTH_FORM);
+    $panel->setHeader($title);
+
+    // TODO -- T848 (add scope to Phabricator OAuth)
+    // generally inform user what this means as this fleshes out
+    $description =
+      "Do want to authorize {$name} to access your ".
+      "Phabricator account data?";
+
+    $form = id(new AphrontFormView())
+      ->setUser($current_user)
+      ->appendChild(
+        id(new AphrontFormStaticControl())
+        ->setValue($description))
+      ->appendChild(
+        id(new AphrontFormSubmitControl())
+        ->setValue('Authorize')
+        ->addCancelButton('/'));
+    // TODO -- T889 (make "cancel" do something more sensible)
+
+    $panel->appendChild($form);
+
+    return $this->buildStandardPageResponse(
+      array($error_view,
+            $panel),
+      array('title' => $title));
+  }
+}

src/applications/oauthserver/controller/auth/__init__.php

@@ -0,0 +1,25 @@
+<?php
+/**
+ * This file is automatically generated. Lint this module to rebuild it.
+ * @generated
+ */
+
+
+
+phutil_require_module('phabricator', 'aphront/writeguard');
+phutil_require_module('phabricator', 'applications/auth/controller/base');
+phutil_require_module('phabricator', 'applications/oauthserver/response');
+phutil_require_module('phabricator', 'applications/oauthserver/server');
+phutil_require_module('phabricator', 'applications/oauthserver/storage/client');
+phutil_require_module('phabricator', 'view/form/base');
+phutil_require_module('phabricator', 'view/form/control/static');
+phutil_require_module('phabricator', 'view/form/control/submit');
+phutil_require_module('phabricator', 'view/form/error');
+phutil_require_module('phabricator', 'view/layout/panel');
+
+phutil_require_module('phutil', 'markup');
+phutil_require_module('phutil', 'parser/uri');
+phutil_require_module('phutil', 'utils');
+
+
+phutil_require_source('PhabricatorOAuthServerAuthController.php');

src/applications/oauthserver/controller/test/PhabricatorOAuthServerTestController.php

@@ -0,0 +1,88 @@
+<?php
+
+/*
+ * Copyright 2012 Facebook, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @group oauthserver
+ */
+final class PhabricatorOAuthServerTestController
+extends PhabricatorAuthController {
+
+  public function shouldRequireLogin() {
+    return true;
+  }
+
+  public function shouldRequireAdmin() {
+    return true;
+  }
+
+  public function processRequest() {
+    $request      = $this->getRequest();
+    $current_user = $request->getUser();
+    $server       = new PhabricatorOAuthServer($current_user);
+
+    $forms = array();
+    $form = id(new AphrontFormView())
+      ->setUser($current_user)
+      ->appendChild(
+        id(new AphrontFormStaticControl())
+        ->setValue('Create Test Client'))
+      ->appendChild(
+        id(new AphrontFormTextControl())
+        ->setLabel('Name')
+        ->setName('name')
+        ->setValue(''))
+      ->appendChild(
+        id(new AphrontFormTextControl())
+        ->setLabel('Redirect URI')
+        ->setName('redirect_uri')
+        ->setValue(''))
+      ->appendChild(
+        id(new AphrontFormSubmitControl())
+        ->setValue('Create Client'));
+    $forms[] = $form;
+    $result = array();
+    if ($request->isFormPost()) {
+      $name         = $request->getStr('name');
+      $redirect_uri = $request->getStr('redirect_uri');
+      $secret       = Filesystem::readRandomCharacters(32);
+      $client       = new PhabricatorOAuthServerClient();
+      $client->setName($name);
+      $client->setSecret($secret);
+      $client->setCreatorPHID($current_user->getPHID());
+      $client->setRedirectURI($redirect_uri);
+      $client->save();
+      $id      = $client->getID();
+      $phid    = $client->getPHID();
+      $name    = phutil_escape_html($name);
+      $results = array();
+      $results[] = "New client named {$name} with secret {$secret}.";
+      $results[] = "Client has id {$id} and phid {$phid}.";
+      $result = implode('<br />', $results);
+    }
+    $title = 'Test OAuthServer Stuff';
+    $panel = new AphrontPanelView();
+    $panel->setWidth(AphrontPanelView::WIDTH_FORM);
+    $panel->setHeader($title);
+    $panel->appendChild($result);
+    $panel->appendChild($forms);
+
+    return $this->buildStandardPageResponse(
+            $panel,
+      array('title' => $title));
+  }
+}

