Support OAuth flow for Connect accounts

lib/StripeResource.js

@@ -23,7 +23,7 @@ function StripeResource(stripe, urlData) {
   this._stripe = stripe;
   this._urlData = urlData || {};
 
-  this.basePath = utils.makeURLInterpolator(stripe.getApiField('basePath'));
+  this.basePath = utils.makeURLInterpolator(this.basePath || stripe.getApiField('basePath'));
   this.resourcePath = this.path;
   this.path = utils.makeURLInterpolator(this.path);
 
@@ -40,6 +40,9 @@ StripeResource.prototype = {
 
   path: '',
 
+  // Methods that don't use the API's default '/v1' path can override it with this setting.
+  basePath: null,
+
   initialize: function() {},
 
   // Function to override the default data processor. This allows full control

lib/resources/OAuth.js

@@ -0,0 +1,62 @@
+'use strict';
+
+var StripeResource = require('../StripeResource');
+var stripeMethod = StripeResource.method;
+var utils = require('../utils');
+
+var oAuthHost = 'connect.stripe.com';
+
+module.exports = StripeResource.extend({
+  basePath: '/',
+
+  authorizeUrl: function(params, options) {
+    // As long as we support Node v4, we have to set defaults like this
+    params = params || {};
+    options = options || {};
+
+    var path = 'oauth/authorize';
+
+    // For Express accounts, the path changes
+    if (options.express) {
+      path = 'express/' + path;
+    }
+
+    if (!params.response_type) {
+      params.response_type = 'code';
+    }
+
+    if (!params.client_id) {
+      var clientId = this._stripe.clientId;
+
+      if (!clientId) {
+        throw Error(this._stripe.ERROR_CLIENT_ID_NOT_SET);
+      }
+
+      params.client_id = clientId;
+    }
+
+    if (!params.scope) {
+      params.scope = 'read_write';
+    }
+
+    return 'https://' + oAuthHost + '/' + path + '?' + utils.stringifyRequestData(params);
+  },
+
+  token: stripeMethod({
+    method: 'POST',
+    path: 'oauth/token',
+    host: oAuthHost,
+  }),
+
+  deauthorize: function(spec) {
+    if (!spec.client_id) {
+      spec.client_id = this._stripe.clientId;
+    }
+
+    return stripeMethod({
+      method: 'POST',
+      path: 'oauth/deauthorize',
+      host: oAuthHost,
+    }).apply(this, arguments);
+  },
+});

lib/stripe.js

@@ -21,6 +21,10 @@ Stripe.USER_AGENT = {
 
 Stripe.USER_AGENT_SERIALIZED = null;
 
+Stripe.ERROR_CLIENT_ID_NOT_SET = 'Please set stripe.clientId or pass client_id as a parameter' +
+                                 'when calling this method. You can find your client_id at' +
+                                 'https://dashboard.stripe.com/account/applications/settings.'
+
 var APP_INFO_PROPERTIES = ['name', 'version', 'url', 'partner_id'];
 
 var EventEmitter = require('events').EventEmitter;
@@ -52,6 +56,7 @@ var resources = {
   Invoices: require('./resources/Invoices'),
   IssuerFraudRecords: require('./resources/IssuerFraudRecords'),
   LoginLinks: require('./resources/LoginLinks'),
+  OAuth: require('./resources/OAuth'),
   OrderReturns: require('./resources/OrderReturns'),
   Orders: require('./resources/Orders'),
   PaymentIntents: require('./resources/PaymentIntents'),
@@ -152,6 +157,7 @@ Stripe.errors = require('./Error');
 Stripe.webhooks = require('./Webhooks');
 
 Stripe.prototype = {
+  clientId: '',
 
   setHost: function(host, port, protocol) {
     this._setApiField('host', host);

