machina-auth 0.1.2 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 72016a1f127a752307bd3351a7179bd514a07f01257141b5976c24512f9a58ab
-  data.tar.gz: 49e3d3a871defaf71cc93405268d6935afdbe97131b5f565fcf74fa7d336c8fa
+  metadata.gz: 3aea4a4e50f2d2700c3e84c0a5c66715d7fad74f6da3f32438da1e372dee3531
+  data.tar.gz: d6f1a257b9fe0dcf868fce3cffeac7c625cba2774d86402e6bf666567c466cc5
 SHA512:
-  metadata.gz: 1b1ca73243c466e604fd6922c9f60ea716d264e7dac913093fdbcaca1fa4e18b5aea6318eae5d5f04fc5809644680c6b39147339f2fa95358da4e74238efee88
-  data.tar.gz: 78582e31a57898eacd0a5abfb4c4bb812eb6683420549590a88ffbe8ffa0ded22e091cdf093f76ef3db75675719d81b4dc7de05482a7babc5d364f03e56d4b2f
+  metadata.gz: 9d0137c9be1a30603f8cc165d234bf34e99f3325439ddf3aad96ea46ee96a5bedeb67388ede7edf54399391213bb904569f9186c454f5375cf392a3b8f0425f8
+  data.tar.gz: b67d7e820671b4ed7e495853924ad1e8f134030960be3a4c8cfe5bc17a594a662294807b5e058ee3ec45d291b91afc58dec65ca918b29b36251cfff5c0f0e340

data/lib/machina/configuration.rb

@@ -11,7 +11,8 @@ module Machina
                   :cache_store,
                   :cache_ttl,
                   :manifest,
-                  :skip_paths
+                  :skip_paths,
+                  :identity_callback_uri
 
     def initialize
       @cache_ttl = 5.minutes

data/lib/machina/controller_helpers.rb

@@ -34,7 +34,7 @@ module Machina
       if request.format.json?
         render json: { error: 'unauthorized' }, status: :unauthorized
       else
-        redirect_to Machina.authorize_url(redirect_to: request.original_url), allow_other_host: true
+        redirect_to Machina.authorize_url(return_to: request.original_url), allow_other_host: true
       end
     end
 

data/lib/machina/permission_sync.rb

@@ -16,7 +16,8 @@ module Machina
 
       product_id = manifest[:product_id] || Machina.config.product_id
       if product_id.blank?
-        raise Machina::ConfigurationError, 'product_id is required for permission sync (set in machina.yml or Machina.config)'
+        raise Machina::ConfigurationError,
+              'product_id is required for permission sync (set in machina.yml or Machina.config)'
       end
 
       Machina.identity_client.sync_permissions(

data/lib/machina/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Machina
-  VERSION = '0.1.2'
+  VERSION = '0.1.3'
 end

data/lib/machina.rb

@@ -54,15 +54,36 @@ module Machina
       config.cache_store || Rails.cache
     end
 
-    def authorize_url(redirect_to:)
+    # Builds the Console authorize URL.
+    #
+    # @param redirect_to [String, nil] explicit redirect URL (backwards compat)
+    # @param return_to [String, nil] user's intended destination, appended to
+    #   the configured +identity_callback_uri+ as a query param
+    # @return [String] the full authorize URL
+    # @raise [ConfigurationError] when neither +redirect_to+ nor
+    #   +identity_callback_uri+ is available
+    def authorize_url(redirect_to: nil, return_to: nil)
       base = config.identity_service_url.to_s.sub(%r{/\z}, '')
-      return "#{base}/authorize" if redirect_to.blank?
 
-      "#{base}/authorize?redirect_to=#{CGI.escape(redirect_to)}"
+      return "#{base}/authorize?redirect_to=#{CGI.escape(redirect_to)}" if redirect_to.present?
+
+      callback = config.identity_callback_uri
+      if callback.blank?
+        raise ConfigurationError,
+              'identity_callback_uri must be configured to use authorize_url without an explicit redirect_to'
+      end
+
+      target = return_to.present? ? "#{callback}?return_to=#{CGI.escape(return_to)}" : callback
+
+      "#{base}/authorize?redirect_to=#{CGI.escape(target)}"
     end
 
