Allow non-User model for Provider

[ideaoforder]

In some circumstances, folks may have a habtm like so:

Account has _and_belongs_to_many :users has_many :products

User has _and_belongs_to_many :accounts

In this case, you'd want the oauth provider attached to the Account model, not the User model, since we it's the Account that's associated with Products (in this case). This mostly entails just changing the DB fields to :account_id and updating models accordingly, but oauth-plugin / lib / oauth / controllers / provider_controller.rb references current_user repeatedly.

So,

1. Is there a hack to set the current_user to the current_account?
2. Would it be feasible to modify this plugin to allow users to specify which model it should be associate with? (I'm certainly willing to fork and help out, but a little guidance would be useful.)

[ngottlieb]

Did you ever get anywhere with this? I'm working on doing the same thing as I want to associate OAuth with my Admin model. I'm trying to hack it by changing user to admin in a lot of places in the plugin, but struggling, so far.

[ideaoforder]

I made some progress, but then ran into a few other issues that eventually proved too frustrating--I couldn't get my requests to authenticate, even just using pretty much vanilla config. I eventually switched to Doorkeeper (https://github.com/applicake/doorkeeper). It works much like Devise (it's an engine), and to me feels much cleaner and more configurable. Additionally (for better or worse, depending on your needs), it's Oauth2, wheres oauth-plugin is 1.0/1.0a. The Ruby/Rails community seems more on top of Oauth2, in my experience (though I had to build a PHP wrapper for our API, which was slightly more difficult).

It does allow you to specify whatever resource you want, out of the box. I'm also using CanCan for role-based permissions, so I had to jump through a few extra hoops, but generally, I've liked Doorkeeper much better (the documentation is better too).

You'll also need to be using Rails 3.1.

[ideaoforder]

I should add that I had to setup a bit of a config hack to restrict Oauth application access (i.e. to the resource that created the application--in this case, a Customer).

https://gist.github.com/2587365