GSoC 2017 Week 3 : Creating methods for SocialAuthUserManager and SocialPostManager

Submitted by hudixt on Tue, 06/20/2017 - 17:52
GSOC 2017  : Coding Period

I am working on Adding support for The league OAuth and new implementers for social auth and social post under the mentorship of Getulio Sánchez "gvso" (Paraguay) and Daniel Harris “dahacouk” (UK). 

In the last week, we worked on creating an OAuth2Manager Class And Interface in social_api and extended it in social_auth and social_post. The classes inheriting OAuth2Manager class defined in social_auth and social_post will be used by their respective implementers.

Here are some of the things that I worked on during the 3rd week of GSoC coding period.

SocialAuthUserManager to use Entity in the authentication process [Pull Request]

As we have earlier set up universal entities in 1st week of GSoC, Now in this we’ve created methods such as addUserRecord which adds a record to social_auth entity table and checkIfUserExists which search for the drupal_user associated with the provider_user_id and pluginId.  

The method authenticateUser will be called from social_auth implementers and will be responsible for dealing with Authenticating the user. This is the UML diagram which depicts the logic flow process of authenticateUser($name, $email, $pluginId, $provider_user_id, $picture_url:-

fggClick To Enlarge

AuthenticateUser Method Code:-

Create SocialPostManager.php to use SocialPost Entities [Pull Request]

We have also defined to social post entities in the first week, now we’ll be creating the methods to use the entities. The 4 major methods we created are addRecord, getToken, updateToken and deleteRecord. Flow diagram of addRecord and getToken methods:

Social Post Manager

Storing tokens

As there can be multiple tokens required by social providers, instead of creating a record for each token we’re converting it into JSON format and then storing it. The array is passed as an argument which is then converted to JSON and then stored in database and vice versa in case of getToken method. Also as the length of data in the token field will exceed 255 characters limit, we had to change the datatype of a token field from string to string_long.

Securing The Access Token

During the 2nd week GSoC check-in meeting, our GSoC administrator “Matthew Lechleider ” asked me to work on securing the token as storing the tokens without encrypting it might possess huge security risk. As these tokens give access to some fairly privileged information about users, It's a good idea to keep it encrypted while not using it. So to JSON format is encoded using the key which gets defined in settings.php during the installation. The concept of key can be understood using the following diagram

Source- Oracle Docs

We’re using openssl_encrypt which encrypts data with given method and key, returns a raw or base64 encoded string. A unique non-NULL Initialization Vector is also generated with each data and is separated by ::, so the format of data stored in the table is encryptedstring::iv.

These were some of the important topics related to my project that I had to work on during my third week. I was thrilled by the third week of Google Summer Of Code coding phase. My goal for the next week is to finish the implementation of the social_auth_facebook by using the league library.