keycloak-api-rails 1.1.1 → 2.0.0

data/spec/keycloak-api-rails/testing_spec.rb

@@ -1,102 +0,0 @@
-require_relative "../../lib/keycloak-api-rails/testing"
-
-RSpec.describe KeycloakApiRails::Testing do
-  include KeycloakApiRails::Testing::Helpers
-
-  # The tokens are validated by the real middleware and the real service, so that these examples
-  # fail if what this module forges stops being what the library expects.
-  let(:authenticated_env) { {} }
-  let(:app) do
-    downstream = lambda do |env|
-      authenticated_env.replace(env)
-      [200, {}, ["OK"]]
-    end
-    KeycloakApiRails::Middleware.new(downstream)
-  end
-
-  def get(headers)
-    app.call({
-      "REQUEST_METHOD"    => "GET",
-      "PATH_INFO"         => "/me",
-      "REQUEST_URI"       => "http://example.org/me",
-      "HTTP_AUTHORIZATION" => headers["Authorization"]
-    })
-  end
-
-  before(:each) do
-    # The middleware only authenticates a request when the configuration tells it to, and the
-    # configuration is global: these examples cannot rely on what the other ones leave behind.
-    KeycloakApiRails.config.opt_in    = false
-    KeycloakApiRails.config.skip_paths = {}
-    KeycloakApiRails::Testing.stub_public_keys!
-  end
-
-  after(:each) do
-    KeycloakApiRails.public_key_resolver = nil
-  end
-
-  describe ".stub_public_keys!" do
-    it "should validate the tokens forged by this module" do
-      status, _headers, _body = get(keycloak_auth_headers)
-
-      expect(status).to eq(200)
-    end
-
-    it "should not require a Keycloak server to be configured" do
-      expect(KeycloakApiRails.config.server_url).to be_nil
-      expect(KeycloakApiRails.config.realm_id).to be_nil
-
-      status, _headers, _body = get(keycloak_auth_headers)
-
-      expect(status).to eq(200)
-    end
-  end
-
-  describe ".token_for" do
-    it "should authenticate the given user" do
-      get(keycloak_auth_headers(sub: "a-keycloak-id"))
-
-      expect(KeycloakApiRails::Helper.current_user_id(authenticated_env)).to eq("a-keycloak-id")
-    end
-
-    it "should generate a different user for each token" do
-      first_token  = JSON::JWT.decode(keycloak_token, KeycloakApiRails::Testing.public_keys)
-      second_token = JSON::JWT.decode(keycloak_token, KeycloakApiRails::Testing.public_keys)
-
-      expect(first_token["sub"]).not_to eq(second_token["sub"])
-    end
-
-    it "should expose every claim read by the library" do
-      get(keycloak_auth_headers(sub:              "a-keycloak-id",
-                                email:            "an-email@keycloak.io",
-                                locale:           "fr",
-                                authorized_party: "a-client",
-                                roles:            ["admin", "user"],
-                                resource_roles:   { "a-client" => ["reader"] }))
-
-      expect(KeycloakApiRails::Helper.current_user_id(authenticated_env)).to eq("a-keycloak-id")
-      expect(KeycloakApiRails::Helper.current_user_email(authenticated_env)).to eq("an-email@keycloak.io")
-      expect(KeycloakApiRails::Helper.current_user_locale(authenticated_env)).to eq("fr")
-      expect(KeycloakApiRails::Helper.current_authorized_party(authenticated_env)).to eq("a-client")
-      expect(KeycloakApiRails::Helper.current_user_roles(authenticated_env)).to eq(["admin", "user"])
-      expect(KeycloakApiRails::Helper.current_resource_roles(authenticated_env)).to eq({ "a-client" => ["reader"] })
-    end
-
-    it "should expose the claims declared as custom attributes" do
-      KeycloakApiRails.config.custom_attributes = ["tenant_id"]
-
-      get(keycloak_auth_headers(claims: { "tenant_id" => "a-tenant" }))
-
-      expect(KeycloakApiRails::Helper.current_user_custom_attributes(authenticated_env)).to eq({ "tenant_id" => "a-tenant" })
-    ensure
-      KeycloakApiRails.config.custom_attributes = []
-    end
-
-    it "should forge a token that is expired when 'expires_at' is in the past" do
-      status, _headers, body = get(keycloak_auth_headers(issued_at: Time.now - 7200, expires_at: Time.now - 3600))
-
-      expect(status).to eq(401)
-      expect(body.first).to include("JWT token is expired")
-    end
-  end
-end

