keycloak-api-rails 1.1.1 → 2.0.0

data/spec/keycloak-api-rails/authentication_spec.rb

@@ -1,70 +0,0 @@
-require "spec_helper"
-
-describe KeycloakApiRails::Authentication do
-  class ExampleController < ActionController::Base
-    include KeycloakApiRails::Authentication
-    # Mark protected methods public so they may be called in tests
-    public(*KeycloakApiRails::Authentication.protected_instance_methods)
-  end
-
-  let(:controller) { ExampleController.new }
-  let(:token) { 'keycloak_valid_token'}
-  let(:headers) do
-    {
-      'REQUEST_METHOD' => :get,
-      'REQUEST_URI' => 'http://www.an-url.io',
-      'HTTP_AUTHORIZATION' => "Bearer #{token}"
-    }
-  end
-
-  describe "when included" do
-    it "declares keycloak_authenticate as a helper method when the base class supports helpers" do
-      declared_helper_methods = []
-      base = Class.new do
-        define_singleton_method(:helper_method) { |*names| declared_helper_methods.concat(names) }
-      end
-
-      base.include(KeycloakApiRails::Authentication)
-
-      expect(declared_helper_methods).to eq [:keycloak_authenticate]
-    end
-
-    it "declares the helper method on a real controller" do
-      expect(ExampleController._helper_methods).to include :keycloak_authenticate
-    end
-
-    it "does not fail when the base class does not support helpers" do
-      expect {
-        Class.new.include(KeycloakApiRails::Authentication)
-      }.to_not raise_error
-    end
-
-    it "exposes its methods as protected instance methods" do
-      expect(KeycloakApiRails::Authentication.protected_instance_methods).to match_array %i[
-        keycloak_authenticate
-        authentication_failed
-        authentication_succeeded
-      ]
-    end
-
-    it "does not add any public method to the including class" do
-      base = Class.new.include(KeycloakApiRails::Authentication)
-
-      expect(base.public_instance_methods).to_not include :keycloak_authenticate
-      expect(base.protected_instance_methods).to include :keycloak_authenticate
-    end
-  end
-
-  describe "#keycloak_authenticate" do
-    before do
-      # Mock request object because we aren't using real request spec
-      allow(controller).to receive(:request).and_return(double("request", env: headers ))
-    end
-
-    it "it authenticates with request header" do
-      expect_any_instance_of(KeycloakApiRails::Service).to receive(:decode_and_verify).with(token).and_return("A User")
-      expect(controller).to receive(:authentication_succeeded)
-      controller.keycloak_authenticate
-    end
-  end
-end

