model_driven_api 3.4.0 → 3.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0ecd0e3a3b7a279fb9a68b6ac3fe513ada2aa9875807cc672fa5a8f4d690fb1d
-  data.tar.gz: 926640daa632265835dc91e24d4062ed3678c91972aa5d6de53c2c8939511c4d
+  metadata.gz: 947535ba94bce4b6b7b3eaed83f5ffd9b624781de13151a8e876bbf490df057a
+  data.tar.gz: a0626e40d22e148fb4b1e15956a28ed90c0a1aca332a2bbb67a01b13726ad2d6
 SHA512:
-  metadata.gz: aa235f9c25f6abcb48d724f68f9a726bf38c1dd90bd7aab6c292fdf78ecab4df142f806337b6782595ba19484481d230020880e2376ed44f62d207f736026acd
-  data.tar.gz: 984146f876ba9b9267855f9099a316641efbd65131191e680e933ccbeb013d3bac51ec287c41e9a886a815f312866f579fcf0a8d3cb795e7b1b6538960b5e058
+  metadata.gz: 7ead1586c1e81df0632b582f72e6e94ca39235f56ba3c2e1700db809514246120e23d2865a62de6bd48252d4d0d6f7e6fb1a57d76541a1c59b43153534ff2ab1
+  data.tar.gz: '0656608baf5a2ba86b4b3eff6a585274c6fbf53bfb6108be2479e681e8a726158cc066489c433482cc1d2eca7822b0d8d76cab7c99ad31f16d12754f564ae492'

data/README.md

@@ -1 +1,66 @@
 This is part of Thecore framework: https://github.com/gabrieletassoni/thecore/tree/release/3
+
+## Authorization
+
+It's enabled to LDAP (Active Directory and othe LDAP Based local service) and to oauth2 (Google Workspace and Microsoft Entra ID) services.
+
+### 📘 Register OAuth Apps
+
+To use OAuth2 for authentication, you need to register your application with the OAuth provider (Google or Microsoft). Follow these steps, which are specific to each provider and aimed at a demo frontend application running on `http://localhost:5173`.
+ 
+#### ✅ Google OAuth Client Setup
+ 
+Go to: https://console.cloud.google.com/apis/credentials
+Create OAuth 2.0 Client ID
+Choose Web Application
+Add to “Authorized JavaScript Origins”:
+http://localhost:5173
+Add to “Authorized redirect URIs” (used by Google, not backend):
+http://localhost:5173 (for frontend access only)
+Save your Client ID
+ 
+ 
+#### ✅ Microsoft Entra ID OAuth Setup
+ 
+Go to https://portal.azure.com
+Microsoft Entra ID → App registrations → New registration
+Set redirect URI to http://localhost:5173 (type: SPA)
+Note the:
+Application (client) ID
+Directory (tenant) ID
+Under Authentication tab:
+Add platform: “Single-page application”
+Add http://localhost:5173 to Redirect URIs
+
+### Save your Client ID and Tenant ID
+You will need these IDs to configure the backend.
+
+### 📘 Configure OAuth in Thecore
+To configure OAuth in Thecore backend, you need to set the following environment variables in your `.env` file or `environmet:` configuration in docker-compose.yml:
+
+```plaintext
+# OAuth Configuration
+# Microsoft OAuth
+ENTRA_CLIENT_ID: "your-client-id"
+ENTRA_CLIENT_SECRET: "your-client-secret"
+ENTRA_TENANT_ID: "your-tenant-id"
+
+# Google OAuth
+GOOGLE_CLIENT_ID: "your-client-id.apps.googleusercontent.com"
+GOOGLE_CLIENT_SECRET: "your-client-secret"
+```
+
+In the Frontend applciation, you will need to set the following environment variables in your `.env` file:
+
+```plaintext
+# OAuth Configuration
+# Google OAuth
+VITE_GOOGLE_CLIENT_ID=your-client-id
+
+# Microsoft OAuth
+VITE_AZURE_CLIENT_ID=your-client-id
+VITE_AZURE_TENANT_ID=your-tenant-id
+
+# OAuth Callback URLs
+VITE_API_URL=http://yourdomain/api/v2/auth/google_oauth2/callback
+```

