keycloak-admin 2.0.2 → 2.0.3

data/lib/keycloak-admin/client/resource.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "faraday"
 require "uri"
 
@@ -18,13 +19,11 @@ module KeycloakAdmin
       new(url, options, logger).send(:request, method, payload, headers)
     end
 
-    def self.put(url, payload, headers = {}, logger = nil)
-      new(url, {}, logger).put(payload, headers)
-    end
-
     def initialize(url, options = {}, logger = nil)
+      options  = (options || {}).dup
+      @adapter = options.delete(:adapter)
       @url     = url
-      @options = options || {}
+      @options = options
       @logger  = logger
     end
 
@@ -75,7 +74,10 @@ module KeycloakAdmin
         # headers by default, which would print the bearer token on every call; headers: false
         # keeps this to method/url/status only. Bodies are already off by Faraday's own default.
         f.response :logger, @logger, headers: false if @logger
-        f.adapter Faraday.default_adapter
+        # Faraday's default net_http adapter wraps every request in http.start, which reopens
+        # the connection each time; config.faraday_adapter lets a caller swap in a pooling one.
+        # Splatted so an adapter needing arguments can be given as [:name, options].
+        f.adapter(*Array(@adapter || Faraday.default_adapter))
       end
     end
 

data/lib/keycloak-admin/client/response.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   # Wraps a Faraday::Response the way RestClient::Response used to: as the body string
   # itself (RestClient::Response < String), so existing call sites that do JSON.parse(response)

data/lib/keycloak-admin/client/role_client.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class RoleClient < Client
     def initialize(configuration, realm_client)
@@ -15,8 +16,6 @@ module KeycloakAdmin
 
     # Returns the role representation for the specified role name
     def get(name)
-      # allows special characters in the name like space
-      name = URI.encode_uri_component(name)
       response = execute_http do
         resource(role_name_url(name)).get(headers)
       end
@@ -25,8 +24,6 @@ module KeycloakAdmin
 
     # Lists all groups that have the specified role name assigned
     def list_groups(name)
-      # allows special characters in the name like space
-      name = URI.encode_uri_component(name)
       response = execute_http do
         resource("#{role_name_url(name)}/groups").get(headers)
       end
@@ -49,11 +46,11 @@ module KeycloakAdmin
     end
 
     def role_id_url(id)
-      "#{@realm_client.realm_admin_url}/roles-by-id/#{id}"
+      "#{@realm_client.realm_admin_url}/roles-by-id/#{encode_segment(id)}"
     end
     
     def role_name_url(name)
-      "#{@realm_client.realm_admin_url}/roles/#{name}"
+      "#{@realm_client.realm_admin_url}/roles/#{encode_segment(name)}"
     end
   end
 end

data/lib/keycloak-admin/client/role_mapper_client.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class RoleMapperClient < Client
     def initialize(configuration, user_resource)
@@ -23,7 +24,7 @@ module KeycloakAdmin
     def remove_realm_level(role_representation_list)
       execute_http do
         Resource.execute(
-          @configuration.faraday_options.merge(
+          connection_options.merge(
             method: :delete,
             url: realm_level_url,
             payload: create_payload(role_representation_list),

data/lib/keycloak-admin/client/token_client.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class TokenClient < Client
     def initialize(configuration, realm_client)

data/lib/keycloak-admin/client/user_client.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class UserClient < Client
     def initialize(configuration, realm_client)
@@ -6,55 +7,61 @@ module KeycloakAdmin
       @realm_client = realm_client
     end
 
+    # Reads the id of the new user off the Location header rather than searching for it
+    # afterwards: Keycloak's `search` parameter matches a substring of the username, email,
+    # first name or last name, so an existing user merely containing this email was returned
+    # instead of the one just created.
     def create!(username, email, password, email_verified, locale, attributes={})
-      user = save(build(username, email, password, email_verified, locale, attributes))
-      search(user.email)&.first
+      response = post_user(build(username, email, password, email_verified, locale, attributes))
+      get(created_id(response))
     end
 
     def save(user_representation)
-      execute_http do
-        resource(users_url).post(
-          create_payload(user_representation), headers
-        )
-      end
+      post_user(user_representation)
       user_representation
     end
 