data/spec/keycloak-api-rails/configuration_spec.rb

@@ -1,101 +0,0 @@
-RSpec.describe KeycloakApiRails::Configuration do
-
-  # Every attribute that used to be declared through ActiveSupport's `config_accessor`.
-  let(:attribute_names) do
-    %i[
-      server_url
-      realm_id
-      skip_paths
-      opt_in
-      token_expiration_tolerance_in_seconds
-      public_key_cache_ttl
-      custom_attributes
-      logger
-      ca_certificate_file
-    ]
-  end
-
-  describe "attributes" do
-    let(:configuration) { KeycloakApiRails::Configuration.new }
-
-    it "exposes a reader and a writer for each attribute" do
-      attribute_names.each do |name|
-        expect(configuration).to respond_to name
-        expect(configuration).to respond_to "#{name}="
-      end
-    end
-
-    it "returns nil for each attribute that has not been assigned" do
-      attribute_names.each do |name|
-        expect(configuration.public_send(name)).to be_nil
-      end
-    end
-
-    it "returns the value that has been assigned" do
-      attribute_names.each do |name|
-        configuration.public_send("#{name}=", "a value for #{name}")
-        expect(configuration.public_send(name)).to eq "a value for #{name}"
-      end
-    end
-
-    it "does not respond to an unknown attribute" do
-      expect(configuration).to_not respond_to :not_a_configuration_attribute
-      expect {
-        configuration.not_a_configuration_attribute
-      }.to raise_error NoMethodError
-    end
-  end
-
-  describe "#configure" do
-    after(:each) do
-      KeycloakApiRails.load_configuration
-    end
-
-    it "yields the configuration" do
-      expect { |block| KeycloakApiRails.configure(&block) }.to yield_with_args KeycloakApiRails::Configuration
-    end
-
-    it "keeps the values assigned within the block" do
-      KeycloakApiRails.configure do |config|
-        config.server_url          = "http://keycloak:8080"
-        config.realm_id            = "a-realm"
-        config.ca_certificate_file = "/etc/ssl/a-certificate.pem"
-      end
-
-      expect(KeycloakApiRails.config.server_url).to eq "http://keycloak:8080"
-      expect(KeycloakApiRails.config.realm_id).to eq "a-realm"
-      expect(KeycloakApiRails.config.ca_certificate_file).to eq "/etc/ssl/a-certificate.pem"
-    end
-
-    it "always returns the same configuration instance" do
-      expect(KeycloakApiRails.config).to be KeycloakApiRails.config
-    end
-  end
-
-  describe "#load_configuration" do
-    before(:each) do
-      KeycloakApiRails.load_configuration
-    end
-
-    after(:each) do
-      KeycloakApiRails.load_configuration
-    end
-
-    it "applies the documented default values" do
-      config = KeycloakApiRails.config
-
-      expect(config.server_url).to be_nil
-      expect(config.realm_id).to be_nil
-      expect(config.logger).to be_a ::Logger
-      expect(config.skip_paths).to eq({})
-      expect(config.opt_in).to be false
-      expect(config.token_expiration_tolerance_in_seconds).to eq 10
-      expect(config.public_key_cache_ttl).to eq 86400
-      expect(config.custom_attributes).to eq []
-    end
-
-    it "exposes the logger through KeycloakApiRails.logger" do
-      expect(KeycloakApiRails.logger).to be KeycloakApiRails.config.logger
-    end
-  end
-end

data/spec/keycloak-api-rails/helper_spec.rb

@@ -1,94 +0,0 @@
-RSpec.describe KeycloakApiRails::Helper do
-  describe "#read_token_from_query_string" do
-
-    subject { KeycloakApiRails::Helper.read_token_from_query_string(uri) }
-
-    context "when the uri is nil" do
-      let(:uri) { nil }
-      it "returns an empty token" do
-        expect(subject).to eq ""
-      end
-    end
-
-    context "when the uri is empty" do
-      let(:uri) { "" }
-      it "returns an empty token" do
-        expect(subject).to eq ""
-      end
-    end
-
-    context "when the uri only contains whitespaces" do
-      let(:uri) { "   " }
-      it "returns an empty token" do
-        expect(subject).to eq ""
-      end
-    end
-
-    context "when the uri has no query string" do
-      let(:uri) { "http://www.an-url.io/health" }
-      it "returns no token" do
-        expect(subject).to be_nil
-      end
-    end
-
-    context "when the uri has a query string but no token" do
-      let(:uri) { "http://www.an-url.io/health?firstName=ouioui" }
-      it "returns no token" do
-        expect(subject).to be_nil
-      end
-    end
-
-    context "when the uri has a token in the query string" do
-      let(:uri) { "http://www.an-url.io/health?authorizationToken=aToken" }
-      it "returns the token" do
-        expect(subject).to eq "aToken"
-      end
-    end
-
-    context "when the uri has a token among other query string parameters" do
-      let(:uri) { "http://www.an-url.io/health?firstName=ouioui&authorizationToken=aToken&lastName=nonnon" }
-      it "returns the token" do
-        expect(subject).to eq "aToken"
-      end
-    end
-
-    context "when the uri has an empty token in the query string" do
-      let(:uri) { "http://www.an-url.io/health?authorizationToken=" }
-      it "returns an empty token" do
-        expect(subject).to eq ""
-      end
-    end
-  end
-
-  describe "#create_url_with_token" do
-
-    let(:uri)   { "http://www.an-url.io" }
-    let(:token) { "aToken" }
-
-    before(:each) do
-      @url_with_token = KeycloakApiRails::Helper.create_url_with_token(uri, token)
-    end
-
-    context "when the uri has no query string yet" do
-      it "returns an url with the provided token" do
-        expect(@url_with_token).to eq "#{uri}?authorizationToken=#{token}"
-      end
-    end
-
-    context "when the uri already has no query strings" do
-      context "but no token yet" do
-        let(:uri)   { "http://www.an-url.io?firstName=ouioui&lastName=nonnon" }
-        it "returns an url with all the query string and the token" do
-          expect(@url_with_token).to eq "#{uri}&authorizationToken=#{token}"
-        end
-      end
-
-      context "including a token" do
-        let(:uri)   { "http://www.an-url.io?authorizationToken=ouioui&lastName=nonnon" }
-        it "returns an url with all the query string and the new token" do
-          expect(@url_with_token).to eq "http://www.an-url.io?lastName=nonnon&authorizationToken=#{token}"
-        end
-      end
-    end
-  end
-end