data/spec/spec_helper.rb

@@ -1,14 +0,0 @@
-require_relative "../lib/keycloak-api-rails"
-require_relative "support/rails_helper"
-require_relative "support/public_key_cached_resolver_stub"
-require_relative "support/public_key_resolver_stub"
-require "timecop"
-require "byebug"
-
-RSpec.configure do |config|
-  config.include RailsHelper
-  
-  config.expect_with :rspec do |expectations|
-    expectations.include_chain_clauses_in_custom_matcher_descriptions = true
-  end
-end

data/spec/support/activesupport_free_probe.rb

@@ -1,131 +0,0 @@
-# Loads the library and exercises every code path that used to rely on ActiveSupport,
-# in a process where ActiveSupport is *not* loaded.
-#
-# The regular test suite loads `rails/all`, which makes ActiveSupport available everywhere and
-# therefore cannot detect that the library depends on it again. This probe is executed in a
-# separate process by spec/keycloak-api-rails/activesupport_free_spec.rb.
-#
-# The library files are required one by one on purpose: `lib/keycloak-api-rails.rb` pulls in
-# `json/jwt`, which depends on ActiveSupport. The point of this probe is that *our* code does not
-# use ActiveSupport, not that it never gets loaded by a third party.
-
-require "uri"
-require "date"
-require "logger"
-
-LIB = File.expand_path("../../../lib/keycloak-api-rails", __FILE__)
-
-# Minimal stand-in for the parts of lib/keycloak-api-rails.rb the required files call at runtime.
-module KeycloakApiRails
-  class << self
-    attr_accessor :config
-  end
-end
-
-require "#{LIB}/configuration"
-require "#{LIB}/helper"
-require "#{LIB}/authentication"
-require "#{LIB}/public_key_resolver"
-require "#{LIB}/public_key_cached_resolver"
-require "#{LIB}/service"
-
-$failures = []
-
-def assert(description)
-  $failures << description unless yield
-rescue => e
-  $failures << "#{description} (raised #{e.class}: #{e.message})"
-end
-
-assert("ActiveSupport is not loaded by the library") { !defined?(ActiveSupport) }
-
-### Configuration -- used to be ActiveSupport::Configurable
-configuration = KeycloakApiRails::Configuration.new
-KeycloakApiRails.config = configuration
-
-%i[
-  server_url realm_id skip_paths opt_in token_expiration_tolerance_in_seconds
-  public_key_cache_ttl custom_attributes logger ca_certificate_file
-].each do |name|
-  assert("Configuration##{name} is nil until it is assigned") { configuration.public_send(name).nil? }
-  configuration.public_send("#{name}=", "a value for #{name}")
-  assert("Configuration##{name} returns what was assigned") { configuration.public_send(name) == "a value for #{name}" }
-end
-
-### Authentication -- used to be ActiveSupport::Concern
-declared_helper_methods = []
-controller_with_helpers = Class.new do
-  define_singleton_method(:helper_method) { |*names| declared_helper_methods.concat(names) }
-end
-controller_with_helpers.include(KeycloakApiRails::Authentication)
-assert("Authentication declares keycloak_authenticate as a helper method") do
-  declared_helper_methods == [:keycloak_authenticate]
-end
-assert("Authentication can be included in a class without helper_method") do
-  Class.new.include(KeycloakApiRails::Authentication)
-  true
-end
-assert("Authentication keeps its methods protected") do
-  KeycloakApiRails::Authentication.protected_instance_methods.sort ==
-    %i[authentication_failed authentication_succeeded keycloak_authenticate]
