nulogy_sso 0.2.0

data/spec/feature_spec_helper.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require "capybara/rspec"
+require "webmock/rspec"
+require "resolv"
+require "socket"
+
+def configure_webmock(overrides: [])
+  allowed_hosts = (overrides + [ENV["NULOGY_SSO_MOCKSERVER_HOST"]]).compact
+  WebMock.disable_net_connect!(
+    allow_localhost: true,
+    allow: allowed_hosts
+  )
+end
+
+Capybara.server = :webrick
+
+if ENV["REMOTE_SELENIUM_HOST"].present?
+  ip = Socket.ip_address_list.detect(&:ipv4_private?)
+  rails_server_host = ip.ip_address
+  remote_selenium_host = Resolv.getaddress(ENV.fetch("REMOTE_SELENIUM_HOST"))
+  remote_selenium_port = ENV.fetch("REMOTE_SELENIUM_PORT")
+
+  Capybara.register_driver :remote do |app|
+    Capybara.server_host = rails_server_host
+    Capybara::Selenium::Driver.new(
+      app,
+      browser: :remote,
+      url: "http://#{remote_selenium_host}:#{remote_selenium_port}/wd/hub",
+      desired_capabilities: :chrome
+    )
+  end
+
+  Capybara.javascript_driver = :remote
+  configure_webmock(overrides: [rails_server_host, remote_selenium_host])
+else
+  Capybara.javascript_driver = :selenium_chrome
+  configure_webmock
+end
+
+RSpec.configure do |config|
+  config.use_transactional_fixtures = true
+end

data/spec/features/nulogy_sso/sso_login_spec.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+require "feature_spec_helper"
+
+module NulogySSO
+  RSpec.describe "the SSO login process", type: :feature, js: true do
+    let(:email) { "test@nulogy.com" }
+    let(:auth_mock) { TestUtilities::AuthMock.new }
+    let(:test_helper) { TestUtilities::TestHelper.new }
+
+    describe "login flow" do
+      it "can successfully login" do
+        auth_mock.setup(email: email, redirect_path: "/hello_world")
+        create_active_user
+
+        visit "/hello_world"
+
+        expect(page).to have_content("Hello World")
+      end
+
+      it "shows an error page when Auth0 authenticates the user but app validation fails" do
+        auth_mock.setup(email: email)
+        create_inactive_user
+
+        visit "/hello_world"
+
+        expect_error
+      end
+
+      it "shows an error page when the user can authorize with Auth0 but not the app itself" do
+        auth_mock.setup(email: email)
+
+        visit "/hello_world"
+
+        expect_error
+      end
+
+      it "shows an error page when Auth0 throws an error" do
+        auth_mock.setup(email: email, status_code: 403)
+        create_active_user
+
+        visit "/hello_world"
+
+        expect_error
+      end
+    end
+
+    describe "JWT authentication" do
+      let!(:user) { create_active_user }
+
+      before do
+        auth_mock.mockserver_reset
+        auth_mock.setup_jwks
+
+        # have to visit an unauthenticated endpoint in order for capybara to have something to have a tab to set the cookie on
+        visit "/robots.txt"
+      end
+
+      it "allows a user with a valid JWT to visit a secured endpoint" do
+        set_access_token_cookie(test_helper.jwt(email))
+
+        visit "/hello_world"
+
+        expect(page).to have_content("Hello World")
+      end
+
+      it "prevents sessions with invalid JWTs from accessing secured endpoints" do
+        set_access_token_cookie(test_helper.jwt(email, "exp" => (Time.now - 1.day).to_i))
+
+        visit "/hello_world"
+
+        expect(current_path).to eq("/authorize")
+      end
+
+      it "prevents sessions with no JWT from accessing secured endpoints" do
+        visit "/hello_world"
+
+        expect(current_path).to eq("/authorize")
+      end
+
+      it "shows the user an error page when they've been deactivated in CPI after they've logged in" do
+        set_access_token_cookie(test_helper.jwt(email))
+
+        visit "/hello_world"
+
+        expect(page).to have_content("Hello World")
+
+        user.update!(active: false)
+
+        visit "/hello_world"
+
+        expect_error
+      end
+
+      def set_access_token_cookie(token)
+        page.driver.browser.manage.add_cookie(name: NulogySSO.auth_cookie_key, value: token)
+      end
+    end
+
+    def create_active_user
+      User.create!(email: email, active: true)
+    end
+
+    def create_inactive_user
+      User.create!(email: email, active: false)
+    end
+
+    def expect_error
+      expect(page).to have_content("You do not have permission to access Nulogy.")
+    end
+  end
+end

