omniauth-citadele 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9b938ec2b4f274cb34b16ae81592c1702ef2b2ba4239d14ce6ce34d02e5f4422
-  data.tar.gz: 483db33d881f20bbd52d9850116b40911a12d1499cc0fc481d0077f96f88addd
+  metadata.gz: 5dca1473dfe08d686501cf3a577eb814057163aba341488436dd49d8145330c5
+  data.tar.gz: 34d8dfd9f45b70de9afac13c1f8a6e5410513123a6edc97a54056381758bfb43
 SHA512:
-  metadata.gz: aeffbebaa67174d486fbdf62158e0c8ecf33f76908d1ff397afeb731f5a31cf2560204c3c1a52bb104cf5acb76c29aab9aed0ef0f847dea2c445adf75cea7501
-  data.tar.gz: c20f1336fedbf59d5b39fd4f75d9eb7ce92f9f2cac3bd52bb32120075b44d9b2a61d32aa61b5cd6a85ac8588b187b12b4742e34f87e7fd7db185b269919430fd
+  metadata.gz: 962dda703cb543299df8b12fbe963136a99161a752d54d6ee9513e061cce3c82c834062a07beea6b2ab18e9360d3053e2ae57fd6714bc2a0698a389fb81d0d85
+  data.tar.gz: '0977fbd5f6529646240b1fba5813935bd14a1a96ded3e907a80ecb737470aab63bee45f979a1c328e11b7e13cd8776c0fc1983b725f3ed044e2d62c8f5e29552'

data/.github/workflows/ruby.yml

@@ -0,0 +1,24 @@
+name: Ruby
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        ruby-version: ['2.7', '3.0', '3.1', '3.2']
+
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up Ruby
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: ${{ matrix.ruby-version }}
+        bundler-cache: true # runs 'bundle install' and caches installed gems automatically
+    - name: Run tests
+      run: bundle exec rspec

data/LICENSE.txt

@@ -1,4 +1,4 @@
-Copyright (c) 2017 MAK IT, Jānis Kiršteins
+Copyright (c) 2017 Mitigate, Jānis Kiršteins
 
 MIT License
 

data/README.md

@@ -2,22 +2,20 @@
 
 Omniauth strategy for using Citadele as an authentication service provider.
 
-[![Build Status](https://travis-ci.org/mak-it/omniauth-citadele.svg?branch=master)](https://travis-ci.org/mak-it/omniauth-citadele)
-
-Supported Ruby versions: 2.3+
+Supported Ruby versions: 2.7+
 
 ## Related projects
 
-- [omniauth-dnb](https://github.com/mak-it/omniauth-dnb) - strategy for authenticating with DNB
-- [omniauth-nordea](https://github.com/mak-it/omniauth-nordea) - strategy for authenticating with Nordea
-- [omniauth-seb-elink](https://github.com/mak-it/omniauth-seb-elink) - strategy for authenticating with SEB
-- [omniauth-swedbank](https://github.com/mak-it/omniauth-swedbank) - strategy for authenticating with Swedbank
-
+- [omniauth-dnb](https://github.com/mitigate-dev/omniauth-dnb) - strategy for authenticating with DNB
+- [omniauth-nordea](https://github.com/mitigate-dev/omniauth-nordea) - strategy for authenticating with Nordea
+- [omniauth-seb-elink](https://github.com/mitigate-dev/omniauth-seb-elink) - strategy for authenticating with SEB
+- [omniauth-swedbank](https://github.com/mitigate-dev/omniauth-swedbank) - strategy for authenticating with Swedbank
 
 ## Installation
 
-Add this line to your application's Gemfile:
+Add these lines to your application's Gemfile (omniauth-rails_csrf_protection is required if using Rails):
 
+    gem 'omniauth-rails_csrf_protection'
     gem 'omniauth-citadele'
 
 And then execute:
@@ -26,7 +24,7 @@ And then execute:
 
 Or install it yourself as:
 
-    $ gem install omniauth-citadele
+    $ gem install omniauth-rails_csrf_protection omniauth-citadele
 
 ## Usage
 

data/lib/omniauth/citadele/version.rb

@@ -1,5 +1,5 @@
 module Omniauth
   module Citadele
-    VERSION = '0.1.0'
+    VERSION = '0.2.0'
   end
 end

data/lib/omniauth/strategies/citadele.rb

@@ -13,6 +13,14 @@ module OmniAuth
       AUTH_REQUEST = 'AUTHREQ'
       AUTH_VERSION = '5.0'
 
