kuroko2 0.2.2 → 0.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 847842a5da73534ceea06805cc86527e236bfa33
-  data.tar.gz: 7b4b52174d0d6303c37b8795e5ce4a5cd5857e21
+  metadata.gz: 82f8904d52f7ed97320ff851e35b91b5913d8baf
+  data.tar.gz: c1fe3a881e302a1823a47aa37176756ae8de7470
 SHA512:
-  metadata.gz: 54a6fbbd9de6a0efb7a26028492b5b4e269770c995949976d809342143bbe96dbb49d20698b2585c7c89349aee9cb3bd70109e7b5b81f02b7e956c07dda17263
-  data.tar.gz: 94daa79c2ff4510379bd91c9b258dae60585f4bf1daa1cfe81adb7c97c5ab9b5e2d591271b42aab63489386008430a9573fd486baee09ffe5b087e5acbcb4c4c
+  metadata.gz: 13794a4c4d2ceb7ae4ed9d38a1bc76fda67a853756c3cdc2a855141fab8d83fceb26b48de303747a0527e8c3cdef7d04e1748019892e436ad2253e074af0c776
+  data.tar.gz: af34902e44039abf0efbdb912674a3196e8f7a7279aa968c09b4e0ba40270daeb2fe5a6c5e6eeaf6404593834d6a11e85d11acfcc75f7fa8fe11cd102ae972d7

data/app/controllers/kuroko2/sessions_controller.rb

@@ -9,6 +9,11 @@ class Kuroko2::SessionsController < Kuroko2::ApplicationController
     return_to = params[:state]
     reset_session
 
+    unless valid_google_hosted_domain?
+      render :invalid_hd, status: 403, layout: false
+      return
+    end
+
     self.current_user = Kuroko2::User.find_or_create_user(auth_hash[:uid], auth_hash[:info])
 
     unless Kuroko2::ReturnToValidator.valid?(return_to)
@@ -29,4 +34,12 @@ class Kuroko2::SessionsController < Kuroko2::ApplicationController
     request.env['omniauth.auth']
   end
 
+  def valid_google_hosted_domain?
+    hd = Kuroko2.config.app_authentication.google_oauth2.options.hd
+    if hd.present?
+      hd == auth_hash.extra.id_info.hd
+    else
+      true
+    end
+  end
 end

data/app/models/kuroko2/job_definition.rb

@@ -57,7 +57,7 @@ class Kuroko2::JobDefinition < Kuroko2::ApplicationRecord
     or_query = column[:name].matches("%#{query}%").or(column[:script].matches("%#{query}%"))
 
     search_by_tag_definition_ids = Kuroko2::JobDefinitionTag.joins(:tag).
-      where('tags.name LIKE ?', "%#{query}%").distinct.pluck(:job_definition_id)
+      where("#{Kuroko2::Tag.table_name}.name LIKE ?", "%#{query}%").distinct.pluck(:job_definition_id)
 
     if search_by_tag_definition_ids.present?
       or_query = or_query.or(column[:id].in(search_by_tag_definition_ids))

data/app/views/kuroko2/sessions/invalid_hd.html.slim

@@ -0,0 +1,15 @@
+- @title = 'Sign in failure'
+
+doctype html
+html.bg-black
+  head
+    title #{@title} « Kuroko 2
+    meta charset='UTF-8'
+    meta content='width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no' name='viewport'
+    = stylesheet_link_tag 'kuroko2/application'
+    = javascript_include_tag 'kuroko2/application'
+  body.bg-black
+    .form-box
+      .header Sign In failure
+      .body
+        p.lead You have to sign in with Google account of #{Kuroko2.config.app_authentication.google_oauth2.options.hd}.

data/lib/kuroko2/version.rb

@@ -1,3 +1,3 @@
 module Kuroko2
-  VERSION = '0.2.2'
+  VERSION = '0.2.3'
 end

data/spec/controllers/sessions_controller_spec.rb

@@ -5,7 +5,7 @@ describe Kuroko2::SessionsController do
 
   describe '#create' do
     let(:auth_hash) do
-      {
+      OmniAuth::AuthHash.new(
         provider: 'google_oauth2',
         uid:      uid,
         info:     {
@@ -14,8 +14,11 @@ describe Kuroko2::SessionsController do
           first_name: 'John',
           last_name:  'Doe',
           image:      'https://lh3.googleusercontent.com/url/photo.jpg'
-        }
-      }
+        },
+        extra: {
+          id_info: {},
+        },
+      )
     end
     let(:uid) { '123456789' }
 
@@ -41,6 +44,38 @@ describe Kuroko2::SessionsController do
         expect(controller.current_user.uid).to eq uid
       end
     end
+
+    context 'with hd configured' do
+      let(:configured_hd) { 'example.com' }
+
+      before do
+        allow(Kuroko2.config.app_authentication.google_oauth2.options).to receive_messages(hd: configured_hd)
+      end
+
+      context 'with valid hd' do
+        before do
+          auth_hash.extra.id_info.hd = configured_hd
+        end
+
+        it 'creates a new session' do
+          get :create, params: { provider: :google_oauth2 }
+          expect(response).to redirect_to(root_path)
+          expect(controller.current_user.uid).to eq(uid)
+        end
+      end
+
+      context 'with invalid hd' do
+        before do
+          auth_hash.extra.id_info.hd = 'example.net'
+        end
+
+        it 'rejects' do
+          get :create, params: { provider: :google_oauth2 }
+          expect(response).to have_http_status(403)
+          expect(controller.current_user).to be_nil
+        end
+      end
+    end
   end
 
   describe '#new' do