model_driven_api 3.3.2 → 3.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5e72c48257faa2dde0c1c5766b28b4162577fa95c6ae6d9ce1e70f707d067516
-  data.tar.gz: 9bf11f22033d32dae78e29ea992649e5d7f9e94039b346ce87a4592101fd85f2
+  metadata.gz: 947535ba94bce4b6b7b3eaed83f5ffd9b624781de13151a8e876bbf490df057a
+  data.tar.gz: a0626e40d22e148fb4b1e15956a28ed90c0a1aca332a2bbb67a01b13726ad2d6
 SHA512:
-  metadata.gz: c42e7720439a5d9b1ac17976f7cd02b8135eda4bf49a953fd217d3f3b997f697773f8d7fce49c962f6318d57b9d2e2b5ce23f180a8796e5f24967602e309505a
-  data.tar.gz: 50891ee25885ebb710ef79a1b100d35a9b63ba300a460b750d0aa62e41e4ecc3772d5780ed460309e2e332ea6782b5913dd8531a9e0a612b5552d80cef240eec
+  metadata.gz: 7ead1586c1e81df0632b582f72e6e94ca39235f56ba3c2e1700db809514246120e23d2865a62de6bd48252d4d0d6f7e6fb1a57d76541a1c59b43153534ff2ab1
+  data.tar.gz: '0656608baf5a2ba86b4b3eff6a585274c6fbf53bfb6108be2479e681e8a726158cc066489c433482cc1d2eca7822b0d8d76cab7c99ad31f16d12754f564ae492'

data/README.md

@@ -1 +1,66 @@
 This is part of Thecore framework: https://github.com/gabrieletassoni/thecore/tree/release/3
+
+## Authorization
+
+It's enabled to LDAP (Active Directory and othe LDAP Based local service) and to oauth2 (Google Workspace and Microsoft Entra ID) services.
+
+### 📘 Register OAuth Apps
+
+To use OAuth2 for authentication, you need to register your application with the OAuth provider (Google or Microsoft). Follow these steps, which are specific to each provider and aimed at a demo frontend application running on `http://localhost:5173`.
+ 
+#### ✅ Google OAuth Client Setup
+ 
+Go to: https://console.cloud.google.com/apis/credentials
+Create OAuth 2.0 Client ID
+Choose Web Application
+Add to “Authorized JavaScript Origins”:
+http://localhost:5173
+Add to “Authorized redirect URIs” (used by Google, not backend):
+http://localhost:5173 (for frontend access only)
+Save your Client ID
+ 
+ 
+#### ✅ Microsoft Entra ID OAuth Setup
+ 
+Go to https://portal.azure.com
+Microsoft Entra ID → App registrations → New registration
+Set redirect URI to http://localhost:5173 (type: SPA)
+Note the:
+Application (client) ID
+Directory (tenant) ID
+Under Authentication tab:
+Add platform: “Single-page application”
+Add http://localhost:5173 to Redirect URIs
+
+### Save your Client ID and Tenant ID
+You will need these IDs to configure the backend.
+
+### 📘 Configure OAuth in Thecore
+To configure OAuth in Thecore backend, you need to set the following environment variables in your `.env` file or `environmet:` configuration in docker-compose.yml:
+
+```plaintext
+# OAuth Configuration
+# Microsoft OAuth
+ENTRA_CLIENT_ID: "your-client-id"
+ENTRA_CLIENT_SECRET: "your-client-secret"
+ENTRA_TENANT_ID: "your-tenant-id"
+
+# Google OAuth
+GOOGLE_CLIENT_ID: "your-client-id.apps.googleusercontent.com"
+GOOGLE_CLIENT_SECRET: "your-client-secret"
+```
+
+In the Frontend applciation, you will need to set the following environment variables in your `.env` file:
+
+```plaintext
+# OAuth Configuration
+# Google OAuth
+VITE_GOOGLE_CLIENT_ID=your-client-id
+
+# Microsoft OAuth
+VITE_AZURE_CLIENT_ID=your-client-id
+VITE_AZURE_TENANT_ID=your-tenant-id
+
+# OAuth Callback URLs
+VITE_API_URL=http://yourdomain/api/v2/auth/google_oauth2/callback
+```

data/app/commands/authenticate_user.rb

@@ -37,6 +37,9 @@ class AuthenticateUser
             user = nil if user.blank? || user.authenticate(password).blank?
         end
 
+        #Try to authenticate the user against LDAP if user is not present at this point
+        user = Ldap::Authenticator.new(email: email, password: password).authenticate if user.blank?
+
         raise AccessDenied unless user.present?
         