+      def self.render_nonce?
+         defined?(ActionDispatch::ContentSecurityPolicy::Request) != nil
+      end
+      if render_nonce?
+        include ActionDispatch::ContentSecurityPolicy::Request
+        delegate :get_header, :set_header, to: :request
+      end
+
       args [:private_key, :private_crt, :public_crt, :from]
 
       option :private_key, nil
@@ -158,13 +166,15 @@ module OmniAuth
         x509_subject_name = private_crt.subject.to_s
         x509_certificate = private_crt.to_s.gsub(/[-]{5}(BEGIN|END).*?[-]{5}/, '').gsub('\n', '')
 
+        set_locale_from_query_param
+
         request_data = {
           timestamp: timestamp, # '20170905175959000'
           from: options.from,
           request: AUTH_REQUEST,
           request_uid: request_uid, # '7387bf5b-fa27-4fdd-add6-a6bfb2599f77'
           version: AUTH_VERSION,
-          language: 'LV',
+          language: resolve_bank_ui_language,
           return_url: callback_url,
           x509_subject_name: x509_subject_name,
           x509_certificate: x509_certificate
@@ -176,10 +186,38 @@ module OmniAuth
         form.html "<input id=\"xmldata\" name=\"xmldata\" type=\"hidden\" value=\"#{field_value}\" />"
         form.button I18n.t('omniauth.citadele.click_here_if_not_redirected')
 
+        nonce_attribute = nil
+        if self.class.render_nonce?
+          nonce_attribute = " nonce='#{escape(content_security_policy_nonce)}'"
+        end
+
         form.instance_variable_set('@html',
-          form.to_html.gsub('</form>', '</form><script type="text/javascript">document.forms[0].submit();</script>'))
+          form.to_html.gsub('</form>', "</form><script type=\"text/javascript\"#{nonce_attribute}>document.forms[0].submit();</script>"))
         form.to_response
       end
+
+      private
+
+      def set_locale_from_query_param
+        locale = request.params['locale']
+        if (locale != nil && locale.strip != '' && I18n.locale_available?(locale))
+          I18n.locale = locale
+        end
+      end
+
+      def resolve_bank_ui_language
+        case I18n.locale
+        when :ru then 'RU'
+        when :en then 'EN'
+        when :et then 'ET'
+        when :lt then 'LT'
+        else 'LV'
+        end
+      end
+
+      def escape(html_attribute_value)
+         CGI.escapeHTML(html_attribute_value) unless html_attribute_value.nil?
+      end
     end
   end
 end

data/omniauth-citadele.gemspec

@@ -6,11 +6,11 @@ require 'omniauth/citadele/version'
 Gem::Specification.new do |spec|
   spec.name          = 'omniauth-citadele'
   spec.version       = Omniauth::Citadele::VERSION
-  spec.authors       = ['MAK IT']
-  spec.email         = ['admin@makit.lv' ]
+  spec.authors       = ['Mitigate']
+  spec.email         = ['admin@mitigate.dev' ]
   spec.description   = %q{OmniAuth strategy for Citadele Banklink}
   spec.summary       = %q{OmniAuth strategy for Citadele Banklink}
-  spec.homepage      = 'https://github.com/mak-it/omniauth-citadele'
+  spec.homepage      = 'https://github.com/mitigate-dev/omniauth-citadele'
   spec.license       = 'MIT'
 
   spec.files         = `git ls-files`.split($/)
@@ -18,15 +18,17 @@ Gem::Specification.new do |spec|
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ['lib']
 
-  spec.required_ruby_version = '>= 2.3.0'
+  spec.required_ruby_version = '>= 2.7'
 
-  spec.add_runtime_dependency 'omniauth', '~> 1.0'
+  spec.add_runtime_dependency 'omniauth', '~> 2.1'
   spec.add_runtime_dependency 'i18n'
 
+  spec.add_development_dependency 'rack'
   spec.add_development_dependency 'rack-test'
   spec.add_development_dependency 'rspec'
   spec.add_development_dependency 'bundler'
   spec.add_development_dependency 'rake'
+  spec.add_development_dependency 'rack-session'
 
   spec.add_dependency 'xmldsig'
   spec.add_dependency 'nokogiri'

data/spec/omniauth/strategies/citadele_spec.rb

@@ -1,4 +1,6 @@
 require 'spec_helper'
+require 'rack-protection'
+require 'rack/session'
 
