omniauth-globus 0.8.7 → 0.9.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.github/workflows/build.yml +37 -0
- data/.github/workflows/changelog.yml +36 -0
- data/.github/workflows/release.yml +47 -0
- data/.rubocop.yml +5 -11
- data/Gemfile +3 -1
- data/Gemfile.lock +59 -44
- data/README.md +1 -0
- data/codemeta.json +38 -0
- data/lib/omniauth-globus.rb +3 -1
- data/lib/omniauth/globus.rb +1 -1
- data/lib/omniauth/globus/version.rb +1 -1
- data/lib/omniauth/strategies/globus.rb +71 -71
- data/omniauth-globus.gemspec +1 -1
- data/spec/omniauth/strategies/globus_spec.rb +199 -198
- data/spec/rubocop_spec.rb +4 -4
- metadata +10 -11
data/omniauth-globus.gemspec
CHANGED
@@ -23,7 +23,7 @@ Gem::Specification.new do |s|
|
|
23
23
|
|
24
24
|
# Declary dependencies here, rather than in the Gemfile
|
25
25
|
s.add_dependency "jwt", "~> 2.0"
|
26
|
-
s.add_dependency "omniauth", "
|
26
|
+
s.add_dependency "omniauth", ">= 1.9"
|
27
27
|
s.add_dependency "omniauth-oauth2", "~> 1.6"
|
28
28
|
s.add_development_dependency "bundler", "~> 1.0"
|
29
29
|
s.add_development_dependency "codeclimate-test-reporter", "~> 1.0", ">= 1.0.9"
|
@@ -1,20 +1,20 @@
|
|
1
1
|
# frozen_string_literal: true
|
2
2
|
|
3
|
-
require
|
4
|
-
require
|
5
|
-
require
|
6
|
-
require
|
3
|
+
require "spec_helper"
|
4
|
+
require "json"
|
5
|
+
require "omniauth-globus"
|
6
|
+
require "stringio"
|
7
7
|
|
8
8
|
describe OmniAuth::Strategies::Globus do
|
9
|
-
let(:request) { double(
|
9
|
+
let(:request) { double("Request", params: {}, cookies: {}, env: {}) }
|
10
10
|
let(:app) do
|
11
11
|
lambda do
|
12
|
-
[200, {}, [
|
12
|
+
[200, {}, ["Hello."]]
|
13
13
|
end
|
14
14
|
end
|
15
15
|
|
16
16
|
subject do
|
17
|
-
OmniAuth::Strategies::Globus.new(app,
|
17
|
+
OmniAuth::Strategies::Globus.new(app, "appid", "secret", @options || {}).tap do |strategy|
|
18
18
|
allow(strategy).to receive(:request) do
|
19
19
|
request
|
20
20
|
end
|
@@ -29,252 +29,253 @@ describe OmniAuth::Strategies::Globus do
|
|
29
29
|
OmniAuth.config.test_mode = false
|
30
30
|
end
|
31
31
|
|
32
|
-
describe
|
33
|
-
it
|
34
|
-
expect(subject.client.site).to eq(
|
32
|
+
describe "#client_options" do
|
33
|
+
it "has correct site" do
|
34
|
+
expect(subject.client.site).to eq("https://auth.globus.org")
|
35
35
|
end
|
36
36
|
|
37
|
-
it
|
38
|
-
expect(subject.client.options[:authorize_url]).to eq(
|
37
|
+
it "has correct authorize_url" do
|
38
|
+
expect(subject.client.options[:authorize_url]).to eq("https://auth.globus.org/v2/oauth2/authorize")
|
39
39
|
end
|
40
40
|
|
41
|
-
it
|
42
|
-
expect(subject.client.options[:token_url]).to eq(
|
41
|
+
it "has correct token_url" do
|
42
|
+
expect(subject.client.options[:token_url]).to eq("https://auth.globus.org/v2/oauth2/token")
|
43
43
|
end
|
44
44
|
|
45
|
-
describe
|
46
|
-
context
|
47
|
-
it
|
48
|
-
@options = { client_options: {
|
49
|
-
expect(subject.client.site).to eq(
|
45
|
+
describe "overrides" do
|
46
|
+
context "as strings" do
|
47
|
+
it "should allow overriding the site" do
|
48
|
+
@options = { client_options: { "site" => "https://example.com" } }
|
49
|
+
expect(subject.client.site).to eq("https://example.com")
|
50
50
|
end
|
51
51
|
|
52
|
-
it
|
53
|
-
@options = { client_options: {
|
54
|
-
expect(subject.client.options[:authorization_endpoint]).to eq(
|
52
|
+
it "should allow overriding the authorization_endpoint" do
|
53
|
+
@options = { client_options: { "authorization_endpoint" => "https://example.com" } }
|
54
|
+
expect(subject.client.options[:authorization_endpoint]).to eq("https://example.com")
|
55
55
|
end
|
56
56
|
|
57
|
-
it
|
58
|
-
@options = { client_options: {
|
59
|
-
expect(subject.client.options[:token_endpoint]).to eq(
|
57
|
+
it "should allow overriding the token_endpoint" do
|
58
|
+
@options = { client_options: { "token_endpoint" => "https://example.com" } }
|
59
|
+
expect(subject.client.options[:token_endpoint]).to eq("https://example.com")
|
60
60
|
end
|
61
61
|
end
|
62
62
|
|
63
|
-
context
|
64
|
-
it
|
65
|
-
@options = { client_options: { site:
|
66
|
-
expect(subject.client.site).to eq(
|
63
|
+
context "as symbols" do
|
64
|
+
it "should allow overriding the site" do
|
65
|
+
@options = { client_options: { site: "https://example.com" } }
|
66
|
+
