Oauth1 support

[bmrussell]

Hi

I think httpYac is amazing! ...but lacking support for a legacy API I use. Using the plugin system, would it be possible to add support for Oauth1, possibly leveraging another node package like this: https://www.npmjs.com/package/oauth-1.0a ?

Asking as I have plenty of programming experience, but minimal js and node, so would appreciate an experienced opinion.

[AnWeber]

Yes, it certainly works. It's just a question of how ambitious you are with the implementation. If you only want to use hard-coded values or variable names, you could use the OnRequestHook.

const crypto = require('crypto')
const OAuth = require('oauth-1.0a')
module.exports = {
  configureHooks: function (api) {
    api.hooks.onRequest.addHook('oauth1', async function (request, context) {
      const variables = context.variables; // access env vars

      // init oauth headers
      oauth = new OAuth({
        consumer: {
          key: variables.oauthKey,
          secret: variables.oauthSecret
        },
        signature_method: 'HMAC-SHA1',
        hash_function: function (base_string, key) {
          return crypto.createHmac(algo, key).update(base_string).digest(enc);
        },
        body_hash_function: function (data) {
          return crypto.createHash(algo).update(data).digest(enc);
        }
      });
      // set oauth headers to request.headers
      const headers = oauth.toHeader(oauth.authorize({
        url: request.url,
        method: request.method,
        data: request.body
      }));

      Object.assign(request.headers, headers);

   
    });
  }
}

If you really want to go the way similar to OAuth2 or AWS and make it dependent on a header similar to Authorization=oauth1 the way via api.hooks.replaceVariable is the way to implement this feature.

const crypto = require('crypto')
const OAuth = require('oauth-1.0a')
module.exports = {
  configureHooks: function (api) {
    api.hooks.onRequest.addHook('oauth1', async function (text, type, context) {
        const request = context.request;
        ....
    });
  }
}

The whole code is mocked up here and without guarantee that it will work in the same way. I'm irritated that no async is needed here to generate the token, but I don't really know OAuth1 either. I would have to read through the RFC and check whether there is no server communication at all.

[bmrussell]

Thanks @AnWeber for the comprehensive answer! - It might not be quick but if I make progress I'll report back. httpYac is awesome!

[AnWeber]

Just ask, if you got some questions. Best with executable example. Will try to help.