     # pay attention that, since Keycloak 24.0.4, partial updates of attributes are not authorized anymore
     def update(user_id, user_representation_body)
       raise ArgumentError.new("user_id must be defined") if user_id.nil?
-      Resource.execute(
-        @configuration.faraday_options.merge(
-          method: :put,
-          url: users_url(user_id),
-          payload: create_payload(user_representation_body),
-          headers: headers,
-          logger: @configuration.logger
+      execute_http do
+        Resource.execute(
+          connection_options.merge(
+            method: :put,
+            url: users_url(user_id),
+            payload: create_payload(user_representation_body),
+            headers: headers,
+            logger: @configuration.logger
+          )
         )
-      )
+      end
     end
 
     def add_group(user_id, group_id)
-      Resource.execute(
-        @configuration.faraday_options.merge(
-          method: :put,
-          url: "#{users_url(user_id)}/groups/#{group_id}",
-          payload: create_payload({}),
-          headers: headers,
-          logger: @configuration.logger
+      execute_http do
+        Resource.execute(
+          connection_options.merge(
+            method: :put,
+            url: "#{users_url(user_id)}/groups/#{encode_segment(group_id)}",
+            payload: create_payload({}),
+            headers: headers,
+            logger: @configuration.logger
+          )
         )
-      )
+      end
     end
 
     def remove_group(user_id, group_id)
-      Resource.execute(
-        @configuration.faraday_options.merge(
-          method: :delete,
-          url: "#{users_url(user_id)}/groups/#{group_id}",
-          headers: headers,
-          logger: @configuration.logger
+      execute_http do
+        Resource.execute(
+          connection_options.merge(
+            method: :delete,
+            url: "#{users_url(user_id)}/groups/#{encode_segment(group_id)}",
+            headers: headers,
+            logger: @configuration.logger
+          )
         )
-      )
+      end
     end
 
     def add_client_roles_on_user(user_id, client_id, role_representations)
@@ -94,8 +101,12 @@ module KeycloakAdmin
       JSON.parse(response).map { |user_as_hash| UserRepresentation.from_hash(user_as_hash) }
     end
 
-    def list
-      search(nil)
+    # Keycloak answers this endpoint with at most 100 users unless `max` says otherwise, so a
+    # bare `list` silently truncates a larger realm. Passing neither bound sends no query
+    # parameter at all, exactly as before.
+    def list(first: nil, max: nil)
+      pagination = {first: first, max: max}.compact
+      search(pagination.empty? ? nil : pagination)
     end
 
     def delete(user_id)
@@ -112,13 +123,13 @@ module KeycloakAdmin
       JSON.parse(response).map { |group_as_hash| GroupRepresentation.from_hash(group_as_hash) }
     end
 
-    def update_password(user_id, new_password)
+    def update_password(user_id, new_password, temporary: false)
       execute_http do
         Resource.execute(
-          @configuration.faraday_options.merge(
+          connection_options.merge(
             method: :put,
             url: reset_password_url(user_id),
-            payload: { type: "password", value: new_password, temporary: false }.to_json,
+            payload: { type: "password", value: new_password, temporary: temporary }.to_json,
             headers: headers,
             logger: @configuration.logger
           )
@@ -148,16 +159,16 @@ module KeycloakAdmin
 
         url = execute_actions_email_url(user_id)
         url = "#{url}?#{build_query(query)}" unless query.empty?
-        Resource.put(url, create_payload(actions), headers, @configuration.logger)
+        resource(url).put(create_payload(actions), headers)
       end
       user_id
     end
 
     def impersonate(user_id)
-      impersonation = get_redirect_impersonation(user_id)
       response = execute_http do
+        impersonation = get_redirect_impersonation(user_id)
         Resource.execute(
-          @configuration.faraday_options.merge(
+          connection_options.merge(
             method: :post,
             url: impersonation.impersonation_url,
             payload: impersonation.body.to_json,
@@ -183,7 +194,7 @@ module KeycloakAdmin
 
       execute_http do
         Resource.execute(
-          @configuration.faraday_options.merge(
+          connection_options.merge(
             method: :post,
             url: logout_url(user_id),
             headers: headers,
@@ -206,7 +217,7 @@ module KeycloakAdmin
 
       execute_http do
         Resource.execute(
-          @configuration.faraday_options.merge(
+          connection_options.merge(
             method: :post,
             url: federated_identity_url(user_id, idp_id),
             payload: fed_id_rep.to_json,
@@ -225,14 +236,14 @@ module KeycloakAdmin
 
