audiences 1.3.0 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8f83dd42249d90e09a66c7f11b5adb821e7f0fbc3add8089f075fe2668e79d35
-  data.tar.gz: 351a6676df1a297b691842e06fc18b721d3581a9bdd0ea6101bce2ed81cee06e
+  metadata.gz: 596d4d408b2fc406d8f3dcf10bdd5c29dfe311ab5691fbc3b6140df37d8bcaed
+  data.tar.gz: f2dd143d3faa6a0e59d20f2af39a0dd7e429d5343f6f63081c2cd9df54b57697
 SHA512:
-  metadata.gz: f90802d28319f4cbc95a8be9f9f2e68115ac7142ab6fcbf4c9be0437a14a2e57b6d58632e1befeb37b19ba1b2ce9de1d6f8fc2d9b674b120ee51d240e47140dd
-  data.tar.gz: d70f080cdad97a5bdfc31b701d7659a300dbeeef3c380371b1d91c7198a30c4ff9899c5106a0eb2af972e8b6d53e77ab718fb962c6f8734c960375394ffa60c6
+  metadata.gz: 3db42cfb3a01581e4cb9d30ed00fba7921fe0a801d1719351c106fe41966ab565ae1dbdd3d639e3f9681abf92b94d46b8e43f318689389ec90f7d0e984ea3535
+  data.tar.gz: d59bbf57891e89dd7ccb9515399913e80a5b2cd1580afceef7683aa02c977cdc75b2452f1cd7fcd5520f7508b00dbcf2066fb88cc27e1767ff56437a8596e696

data/app/controllers/audiences/application_controller.rb

@@ -2,5 +2,14 @@
 
 module Audiences
   class ApplicationController < ActionController::API
+    before_action unless: :authenticate! do
+      render json: { error: "Unauthorized" }, status: :unauthorized
+    end
+
+  private
+
+    def authenticate!
+      instance_exec(request, &Audiences.config.authenticate)
+    end
   end
 end

data/app/controllers/audiences/contexts_controller.rb

@@ -44,7 +44,7 @@ module Audiences
       params.permit(
         :match_all,
         criteria: [groups: {}],
-        extra_users: Audiences.config.resources[:Users].attributes
+        extra_users: %i[externalId]
       ).to_h.symbolize_keys
     end
   end

data/app/controllers/audiences/scim_proxy_controller.rb

@@ -4,7 +4,7 @@ module Audiences
   class ScimProxyController < ApplicationController
     def get
       resources = Audiences::Scim.resource(params[:scim_path].to_sym)
-                                 .query(filter: params[:filter])
+                                 .query(filter: params[:filter], startIndex: params[:startIndex], count: params[:count])
 
       render json: resources, except: %w[schemas meta]
     end

data/app/models/audiences/context_users.rb

@@ -20,8 +20,8 @@ module Audiences
   private
 
     def all_users
-      users = Scim.resource(:Users).query
-      ExternalUser.wrap(users.all)
+      users = Scim.resource(:Users).all
+      ExternalUser.wrap(users)
     end
 
     def matching_users

data/app/models/audiences/criterion_users.rb

@@ -21,8 +21,8 @@ module Audiences
 
     def groups_users(group_ids)
       filter = group_ids.map { "groups.value eq #{_1}" }.join(" OR ")
-      users = Audiences::Scim.resource(:Users).query(filter: filter)
-      ExternalUser.wrap(users.all)
+      users = Audiences::Scim.resource(:Users).all(filter: filter)
+      ExternalUser.wrap(users)
     end
   end
 end

data/app/models/audiences/external_user.rb

@@ -10,6 +10,13 @@ module Audiences
                             inverse_of: false
     end
 
+    def self.fetch(external_ids)
+      return [] unless external_ids.any?
+
+      filter = Array(external_ids).map { "externalId eq #{_1}" }.join(" OR ")
+      Audiences::Scim.resource(:Users).all(filter: filter)
+    end
+
     def self.wrap(resources)
       return [] unless resources&.any?
 

data/docs/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Unreleased
 
+# Version 1.4.0 (2024-11-01)
+
+- Add authentication hooks for Audiences controllers [#438](https://github.com/powerhome/audiences/pull/438)
+
+# Version 1.3.1 (2024-10-11)
+
+- Forward pagination parameters to SCIM on proxy [#397](https://github.com/powerhome/audiences/pull/397)
+- Fix security flaw when setting extra users [#398](https://github.com/powerhome/audiences/pull/398)
+
 # Version 1.3.0 (2024-09-03)
 
 - Filter out inactive users by default [#382](https://github.com/powerhome/audiences/pull/382)

data/lib/audiences/configuration.rb

@@ -5,6 +5,34 @@ module Audiences
 
   # Configuration options
 
+  #
+  # Authentication configuration. This defaults to true, meaning that the audiences
+  # endpoints are open to the public.
+  #
+  # To authenticate requests, set this configuration to a lambda that will receive
+  # the request and return true if the request is authenticated.
+  #
+  # Raising an exception will also prevent the execution of the request, but the
+  # exception will not be caught and should be handled by the application middlewares.
+  #
+  # I.e.:
+  #
+  #   Audiences.configure do |config|
+  #     config.authentication = ->(*) { authenticate_request }
+  #   end
+  #
+  # I.e:
+  #
+  #   Audiences.configure do |config|
+  #     config.authentication = ->(request) do
+  #       request.env["warden"].authenticate!
+  #     end
+  #   end
+  #
+  config_accessor :authentication do
+    ->(*) { true }
+  end
+
   #
   # Identity model representing a SCIM User in the current application. I.e.: "User"
   #

data/lib/audiences/scim/resource.rb

@@ -20,6 +20,10 @@ module Audiences
                                         **@options, **options)
       end
 
+      def all(...)
+        query(...).all
+      end
+
       def scim_attributes
         @attributes.reduce([]) do |attrs, attr|
           case attr

data/lib/audiences/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Audiences
-  VERSION = "1.3.0"
+  VERSION = "1.4.0"
 end

data/lib/audiences.rb

@@ -23,11 +23,12 @@ module_function
   # @param params [Hash] the updated params
   # @return Audience::Context
   #
-  def update(key, criteria: [], **attrs)
+  def update(key, criteria: [], extra_users: [], match_all: false)
     Audiences::Context.load(key) do |context|
       context.update!(
+        match_all: match_all,
         criteria: ::Audiences::Criterion.map(criteria),
-        **attrs
+        extra_users: ::Audiences::ExternalUser.fetch(extra_users.pluck("externalId"))
       )
       context.refresh_users!
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: audiences
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.4.0
 platform: ruby
 authors:
 - Carlos Palhares
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-09-03 00:00:00.000000000 Z
+date: 2024-11-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -93,7 +93,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.11
+rubygems_version: 3.5.16
 signing_key:
 specification_version: 4
 summary: Audiences system