From 355c1490dae834431e625076836224453ab5c794 Mon Sep 17 00:00:00 2001
From: James Barnsley <james@barnsley.nz>
Date: Mon, 12 Jun 2017 08:34:21 +1200
Subject: [PATCH] Configurable auth_url for user-defined auth frame

---
 mopidy_iris/__init__.py                       |  1 +
 mopidy_iris/core.py                           |  3 +-
 mopidy_iris/ext.conf                          |  3 +-
 .../components/SpotifyAuthenticationFrame.js  | 29 ++++++++++---------
 4 files changed, 21 insertions(+), 15 deletions(-)

diff --git a/mopidy_iris/__init__.py b/mopidy_iris/__init__.py
index bff33c38..b6f9e8e7 100755
--- a/mopidy_iris/__init__.py
+++ b/mopidy_iris/__init__.py
@@ -34,6 +34,7 @@ class Extension( ext.Extension ):
         schema['enabled'] = config.Boolean()
         schema['country'] = config.String()
         schema['locale'] = config.String()
+        schema['authorization_url'] = config.String()
         return schema
 
     def setup(self, registry):
diff --git a/mopidy_iris/core.py b/mopidy_iris/core.py
index 44a6f4e0..53d3a2de 100755
--- a/mopidy_iris/core.py
+++ b/mopidy_iris/core.py
@@ -194,7 +194,8 @@ class IrisCore(object):
         config = {
             "spotify_username": spotify_username,
             "country": self.config['iris']['country'],
-            "locale": self.config['iris']['locale']
+            "locale": self.config['iris']['locale'],
+            "authorization_url": self.config['iris']['authorization_url']
         }
         return {
             'config': config
diff --git a/mopidy_iris/ext.conf b/mopidy_iris/ext.conf
index dd07bf86..973ad7fd 100755
--- a/mopidy_iris/ext.conf
+++ b/mopidy_iris/ext.conf
@@ -1,4 +1,5 @@
 [iris]
 enabled = true
 country = NZ
-locale = en_NZ
\ No newline at end of file
+locale = en_NZ
+authorization_url = http://iris.barnsley.nz/auth.php
\ No newline at end of file
diff --git a/src/js/components/SpotifyAuthenticationFrame.js b/src/js/components/SpotifyAuthenticationFrame.js
index b7a00447..71f100d4 100755
--- a/src/js/components/SpotifyAuthenticationFrame.js
+++ b/src/js/components/SpotifyAuthenticationFrame.js
@@ -17,7 +17,7 @@ class SpotifyAuthenticationFrame extends React.Component{
 		super(props);
 
 		this.state = {
-			frameUrl: 'https://jamesbarnsley.co.nz/auth.php?action=frame',
+			frameUrl: this.props.authorization_url+'?action=frame',
 			authorizing: false
 		}
 	}
@@ -26,14 +26,22 @@ class SpotifyAuthenticationFrame extends React.Component{
 
 		let self = this;
 
-		// listen for incoming messages from the authorization iframe
-		// this is triggered when authentication is granted from the popup
+		// Listen for incoming messages from the authorization iframe
+		// This is triggered when the popup posts a message, which is then passed to
+		// the iframe, and then passed on to the parent frame (our application)
 		window.addEventListener('message', function(event){
+				
+			// only allow incoming data from our authorized authenticator proxy
+			var authorization_domain = self.props.authorization_url.substring(0,self.props.authorization_url.indexOf('/',8))
+			if (event.origin != authorization_domain){
+				self.props.uiActions.createNotification('Authorization failed. '+event.origin+' is not the configured authorization_url.','bad')
+				return false
+			}
 			
 			// Window prematurely closed
 			if (event.data == 'closed'){
 				self.setState({
-					frameUrl: 'https://jamesbarnsley.co.nz/auth.php?action=frame',
+					frameUrl: self.props.authorization_url+'?action=frame',
 					authorizing: false
 				})
 
@@ -41,17 +49,11 @@ class SpotifyAuthenticationFrame extends React.Component{
 			} else if (event.data == 'blocked'){
 				self.props.uiActions.createNotification('Popup blocked. Please allow popups and try again.','bad')
 				self.setState({
-					frameUrl: 'https://jamesbarnsley.co.nz/auth.php?action=frame',
+					frameUrl: self.props.authorization_url+'?action=frame',
 					authorizing: false
 				})
 
 			} else {
-				
-				// only allow incoming data from our authorized authenticator proxy
-				if (!/^https?:\/\/jamesbarnsley\.co\.nz/.test(event.origin)){
-					return false
-				}
-
 				var data = JSON.parse(event.data);
 
 				// Spotify bounced with an error
@@ -66,7 +68,7 @@ class SpotifyAuthenticationFrame extends React.Component{
 
 				// Turn off our authorizing switch
 				self.setState({
-					frameUrl: 'https://jamesbarnsley.co.nz/auth.php?action=frame',
+					frameUrl: self.props.authorization_url+'?action=frame',
 					authorizing: false
 				})	
 			}
@@ -76,7 +78,7 @@ class SpotifyAuthenticationFrame extends React.Component{
 
 	startAuthorization(){
 		this.setState({
-			frameUrl: 'https://jamesbarnsley.co.nz/auth.php?action=authorize&app='+location.protocol+'//'+window.location.host,
+			frameUrl: this.props.authorization_url+'?action=authorize&app='+location.protocol+'//'+window.location.host,
 			authorizing: true
 		})
 	}
@@ -128,6 +130,7 @@ class SpotifyAuthenticationFrame extends React.Component{
 
 const mapStateToProps = (state, ownProps) => {
 	return {
+		authorization_url: (state.ui.config && state.ui.config.authorization_url ? state.ui.config.authorization_url : 'https://jamesbarnsley.co.nz/auth.php'),
 		authorized: state.spotify.authorized,
 		authorizing: state.spotify.authorizing,
 		refreshing_token: state.spotify.refreshing_token