-end
-
-### Helper#read_token_from_query_string -- used to be `present?` and `second`
-{
-  nil                                                             => "",
-  ""                                                              => "",
-  "   "                                                           => "",
-  "http://www.an-url.io/health"                                   => nil,
-  "http://www.an-url.io/health?firstName=ouioui"                  => nil,
-  "http://www.an-url.io/health?authorizationToken=aToken"         => "aToken",
-  "http://www.an-url.io/health?a=1&authorizationToken=aToken&b=2" => "aToken",
-}.each do |uri, expected|
-  assert("Helper.read_token_from_query_string(#{uri.inspect}) returns #{expected.inspect}") do
-    KeycloakApiRails::Helper.read_token_from_query_string(uri) == expected
-  end
-end
-
-### Service#expired? -- used to be `to_datetime` and `seconds`
-configuration.token_expiration_tolerance_in_seconds = 10
-configuration.skip_paths = {}
-configuration.opt_in     = false
-configuration.logger     = ::Logger.new(File::NULL)
-service = KeycloakApiRails::Service.new(nil)
-now = Time.now
-
-{
-  "expiring in one hour"                         => [(now + 3600).to_i, false],
-  "expired two days ago"                         => [(now - 172800).to_i, true],
-  "expiring within the tolerance (5s < 10s)"     => [(now + 5).to_i, true],
-  "expiring after the tolerance (30s > 10s)"     => [(now + 30).to_i, false],
-}.each do |description, (exp, expected)|
-  assert("Service#expired? returns #{expected} for a token #{description}") do
-    service.send(:expired?, { "exp" => exp }) == expected
-  end
-end
-
-### PublicKeyCachedResolver -- used to be `seconds`
-ttl = 86400
-resolver = KeycloakApiRails::PublicKeyCachedResolver.new(nil, "a-realm", ttl)
-assert("PublicKeyCachedResolver considers an empty cache as outdated") do
-  resolver.send(:public_keys_are_outdated?) == true
-end
-resolver.instance_variable_set(:@cached_public_keys, "a-public-key")
-resolver.instance_variable_set(:@cached_public_key_retrieved_at, Time.now - (ttl - 10))
-assert("PublicKeyCachedResolver keeps a cache that is within its TTL") do
-  resolver.send(:public_keys_are_outdated?) == false
-end
-resolver.instance_variable_set(:@cached_public_key_retrieved_at, Time.now - (ttl + 10))
-assert("PublicKeyCachedResolver invalidates a cache that outlived its TTL") do
-  resolver.send(:public_keys_are_outdated?) == true
-end
-
-assert("ActiveSupport has not been loaded while exercising the library") { !defined?(ActiveSupport) }
-
-if $failures.empty?
-  puts "The library behaves correctly without ActiveSupport"
-  exit 0
-else
-  $failures.each { |failure| puts "FAILED: #{failure}" }
-  exit 1
-end

data/spec/support/public_key_cached_resolver_stub.rb

@@ -1,11 +0,0 @@
-module KeycloakApiRails
-  class PublicKeyCachedResolverStub
-    def initialize(public_key)
-      @public_key = public_key
-    end
-
-    def find_public_keys
-      @public_key
-    end
-  end
-end

data/spec/support/public_key_resolver_stub.rb

@@ -1,7 +0,0 @@
-module KeycloakApiRails
-  class PublicKeyResolverStub
-    def find_public_keys
-      OpenSSL::PKey::RSA.generate(1024).public_key
-    end
-  end
-end

data/spec/support/rails_helper.rb

@@ -1,4 +0,0 @@
-require "rails/all"
-
-module RailsHelper
-end