1 files changed, 34 insertions, 32 deletions

diff --git a/projecttemplates/WebFormsRelyingParty/Members/OAuthAuthorize.aspx.cs b/projecttemplates/WebFormsRelyingParty/Members/OAuthAuthorize.aspx.cs
index 16e48f0..05a5f52 100644
--- a/projecttemplates/WebFormsRelyingParty/Members/OAuthAuthorize.aspx.cs
+++ b/projecttemplates/WebFormsRelyingParty/Members/OAuthAuthorize.aspx.cs
@@ -7,60 +7,62 @@
 namespace WebFormsRelyingParty.Members {
 	using System;
 	using System.Collections.Generic;
+	using System.Globalization;
 	using System.Linq;
+	using System.Net;
 	using System.Web;
 	using System.Web.UI;
 	using System.Web.UI.WebControls;
+	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth;
 	using DotNetOpenAuth.OAuth.Messages;
+	using DotNetOpenAuth.OAuth2;
+	using DotNetOpenAuth.OAuth2.Messages;
 	using RelyingPartyLogic;
 
 	public partial class OAuthAuthorize : System.Web.UI.Page {
+		private EndUserAuthorizationRequest pendingRequest;
+
 		protected void Page_Load(object sender, EventArgs e) {
-			if (!IsPostBack) {
-				var pendingRequest = OAuthServiceProvider.PendingAuthorizationRequest;
-				if (pendingRequest == null) {
-					Response.Redirect("AccountInfo.aspx");
-				}
+			// We'll mask that on postback it's a POST when looking up the authorization details so that the GET-only
+			// message can be picked up.
+			var requestInfo = this.IsPostBack
+								? new HttpRequestInfo("GET", this.Request.Url, this.Request.RawUrl, new WebHeaderCollection(), null)
+								: null;
+			this.pendingRequest = OAuthServiceProvider.AuthorizationServer.ReadAuthorizationRequest(requestInfo);
+			if (this.pendingRequest == null) {
+				Response.Redirect("AccountInfo.aspx");
+			}
 
+			if (!IsPostBack) {
 				this.csrfCheck.Value = Code.SiteUtilities.SetCsrfCookie();
-				this.consumerNameLabel.Text = HttpUtility.HtmlEncode(OAuthServiceProvider.PendingAuthorizationConsumer.Name);
-				this.OAuth10ConsumerWarning.Visible = pendingRequest.IsUnsafeRequest;
+				var requestingClient = Database.DataContext.Clients.First(c => c.ClientIdentifier == this.pendingRequest.ClientIdentifier);
+				this.consumerNameLabel.Text = HttpUtility.HtmlEncode(requestingClient.Name);
+				this.scopeLabel.Text = HttpUtility.HtmlEncode(OAuthUtilities.JoinScopes(this.pendingRequest.Scope));
 
-				this.serviceProviderDomainNameLabel.Text = HttpUtility.HtmlEncode(this.Request.Url.Host);
-				this.consumerDomainNameLabel3.Text = this.consumerDomainNameLabel2.Text = this.consumerDomainNameLabel1.Text = HttpUtility.HtmlEncode(OAuthServiceProvider.PendingAuthorizationConsumer.Name);
+				// Consider auto-approving if safe to do so.
+				if (((OAuthAuthorizationServer)OAuthServiceProvider.AuthorizationServer.AuthorizationServer).CanBeAutoApproved(this.pendingRequest)) {
+					OAuthServiceProvider.AuthorizationServer.ApproveAuthorizationRequest(this.pendingRequest, HttpContext.Current.User.Identity.Name);
+				}
 			} else {
 				Code.SiteUtilities.VerifyCsrfCookie(this.csrfCheck.Value);
 			}
 		}
 
 		protected void yesButton_Click(object sender, EventArgs e) {
-			this.outerMultiView.SetActiveView(this.authorizationGrantedView);
-
-			var consumer = OAuthServiceProvider.PendingAuthorizationConsumer;
-			var tokenManager = OAuthServiceProvider.ServiceProvider.TokenManager;
-			var pendingRequest = OAuthServiceProvider.PendingAuthorizationRequest;
-			ITokenContainingMessage requestTokenMessage = pendingRequest;
-			var requestToken = tokenManager.GetRequestToken(requestTokenMessage.Token);
-
-			OAuthServiceProvider.AuthorizePendingRequestToken();
-
-			// The rest of this method only executes if we couldn't automatically
-			// redirect to the consumer.
-			if (pendingRequest.IsUnsafeRequest) {
-				this.verifierMultiView.SetActiveView(this.noCallbackView);
-			} else {
-				this.verifierMultiView.SetActiveView(this.verificationCodeView);
-				string verifier = ServiceProvider.CreateVerificationCode(consumer.VerificationCodeFormat, consumer.VerificationCodeLength);
-				this.verificationCodeLabel.Text = HttpUtility.HtmlEncode(verifier);
-				requestToken.VerificationCode = verifier;
-				tokenManager.UpdateToken(requestToken);
-			}
+			var requestingClient = Database.DataContext.Clients.First(c => c.ClientIdentifier == this.pendingRequest.ClientIdentifier);
+			Database.LoggedInUser.ClientAuthorizations.Add(
+				new ClientAuthorization {
+					Client = requestingClient,
+					Scope = OAuthUtilities.JoinScopes(this.pendingRequest.Scope),
+					User = Database.LoggedInUser,
+					CreatedOnUtc = DateTime.UtcNow.CutToSecond(),
+				});
+			OAuthServiceProvider.AuthorizationServer.ApproveAuthorizationRequest(this.pendingRequest, HttpContext.Current.User.Identity.Name);
 		}
 
 		protected void noButton_Click(object sender, EventArgs e) {
-			this.outerMultiView.SetActiveView(this.authorizationDeniedView);
-			OAuthServiceProvider.PendingAuthorizationRequest = null;
+			OAuthServiceProvider.AuthorizationServer.RejectAuthorizationRequest(this.pendingRequest);
 		}
 	}
 }