keycloak-admin 1.1.2 → 1.1.3

data/lib/keycloak-admin/client/client_authz_resource_client.rb

@@ -0,0 +1,93 @@
+module KeycloakAdmin
+  class ClientAuthzResourceClient < Client
+    def initialize(configuration, realm_client, client_id)
+      super(configuration)
+      raise ArgumentError.new("realm must be defined") unless realm_client.name_defined?
+      @realm_client = realm_client
+      @client_id = client_id
+    end
+
+    def list
+      response = execute_http do
+        RestClient::Resource.new(authz_resources_url(@client_id), @configuration.rest_client_options).get(headers)
+      end
+      JSON.parse(response).map { |role_as_hash| ClientAuthzResourceRepresentation.from_hash(role_as_hash) }
+    end
+
+    def get(resource_id)
+      response = execute_http do
+        RestClient::Resource.new(authz_resources_url(@client_id, resource_id), @configuration.rest_client_options).get(headers)
+      end
+      ClientAuthzResourceRepresentation.from_hash(JSON.parse(response))
+    end
+
+    def update(resource_id, client_authz_resource_representation)
+      raise "scope[:name] is mandatory and the only necessary attribute to add scope to resource" if client_authz_resource_representation[:scopes] && client_authz_resource_representation[:scopes].any?{|a| !a[:name]}
+
+      existing_resource = get(resource_id)
+      new_resource = build(
+        client_authz_resource_representation[:name] || existing_resource.name,
+        client_authz_resource_representation[:type] || existing_resource.type,
+        (client_authz_resource_representation[:uris] || [] ) + existing_resource.uris,
+        client_authz_resource_representation[:owner_managed_access] || existing_resource.owner_managed_access,
+        client_authz_resource_representation[:display_name] || existing_resource.display_name,
+        (client_authz_resource_representation[:scopes] || []) + existing_resource.scopes.map{|s| {name: s.name}},
+        client_authz_resource_representation[:attributes] || existing_resource.attributes
+      )
+
+      execute_http do
+        RestClient::Resource.new(authz_resources_url(@client_id, resource_id), @configuration.rest_client_options).put(new_resource.to_json, headers)
+      end
+      get(resource_id)
+    end
+
+    def create!(name, type, uris, owner_managed_access, display_name, scopes, attributes = {})
+      save(build(name, type, uris, owner_managed_access, display_name, scopes, attributes))
+    end
+
+    def find_by(name, type, uris, owner, scope)
+      response = execute_http do
+        url = "#{authz_resources_url(@client_id)}?name=#{name}&type=#{type}&uris=#{uris}&owner=#{owner}&scope=#{scope}&deep=true&first=0&max=100"
+        RestClient::Resource.new(url, @configuration.rest_client_options).get(headers)
+      end
+      JSON.parse(response).map { |role_as_hash| ClientAuthzResourceRepresentation.from_hash(role_as_hash) }
+    end
+
+    def save(client_authz_resource_representation)
+      response = execute_http do
+        RestClient::Resource.new(authz_resources_url(@client_id), @configuration.rest_client_options).post(client_authz_resource_representation.to_json, headers)
+      end
+      ClientAuthzResourceRepresentation.from_hash(JSON.parse(response))
+    end
+
+    def delete(resource_id)
+      execute_http do
+        RestClient::Resource.new(authz_resources_url(@client_id, resource_id), @configuration.rest_client_options).delete(headers)
+      end
+      true
+    end
+
+    def authz_resources_url(client_id, id = nil)
+      if id
+        "#{@realm_client.realm_admin_url}/clients/#{client_id}/authz/resource-server/resource/#{id}"
+      else
+        "#{@realm_client.realm_admin_url}/clients/#{client_id}/authz/resource-server/resource"
+      end
+    end
+
+    private
+
+    def build(name, type, uris, owner_managed_access, display_name, scopes, attributes={})
+      resource                      = ClientAuthzResourceRepresentation.new
+      resource.name                 = name
+      resource.type                 = type
+      resource.uris                 = uris
+      resource.owner_managed_access = owner_managed_access
+      resource.display_name         = display_name
+      resource.scopes               = scopes
+      resource.attributes           = attributes || {}
+      resource
+    end
+
+  end
+end