test/resources/OAuth.spec.js

@@ -0,0 +1,184 @@
+'use strict';
+
+var stripe = require('../../testUtils').getSpyableStripe();
+stripe.clientId = 'default_client_id';
+
+var expect = require('chai').expect;
+
+describe('OAuth', function() {
+  describe('authorize', function() {
+    describe('when a default client_id is not set', function() {
+      beforeEach(function() {
+        stripe.clientId = '';
+      });
+
+      describe('without an explicitly provided client_id', function() {
+        it('Prompts the user to set a default client_id or provide one explicitly', function() {
+          expect(stripe.oAuth.authorizeUrl.bind(stripe.oAuth)).to.throw(Error, stripe.ERROR_CLIENT_ID_NOT_SET);
+        });
+      });
+
+      describe('with an explicitly provided client_id', function() {
+        it('Generates the correct URL', function() {
+          var url = stripe.oAuth.authorizeUrl({client_id: '123abc'});
+
+          var expectedUrl = 'https://connect.stripe.com/oauth/authorize?client_id=123abc&response_type=code&scope=read_write';
+
+          expect(url).to.equal(expectedUrl);
+        });
+      })
+    });
+
+    describe('when a default client_id is set', function() {
+      beforeEach(function() {
+        stripe.clientId = 'default_client_id';
+      });
+
+      describe('when required parameters are not provided', function() {
+        it('Generates the correct URL', function() {
+          var url = stripe.oAuth.authorizeUrl();
+
+          var expectedUrl = 'https://connect.stripe.com/oauth/authorize?response_type=code&client_id=default_client_id&scope=read_write';
+
+          expect(url).to.equal(expectedUrl);
+        });
+
+        it('Generates the correct URL with state provided', function() {
+          var url = stripe.oAuth.authorizeUrl({state: 'some_state'});
+
+          var expectedUrl = 'https://connect.stripe.com/oauth/authorize?state=some_state&response_type=code&client_id=default_client_id&scope=read_write';
+
+          expect(url).to.equal(expectedUrl);
+        });
+      });
+
+      describe('for non-Express account', function() {
+        it('Generates the correct URL', function() {
+          var url = stripe.oAuth.authorizeUrl(
+            {
+              response_type: 'code',
+              client_id: '123abc',
+              scope: 'read_write',
+            }
+          );
+
+          var expectedUrl = 'https://connect.stripe.com/oauth/authorize?response_type=code&client_id=123abc&scope=read_write';
+
+          expect(url).to.equal(expectedUrl);
+        });
+
+        it('Generates the correct URL with state provided', function() {
+          var url = stripe.oAuth.authorizeUrl(
+            {
+              response_type: 'code',
+              client_id: '123abc',
+              scope: 'read_write',
+            }
+          );
+
+          var expectedUrl = 'https://connect.stripe.com/oauth/authorize?response_type=code&client_id=123abc&scope=read_write';
+
+          expect(url).to.equal(expectedUrl);
+        });
+      });
+
+      describe('for Express account', function() {
+        it('Generates the correct URL', function() {
+          var url = stripe.oAuth.authorizeUrl(
+            {
+              response_type: 'code',
+              client_id: '123abc',
+              scope: 'read_write',
+            },
+            {
+              express: true,
+            }
+          );
+
+          var expectedUrl = 'https://connect.stripe.com/express/oauth/authorize?response_type=code&client_id=123abc&scope=read_write';
+
+          expect(url).to.equal(expectedUrl);
+        });
+
+        it('Generates the correct URL with state provided', function() {
+          var url = stripe.oAuth.authorizeUrl(
+            {
+              response_type: 'code',
+              client_id: '123abc',
+              scope: 'read_write',
+              state: 'some_state',
+            },
+            {
+              express: true,
+            }
+          );
+
+          var expectedUrl = 'https://connect.stripe.com/express/oauth/authorize?response_type=code&client_id=123abc&scope=read_write&state=some_state';
+
+          expect(url).to.equal(expectedUrl);
+        });
+      });
+    });
+  });
+
+  describe('token', function() {
+    it('Sends the correct request', function() {
+      stripe.oAuth.token({
+        code: '123abc',
+        grant_type: 'authorization_code'
+      });
+
+      expect(stripe.LAST_REQUEST).to.deep.equal({
+        method: 'POST',
+        host: 'connect.stripe.com',
+        url: '/oauth/token',
+        headers: {},
+        data: {
+          code: '123abc',
+          grant_type: 'authorization_code'
+        },
+      });
+    });
+  });
+
+  describe('deauthorize', function() {
+    beforeEach(function() {
+      stripe.clientId = 'default_client_id';
+    });
+
+    it('Sends the correct request without explicit client_id', function() {
+      stripe.oAuth.deauthorize({
+        stripe_user_id: 'some_user_id',
+      });
+
+      expect(stripe.LAST_REQUEST).to.deep.equal({
+        method: 'POST',
+        host: 'connect.stripe.com',
+        url: '/oauth/deauthorize',
+        headers: {},
+        data: {
+          client_id: stripe.clientId,
+          stripe_user_id: 'some_user_id'
+        },
+      });
+    });
+
+    it('Sends the correct request with explicit client_id', function() {
+      stripe.oAuth.deauthorize({
+        stripe_user_id: 'some_user_id',
+        client_id: '123abc',
+      });
+
+      expect(stripe.LAST_REQUEST).to.deep.equal({
+        method: 'POST',
+        host: 'connect.stripe.com',
+        url: '/oauth/deauthorize',
+        headers: {},
+        data: {
+          client_id: '123abc',
+          stripe_user_id: 'some_user_id'
+        },
+      });
+    });
+  });
+});