src/applications/oauthserver/controller/test/__init__.php

@@ -0,0 +1,23 @@
+<?php
+/**
+ * This file is automatically generated. Lint this module to rebuild it.
+ * @generated
+ */
+
+
+
+phutil_require_module('phabricator', 'applications/auth/controller/base');
+phutil_require_module('phabricator', 'applications/oauthserver/server');
+phutil_require_module('phabricator', 'applications/oauthserver/storage/client');
+phutil_require_module('phabricator', 'view/form/base');
+phutil_require_module('phabricator', 'view/form/control/static');
+phutil_require_module('phabricator', 'view/form/control/submit');
+phutil_require_module('phabricator', 'view/form/control/text');
+phutil_require_module('phabricator', 'view/layout/panel');
+
+phutil_require_module('phutil', 'filesystem');
+phutil_require_module('phutil', 'markup');
+phutil_require_module('phutil', 'utils');
+
+
+phutil_require_source('PhabricatorOAuthServerTestController.php');

src/applications/oauthserver/controller/token/PhabricatorOAuthServerTokenController.php

@@ -0,0 +1,90 @@
+<?php
+
+/*
+ * Copyright 2012 Facebook, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @group oauthserver
+ */
+final class PhabricatorOAuthServerTokenController
+extends PhabricatorAuthController {
+
+  public function shouldRequireLogin() {
+    return false;
+  }
+
+  public function processRequest() {
+    $request       = $this->getRequest();
+    $code          = $request->getStr('code');
+    $client_phid   = $request->getStr('client_id');
+    $client_secret = $request->getStr('client_secret');
+    $response      = new PhabricatorOAuthResponse();
+    if (!$code) {
+      return $response->setMalformed(
+        'Required parameter code missing.'
+      );
+    }
+    if (!$client_phid) {
+      return $response->setMalformed(
+        'Required parameter client_id missing.'
+      );
+    }
+    if (!$client_secret) {
+      return $response->setMalformed(
+        'Required parameter client_secret missing.'
+      );
+    }
+
+    $auth_code = id(new PhabricatorOAuthServerAuthorizationCode())
+      ->loadOneWhere('code = %s', $code);
+    if (!$auth_code) {
+      return $response->setNotFound(
+        'Authorization code '.$code.' not found.'
+      );
+    }
+    $user = id(new PhabricatorUser())
+      ->loadOneWhere('phid = %s', $auth_code->getUserPHID());
+    $server = new PhabricatorOAuthServer($user);
+    $test_code = new PhabricatorOAuthServerAuthorizationCode();
+    $test_code->setClientSecret($client_secret);
+    $test_code->setClientPHID($client_phid);
+    $is_good_code = $server->validateAuthorizationCode($auth_code,
+                                                       $test_code);
+    if (!$is_good_code) {
+      return $response->setMalformed(
+        'Invalid authorization code '.$code.'.'
+      );
+    }
+
+    $client = id(new PhabricatorOAuthServerClient())
+      ->loadOneWhere('phid = %s', $client_phid);
+    if (!$client) {
+      return $response->setNotFound(
+        'Client with client_id '.$client_phid.' not found.'
+      );
+    }
+
+    $scope = AphrontWriteGuard::beginScopedUnguardedWrites();
+    $access_token = $server->generateAccessToken($client);
+    if ($access_token) {
+      $auth_code->delete();
+      $result = array('access_token' => $access_token->getToken());
+      return $response->setContent($result);
+    }
+
+    return $response->setMalformed('Request is malformed in some way.');
+  }
+}

src/applications/oauthserver/controller/token/__init__.php

@@ -0,0 +1,20 @@
+<?php
+/**
+ * This file is automatically generated. Lint this module to rebuild it.
+ * @generated
+ */
+
+
+
+phutil_require_module('phabricator', 'aphront/writeguard');
+phutil_require_module('phabricator', 'applications/auth/controller/base');
+phutil_require_module('phabricator', 'applications/oauthserver/response');
+phutil_require_module('phabricator', 'applications/oauthserver/server');
+phutil_require_module('phabricator', 'applications/oauthserver/storage/authorizationcode');
+phutil_require_module('phabricator', 'applications/oauthserver/storage/client');
+phutil_require_module('phabricator', 'applications/people/storage/user');
+
+phutil_require_module('phutil', 'utils');
+
+
+phutil_require_source('PhabricatorOAuthServerTokenController.php');