data/lib/keycloak-admin/client/client_authz_scope_client.rb

@@ -0,0 +1,71 @@
+module KeycloakAdmin
+  class ClientAuthzScopeClient < Client
+    def initialize(configuration, realm_client, client_id, resource_id = nil)
+      super(configuration)
+      raise ArgumentError.new("realm must be defined") unless realm_client.name_defined?
+      @realm_client = realm_client
+      @client_id = client_id
+      @resource_id = resource_id
+    end
+
+    def create!(name, display_name, icon_uri)
+      response = save(build(name, display_name, icon_uri))
+      ClientAuthzScopeRepresentation.from_hash(JSON.parse(response))
+    end
+
+    def list
+      response = execute_http do
+        RestClient::Resource.new(authz_scopes_url(@client_id, @resource_id), @configuration.rest_client_options).get(headers)
+      end
+      JSON.parse(response).map { |role_as_hash| ClientAuthzScopeRepresentation.from_hash(role_as_hash) }
+    end
+
+    def delete(scope_id)
+      execute_http do
+        RestClient::Resource.new(authz_scopes_url(@client_id, nil, scope_id), @configuration.rest_client_options).delete(headers)
+      end
+      true
+    end
+
+    def get(scope_id)
+      response = execute_http do
+        RestClient::Resource.new(authz_scopes_url(@client_id, nil, scope_id), @configuration.rest_client_options).get(headers)
+      end
+      ClientAuthzScopeRepresentation.from_hash(JSON.parse(response))
+    end
+
+    def search(name)
+      url = "#{authz_scopes_url(@client_id)}?first=0&max=11&deep=false&name=#{name}"
+      response = execute_http do
+        RestClient::Resource.new(url, @configuration.rest_client_options).get(headers)
+      end
+      JSON.parse(response).map { |role_as_hash| ClientAuthzScopeRepresentation.from_hash(role_as_hash) }
+    end
+
+    def authz_scopes_url(client_id, resource_id = nil, id = nil)
+      if resource_id
+        "#{@realm_client.realm_admin_url}/clients/#{client_id}/authz/resource-server/resource/#{resource_id}/scopes"
+      elsif id
+        "#{@realm_client.realm_admin_url}/clients/#{client_id}/authz/resource-server/scope/#{id}"
+      else
+        "#{@realm_client.realm_admin_url}/clients/#{client_id}/authz/resource-server/scope"
+      end
+    end
+
+    def save(scope_representation)
+      execute_http do
+        RestClient::Resource.new(authz_scopes_url(@client_id), @configuration.rest_client_options).post(
+          create_payload(scope_representation), headers
+        )
+      end
+    end
+
+    def build(name, display_name, icon_uri)
+      scope              = ClientAuthzScopeRepresentation.new
+      scope.name         = name
+      scope.icon_uri     = icon_uri
+      scope.display_name = display_name
+      scope
+    end
+  end
+end

data/lib/keycloak-admin/client/realm_client.rb

@@ -99,6 +99,22 @@ module KeycloakAdmin
       UserResource.new(@configuration, self, user_id)
     end
 