 describe OmniAuth::Strategies::Citadele do
   PRIVATE_KEY = File.read(File.join(RSpec.configuration.cert_folder, 'request.key'))
@@ -6,11 +8,13 @@ describe OmniAuth::Strategies::Citadele do
   PUBLIC_CRT = File.read(File.join(RSpec.configuration.cert_folder, 'response.crt'))
 
   let(:app){ Rack::Builder.new do |b|
-    b.use Rack::Session::Cookie, {secret: 'abc123'}
+    b.use Rack::Session::Cookie, {secret: '5242e6bd9daf0e9645c2d4e22b11ba8cee0bed44439906d5f1bd5dad409d8637'}
     b.use(OmniAuth::Strategies::Citadele, PRIVATE_KEY, PRIVATE_CRT, PUBLIC_CRT, 'MY_FROM')
     b.run lambda{|env| [404, {}, ['Not Found']]}
   end.to_app }
 
+  let(:token){ Rack::Protection::AuthenticityToken.random_token }
+
   let(:last_response_xmldata) { last_response.body.match(/name="xmldata" type="hidden" value="([^"]*)"/)[1] }
 
   context 'request phase' do
@@ -18,20 +22,20 @@ describe OmniAuth::Strategies::Citadele do
     let!(:request_uid) { '7387bf5b-fa27-4fdd-add6-a6bfb2599f77' }
 
     it 'displays a single form' do
-      get '/auth/citadele'
+      post_to_request_phase_path
       expect(last_response.status).to eq(200)
       expect(last_response.body.scan('<form').size).to eq(1)
     end
 
     it 'has JavaScript code to submit the form after it is created' do
-      get '/auth/citadele'
+      post_to_request_phase_path
       expect(last_response.body).to be_include('</form><script type="text/javascript">document.forms[0].submit();</script>')
     end
 
     it 'has hidden input field xmldata with required data' do
       allow_any_instance_of(OmniAuth::Strategies::Citadele).to receive(:timestamp).and_return(timestamp)
       allow_any_instance_of(OmniAuth::Strategies::Citadele).to receive(:request_uid).and_return(request_uid)
-      get '/auth/citadele'
+      post_to_request_phase_path
 
       priv_key = OpenSSL::PKey::RSA.new(PRIVATE_KEY)
       priv_crt = OpenSSL::X509::Certificate.new(PRIVATE_CRT)
@@ -56,7 +60,7 @@ describe OmniAuth::Strategies::Citadele do
       expect(sent_values[:request]).to eq 'AUTHREQ'
       expect(sent_values[:request_uid]).to eq request_uid
       expect(sent_values[:version]).to eq '5.0'
-      expect(sent_values[:language]).to eq 'LV'
+      expect(sent_values[:language]).to eq 'EN'
       expect(sent_values[:return_url]).to eq 'http://example.org/auth/citadele/callback'
       expect(sent_values[:x509_subject_name]).to eq x509_subject_name
       expect(sent_values[:x509_certificate]).to eq x509_certificate
@@ -65,7 +69,7 @@ describe OmniAuth::Strategies::Citadele do
     it 'xmldata has a correct signature' do
       allow_any_instance_of(OmniAuth::Strategies::Citadele).to receive(:timestamp).and_return(timestamp)
       allow_any_instance_of(OmniAuth::Strategies::Citadele).to receive(:request_uid).and_return(request_uid)
-      get '/auth/citadele'
+      post_to_request_phase_path
 
       signed_xml = <<~XML
         #{last_response_xmldata.gsub('&quot;','"')}
@@ -77,34 +81,34 @@ describe OmniAuth::Strategies::Citadele do
 
     context 'with default options' do
       it 'has the default action tag value' do
-        get '/auth/citadele'
+        post_to_request_phase_path
         expect(last_response.body).to be_include("action='https://online.citadele.lv/amai/start.htm'")
       end
     end
 
     context 'with custom options' do
       let(:app){ Rack::Builder.new do |b|
-        b.use Rack::Session::Cookie, {secret: 'abc123'}
+        b.use Rack::Session::Cookie, {secret: '5242e6bd9daf0e9645c2d4e22b11ba8cee0bed44439906d5f1bd5dad409d8637'}
         b.use(OmniAuth::Strategies::Citadele, PRIVATE_KEY, PRIVATE_CRT, PUBLIC_CRT, 'MY_FROM',
           site: 'https://test.lv/banklink')
         b.run lambda{|env| [404, {}, ['Not Found']]}
       end.to_app }
 
       it 'has the custom action tag value' do
-        get '/auth/citadele'
+        post_to_request_phase_path
         expect(last_response.body).to be_include("action='https://test.lv/banklink'")
       end
     end
 
