accessToken = dataProvider.getAccessToken(oAuthMessage.getToken());
//check if access token is not null
if (accessToken == null) {
LOG.warning("Access token is unavailable");
throw new OAuthProblemException(OAuth.Problems.TOKEN_REJECTED);
}
client = accessToken.getClient();
} else {
String consumerKey = oAuthMessage.getParameter(OAuth.OAUTH_CONSUMER_KEY);
String consumerSecret = oAuthMessage.getParameter("oauth_consumer_secret");
client = dataProvider.getClient(consumerKey);
if (client == null || consumerSecret == null || !consumerSecret.equals(client.getSecretKey())) {
LOG.warning("Client is invalid");
throw new OAuthProblemException(OAuth.Problems.CONSUMER_KEY_UNKNOWN);
}
}
OAuthUtils.validateMessage(oAuthMessage, client, accessToken, dataProvider);
//check valid URI
checkRequestURI(req, getAllUris(client, accessToken));
List<OAuthPermission> permissions = dataProvider.getPermissionsInfo(
getAllScopes(client, accessToken));
for (OAuthPermission perm : permissions) {
if (perm.getUri() != null) {
checkRequestURI(req, Collections.singletonList(perm.getUri()));
}
if (!perm.getHttpVerbs().isEmpty()
&& !perm.getHttpVerbs().contains(req.getMethod())) {
String message = "Invalid http verb";
LOG.warning(message);
throw new OAuthProblemException(message);
}
checkNoAccessTokenIsAllowed(client, accessToken, perm);
}
return new OAuthInfo(client, accessToken, permissions);