src/applications/oauthserver/response/PhabricatorOAuthResponse.php

@@ -0,0 +1,93 @@
+<?php
+
+/*
+ * Copyright 2012 Facebook, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+* @group oauthserver
+*/
+final class PhabricatorOAuthResponse extends AphrontResponse {
+
+  private $content;
+  private $uri;
+
+  public function setContent($content) {
+    $this->content = $content;
+    return $this;
+  }
+  private function getContent() {
+    return $this->content;
+  }
+
+  private function setURI($uri) {
+    $this->uri = $uri;
+    return $this;
+  }
+  private function getURI() {
+    return $this->uri;
+  }
+
+  public function setMalformed($malformed) {
+    if ($malformed) {
+      $this->setHTTPResponseCode(400);
+      $this->setContent(array('error' => $malformed));
+    }
+    return $this;
+  }
+
+  public function setNotFound($not_found) {
+    if ($not_found) {
+      $this->setHTTPResponseCode(404);
+      $this->setContent(array('error' => $not_found));
+    }
+    return $this;
+  }
+
+  public function setRedirect(PhutilURI $uri) {
+    if ($uri) {
+      $this->setHTTPResponseCode(302);
+      $this->setURI($uri);
+      $this->setContent(null);
+    }
+    return $this;
+  }
+
+  public function __construct() {
+    $this->setHTTPResponseCode(200);
+    return $this;
+  }
+
+  public function getHeaders() {
+    $headers = array(
+      array('Content-Type', 'application/json'),
+    );
+    if ($this->getURI()) {
+      $headers[] = array('Location', $this->getURI());
+    }
+    // TODO -- T844 set headers with X-Auth-Scopes, etc
+    $headers = array_merge(parent::getHeaders(), $headers);
+    return $headers;
+  }
+
+  public function buildResponseString() {
+    $content = $this->getContent();
+    if ($content) {
+      return $this->encodeJSONForHTTPResponse($content);
+    }
+    return '';
+  }
+
+}

src/applications/oauthserver/response/__init__.php

@@ -0,0 +1,12 @@
+<?php
+/**
+ * This file is automatically generated. Lint this module to rebuild it.
+ * @generated
+ */
+
+
+
+phutil_require_module('phabricator', 'aphront/response/base');
+
+
+phutil_require_source('PhabricatorOAuthResponse.php');