     def users_url(id=nil)
       if id
-        "#{@realm_client.realm_admin_url}/users/#{id}"
+        "#{@realm_client.realm_admin_url}/users/#{encode_segment(id)}"
       else
         "#{@realm_client.realm_admin_url}/users"
       end
     end
 
     def user_client_role_mappings_url(user_id, client_id)
-      "#{users_url(user_id)}/role-mappings/clients/#{client_id}"
+      "#{users_url(user_id)}/role-mappings/clients/#{encode_segment(client_id)}"
     end
 
     def reset_password_url(user_id)
@@ -263,7 +274,7 @@ module KeycloakAdmin
     def federated_identity_url(user_id, identity_provider)
       raise ArgumentError.new("user_id must be defined") if user_id.nil?
       raise ArgumentError.new("identity_provider must be defined") if identity_provider.nil?
-      "#{users_url(user_id)}/federated-identity/#{identity_provider}"
+      "#{users_url(user_id)}/federated-identity/#{encode_segment(identity_provider)}"
     end
 
     def logout_url(user_id)
@@ -274,13 +285,21 @@ module KeycloakAdmin
 
     private
 
+    def post_user(user_representation)
+      execute_http do
+        resource(users_url).post(
+          create_payload(user_representation), headers
+        )
+      end
+    end
+
     def build(username, email, password, email_verified, locale, attributes={})
       user                     = UserRepresentation.new
       user.email               = email
       user.username            = username
       user.email_verified      = email_verified
       user.enabled             = true
-      user.attributes          = attributes || {}
+      user.attributes          = (attributes || {}).dup
       user.attributes[:locale] = locale if locale
       user.add_credential(CredentialRepresentation.from_password(password)) if !password.nil?
       user

data/lib/keycloak-admin/configuration.rb

@@ -1,13 +1,48 @@
+# frozen_string_literal: true
 require "base64"
 
 module KeycloakAdmin
   class Configuration
-    attr_accessor :server_url, :server_domain, :client_id, :client_secret, :client_realm_name, :use_service_account, :username, :password, :logger, :faraday_options
+    attr_accessor :server_url, :server_domain, :client_id, :client_secret, :client_realm_name, :use_service_account, :username, :password, :logger, :faraday_options, :faraday_adapter
 
     # Treat a cached token as expired this many seconds before its real expiry, so it
     # cannot go stale between the check below and the request that relies on it.
     TOKEN_EXPIRY_SAFETY_MARGIN_SECONDS = 10
 
+    FILTERED_ATTRIBUTES  = %i[@client_secret @password @cached_token].freeze
+    FILTERED_PLACEHOLDER = "[FILTERED]".freeze
+
+    def initialize
+      @token_mutex = Mutex.new
+    end
+
+    def inspect
+      rendered = instance_variables.map do |name|
+        value = instance_variable_get(name)
+        shown  = if FILTERED_ATTRIBUTES.include?(name) && !value.nil?
+          FILTERED_PLACEHOLDER
+        else
+          value.inspect
+        end
+        "#{name}=#{shown}"
+      end
+      "#<#{self.class.name} #{rendered.join(", ")}>"
+    end
+
+    # Returns the cached token, fetching one through the block if there is none.
+    # The block runs at most once across threads.
+    def fetch_token_once
+      token = cached_token
+      if token.nil?
+        @token_mutex.synchronize do
+          token = cached_token
+          token.nil? ? cache_token(yield) : token
+        end
+      else
+        token
+      end
+    end
+
     # Returns the cached TokenRepresentation, or nil if there is none or it is (about to be) expired.
     def cached_token
       return nil if @token_expires_at.nil? || Time.now >= @token_expires_at
@@ -22,8 +57,8 @@ module KeycloakAdmin
     end
 
     def clear_cached_token!
-      @cached_token     = nil
       @token_expires_at = nil
+      @cached_token     = nil
     end
 
     def body_for_token_retrieval

data/lib/keycloak-admin/error.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class Error < StandardError; end
 