+    def authz_scopes(client_id, resource_id = nil)
+      ClientAuthzScopeClient.new(@configuration, self, client_id, resource_id)
+    end
+
+    def authz_resources(client_id)
+      ClientAuthzResourceClient.new(@configuration, self, client_id)
+    end
+
+    def authz_permissions(client_id, type, resource_id = nil)
+      ClientAuthzPermissionClient.new(@configuration, self, client_id, type, resource_id)
+    end
+
+    def authz_policies(client_id, type)
+      ClientAuthzPolicyClient.new(@configuration, self, client_id, type)
+    end
+
     def name_defined?
       !@realm_name.nil?
     end

data/lib/keycloak-admin/representation/client_authz_permission_representation.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+
+## ### {"resources":["4f55e984-d1ec-405c-a25c-1387f88acd5c"],"policies":["e9e3bc49-fe11-4287-b6fc-fa8be4930ffa"],"name":"delme policy","description":"delme polidy ","decisionStrategy":"UNANIMOUS","resourceType":""}
+#
+module KeycloakAdmin
+  class ClientAuthzPermissionRepresentation < Representation
+    attr_accessor :id,
+                  :name,
+                  :description,
+                  :decision_strategy,
+                  :resource_type,
+                  :resources,
+                  :policies,
+                  :scopes,
+                  :logic,
+                  :type
+
+    def self.from_hash(hash)
+      resource                   = new
+      resource.id                = hash["id"]
+      resource.name              = hash["name"]
+      resource.description       = hash["description"]
+      resource.decision_strategy = hash["decisionStrategy"]
+      resource.resource_type     = hash["resourceType"]
+      resource.resources         = hash["resources"]
+      resource.policies          = hash["policies"]
+      resource.scopes            = hash["scopes"]
+      resource.logic             = hash["logic"]
+      resource.type              = hash["type"]
+      resource
+    end
+  end
+end

data/lib/keycloak-admin/representation/client_authz_policy_config_representation.rb

@@ -0,0 +1,15 @@
+module KeycloakAdmin
+  class ClientAuthzPolicyConfigRepresentation < Representation
+    attr_accessor :roles,
+                  :code
+
+    def self.from_hash(hash)
+      resource                      = new
+      resource.code                 = hash["code"]
+      resource.roles               = JSON.parse(hash["roles"] || '[]').map do |str|
+        RoleRepresentation.from_hash(str)
+      end
+      resource
+    end
+  end
+end

data/lib/keycloak-admin/representation/client_authz_policy_representation.rb

@@ -0,0 +1,27 @@
+module KeycloakAdmin
+  class ClientAuthzPolicyRepresentation < Representation
+    attr_accessor :id,
+                  :name,
+                  :description,
+                  :type,
+                  :logic,
+                  :decision_strategy,
+                  :config,
+                  :fetch_roles,
+                  :roles
+
+    def self.from_hash(hash)
+      resource                      = new
+      resource.id                   = hash["id"]
+      resource.name                 = hash["name"]
+      resource.description          = hash["description"]
+      resource.type                 = hash["type"]
+      resource.logic                = hash["logic"]
+      resource.decision_strategy    = hash["decisionStrategy"]
+      resource.roles                = hash["roles"]
+      resource.fetch_roles          = hash["fetchRoles"]
+      resource.config               = ClientAuthzPolicyConfigRepresentation.from_hash((hash["config"] || {}))
+      resource
+    end
+  end
+end

data/lib/keycloak-admin/representation/client_authz_resource_representation.rb

@@ -0,0 +1,26 @@
+module KeycloakAdmin
+
+  class ClientAuthzResourceRepresentation < Representation
+    attr_accessor :id,
+                  :name,
+                  :type,
+                  :uris,
+                  :owner_managed_access,
+                  :display_name,
+                  :attributes,
+                  :scopes
+
+    def self.from_hash(hash)
+      resource                      = new
+      resource.id                   = hash["_id"]
+      resource.type                 = hash["type"]
+      resource.name                 = hash["name"]
+      resource.owner_managed_access = hash["ownerManagedAccess"]
+      resource.uris                 = hash["uris"]
+      resource.display_name         = hash["displayName"]
+      resource.attributes           = hash.fetch("attributes", {}).map { |k, v| [k.to_sym, Array(v)] }.to_h
+      resource.scopes               = (hash["scopes"] || []).map { |scope_hash| ClientAuthzScopeRepresentation.from_hash(scope_hash) }
+      resource
+    end
+  end
+end