src/applications/oauthserver/server/PhabricatorOAuthServer.php

@@ -0,0 +1,151 @@
+<?php
+
+/*
+ * Copyright 2012 Facebook, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Implements core OAuth 2.0 Server logic.
+ *
+ * This class should be used behind business logic that parses input to
+ * determine pertinent @{class:PhabricatorUser} $user,
+ * @{class:PhabricatorOAuthServerClient} $client(s),
+ * @{class:PhabricatorOAuthServerAuthorizationCode} $code(s), and.
+ * @{class:PhabricatorOAuthServerAccessToken} $token(s).
+ *
+ * For an OAuth 2.0 server, there are two main steps:
+ *
+ * 1) Authorization - the user authorizes a given client to access the data
+ * the OAuth 2.0 server protects.  Once this is achieved / if it has
+ * been achived already, the OAuth server sends the client an authorization
+ * code.
+ * 2) Access Token - the client should send the authorization code received in
+ * step 1 along with its id and secret to the OAuth server to receive an
+ * access token.  This access token can later be used to access Phabricator
+ * data on behalf of the user.
+ *
+ * @task auth Authorizing @{class:PhabricatorOAuthServerClient}s and
+ *            generating @{class:PhabricatorOAuthServerAuthorizationCode}s
+ * @task token Validating @{class:PhabricatorOAuthServerAuthorizationCode}s
+ *             and generating @{class:PhabricatorOAuthServerAccessToken}s
+ * @task internal Internals
+ *
+ * @group oauthserver
+ */
+final class PhabricatorOAuthServer {
+
+  const AUTHORIZATION_CODE_TIMEOUT = 300;
+
+  private $user;
+
+  /**
+   * @group internal
+   */
+  private function getUser() {
+    return $this->user;
+  }
+
+  public function __construct(PhabricatorUser $user) {
+    if (!$user) {
+      throw new Exception('Must specify a Phabricator $user to constructor!');
+    }
+    $this->user = $user;
+  }
+
+  /**
+   * @task auth
+   */
+  public function userHasAuthorizedClient(
+    PhabricatorOAuthServerClient $client) {
+
+    $authorization = id(new PhabricatorOAuthClientAuthorization())->
+      loadOneWhere('userPHID = %s AND clientPHID = %s',
+                   $this->getUser()->getPHID(),
+                   $client->getPHID());
+
+    if (empty($authorization)) {
+      return false;
+    }
+
+    return true;
+  }
+
+  /**
+   * @task auth
+   */
+  public function authorizeClient(PhabricatorOAuthServerClient $client) {
+    $authorization = new PhabricatorOAuthClientAuthorization();
+    $authorization->setUserPHID($this->getUser()->getPHID());
+    $authorization->setClientPHID($client->getPHID());
+    $authorization->save();
+  }
+
+  /**
+   * @task auth
+   */
+  public function generateAuthorizationCode(
+    PhabricatorOAuthServerClient $client) {
+
+    $code = Filesystem::readRandomCharacters(32);
+
+    $authorization_code = new PhabricatorOAuthServerAuthorizationCode();
+    $authorization_code->setCode($code);
+    $authorization_code->setClientPHID($client->getPHID());
+    $authorization_code->setClientSecret($client->getSecret());
+    $authorization_code->setUserPHID($this->getUser()->getPHID());
+    $authorization_code->save();
+
+    return $authorization_code;
+  }
+
+  /**
+   * @task token
+   */
+  public function generateAccessToken(PhabricatorOAuthServerClient $client) {
+
+    $token = Filesystem::readRandomCharacters(32);
+
+    $access_token = new PhabricatorOAuthServerAccessToken();
+    $access_token->setToken($token);
+    $access_token->setUserPHID($this->getUser()->getPHID());
+    $access_token->setClientPHID($client->getPHID());
+    $access_token->setDateExpires(0);
+    $access_token->save();
+
+    return $access_token;
+  }
+
+  /**
+   * @task token
+   */
+  public function validateAuthorizationCode(
+    PhabricatorOAuthServerAuthorizationCode $test_code,
+    PhabricatorOAuthServerAuthorizationCode $valid_code) {
+
+    // check that all the meta data matches
+    if ($test_code->getClientPHID() != $valid_code->getClientPHID()) {
+      return false;
+    }
+    if ($test_code->getClientSecret() != $valid_code->getClientSecret()) {
+      return false;
+    }
+
+    // check that the authorization code hasn't timed out
+    $created_time = $test_code->getDateCreated();
+    $must_be_used_by = $created_time + self::AUTHORIZATION_CODE_TIMEOUT;
+    return (time() < $must_be_used_by);
+  }
+
+}

src/applications/oauthserver/server/__init__.php

@@ -0,0 +1,17 @@
+<?php
+/**
+ * This file is automatically generated. Lint this module to rebuild it.
+ * @generated
+ */
+
+
+
+phutil_require_module('phabricator', 'applications/oauthserver/storage/accesstoken');
+phutil_require_module('phabricator', 'applications/oauthserver/storage/authorizationcode');
+phutil_require_module('phabricator', 'applications/oauthserver/storage/clientauthorization');
+
+phutil_require_module('phutil', 'filesystem');
+phutil_require_module('phutil', 'utils');
+
+
+phutil_require_source('PhabricatorOAuthServer.php');

src/applications/oauthserver/storage/accesstoken/PhabricatorOAuthServerAccessToken.php

@@ -0,0 +1,29 @@
+<?php
+
+/*
+ * Copyright 2012 Facebook, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @group oauthserver
+ */
+final class PhabricatorOAuthServerAccessToken
+extends PhabricatorOAuthServerDAO {
+  protected $id;
+  protected $token;
+  protected $userPHID;
+  protected $clientPHID;
+  protected $dateExpires;
+}

src/applications/oauthserver/storage/accesstoken/__init__.php

@@ -0,0 +1,12 @@
+<?php
+/**
+ * This file is automatically generated. Lint this module to rebuild it.
+ * @generated
+ */
+
+
+
+phutil_require_module('phabricator', 'applications/oauthserver/storage/base');
+
+
+phutil_require_source('PhabricatorOAuthServerAccessToken.php');

src/applications/oauthserver/storage/authorizationcode/PhabricatorOAuthServerAuthorizationCode.php