data/lib/keycloak-admin/path_encoding.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+require "uri"
+
+module KeycloakAdmin
+  # Percent-encoding for the identifiers interpolated into a URL path.
+  #
+  # Included by Client and BaseRoleContainingResource, which have no common ancestor but
+  # both build URLs out of caller-supplied values.
+  module PathEncoding
+    private
+
+    # Encodes '/' as %2F too, so an identifier can never open a path segment of its own.
+    # Values that are already URL-safe - the UUIDs Keycloak hands out - come out unchanged,
+    # so this is a no-op for the usual case.
+    #
+    # Without it, any identifier holding a character that is illegal in a URI (a space, most
+    # obviously) made Ruby's URI parser raise URI::InvalidURIError before the request was
+    # ever sent. That is reachable with values users choose themselves, identity provider
+    # aliases being the clearest case.
+    def encode_segment(value)
+      URI.encode_uri_component(value.to_s)
+    end
+  end
+end

data/lib/keycloak-admin/representation/attack_detection_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class AttackDetectionRepresentation < Representation
     attr_accessor :num_failures,

data/lib/keycloak-admin/representation/camel_json.rb

@@ -1,11 +1,15 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   module CamelJson
 
     def camelize(lower_case_and_underscored_word, first_letter_in_uppercase = true)
-      if first_letter_in_uppercase
-        lower_case_and_underscored_word.to_s.gsub(/\/(.?)/) { "::" + $1.upcase }.gsub(/(^|_)(.)/) { $2.upcase }
+      word = lower_case_and_underscored_word.to_s
+      if word.empty?
+        word
+      elsif first_letter_in_uppercase
+        word.gsub(/\/(.?)/) { "::" + $1.upcase }.gsub(/(^|_)(.)/) { $2.upcase }
       else
-        lower_case_and_underscored_word[0] + camelize(lower_case_and_underscored_word)[1..-1]
+        word[0] + camelize(word)[1..-1]
       end
     end
   end

data/lib/keycloak-admin/representation/client_authz_policy_config_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class ClientAuthzPolicyConfigRepresentation < Representation
     attr_accessor :roles,

data/lib/keycloak-admin/representation/client_authz_policy_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class ClientAuthzPolicyRepresentation < Representation
     attr_accessor :id,

data/lib/keycloak-admin/representation/client_authz_resource_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
 
   class ClientAuthzResourceRepresentation < Representation

data/lib/keycloak-admin/representation/client_authz_scope_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class ClientAuthzScopeRepresentation < Representation
     attr_accessor :id,

data/lib/keycloak-admin/representation/client_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class ClientRepresentation < Representation
     attr_accessor :id,
@@ -26,7 +27,6 @@ module KeycloakAdmin
                   :authentication_flow_binding_overrides,
                   :full_scope_allowed,
                   :node_re_registration_timeout,
-                  :attributes,
                   :protocol_mappers,
                   :default_client_scopes,
                   :optional_client_scopes,
@@ -41,9 +41,9 @@ module KeycloakAdmin
       client.client_authenticator_type             = hash["clientAuthenticatorType"]
       client.always_display_in_console             = hash["alwaysDisplayInConsole"] || false
       client.surrogate_auth_required               = hash["surrogateAuthRequired"] || false
-      client.redirect_uris                         = hash["redirectUris"] || false
-      client.web_origins                           = hash["webOrigins"] || false
-      client.not_before                            = hash["notBefore"] || false
+      client.redirect_uris                         = hash["redirectUris"] || []
+      client.web_origins                           = hash["webOrigins"] || []
+      client.not_before                            = hash["notBefore"] || 0
       client.bearer_only                           = hash["bearerOnly"] || false
       client.consent_required                      = hash["consentRequired"] || false
       client.standard_flow_enabled                 = hash["standardFlowEnabled"] || false
@@ -60,7 +60,6 @@ module KeycloakAdmin
       client.authentication_flow_binding_overrides = hash["authenticationFlowBindingOverrides"] || {}
       client.full_scope_allowed                    = hash["fullScopeAllowed"] || false
       client.node_re_registration_timeout          = hash["nodeReRegistrationTimeout"] || -1
-      client.attributes                            = hash["attributes"]
       client.protocol_mappers                      = (hash["protocolMappers"] || []).map { |protocol_mapper_hash| ProtocolMapperRepresentation.from_hash(protocol_mapper_hash) }
       client.default_client_scopes                 = hash["defaultClientScopes"] || []
       client.optional_client_scopes                = hash["optionalClientScopes"] || []

data/lib/keycloak-admin/representation/client_scope_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class ClientScopeRepresentation < Representation
     attr_accessor :id,