         return user

data/app/controllers/api/v2/auth/oauth_controller.rb

@@ -0,0 +1,71 @@
+module Api::V2::Auth
+  class OauthController < ActionController::API
+    def callback
+      email = params['email']
+
+      user = User.find_or_create_by(email: email) do |u|
+        u.name = params['given_name']
+        u.surname = params['family_name']
+        u.password = u.password_confirmation = ThecoreAuthCommons.generate_secure_password
+        u.auth_source = params['provider'] # 'google' or 'microsoft'
+        u.admin = true
+      end
+      unless user
+        render json: { error: "User not registered" }, status: :unauthorized
+        return
+      end
+
+      token = JsonWebToken.encode(user_id: user.id)
+
+      if ENV["ALLOW_MULTISESSIONS"] == "false"
+        UsedToken.where(user_id: user.id).update_all(is_valid: false)
+        UsedToken.create!(token: token, user_id: user.id)
+      end
+
+      # redirect_url = "#{ENV['FRONTEND_URL']}?token=#{token}"
+      # redirect_to redirect_url
+      response.set_header("Token", JsonWebToken.encode(user_id: user.id))
+      render json: user, status: :ok
+    end
+
+    def failure
+      render json: { error: "OAuth authentication failed" }, status: :unauthorized
+    end
+
+    def exchange_token
+      provider_token = params[:provider_token]
+      provider = params[:provider] # 'google' or 'microsoft'
+
+      user_info = case provider
+      when 'google'
+        uri = URI("https://www.googleapis.com/oauth2/v3/userinfo")
+        res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) do |http|
+          req = Net::HTTP::Get.new(uri)
+          req["Authorization"] = "Bearer #{provider_token}"
+          http.request(req)
+        end
+        JSON.parse(res.body)
+      when 'microsoft'
+        uri = URI("https://graph.microsoft.com/v1.0/me")
+        res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) do |http|
+          req = Net::HTTP::Get.new(uri)
+          req["Authorization"] = "Bearer #{provider_token}"
+          http.request(req)
+        end
+        JSON.parse(res.body)
+      else
+        return render json: { error: "Unknown provider" }, status: :unprocessable_entity
+      end
+
+      email = user_info["mail"] || user_info["email"] || user_info["userPrincipalName"]
+      user = User.find_by(email: email)
+
+      if user.nil?
+        return render json: { error: "User not registered" }, status: :unauthorized
+      end
+
+      response.set_header("Token", JsonWebToken.encode(user_id: user.id))
+      render json: user, status: :ok
+    end
+  end
+end

data/config/initializers/omniauth.rb

@@ -0,0 +1,20 @@
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider(
+    :entra_id,
+    {
+      client_id: ENV['ENTRA_CLIENT_ID'],
+      client_secret: ENV['ENTRA_CLIENT_SECRET'],
+      tenant_id: ENV['ENTRA_TENANT_ID'], # Needed for Microsoft
+      scope: 'User.Read',
+      response_type: 'code'
+    }
+  )
+  provider :google_oauth2, ENV['GOOGLE_CLIENT_ID'], ENV['GOOGLE_CLIENT_SECRET'], {
+    scope: 'email,profile',
+    prompt: 'select_account',
+    access_type: 'online'
+  }
+end
+
+OmniAuth.config.allowed_request_methods = [:get, :post]
+OmniAuth.config.silence_get_warning = true

data/config/routes.rb

@@ -1,11 +1,26 @@
 # require 'ransack'
 
 Rails.application.routes.draw do
-    # REST API (Stateless)
-
+    oauth_test = (ENV['ENTRA_CLIENT_ID'].present? && ENV['ENTRA_CLIENT_SECRET'].present? && ENV['ENTRA_TENANT_ID'].present?) || (ENV['GOOGLE_CLIENT_ID'].present? && ENV['GOOGLE_CLIENT_SECRET'].present?)
     scope ENV.fetch("RAILS_RELATIVE_URL_ROOT", "/") do
+        if oauth_test
+            # OmniAuth callbacks need these top-level paths:
+            match '/auth/:provider/callback', to: redirect('/api/v2/auth/%{provider}/callback'), via: [:get, :post]
+            match '/auth/failure', to: redirect('/api/v2/auth/failure'), via: [:get, :post]
+        end
         namespace :api, constraints: { format: :json } do
             namespace :v2 do
+                # Authentication via Oauth2 only if the environment variable is set
+                if oauth_test
+                    namespace :auth do
+                        # Omniauth routes for OAuth2 authentication
+                        match ':provider/callback', to: 'oauth#callback', via: [:get, :post]
+                        get :failure, to: 'oauth#failure'
+                        get ':provider', to: redirect('/auth/%{provider}') # triggers OmniAuth middleware
+                        post :jwt, to: 'oauth#exchange_token' # Optional endpoint to allow frontends to send the OAuth token
+                    end
+                end
+
                 resources :users
 
                 namespace :info do

data/lib/model_driven_api/version.rb

@@ -1,3 +1,3 @@
 module ModelDrivenApi
-  VERSION = "3.3.2".freeze
+  VERSION = "3.4.1".freeze
 end

data/lib/model_driven_api.rb

@@ -13,6 +13,10 @@ require 'concerns/api_exception_management'
 
 require 'deep_merge/rails_compat'
 
+require 'omniauth'
+require 'omniauth-google-oauth2'
+require 'omniauth-entra-id'
+
 require "model_driven_api/engine"
 
 require "safe_sql_executor"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 3.3.2
+  version: 3.4.1
 platform: ruby
 authors:
 - Gabriele Tassoni
@@ -93,6 +93,48 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.2'
+- !ruby/object:Gem::Dependency
+  name: omniauth
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
+- !ruby/object:Gem::Dependency
+  name: omniauth-google-oauth2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.2'
+- !ruby/object:Gem::Dependency
+  name: omniauth-entra-id
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
@@ -121,6 +163,7 @@ files:
 - app/commands/authenticate_user.rb
 - app/commands/authorize_api_request.rb
 - app/controllers/api/v2/application_controller.rb
+- app/controllers/api/v2/auth/oauth_controller.rb
 - app/controllers/api/v2/authentication_controller.rb
 - app/controllers/api/v2/info_controller.rb
 - app/controllers/api/v2/raw_controller.rb
@@ -131,6 +174,7 @@ files:
 - config/initializers/after_initialize_for_model_driven_api.rb
 - config/initializers/cors_api_thecore.rb
 - config/initializers/knock.rb
+- config/initializers/omniauth.rb
 - config/initializers/time_with_zone.rb
 - config/initializers/wrap_parameters.rb
 - config/routes.rb