data/spec/keycloak-api-rails/public_key_cached_resolver_spec.rb

@@ -1,80 +0,0 @@
-RSpec.describe KeycloakApiRails::Service do
-
-  let(:public_key_cache_ttl)  { 86400 }
-  let(:server_url)            { "whatever:8080" }
-  let(:realm_id)              { "pouet" }
-  let!(:resolver)             { KeycloakApiRails::PublicKeyCachedResolver.new(server_url, realm_id, public_key_cache_ttl) }
-
-  before(:each) do
-    resolver.instance_variable_set(:@resolver, KeycloakApiRails::PublicKeyResolverStub.new)
-    now = Time.local(2018, 1, 9, 12, 0, 0)
-    Timecop.freeze(now)
-  end
-
-  after(:each) do
-    Timecop.return
-  end
-
-  describe "#find_public_key" do
-    context "when there is no public key in cache yet" do
-      before(:each) do
-        @public_key = resolver.find_public_keys
-      end
-
-      it "returns a valid public key" do
-        expect(@public_key).to_not be_nil
-      end
-
-      it "sets the current time to the resolver" do
-        expect(resolver.cached_public_key_retrieved_at).to eq Time.now
-      end
-    end
-
-    context "when there is already a public key in cache" do
-      before(:each) do
-        @first_public_key                     = resolver.find_public_keys
-        @first_cached_public_key_retrieved_at = resolver.cached_public_key_retrieved_at
-      end
-
-      context "and no need to refresh it" do
-        before(:each) do
-          Timecop.freeze(Time.now + public_key_cache_ttl.seconds - 10.seconds)
-          @second_public_key                     = resolver.find_public_keys
-          @second_cached_public_key_retrieved_at = resolver.cached_public_key_retrieved_at
-        end
-
-        it "returns a valid public key" do
-          expect(@second_public_key).to_not be_nil
-        end
-
-        it "does not refresh the public key" do
-          expect(@second_public_key).to eq @first_public_key
-        end
-
-        it "does not refresh the public key retrieval time" do
-          expect(@first_cached_public_key_retrieved_at).to eq @second_cached_public_key_retrieved_at
-        end
-      end
-
-      context "and its TTL has expired" do
-        before(:each) do
-          Timecop.freeze(Time.now + public_key_cache_ttl.seconds + 10.seconds)
-          @second_public_key                     = resolver.find_public_keys
-          @second_cached_public_key_retrieved_at = resolver.cached_public_key_retrieved_at
-        end
-
-        it "returns a valid public key" do
-          expect(@second_public_key).to_not be_nil
-        end
-
-        it "refreshes the public key" do
-          expect(@second_public_key).to_not eq @first_public_key
-        end
-
-        it "refreshes the public key retrieval time" do
-          expect(@first_cached_public_key_retrieved_at).to_not eq @second_cached_public_key_retrieved_at
-        end
-      end
-    end
-  end
-end