data/spec/integration/services/nulogy_sso/authenticator_spec.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+module NulogySSO
+  RSpec.describe Authenticator do
+    let(:auth_config) { NulogySSO.auth_config }
+    let(:verifier) do
+      MockAuth0Verifier.new(
+        issuer: "#{auth_config.base_uri}/",
+        audience: auth_config.audience,
+        jwks: TestUtilities::AuthMock.new.jwks_json
+      )
+    end
+    let(:default_authenticator) { Authenticator.new(verifier: verifier, find_user_by_email: find_a_user) }
+    let(:user) { User.new(email: email, active: true) }
+    let(:find_a_user) { proc { user } }
+    let(:find_no_user) { proc { nil } }
+    let(:on_success) { spy("on_success") }
+    let(:on_invalid_token) { spy("on_invalid_token") }
+    let(:email) { "sso_test@nulogy.com" }
+    let(:valid_signed_token) { test_helper.jwt(email) }
+    let(:invalid_signed_token) { test_helper.jwt(email, "exp" => 1.day.ago.to_i) }
+    let(:test_helper) { TestUtilities::TestHelper.new }
+
+    describe "#validate_token" do
+      it "calls on_invalid_token when the access token is blank" do
+        [nil, "", false].each(&method(:validate_token))
+
+        expect(on_invalid_token).to have_received(:call).exactly(3).times
+      end
+
+      context "JWT passes verification" do
+        it "calls the success handler when a user matching the access token email exists" do
+          validate_token(valid_signed_token)
+
+          expect(on_success).to have_received(:call).with(
+            a_hash_including(JWT_EMAIL_KEY => email)
+          ).once
+          expect(on_invalid_token).not_to have_received(:call)
+        end
+
+        it "calls the invalid token handler when there is no user matching the access token email" do
+          authenticator = Authenticator.new(verifier: verifier, find_user_by_email: find_no_user)
+
+          validate_token(valid_signed_token, authenticator: authenticator)
+
+          expect(on_invalid_token).to have_received(:call).once
+        end
+
+        it "calls the invalid token handler when there is an invalid user" do
+          authenticator = Authenticator.new(verifier: verifier, find_user_by_email: find_a_user, validate_user: proc { false })
+
+          validate_token(valid_signed_token, authenticator: authenticator)
+
+          expect(on_invalid_token).to have_received(:call).once
+        end
+      end
+
+      context "JWT fails verification" do
+        it "calls the invalid token handler" do
+          validate_token(invalid_signed_token)
+
+          expect(on_invalid_token).to have_received(:call).once
+        end
+      end
+
+      def validate_token(raw_access_token, authenticator: default_authenticator)
+        authenticator.validate_token(
+          raw_access_token,
+          on_success: on_success,
+          on_invalid_token: on_invalid_token
+        )
+      end
+    end
+
+    describe "#authenticated_user" do
+      it "returns the user that is associated to a valid JWT" do
+        expect(default_authenticator.authenticated_user(valid_signed_token)).to eq(user)
+      end
+
+      it "returns nil when the JWT is invalid" do
+        expect(default_authenticator.authenticated_user(invalid_signed_token)).to be_nil
+      end
+
+      it "returns nil when the provided token is blank" do
+        expect(default_authenticator.authenticated_user("")).to be_nil
+      end
+
+      it "returns nil when no user matching the JWT's email field exists" do
+        authenticator = Authenticator.new(verifier: verifier, find_user_by_email: find_no_user)
+
+        expect(authenticator.authenticated_user(valid_signed_token)).to be_nil
+      end
+    end
+  end
+end