data/lib/keycloak-admin/representation/client_authz_scope_representation.rb

@@ -0,0 +1,17 @@
+module KeycloakAdmin
+  class ClientAuthzScopeRepresentation < Representation
+    attr_accessor :id,
+                  :name,
+                  :icon_uri,
+                  :display_name
+
+    def self.from_hash(hash)
+      scope                                      = new
+      scope.id                                   = hash["id"]
+      scope.name                                 = hash["name"]
+      scope.icon_uri                             = hash["iconUri"]
+      scope.display_name                         = hash["displayName"]
+      scope
+    end
+  end
+end

data/lib/keycloak-admin/version.rb

@@ -1,3 +1,3 @@
 module KeycloakAdmin
-  VERSION = "1.1.2"
+  VERSION = "1.1.3"
 end

data/lib/keycloak-admin.rb

@@ -14,6 +14,10 @@ require_relative "keycloak-admin/client/user_client"
 require_relative "keycloak-admin/client/identity_provider_client"
 require_relative "keycloak-admin/client/configurable_token_client"
 require_relative "keycloak-admin/client/attack_detection_client"
+require_relative "keycloak-admin/client/client_authz_scope_client"
+require_relative "keycloak-admin/client/client_authz_resource_client"
+require_relative "keycloak-admin/client/client_authz_policy_client"
+require_relative "keycloak-admin/client/client_authz_permission_client"
 require_relative "keycloak-admin/representation/camel_json"
 require_relative "keycloak-admin/representation/representation"
 require_relative "keycloak-admin/representation/protocol_mapper_representation"
@@ -31,6 +35,11 @@ require_relative "keycloak-admin/representation/identity_provider_mapper_represe
 require_relative "keycloak-admin/representation/identity_provider_representation"
 require_relative "keycloak-admin/representation/attack_detection_representation"
 require_relative "keycloak-admin/representation/session_representation"
+require_relative "keycloak-admin/representation/client_authz_scope_representation"
+require_relative "keycloak-admin/representation/client_authz_resource_representation"
+require_relative "keycloak-admin/representation/client_authz_policy_representation"
+require_relative "keycloak-admin/representation/client_authz_policy_config_representation"
+require_relative "keycloak-admin/representation/client_authz_permission_representation"
 require_relative "keycloak-admin/resource/base_role_containing_resource"
 require_relative "keycloak-admin/resource/group_resource"
 require_relative "keycloak-admin/resource/user_resource"