     context 'with non-existant private key file' do
       let(:app){ Rack::Builder.new do |b|
-        b.use Rack::Session::Cookie, {secret: 'abc123'}
+        b.use Rack::Session::Cookie, {secret: '5242e6bd9daf0e9645c2d4e22b11ba8cee0bed44439906d5f1bd5dad409d8637'}
         b.use(OmniAuth::Strategies::Citadele, 'missing-private-key-file.pem', PRIVATE_CRT, PUBLIC_CRT, 'MY_FROM')
         b.run lambda{|env| [404, {}, ['Not Found']]}
       end.to_app }
 
       it 'redirects to /auth/failure with appropriate query params' do
-        get '/auth/citadele'
+        post_to_request_phase_path
         expect(last_response.status).to eq(302)
         expect(last_response.headers['Location']).to eq('/auth/failure?message=private_key_load_err&strategy=citadele')
       end
@@ -112,17 +116,26 @@ describe OmniAuth::Strategies::Citadele do
 
     context 'with non-existant private certificate file' do
       let(:app){ Rack::Builder.new do |b|
-        b.use Rack::Session::Cookie, {secret: 'abc123'}
+        b.use Rack::Session::Cookie, {secret: '5242e6bd9daf0e9645c2d4e22b11ba8cee0bed44439906d5f1bd5dad409d8637'}
         b.use(OmniAuth::Strategies::Citadele, PRIVATE_KEY, 'missing-private-crt-file.pem', PUBLIC_CRT, 'MY_FROM')
         b.run lambda{|env| [404, {}, ['Not Found']]}
       end.to_app }
 
       it 'redirects to /auth/failure with appropriate query params' do
-        get '/auth/citadele'
+        post_to_request_phase_path
         expect(last_response.status).to eq(302)
         expect(last_response.headers['Location']).to eq('/auth/failure?message=private_crt_load_err&strategy=citadele')
       end
     end
+
+    def post_to_request_phase_path
+      post(
+        '/auth/citadele',
+        {},
+        'rack.session' => {csrf: token},
+        'HTTP_X_CSRF_TOKEN' => token
+      )
+    end
   end
 
   context 'callback phase' do
@@ -149,7 +162,7 @@ describe OmniAuth::Strategies::Citadele do
 
     context 'with non-existant public key file' do
       let(:app){ Rack::Builder.new do |b|
-        b.use Rack::Session::Cookie, {secret: 'abc123'}
+        b.use Rack::Session::Cookie, {secret: '5242e6bd9daf0e9645c2d4e22b11ba8cee0bed44439906d5f1bd5dad409d8637'}
         b.use(OmniAuth::Strategies::Citadele, PRIVATE_KEY, PRIVATE_CRT, 'missing-public-key-file.pem' )
         b.run lambda{|env| [404, {}, ['Not Found']]}
       end.to_app }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-citadele
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
-- MAK IT
-autorequire: 
+- Mitigate
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2019-02-14 00:00:00.000000000 Z
+date: 2023-09-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '2.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '2.1'
 - !ruby/object:Gem::Dependency
   name: i18n
   requirement: !ruby/object:Gem::Requirement
@@ -38,6 +38,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: rack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rack-test
   requirement: !ruby/object:Gem::Requirement
@@ -94,6 +108,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: rack-session
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: xmldsig
   requirement: !ruby/object:Gem::Requirement
@@ -124,13 +152,13 @@ dependencies:
         version: '0'
 description: OmniAuth strategy for Citadele Banklink
 email:
-- admin@makit.lv
+- admin@mitigate.dev
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/workflows/ruby.yml"
 - ".gitignore"
-- ".travis.yml"
 - Gemfile
 - LICENSE.txt
 - README.md
@@ -148,11 +176,11 @@ files:
 - spec/certs/response.key
 - spec/omniauth/strategies/citadele_spec.rb
 - spec/spec_helper.rb
-homepage: https://github.com/mak-it/omniauth-citadele
+homepage: https://github.com/mitigate-dev/omniauth-citadele
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -160,15 +188,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.3.0
+      version: '2.7'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.1
-signing_key: 
+rubygems_version: 3.3.26
+signing_key:
 specification_version: 4
 summary: OmniAuth strategy for Citadele Banklink
 test_files:

data/.travis.yml

@@ -1,7 +0,0 @@
-language: ruby
-rvm:
-  - 2.3
-  - 2.4
-  - 2.5
-  - 2.6
-script: bundle exec rspec