data/spec/rails_helper.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+ENV["RAILS_ENV"] ||= "test"
+require_relative "dummy/config/environment"
+# Prevent database truncation if the environment is production
+abort("The Rails environment is running in production mode!") if Rails.env.production?
+require "rspec/rails"
+# Add additional requires below this line. Rails is not loaded until this point!
+
+Dir[NulogySSO::Engine.root.join("spec/support/**/*.rb")].each { |f| require f }
+
+require "nulogy_sso/test_utilities/auth_mock"
+require "nulogy_sso/test_utilities/test_helper"
+
+begin
+  ActiveRecord::Migration.maintain_test_schema!
+rescue ActiveRecord::PendingMigrationError => e
+  puts e.to_s.strip
+  exit 1
+end
+
+RSpec.configure do |config|
+  config.infer_spec_type_from_file_location!
+
+  # Filter lines from Rails gems in backtraces.
+  config.filter_rails_from_backtrace!
+end

data/spec/spec_helper.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+# See http://rubydoc.info/gems/rspec-core/RSpec/Core/Configuration
+RSpec.configure do |config|
+  config.expect_with :rspec do |expectations|
+    # This option will default to `true` in RSpec 4
+    expectations.include_chain_clauses_in_custom_matcher_descriptions = true
+  end
+
+  config.mock_with :rspec do |mocks|
+    # Prevents you from mocking or stubbing a method that does not exist on
+    # a real object. This is generally recommended, and will default to
+    # `true` in RSpec 4.
+    mocks.verify_partial_doubles = true
+  end
+
+  # This option will default to `:apply_to_host_groups` in RSpec 4 (and will
+  # have no way to turn it off -- the option exists only for backwards
+  # compatibility in RSpec 3). It causes shared context metadata to be
+  # inherited by the metadata hash of host groups and examples, rather than
+  # triggering implicit auto-inclusion in groups with matching metadata.
+  config.shared_context_metadata_behavior = :apply_to_host_groups
+
+  # This allows you to limit a spec run to individual examples or groups
+  # you care about by tagging them with `:focus` metadata. When nothing
+  # is tagged with `:focus`, all examples get run. RSpec also provides
+  # aliases for `it`, `describe`, and `context` that include `:focus`
+  # metadata: `fit`, `fdescribe` and `fcontext`, respectively.
+  config.filter_run_when_matching :focus
+
+  config.example_status_persistence_file_path = "spec/examples.txt"
+
+  config.disable_monkey_patching!
+
+  if config.files_to_run.one?
+    config.default_formatter = "doc"
+  end
+
+  config.order = :random
+
+  # Seed global randomization in this process using the `--seed` CLI option.
+  Kernel.srand config.seed
+end

data/spec/support/mock_auth0_verifier.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+# This is a mock verifier that allows the auth0_rs256_jwt_verifier gem
+# to still be used for verifying JWTs, but with a localhost JWKS specified.
+# This code was adapted from the gem's test suite:
+# https://github.com/DroidsOnRoids/auth0_rs256_jwt_verifier/blob/master/test/auth0_rs256_jwt_verifier_test.rb
+
+class MockAuth0Verifier
+  def initialize(issuer:, audience:, jwks:)
+    @internal_verifier = Auth0RS256JWTVerifier.new(
+      issuer: issuer,
+      audience: audience,
+      jwks_url: "https://do.not.care",
+      http: http_stub(jwks)
+    )
+  end
+
+  delegate :verify, to: :@internal_verifier
+
+  private
+
+  def http_stub(jwks)
+    http_stub = Object.new
+    http_stub.define_singleton_method(:get) { |*_| jwks }
+    http_stub
+  end
+end