gds-sso 18.0.0 → 19.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6450ab2114242674c0c5f9ddeba9d15cca06e538f2f211a1c621469f9fd2d9af
-  data.tar.gz: eedc4aaa3abd89833c43af03c841f63dc6d68f9fbbd965a15aa917bc20ad933a
+  metadata.gz: 7ddad93d93075a295b1b4a6561d7c37dfba8e89892be22fc2ba54f53b594f460
+  data.tar.gz: 2de1bc908bd25480554df696b32a08f72f3b02f8c74c72bfa4b3ccd59227ac6a
 SHA512:
-  metadata.gz: cfe330d97944bac31202779575770107056ca493ac5af511eb5fb316bbd4a83b459367dd683d69c01656c3e446177dabd008e47cf6d83138f29f139b7e765374
-  data.tar.gz: 01b11032563802c91717c6418150dafadd4518f95845c938bb6ad855895971d541f1a95d59cddae92060e4896ec6fdea6620af24a72515cd9fb79074d705c3c3
+  metadata.gz: cdae7d624ab18260632acc9945ce7790664dde1f99fc2dca57c7fe5569f8aacdf0180286c1acd34f60d054c4100ec212b2359ae4a5b056352edecc30c3721058
+  data.tar.gz: 6d71aefcfa8f20aed5a479ca032bd2abab343fe71054b61766dbf3f80ed88047203929119e92183f31f735810066a9683b7c36279310f9e8044ee9f38933bc54

data/lib/gds-sso/config.rb

@@ -26,7 +26,6 @@ module GDS
       @@auth_valid_for = 20 * 3600
 
       mattr_accessor :cache
-      @@cache = ActiveSupport::Cache::NullStore.new
 
       mattr_accessor :api_only
 

data/lib/gds-sso/version.rb

@@ -1,5 +1,5 @@
 module GDS
   module SSO
-    VERSION = "18.0.0".freeze
+    VERSION = "19.0.0".freeze
   end
 end

data/lib/omniauth/strategies/gds.rb

@@ -4,6 +4,8 @@ require "json"
 class OmniAuth::Strategies::Gds < OmniAuth::Strategies::OAuth2
   uid { user["uid"] }
 
+  option :pkce, true
+
   info do
     {
       name: user["name"],

data/spec/internal/app/models/user.rb

@@ -1,5 +1,5 @@
 class User < ActiveRecord::Base
   include GDS::SSO::User
 
-  serialize :permissions, Array
+  serialize :permissions, type: Array
 end

data/spec/system/authentication_and_authorisation_spec.rb

@@ -1,6 +1,42 @@
 require "spec_helper"
 
 RSpec.describe "Authenication and authorisation" do
+  context "omniauth request phase" do
+    let(:redirect_url) { URI.parse(page.response_headers["Location"]) }
+    let(:authorize_params) { Rack::Utils.parse_query(redirect_url.query) }
+
+    before do
+      visit "/auth/gds"
+    end
+
+    it "includes pkce code_challenge_method in request for /oauth/authorize" do
+      expect(redirect_url.path).to eql("/oauth/authorize")
+      expect(authorize_params["code_challenge_method"]).to eq("S256")
+    end
+
+    it "includes pkce code_challenge in request for /oauth/authorize" do
+      expect(redirect_url.path).to eql("/oauth/authorize")
+      expect(authorize_params["code_challenge"]).to be_present
+    end
+  end
+
+  context "omniauth callback phase" do
+    it "includes pkce code_verifier in request for /oauth/access_token" do
+      visit "/auth/gds"
+
+      redirect_url = URI.parse(page.response_headers["Location"])
+      expect(redirect_url.path).to eql("/oauth/authorize")
+      state = Rack::Utils.parse_query(redirect_url.query)["state"]
+
+      stub_request(:post, "http://signon/oauth/access_token")
+
+      visit "/auth/gds/callback?state=#{state}"
+
+      expect(WebMock).to have_requested(:post, "http://signon/oauth/access_token")
+        .with(body: hash_including({ "code_verifier" => /.*/ }))
+    end
+  end
+
   context "when accessing a route that doesn't require permissions or authentication" do
     it "allows access" do
       visit "/not-restricted"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gds-sso
 version: !ruby/object:Gem::Version
-  version: 18.0.0
+  version: 19.0.0
 platform: ruby
 authors:
 - GOV.UK Dev
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-08-02 00:00:00.000000000 Z
+date: 2024-02-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: oauth2
@@ -239,7 +239,6 @@ files:
 - app/controllers/api/user_controller.rb
 - app/controllers/authentications_controller.rb
 - app/views/authentications/failure.html.erb
-- app/views/authorisations/cant_signin.html.erb
 - app/views/authorisations/unauthorised.html.erb
 - app/views/layouts/unauthorised.html.erb
 - config/routes.rb
@@ -298,7 +297,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.18
+rubygems_version: 3.5.5
 signing_key: 
 specification_version: 4
 summary: Client for GDS' OAuth 2-based SSO

data/app/views/authorisations/cant_signin.html.erb

@@ -1,6 +0,0 @@
-<h1>Sorry, you don't have permission to access this application</h1>
-
-<p>Please contact your Delivery Manager or main GDS contact if you need access.</p>
-
-<p>If you think something is wrong, try <%= link_to "signing out", gds_sign_out_path %> and then back in.</p>
-