@@ -0,0 +1,30 @@
+<?php
+
+/*
+ * Copyright 2012 Facebook, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @group oauthserver
+ */
+final class PhabricatorOAuthServerAuthorizationCode
+extends PhabricatorOAuthServerDAO {
+
+  protected $id;
+  protected $code;
+  protected $clientPHID;
+  protected $clientSecret;
+  protected $userPHID;
+}

src/applications/oauthserver/storage/authorizationcode/__init__.php

@@ -0,0 +1,12 @@
+<?php
+/**
+ * This file is automatically generated. Lint this module to rebuild it.
+ * @generated
+ */
+
+
+
+phutil_require_module('phabricator', 'applications/oauthserver/storage/base');
+
+
+phutil_require_source('PhabricatorOAuthServerAuthorizationCode.php');

src/applications/oauthserver/storage/base/PhabricatorOAuthServerDAO.php

@@ -0,0 +1,26 @@
+<?php
+
+/*
+ * Copyright 2012 Facebook, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @group oauthserver
+ */
+abstract class PhabricatorOAuthServerDAO extends PhabricatorLiskDAO {
+  public function getApplicationName() {
+    return 'oauth_server';
+  }
+}

src/applications/oauthserver/storage/base/__init__.php

@@ -0,0 +1,12 @@
+<?php
+/**
+ * This file is automatically generated. Lint this module to rebuild it.
+ * @generated
+ */
+
+
+
+phutil_require_module('phabricator', 'applications/base/storage/lisk');
+
+
+phutil_require_source('PhabricatorOAuthServerDAO.php');

src/applications/oauthserver/storage/client/PhabricatorOAuthServerClient.php

@@ -0,0 +1,43 @@
+<?php
+
+/*
+ * Copyright 2012 Facebook, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @group oauthserver
+ */
+final class PhabricatorOAuthServerClient
+extends PhabricatorOAuthServerDAO {
+
+  protected $id;
+  protected $phid;
+  protected $secret;
+  protected $name;
+  protected $redirectURI;
+  protected $creatorPHID;
+
+  public function getConfiguration() {
+    return array(
+      self::CONFIG_AUX_PHID => true,
+    ) + parent::getConfiguration();
+  }
+
+  public function generatePHID() {
+    return PhabricatorPHID::generateNewPHID(
+      PhabricatorPHIDConstants::PHID_TYPE_OASC);
+  }
+
+}

src/applications/oauthserver/storage/client/__init__.php

@@ -0,0 +1,14 @@
+<?php
+/**
+ * This file is automatically generated. Lint this module to rebuild it.
+ * @generated
+ */
+
+
+
+phutil_require_module('phabricator', 'applications/oauthserver/storage/base');
+phutil_require_module('phabricator', 'applications/phid/constants');
+phutil_require_module('phabricator', 'applications/phid/storage/phid');
+
+
+phutil_require_source('PhabricatorOAuthServerClient.php');

src/applications/oauthserver/storage/clientauthorization/PhabricatorOAuthClientAuthorization.php

@@ -0,0 +1,41 @@
+<?php
+
+/*
+ * Copyright 2012 Facebook, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @group oauthserver
+ */
+final class PhabricatorOAuthClientAuthorization
+extends PhabricatorOAuthServerDAO {
+
+  protected $id;
+  protected $phid;
+  protected $userPHID;
+  protected $clientPHID;
+
+
+  public function getConfiguration() {
+    return array(
+      self::CONFIG_AUX_PHID => true,
+    ) + parent::getConfiguration();
+  }
+
+  public function generatePHID() {
+    return PhabricatorPHID::generateNewPHID(
+      PhabricatorPHIDConstants::PHID_TYPE_OASA);
+  }
+}

src/applications/oauthserver/storage/clientauthorization/__init__.php

@@ -0,0 +1,14 @@
+<?php
+/**
+ * This file is automatically generated. Lint this module to rebuild it.
+ * @generated
+ */
+
+
+
+phutil_require_module('phabricator', 'applications/oauthserver/storage/base');
+phutil_require_module('phabricator', 'applications/phid/constants');
+phutil_require_module('phabricator', 'applications/phid/storage/phid');
+
+
+phutil_require_source('PhabricatorOAuthClientAuthorization.php');