From 0edc2ecea41adbb5be1896323203c07dbbe26dbe Mon Sep 17 00:00:00 2001
From: James Barnsley <james@barnsley.nz>
Date: Mon, 12 Jun 2017 09:24:57 +1200
Subject: [PATCH] Authorization method

---
 auth.php                           | 78 ++++++++----------------------
 src/js/services/spotify/actions.js |  2 +-
 2 files changed, 22 insertions(+), 58 deletions(-)

diff --git a/auth.php b/auth.php
index d93c5ecc..4dcd9b9d 100755
--- a/auth.php
+++ b/auth.php
@@ -1,10 +1,16 @@
 <?php
 
-// allow cross-domain requests
+// Authorization script (PHP)
+define('URL','https://jamesbarnsley.co.nz/auth.php');
+
+// Spotify app credentials
+define('CLIENT_ID','01d4ca2e9f4f415c80502431a6aa4200');
+define('CLIENT_SECRET','7352c9c74791478ab02be0f004ec9541');
+
+// Allow cross-domain requests
 header("Access-Control-Allow-Origin: *");
 
-$url = 'https://jamesbarnsley.co.nz/auth.php';
-
+// Set our cookies
 if (isset($_GET['app'])){
 	setcookie( 'mopidy_iris', $_GET['app'], time()+3600 );
 }
@@ -17,7 +23,7 @@ if (isset($_GET['app'])){
 if (isset($_GET['code'])){
 	
 	// go get our credentials
-	$response = getToken( $_GET['code'], $url );	
+	$response = getToken($_GET['code']);
 	$responseArray = json_decode( $response, true );
 	
 	// add our code to the array of credentials, etc
@@ -30,7 +36,7 @@ if (isset($_GET['code'])){
 		die();
 	}
 	
-	// send our data back to Iris
+    // Pass our error back to the popup opener
 	?>	
 		<script type="text/javascript">
 			window.opener.postMessage( '<?php echo $response ?>', "*");
@@ -41,7 +47,7 @@ if (isset($_GET['code'])){
 // authorization error
 } else if (isset($_GET['error'])){
 
-        // Pass our error back to Iris
+        // Pass our error back to the popup opener
         ?>
                 <script type="text/javascript">
                         window.opener.postMessage("{\"error\": \"<?php echo $_GET['error'] ?>\"}", "*");
@@ -63,7 +69,11 @@ if (isset($_GET['code'])){
 
 // fresh authentication, so let's get one
 } else if (isset($_GET['action']) && $_GET['action'] == 'authorize'){
-	getAuthorizationCode( $url );
+
+	// Simply redirect to the authorization panel
+	header('Location: https://accounts.spotify.com/authorize?client_id='.CLIENT_ID.'&redirect_uri='.URL.'&scope='.$_GET['scope'].'&response_type=code&show_dialog=true');
+
+	exit;
 }
 
 
@@ -74,59 +84,13 @@ if (isset($_GET['code'])){
 /* ======================================================================================================= */
 
 
-
-/**
- * Acquire an authorization code.
- *
- * This is what connects an account's authorization for this app to use their account 
- * for future tokens and queries. Redirects to Spotify.
- * @param $url = redirect url (this script)
-*/
-function getAuthorizationCode( $url ){
-
-	$popup = 'https://accounts.spotify.com/authorize?client_id=01d4ca2e9f4f415c80502431a6aa4200&redirect_uri='.$url.'&scope=playlist-modify-private%20playlist-modify-public%20playlist-read-private%20playlist-modify-private%20user-library-read%20user-library-modify%20user-follow-modify%20user-follow-read%20user-top-read%20user-read-currently-playing%20user-read-playback-state&response_type=code&show_dialog=true';
-
-	?>
-		<script tye="text/javascript">
-		
-			// open an authentication request window (to spotify)
-			var popup = window.open("<?php echo $popup ?>","popup","height=680,width=400");
-
-			// listen for incoming messages from the popup
-			window.addEventListener('message', function(event){
-				
-				// only allow incoming data from our authentication proxy site
-				if( !/^https?:\/\/jamesbarnsley\.co\.nz/.test(event.origin) )
-					return false;
-
-				// pass the message on to the Angular application
-				window.parent.postMessage( event.data, '*' );
-			}, false);
-
-			var timer = setInterval(checkPopup, 1000);
-            function checkPopup(){
-                if( typeof(popup) !== 'undefined' && popup ){
-	                if( popup.closed ){
-	                    window.parent.postMessage( 'closed', '*' );
-	                    clearInterval(timer);
-	                }
-                }else{
-                    window.parent.postMessage( 'blocked', '*' );
-                    clearInterval(timer);
-                }
-            }
-
-		</script>
-	<?php
-}
-
 /*
  * Get a new access token
  * Creates a request to Spotify, which returns a new access_token, refresh_token and token_expiry object
  * @param $code = string
  * @param $url = redirect url (this script)
 */
-function getToken( $code, $url ){
+function getToken($code){
 	
 	$ch = curl_init();
 
@@ -134,11 +98,11 @@ function getToken( $code, $url ){
 		throw new Exception('Failed to initialize');
 		
 	$post_data = array(
-			'client_id' => '01d4ca2e9f4f415c80502431a6aa4200',
-			'client_secret' => '7352c9c74791478ab02be0f004ec9541',
+			'client_id' => CLIENT_ID,
+			'client_secret' => CLIENT_SECRET,
 			'grant_type' => 'authorization_code',
 			'code' => $code,
-			'redirect_uri' => $url
+			'redirect_uri' => URL
 		);
 	
 	curl_setopt($ch, CURLOPT_URL,"https://accounts.spotify.com/api/token");
diff --git a/src/js/services/spotify/actions.js b/src/js/services/spotify/actions.js
index 6b887655..ee6cb011 100755
--- a/src/js/services/spotify/actions.js
+++ b/src/js/services/spotify/actions.js
@@ -111,7 +111,7 @@ function refreshToken( dispatch, getState ){
 
             $.ajax({
                     method: 'GET',
-                    url: '//jamesbarnsley.co.nz/auth.php?action=refresh&refresh_token='+getState().spotify.refresh_token,
+                    url: getState().config.authorization_url+'?action=refresh&refresh_token='+getState().spotify.refresh_token,
                     dataType: "json",
                     timeout: 10000
                 })