data/app/controllers/api/v2/auth/oauth_controller.rb

@@ -0,0 +1,71 @@
+module Api::V2::Auth
+  class OauthController < ActionController::API
+    def callback
+      email = params['email']
+
+      user = User.find_or_create_by(email: email) do |u|
+        u.name = params['given_name']
+        u.surname = params['family_name']
+        u.password = u.password_confirmation = ThecoreAuthCommons.generate_secure_password
+        u.auth_source = params['provider'] # 'google' or 'microsoft'
+        u.admin = true
+      end
+      unless user
+        render json: { error: "User not registered" }, status: :unauthorized
+        return
+      end
+
+      token = JsonWebToken.encode(user_id: user.id)
+
+      if ENV["ALLOW_MULTISESSIONS"] == "false"
+        UsedToken.where(user_id: user.id).update_all(is_valid: false)
+        UsedToken.create!(token: token, user_id: user.id)
+      end
+
+      # redirect_url = "#{ENV['FRONTEND_URL']}?token=#{token}"
+      # redirect_to redirect_url
+      response.set_header("Token", JsonWebToken.encode(user_id: user.id))
+      render json: user, status: :ok
+    end
+
+    def failure
+      render json: { error: "OAuth authentication failed" }, status: :unauthorized
+    end
+
+    def exchange_token
+      provider_token = params[:provider_token]
+      provider = params[:provider] # 'google' or 'microsoft'
+
+      user_info = case provider
+      when 'google'
+        uri = URI("https://www.googleapis.com/oauth2/v3/userinfo")
+        res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) do |http|
+          req = Net::HTTP::Get.new(uri)
+          req["Authorization"] = "Bearer #{provider_token}"
+          http.request(req)
+        end
+        JSON.parse(res.body)
+      when 'microsoft'
+        uri = URI("https://graph.microsoft.com/v1.0/me")
+        res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) do |http|
+          req = Net::HTTP::Get.new(uri)
+          req["Authorization"] = "Bearer #{provider_token}"
+          http.request(req)
+        end
+        JSON.parse(res.body)
+      else
+        return render json: { error: "Unknown provider" }, status: :unprocessable_entity
+      end
+
+      email = user_info["mail"] || user_info["email"] || user_info["userPrincipalName"]
+      user = User.find_by(email: email)
+
+      if user.nil?
+        return render json: { error: "User not registered" }, status: :unauthorized
+      end
+
+      response.set_header("Token", JsonWebToken.encode(user_id: user.id))
+      render json: user, status: :ok
+    end
+  end
+end

data/config/initializers/omniauth.rb

@@ -0,0 +1,20 @@
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider(
+    :entra_id,
+    {
+      client_id: ENV['ENTRA_CLIENT_ID'],
+      client_secret: ENV['ENTRA_CLIENT_SECRET'],
+      tenant_id: ENV['ENTRA_TENANT_ID'], # Needed for Microsoft
+      scope: 'User.Read',
+      response_type: 'code'
+    }
+  )
+  provider :google_oauth2, ENV['GOOGLE_CLIENT_ID'], ENV['GOOGLE_CLIENT_SECRET'], {
+    scope: 'email,profile',
+    prompt: 'select_account',
+    access_type: 'online'
+  }
+end
+
+OmniAuth.config.allowed_request_methods = [:get, :post]
+OmniAuth.config.silence_get_warning = true

data/config/routes.rb

@@ -1,11 +1,26 @@
 # require 'ransack'
 
 Rails.application.routes.draw do
-    # REST API (Stateless)
-
+    oauth_test = (ENV['ENTRA_CLIENT_ID'].present? && ENV['ENTRA_CLIENT_SECRET'].present? && ENV['ENTRA_TENANT_ID'].present?) || (ENV['GOOGLE_CLIENT_ID'].present? && ENV['GOOGLE_CLIENT_SECRET'].present?)
     scope ENV.fetch("RAILS_RELATIVE_URL_ROOT", "/") do
+        if oauth_test
+            # OmniAuth callbacks need these top-level paths:
+            match '/auth/:provider/callback', to: redirect('/api/v2/auth/%{provider}/callback'), via: [:get, :post]
+            match '/auth/failure', to: redirect('/api/v2/auth/failure'), via: [:get, :post]
+        end
         namespace :api, constraints: { format: :json } do
             namespace :v2 do
+                # Authentication via Oauth2 only if the environment variable is set
+                if oauth_test
+                    namespace :auth do
+                        # Omniauth routes for OAuth2 authentication
+                        match ':provider/callback', to: 'oauth#callback', via: [:get, :post]
+                        get :failure, to: 'oauth#failure'
+                        get ':provider', to: redirect('/auth/%{provider}') # triggers OmniAuth middleware
+                        post :jwt, to: 'oauth#exchange_token' # Optional endpoint to allow frontends to send the OAuth token
+                    end
+                end
+
                 resources :users
 
                 namespace :info do

data/lib/model_driven_api/version.rb

@@ -1,3 +1,3 @@
 module ModelDrivenApi
-  VERSION = "3.4.0".freeze
+  VERSION = "3.4.1".freeze
 end

data/lib/model_driven_api.rb

@@ -13,6 +13,10 @@ require 'concerns/api_exception_management'
 
 require 'deep_merge/rails_compat'
 
+require 'omniauth'
+require 'omniauth-google-oauth2'
+require 'omniauth-entra-id'
+
 require "model_driven_api/engine"
 
 require "safe_sql_executor"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 3.4.0
+  version: 3.4.1
 platform: ruby
 authors:
 - Gabriele Tassoni
@@ -93,6 +93,48 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.2'
+- !ruby/object:Gem::Dependency
+  name: omniauth
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
+- !ruby/object:Gem::Dependency
+  name: omniauth-google-oauth2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.2'
+- !ruby/object:Gem::Dependency
+  name: omniauth-entra-id
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
@@ -121,6 +163,7 @@ files:
 - app/commands/authenticate_user.rb
 - app/commands/authorize_api_request.rb
 - app/controllers/api/v2/application_controller.rb
+- app/controllers/api/v2/auth/oauth_controller.rb
 - app/controllers/api/v2/authentication_controller.rb
 - app/controllers/api/v2/info_controller.rb
 - app/controllers/api/v2/raw_controller.rb
@@ -131,6 +174,7 @@ files:
 - config/initializers/after_initialize_for_model_driven_api.rb
 - config/initializers/cors_api_thecore.rb
 - config/initializers/knock.rb
+- config/initializers/omniauth.rb
 - config/initializers/time_with_zone.rb
 - config/initializers/wrap_parameters.rb
 - config/routes.rb