data/spec/keycloak-api-rails/service_spec.rb

@@ -1,281 +0,0 @@
-RSpec.describe KeycloakApiRails::Service do
-
-  let!(:private_key)  { OpenSSL::PKey::RSA.generate(2048) }
-  let!(:public_key)   { private_key.public_key }
-  let!(:key_resolver)  { KeycloakApiRails::PublicKeyCachedResolverStub.new(public_key) }
-  let!(:service)       { KeycloakApiRails::Service.new(key_resolver) }
-  
-  before(:each) do
-    now = Time.local(2018, 1, 9, 12, 0, 0)
-    Timecop.freeze(now)
-  end
-
-  after(:each) do
-    Timecop.return
-  end
-
-  describe "#decode_and_verify" do
-    def create_token(private_key, expiration_date, algorithm)
-      claim = {
-        iss: "KeycloakApiRails",
-        exp: expiration_date,
-        nbf: Time.local(2018, 1, 1, 0, 0, 0)
-      }
-      jws = JSON::JWT.new(claim).sign(private_key, algorithm)
-      jws.to_s
-    end
-
-    context "when token is nil" do
-      let(:token) { nil }
-      it "should raise an error :no_token" do
-        expect {
-          service.decode_and_verify(token)
-        }.to raise_error(TokenError, "No JWT token provided")
-      end
-    end
-
-    context "when token is an empty string" do
-      let(:token) { "" }
-      it "should raise an error :no_token" do
-        expect {
-          service.decode_and_verify(token)
-        }.to raise_error(TokenError, "No JWT token provided")
-      end
-    end
-
-    context "when token is in an invalid format" do
-      let(:token) { "coucou" }
-      it "should raise an error :invalid_format" do
-        expect {
-          service.decode_and_verify(token)
-        }.to raise_error(TokenError, "Wrong JWT Format")
-      end
-    end
-
-    context "when token is in a valid format" do
-      let(:algorithm)       { :RS256 }
-      let(:expiration_date) { 1.week.from_now }
-
-      context "and token is generated by another private key" do
-        let(:another_private_key)  { OpenSSL::PKey::RSA.generate(1024) }
-        let(:token)                { create_token(another_private_key, expiration_date, algorithm) }
-        
-        it "should raise an error :verification_failed" do
-          expect {
-            service.decode_and_verify(token)
-          }.to raise_error(TokenError, "Failed to verify JWT token")
-        end
-      end
-
-      context "and token is generated by the right private key" do
-        let(:token) { create_token(private_key, expiration_date, algorithm) }
-        
-        context "and token is expired" do
-          let(:expiration_date) { Time.now - 2.days }
-          
-          it "should raise an error :expiration_date" do
-            expect {
-              service.decode_and_verify(token)
-            }.to raise_error(TokenError, "JWT token is expired")
-          end
-        end
-
-        # The service reads `token_expiration_tolerance_in_seconds` when it is instantiated:
-        # a token expiring within that tolerance is already considered as expired.
-        context "and token expires within the expiration tolerance" do
-          let(:expiration_date) { Time.now + 5 }
-
-          it "should raise an error :expiration_date" do
-            expect(KeycloakApiRails.config.token_expiration_tolerance_in_seconds).to eq 10
-            expect {
-              service.decode_and_verify(token)
-            }.to raise_error(TokenError, "JWT token is expired")
-          end
-        end
-
-        context "and token expires just after the expiration tolerance" do
-          let(:expiration_date) { Time.now + 30 }
-
-          it "should return a not-nil decoded token" do
-            expect(KeycloakApiRails.config.token_expiration_tolerance_in_seconds).to eq 10
-            expect(service.decode_and_verify(token)).to_not be_nil
-          end
-        end
-
-        context "and token is not expired" do
-          let(:expiration_date) { Time.now + 2.days }
-
-          context "and token is encrypted using RS256" do
-            let(:algorithm) { :RS256 }
-            
-            it "should return a not-nil decoded token" do
-              expect(service.decode_and_verify(token)).to_not be_nil
-            end
-          end
-
-          context "and token is encrypted using RS512" do
-            let(:algorithm) { :RS512 }
-            
-            it "should return a not-nil decoded token" do
-              expect(service.decode_and_verify(token)).to_not be_nil
-            end
-          end