data/spec/client/client_authz_permission_client_spec.rb

@@ -0,0 +1,170 @@
+RSpec.describe KeycloakAdmin::ClientAuthzPermissionClient do
+
+  describe "#initialize" do
+    let(:realm_name) { nil }
+    let(:type) { :scope }
+    before(:each) do
+      @realm = KeycloakAdmin.realm(realm_name)
+    end
+
+    context "when realm_name is defined" do
+      let(:realm_name) { "master" }
+      it "does not raise any error" do
+        expect {
+          @realm.authz_permissions("", type)
+        }.to_not raise_error
+      end
+    end
+
+    context "when realm_name is not defined" do
+      let(:realm_name) { nil }
+      it "raises any error" do
+        expect {
+          @realm.authz_permissions("", type)
+        }.to raise_error(ArgumentError)
+      end
+    end
+
+    context "when type is bad value" do
+      let(:realm_name) { "master" }
+      let(:type) { "bad-type" }
+      it "does not raise any error" do
+        expect {
+          @realm.authz_permissions("", type)
+        }.to raise_error
+      end
+    end
+  end
+
+  describe '#delete' do
+    let(:realm_name) { "valid-realm" }
+    let(:client_id) { "valid-client-id" }
+    let(:client_authz_permission) {  KeycloakAdmin.realm(realm_name).authz_permissions(client_id, "resource") }
+    before(:each) do
+      stub_token_client
+      allow_any_instance_of(RestClient::Resource).to receive(:delete).and_return 'true'
+    end
+
+    it "deletes a permission" do
+      expect(client_authz_permission.delete("valid-permission-id")).to be_truthy
+    end
+  end
+
+  describe '#find_by' do
+    let(:realm_name) { "valid-realm" }
+    let(:client_id) { "valid-client-id" }
+    let(:client_authz_permission) {  KeycloakAdmin.realm(realm_name).authz_permissions(client_id, "resource") }
+    before(:each) do
+      stub_token_client
+      allow_any_instance_of(RestClient::Resource).to receive(:get).and_return '[{"id":"245ce612-ccdc-4426-8ea7-e0e29a718033","name":"Default Permission","description":"A permission that applies to the default resource type","type":"resource","logic":"POSITIVE","decisionStrategy":"UNANIMOUS","resourceType":"urn:dummy-client:resources:default"},{"id":"06a21e38-4e92-466d-8647-ffcd9c7b51c3","name":"delme policy","description":"delme polidy ","type":"resource","logic":"POSITIVE","decisionStrategy":"UNANIMOUS","resourceType":"asdfasdf"}]'
+    end
+
+    it "finds permissions" do
+      response = client_authz_permission.find_by("name", "resource", "scope")
+      expect(response[0].id).to eql "245ce612-ccdc-4426-8ea7-e0e29a718033"
+      expect(response[1].id).to eql "06a21e38-4e92-466d-8647-ffcd9c7b51c3"
+    end
+  end
+
+  describe '#create!' do
+    let(:realm_name) { "valid-realm" }
+    let(:client_id) { "valid-client-id" }
+    let(:client_authz_permission) {  KeycloakAdmin.realm(realm_name).authz_permissions(client_id, "resource") }
+    before(:each) do
+      stub_token_client
+      allow_any_instance_of(RestClient::Resource).to receive(:post).and_return '{"id":"245ce612-ccdc-4426-8ea7-e0e29a718033","name":"Default Permission","description":"A permission that applies to the default resource type","type":"resource","logic":"POSITIVE","decisionStrategy":"UNANIMOUS","resourceType":"urn:dummy-client:resources:default"}'
+    end
+
+    it "creates a permission" do
+      response = client_authz_permission.create!("name", "description", "UNANIMOUS", "POSITIVE", [], [], [], "resource")
+      expect(response.id).to eql "245ce612-ccdc-4426-8ea7-e0e29a718033"
+      expect(response.name).to eql "Default Permission"
+      expect(response.description).to eql "A permission that applies to the default resource type"
+      expect(response.logic).to eql "POSITIVE"
+      expect(response.decision_strategy).to eql "UNANIMOUS"
+      expect(response.resource_type).to eql "urn:dummy-client:resources:default"
+    end
+  end
+
+  describe '#list' do
+    let(:realm_name) { "valid-realm" }
+    let(:client_id) { "valid-client-id" }
+    before(:each) do
+      @client_authz_permission = KeycloakAdmin.realm(realm_name).authz_permissions(client_id, "resource")
+      stub_token_client