+    # Convenience wrapper that delegates to {authorize_url} with +return_to+.
+    #
+    # @param return_to [String] the user's intended destination
+    # @return [String] the full authorize URL
     def login_url(return_to:)
-      authorize_url(redirect_to: return_to)
+      authorize_url(return_to:)
     end
   end
 end

data/spec/machina/authorize_url_spec.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require_relative '../rails_helper'
+
+RSpec.describe 'Machina.authorize_url' do
+  let(:base_url) { 'https://machina.example.test' }
+
+  context 'when identity_callback_uri is configured' do
+    before do
+      Machina.config.identity_callback_uri = 'http://localhost:3000/auth/machina/callback'
+    end
+
+    it 'uses the callback URI as redirect_to' do
+      url = Machina.authorize_url
+
+      expect(url).to eq("#{base_url}/authorize?redirect_to=#{CGI.escape('http://localhost:3000/auth/machina/callback')}")
+    end
+
+    it 'appends return_to as a query param on the callback URI' do
+      url = Machina.authorize_url(return_to: '/dashboard')
+
+      callback_with_return = 'http://localhost:3000/auth/machina/callback?return_to=%2Fdashboard'
+      expect(url).to eq("#{base_url}/authorize?redirect_to=#{CGI.escape(callback_with_return)}")
+    end
+
+    it 'encodes a full return_to URL' do
+      url = Machina.authorize_url(return_to: 'http://localhost:3000/inquiries?page=2')
+
+      callback_with_return = 'http://localhost:3000/auth/machina/callback?return_to=http%3A%2F%2Flocalhost%3A3000%2Finquiries%3Fpage%3D2'
+      expect(url).to eq("#{base_url}/authorize?redirect_to=#{CGI.escape(callback_with_return)}")
+    end
+  end
+
+  context 'when identity_callback_uri is not configured' do
+    it 'raises a configuration error when called without redirect_to' do
+      expect { Machina.authorize_url }.to raise_error(
+        Machina::ConfigurationError,
+        /identity_callback_uri/,
+      )
+    end
+
+    it 'still works with an explicit redirect_to for backwards compatibility' do
+      url = Machina.authorize_url(redirect_to: 'http://localhost:3000/login')
+
+      expect(url).to eq("#{base_url}/authorize?redirect_to=#{CGI.escape('http://localhost:3000/login')}")
+    end
+  end
+
+  describe '.login_url' do
+    before do
+      Machina.config.identity_callback_uri = 'http://localhost:3000/auth/machina/callback'
+    end
+
+    it 'delegates to authorize_url with return_to' do
+      url = Machina.login_url(return_to: '/settings')
+
+      callback_with_return = 'http://localhost:3000/auth/machina/callback?return_to=%2Fsettings'
+      expect(url).to eq("#{base_url}/authorize?redirect_to=#{CGI.escape(callback_with_return)}")
+    end
+  end
+end

data/spec/machina/configuration_spec.rb

@@ -12,4 +12,10 @@ RSpec.describe Machina::Configuration do
     config.product_id = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890'
     expect(config.product_id).to eq('a1b2c3d4-e5f6-7890-abcd-ef1234567890')
   end
+
+  it 'supports identity_callback_uri configuration' do
+    config = described_class.new
+    config.identity_callback_uri = 'http://localhost:3000/auth/machina/callback'
+    expect(config.identity_callback_uri).to eq('http://localhost:3000/auth/machina/callback')
+  end
 end

data/spec/machina/controller_helpers_spec.rb

@@ -29,12 +29,15 @@ RSpec.describe Machina::ControllerHelpers, type: :controller do
     end
   end
 
-  it 'redirects browser requests to authorize when unauthenticated' do
+  it 'redirects browser requests to authorize using identity_callback_uri when unauthenticated' do
+    Machina.config.identity_callback_uri = 'http://localhost:3000/auth/machina/callback'
+
     get :index
 
     expect(response).to have_http_status(:redirect)
     expect(response.location).to include('https://machina.example.test/authorize')
     expect(response.location).to include('redirect_to=')
+    expect(CGI.unescape(response.location)).to include('http://localhost:3000/auth/machina/callback?return_to=')
   end
 
   it 'returns json unauthorized for api-style requests' do

data/spec/machina/permission_sync_spec.rb

@@ -106,7 +106,7 @@ RSpec.describe Machina::PermissionSync do
   context 'with an ERB manifest' do
     let(:tmpfile) do
       file = Tempfile.new(['machina', '.yml'])
-      file.write(<<~'YAML')
+      file.write(<<~YAML)
         product_id: <%= "erb-product-id" %>
 
         permissions:

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: machina-auth
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
 platform: ruby
 authors:
 - ZAR
@@ -174,6 +174,7 @@ files:
 - spec/dummy/config/routes.rb
 - spec/dummy/db/schema.rb
 - spec/fixtures/machina.yml
+- spec/machina/authorize_url_spec.rb
 - spec/machina/authorized_spec.rb
 - spec/machina/configuration_spec.rb
 - spec/machina/controller_helpers_spec.rb