-        end
-      end
-    end
-  end
-
-  describe "#need_middleware_authentication?" do
-
-    let(:method)  { nil }
-    let(:path)    { nil }
-    let(:headers) { {} }
-
-
-    before(:each) do
-      KeycloakApiRails.config.skip_paths = {
-        post:   [/^\/skip/],
-        get:    [/^\/skip/]
-      }
-      @result = service.need_middleware_authentication?(method, path, headers)
-    end
-
-    context "when method is nil" do
-      let(:method) { nil }
-      let(:path)   { "/do-not-skip" }
-      it "should return true" do
-        expect(@result).to be true
-      end
-    end
-
-    context "when path is nil" do
-      let(:method) { :get }
-      let(:path)   { nil }
-      it "should return true" do
-        expect(@result).to be true
-      end
-    end
-
-    context "when method does not match the configuration" do
-      let(:method) { :put }
-      let(:path)   { "/skip" }
-      it "should return true" do
-        expect(@result).to be true
-      end
-    end
-
-    context "when path does not match the configuration" do
-      let(:method) { :get }
-      let(:path)   { "/do-not-skip" }
-      it "should return true" do
-        expect(@result).to be true
-      end
-    end
-
-    context "when method [get] and path do match the configuration" do
-      let(:method) { :get }
-      let(:path)   { "/skip" }
-      it "should return false" do
-        expect(@result).to be false
-      end
-    end
-
-
-    context "when method [post] and path do match the configuration" do
-      let(:method) { :get }
-      let(:path)   { "/skip" }
-      it "should return false" do
-        expect(@result).to be false
-      end
-    end
-
-    context "when the request is preflight" do
-      let(:method)  { :options }
-      let(:headers) { { "HTTP_ACCESS_CONTROL_REQUEST_METHOD" => ["Authorization"] } }
-      let(:path)    { "/do-not-skip" }
-      it "should return false" do
-        expect(@result).to be false
-      end
-    end
-
-    context "when configured as opt_in" do
-      before do
-        KeycloakApiRails.config.opt_in = true
-        service2 = KeycloakApiRails::Service.new(key_resolver)
-        @result = service2.need_middleware_authentication?(method, path, headers)
-      end
-
-      # The configuration is global: leaving 'opt_in' enabled would disable the authentication
-      # of every example running afterwards.
-      after do
-        KeycloakApiRails.config.opt_in = false
-      end
-
-      it "should return false" do
-        expect(@result).to be false
-      end
-    end
-  end
-
-  describe "#read_token" do
-    let(:query_string)       { "" }
-    let(:url)                { "http://api.service.com/api/health?aParameter=true#{query_string}" }
-    let(:headers)            { {} }
-    let(:header_token)       { "header_token" }
-    let(:query_string_token) { "query_string_token" }
-
-    before(:each) do
-      @token = service.read_token(url, headers)
-    end
-
-    context "when the token is provided in the Authorization headers" do
-      let(:headers) do
-        {
-          "HTTP_AUTHORIZATION" => "Bearer #{header_token}"
-        }
-      end
-      context "and not in the query string" do
-        let(:query_string) { "" }
-        it "returns the header token" do
-          expect(@token).to eq header_token
-        end
-      end
-
-      context "and also in the query string" do
-        let(:query_string) { "&authorizationToken=#{query_string_token}" }
-        it "returns the query string token" do
-          expect(@token).to eq query_string_token
-        end
-      end
-    end
-
-    context "when the token is not provided in the Authorization headers" do
-      let(:headers) do
-        {
-          "ANOTHER_HEADER" => header_token
-        }
-      end
-
-      context "and not in the query string" do
-        let(:query_string) { "" }
-        it "returns an empty token" do
-          expect(@token).to eq ""
-        end
-      end
-
-      context "and query string is nil" do
-        let(:query_string) { nil }
-        it "returns an empty token" do
-          expect(@token).to eq ""
-        end
-      end
-
-      context "but in the query string" do
-        let(:query_string) { "&authorizationToken=#{query_string_token}" }
-        it "returns the query string token" do
-          expect(@token).to eq query_string_token
-        end
-      end
-    end
-  end
-end