# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1582841851 -3600
# Node ID cf92e3b30c18ac17abe90597dca9b19ad75d66d3
# Parent  8ed261a08a9c6414f48f4155655227181e4025cf
mod_http_oauth2: Use component_secret setting as password on Components

Same setting as used by external components.

diff -r 8ed261a08a9c -r cf92e3b30c18 mod_http_oauth2/mod_http_oauth2.lua
--- a/mod_http_oauth2/mod_http_oauth2.lua	Thu Feb 27 23:14:24 2020 +0100
+++ b/mod_http_oauth2/mod_http_oauth2.lua	Thu Feb 27 23:17:31 2020 +0100
@@ -45,6 +45,27 @@
 	return oauth_error("invalid_grant", "incorrect credentials");
 end
 
+if module:get_host_type() == "component" then
+	local component_secret = assert(module:get_option_string("component_secret"), "'component_secret' is a required setting when loaded on a Component");
+
+	function grant_type_handlers.password(params)
+		local request_jid = assert(params.username, oauth_error("invalid_request", "missing 'username' (JID)"));
+		local request_password = assert(params.password, oauth_error("invalid_request", "missing 'password'"));
+		local request_username, request_host, request_resource = jid.prepped_split(request_jid);
+		if params.scope then
+			return oauth_error("invalid_scope", "unknown scope requested");
+		end
+		if not request_host or request_host ~= module.host then
+			return oauth_error("invalid_request", "invalid JID");
+		end
+		if request_password == component_secret then
+			local granted_jid = jid.join(request_username, request_host, request_resource);
+			return json.encode(new_access_token(granted_jid, request_host, nil, nil));
+		end
+		return oauth_error("invalid_grant", "incorrect credentials");
+	end
+end
+
 function handle_token_grant(event)
 	local params = http.formdecode(event.request.body);
 	if not params then