+      allow_any_instance_of(RestClient::Resource).to receive(:get).and_return '[{"id":"245ce612-ccdc-4426-8ea7-e0e29a718033","name":"Default Permission","description":"A permission that applies to the default resource type","type":"resource","logic":"POSITIVE","decisionStrategy":"UNANIMOUS","resourceType":"urn:dummy-client:resources:default"},{"id":"06a21e38-4e92-466d-8647-ffcd9c7b51c3","name":"delme policy","description":"delme polidy ","type":"resource","logic":"POSITIVE","decisionStrategy":"UNANIMOUS","resourceType":"asdfasdf"}]'
+
+    end
+
+    it "returns list of authz permissions" do
+      response = @client_authz_permission.list
+      expect(response.size).to eq 2
+      expect(response[0].id).to eq "245ce612-ccdc-4426-8ea7-e0e29a718033"
+      expect(response[0].name).to eq "Default Permission"
+      expect(response[0].description).to eq "A permission that applies to the default resource type"
+      expect(response[0].logic).to eq "POSITIVE"
+      expect(response[0].decision_strategy).to eq "UNANIMOUS"
+      expect(response[0].resource_type).to eq "urn:dummy-client:resources:default"
+    end
+  end
+
+  describe '#get' do
+    let(:realm_name) { "valid-realm" }
+    let(:client_id) { "valid-client-id" }
+    let(:client_authz_permission) {  KeycloakAdmin.realm(realm_name).authz_permissions(client_id, "resource") }
+    before(:each) do
+      stub_token_client
+      allow_any_instance_of(RestClient::Resource).to receive(:get).and_return '{"id":"245ce612-ccdc-4426-8ea7-e0e29a718033","name":"Default Permission","description":"A permission that applies to the default resource type","type":"resource","logic":"POSITIVE","decisionStrategy":"UNANIMOUS","resourceType":"urn:dummy-client:resources:default"}'
+    end
+
+    it "gets a permission" do
+      response = client_authz_permission.get("245ce612-ccdc-4426-8ea7-e0e29a718033")
+      expect(response.id).to eql "245ce612-ccdc-4426-8ea7-e0e29a718033"
+      expect(response.name).to eql "Default Permission"
+      expect(response.description).to eql "A permission that applies to the default resource type"
+      expect(response.logic).to eql "POSITIVE"
+      expect(response.decision_strategy).to eql "UNANIMOUS"
+      expect(response.resource_type).to eql "urn:dummy-client:resources:default"
+    end
+  end
+
+  describe '#authz_permission_url' do
+    let(:realm_name) { "valid-realm" }
+    let(:client_id) { "valid-client-id" }
+    let(:resource_id){ "valid-resource-id" }
+    let(:type){ "resource" }
+    let(:client_authz_permission) { KeycloakAdmin.realm(realm_name).authz_permissions(client_id, type, resource_id) }
+    context 'when resource_id is nil' do
+      it "return a proper url" do
+        expect(client_authz_permission.authz_permission_url(client_id)).to eq "http://auth.service.io/auth/admin/realms/valid-realm/clients/valid-client-id/authz/resource-server/permission/"
+      end
+    end
+    context 'when resource_id is not nil' do
+      it "return a proper url" do
+        expect(client_authz_permission.authz_permission_url(client_id, resource_id)).to eq "http://auth.service.io/auth/admin/realms/valid-realm/clients/valid-client-id/authz/resource-server/resource/valid-resource-id/permissions"
+      end
+    end
+    context 'when id is not nil' do
+      it "return a proper url" do
+        expect(client_authz_permission.authz_permission_url(client_id, nil, :resource, "valid-permission-id")).to eq "http://auth.service.io/auth/admin/realms/valid-realm/clients/valid-client-id/authz/resource-server/permission/resource/valid-permission-id"
+      end
+    end
+    context 'when resource_id and id are nil' do
+      it "return a proper url" do
+        expect(client_authz_permission.authz_permission_url(client_id, nil, :resource)).to eq "http://auth.service.io/auth/admin/realms/valid-realm/clients/valid-client-id/authz/resource-server/permission/resource"
+      end
+    end
+  end
+
+  describe '#authz_permission_url' do
+    let(:realm_name) { "valid-realm" }
+    let(:client_id) { "valid-client-id" }
+    before(:each) do
+      @client_authz_permission = KeycloakAdmin.realm(realm_name).authz_permissions(client_id, "resource")
+    end
+
+    it "return a proper url" do
+      expect(@client_authz_permission.authz_permission_url(client_id)).to eq "http://auth.service.io/auth/admin/realms/valid-realm/clients/valid-client-id/authz/resource-server/permission/"
+    end
+  end
+end