data/lib/keycloak-admin/representation/credential_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class CredentialRepresentation < Representation
     attr_accessor :id,

data/lib/keycloak-admin/representation/federated_identity_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class FederatedIdentityRepresentation < Representation
     attr_accessor :identity_provider,

data/lib/keycloak-admin/representation/group_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class GroupRepresentation < Representation
     attr_accessor :id,

data/lib/keycloak-admin/representation/identity_provider_mapper_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class IdentityProviderMapperRepresentation < Representation
     attr_accessor :id,

data/lib/keycloak-admin/representation/identity_provider_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class IdentityProviderRepresentation < Representation
     attr_accessor :alias,

data/lib/keycloak-admin/representation/impersonation_redirection_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class ImpersonationRedirectionRepresentation < Representation
     attr_reader :headers, :impersonation_url, :http_method, :body

data/lib/keycloak-admin/representation/impersonation_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "http-cookie"
 
 module KeycloakAdmin

data/lib/keycloak-admin/representation/member_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class MemberRepresentation < UserRepresentation
     attr_accessor :membership_type

data/lib/keycloak-admin/representation/organization_domain_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class OrganizationDomainRepresentation < Representation
     attr_accessor :name, :verified

data/lib/keycloak-admin/representation/organization_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class OrganizationRepresentation < Representation
     attr_accessor :id,
@@ -9,7 +10,6 @@ module KeycloakAdmin
       :attributes,
       :domains,
       :members,
-      :attributes,
       :identity_providers
 
     def self.from_hash(hash)

data/lib/keycloak-admin/representation/protocol_mapper_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class ProtocolMapperRepresentation < Representation
     attr_accessor :config,

data/lib/keycloak-admin/representation/realm_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class RealmRepresentation < Representation
     attr_accessor :id,

data/lib/keycloak-admin/representation/representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "json"
 require_relative "camel_json"
 
@@ -5,14 +6,15 @@ class Representation
   include ::KeycloakAdmin::CamelJson
 
   def as_json(options=nil)
-    Hash[instance_variables.map { |ivar| [ivar.to_s[1..-1], instance_variable_get(ivar)] }]
+    instance_variables.each_with_object({}) do |ivar, hash|
+      val = instance_variable_get(ivar)
+      hash[ivar.to_s[1..-1]] = val unless val.nil?
+    end
   end
 
   def to_json(options=nil)
-    snaked_hash = as_json(options)
-    snaked_hash.keys.reduce({}) do |camelized_hash, key|
-      camelized_hash[camelize(key, false)] = snaked_hash[key]
-      camelized_hash
+    as_json(options).each_with_object({}) do |(key, val), hash|
+      hash[camelize(key, false)] = val
     end.to_json(options)
   end
 

data/lib/keycloak-admin/representation/role_representation.rb

@@ -1,10 +1,11 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class RoleRepresentation < Representation
     attr_accessor :id,
       :name,
       :composite,
       :client_role,
-      :container_id,
+      :container_id
 
     def self.from_hash(hash)
       role             = new

data/lib/keycloak-admin/representation/session_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class SessionRepresentation < Representation
     attr_accessor :id,
@@ -6,7 +7,7 @@ module KeycloakAdmin
       :ip_address,
       :start,
       :last_access,
-      :remember_me,
+      :remember_me
 
     def self.from_hash(hash)
       rep                   = new

data/lib/keycloak-admin/representation/token_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 
 module KeycloakAdmin
   class TokenRepresentation < Representation

data/lib/keycloak-admin/representation/user_representation.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class UserRepresentation < Representation
     attr_accessor :id,

data/lib/keycloak-admin/resource/base_role_containing_resource.rb

@@ -1,5 +1,8 @@
+# frozen_string_literal: true
 module KeycloakAdmin
   class BaseRoleContainingResource
+    include PathEncoding
+
     attr_reader :resource_id
 
     def initialize(configuration, realm_client, resource_id)
@@ -14,7 +17,7 @@ module KeycloakAdmin
     end
 
     def resource_url
-      "#{@realm_client.realm_admin_url}/#{resources_name}/#{@resource_id}"
+      "#{@realm_client.realm_admin_url}/#{resources_name}/#{encode_segment(@resource_id)}"
     end
 
     def client_role_mappings(client_id)