gds-sso 0.7.9 → 0.8.0

data/app/controllers/api/user_controller.rb

@@ -0,0 +1,31 @@
+class Api::UserController < ApplicationController
+  before_filter :authenticate_user!
+  before_filter :require_user_update_permission
+
+  def update
+    user_json = JSON.parse(request.body.read)['user']
+    oauth_hash = build_gds_oauth_hash(user_json)
+    GDS::SSO::Config.user_klass.find_for_gds_oauth(oauth_hash)
+    head :ok
+  end
+
+  private
+    # This should mirror the object created by the omniauth-gds strategy/gem
+    # By doing this, we can reuse the code for creating/updating the user
+    def build_gds_oauth_hash(user_json)
+      OmniAuth::AuthHash.new(
+          uid: user_json['uid'], 
+          provider: 'gds', 
+          info: { 
+            name: user_json['name'], 
+            email: user_json['email']
+          }, 
+          extra: { 
+            user: { permissions: user_json['permissions'] }
+          })
+    end
+
+    def require_user_update_permission
+      authorise_user!(GDS::SSO::Config.default_scope, "user_update_permission")
+    end
+end

data/config/routes.rb

@@ -1,5 +1,6 @@
 Rails.application.routes.draw do
   match '/auth/gds/callback', to: 'authentications#callback', as: :gds_sign_in
   match '/auth/gds/sign_out', to: 'authentications#sign_out', as: :gds_sign_out
-  match '/auth/failure',  to: 'authentications#failure',  as: :auth_failure
+  match '/auth/failure',      to: 'authentications#failure',  as: :auth_failure
+  match '/auth/gds/api/user', to: "api/user#update", via: "PUT"
 end

data/lib/gds-sso/controller_methods.rb

@@ -14,6 +14,10 @@ module GDS
 
 
       def authorise_user!(scope, permission)
+        # Ensure that we're authenticated (and by extension that current_user is set).
+        # Otherwise current_user might be nil, and we'd error out
+        authenticate_user!
+
         if not current_user.has_permission?(scope, permission)
           raise PermissionDeniedException, "Sorry, you don't seem to have the #{permission} permission for #{scope}."
         end

data/lib/gds-sso/version.rb

@@ -1,5 +1,5 @@
 module GDS
   module SSO
-    VERSION = "0.7.9"
+    VERSION = "0.8.0"
   end
 end

data/spec/controller/api_user_controller_spec.rb

@@ -0,0 +1,57 @@
+require "spec_helper"
+
+def user_update_json
+  {
+    "user" => { 
+      "uid" => "a1s2d3", 
+      "name" => "Joshua Marshall", 
+      "email" => "user@domain.com", 
+      "permissions" => {
+        "GDS_SSO integration test" => ["signin", "new permission"]
+      }
+    }
+  }.to_json
+end
+
+describe Api::UserController, type: :controller do
+
+  before :each do
+    @user_to_update = User.new({ 
+        :uid => 'a1s2d3', 
+        :name => "Moshua Jarshall", 
+        :permissions => { "GDS_SSO integration test" => ["signin"] } })
+  end
+
+  describe "PUT update" do
+    it "should deny access to anybody but the API user (or a user with 'user_update_permission')" do
+      malicious_user = User.new({ 
+          :uid => '2', 
+          :name => "User", 
+          :permissions => { "GDS_SSO integration test" => ["signin"] } })
+
+      request.env['warden'] = stub("stub warden", :authenticate! => true, authenticated?: true, user: malicious_user)
+
+      request.env['RAW_POST_DATA'] = user_update_json
+      put :update
+      
+      assert_equal 403, response.status
+    end
+
+    it "should create/update the user record in the same way as the OAuth callback" do
+      # Test that it authenticates
+      request.env['warden'] = mock("stub warden", authenticated?: true, user: GDS::SSO::ApiUser.new)
+      request.env['warden'].expects(:authenticate!).at_least_once.returns(true)
+
+      @user_to_update.expects(:update_attributes).with({ 
+          "uid" => "a1s2d3",
+          "name" => "Joshua Marshall", 
+          "email" => "user@domain.com", 
+          "permissions" => { "GDS_SSO integration test" => ["signin", "new permission"] }}, as: :oauth)
+
+      User.expects(:find_by_uid).with("a1s2d3").returns(@user_to_update)
+
+      request.env['RAW_POST_DATA'] = user_update_json
+      put :update
+    end
+  end
+end