expect(subject.client.site).to eq("https://example.com")
|
67
67
|
end
|
68
68
|
|
69
|
-
it
|
70
|
-
@options = { client_options: { authorization_endpoint:
|
71
|
-
expect(subject.client.options[:authorization_endpoint]).to eq(
|
69
|
+
it "should allow overriding the authorization_endpoint" do
|
70
|
+
@options = { client_options: { authorization_endpoint: "https://example.com" } }
|
71
|
+
expect(subject.client.options[:authorization_endpoint]).to eq("https://example.com")
|
72
72
|
end
|
73
73
|
|
74
|
-
it
|
75
|
-
@options = { client_options: { token_endpoint:
|
76
|
-
expect(subject.client.options[:token_endpoint]).to eq(
|
74
|
+
it "should allow overriding the token_endpoint" do
|
75
|
+
@options = { client_options: { token_endpoint: "https://example.com" } }
|
76
|
+
expect(subject.client.options[:token_endpoint]).to eq("https://example.com")
|
77
77
|
end
|
78
78
|
end
|
79
79
|
end
|
80
80
|
end
|
81
81
|
|
82
|
-
describe
|
82
|
+
describe "#authorize_options" do
|
83
83
|
%i[access_type login_hint prompt scope state device_id device_name].each do |k|
|
84
84
|
it "should support #{k}" do
|
85
|
-
@options = { k =>
|
86
|
-
expect(subject.authorize_params[k.to_s]).to eq(
|
85
|
+
@options = { k => "http://someval" }
|
86
|
+
expect(subject.authorize_params[k.to_s]).to eq("http://someval")
|
87
87
|
end
|
88
88
|
end
|
89
89
|
|
90
|
-
describe
|
91
|
-
it
|
90
|
+
describe "redirect_uri" do
|
91
|
+
it "should default to nil" do
|
92
92
|
@options = {}
|
93
|
-
expect(subject.authorize_params[
|
93
|
+
expect(subject.authorize_params["redirect_uri"]).to eq(nil)
|
94
94
|
end
|
95
95
|
|
96
|
-
it
|
97
|
-
@options = { redirect_uri:
|
98
|
-
expect(subject.authorize_params[
|
96
|
+
it "should set the redirect_uri parameter if present" do
|
97
|
+
@options = { redirect_uri: "https://example.com" }
|
98
|
+
expect(subject.authorize_params["redirect_uri"]).to eq("https://example.com")
|
99
99
|
end
|
100
100
|
end
|
101
101
|
|
102
|
-
describe
|
102
|
+
describe "access_type" do
|
103
103
|
it 'should default to "offline"' do
|
104
104
|
@options = {}
|
105
|
-
expect(subject.authorize_params[
|
105
|
+
expect(subject.authorize_params["access_type"]).to eq("offline")
|
106
106
|
end
|
107
107
|
|
108
|
-
it
|
109
|
-
@options = { access_type:
|
110
|
-
expect(subject.authorize_params[
|
108
|
+
it "should set the access_type parameter if present" do
|
109
|
+
@options = { access_type: "online" }
|
110
|
+
expect(subject.authorize_params["access_type"]).to eq("online")
|
111
111
|
end
|
112
112
|
end
|
113
113
|
|
114
|
-
describe
|
115
|
-
it
|
116
|
-
expect(subject.authorize_params[
|
114
|
+
describe "login_hint" do
|
115
|
+
it "should default to nil" do
|
116
|
+
expect(subject.authorize_params["login_hint"]).to eq(nil)
|
117
117
|
end
|
118
118
|
|
119
|
-
it
|
120
|
-
@options = { login_hint:
|
121
|
-
expect(subject.authorize_params[
|
119
|
+
it "should set the login_hint parameter if present" do
|
120
|
+
@options = { login_hint: "john@example.com" }
|
121
|
+
expect(subject.authorize_params["login_hint"]).to eq("john@example.com")
|
122
122
|
end
|
123
123
|
end
|
124
124
|
|
125
|
-
describe
|
126
|
-
it
|
127
|
-
expect(subject.authorize_params[
|
125
|
+
describe "prompt" do
|
126
|
+
it "should default to nil" do
|
127
|
+
expect(subject.authorize_params["prompt"]).to eq(nil)
|
128
128
|
end
|
129
129
|
|
130
|
-
it
|
131
|
-
@options = { prompt:
|
132
|
-
expect(subject.authorize_params[
|
130
|
+
it "should set the prompt parameter if present" do
|
131
|
+
@options = { prompt: "consent select_account" }
|
132
|
+
expect(subject.authorize_params["prompt"]).to eq("consent select_account")
|
133
133
|
end
|
134
134
|
end
|
135
135
|
|
136
|
-
describe
|
137
|
-
it
|
138
|
-
expect(subject.authorize_params[
|
136
|
+
describe "request_visible_actions" do
|
137
|
+
it "should default to nil" do
|
138
|
+
expect(subject.authorize_params["request_visible_actions"]).to eq(nil)
|
139
139
|
end
|
140
140
|
|
141
|
-
it
|
142
|
-
@options = { request_visible_actions:
|
143
|
-
expect(subject.authorize_params[
|
141
|
+
it "should set the request_visible_actions parameter if present" do
|
142
|
+
@options = { request_visible_actions: "something" }
|
143
|
+
expect(subject.authorize_params["request_visible_actions"]).to eq("something")
|
144
144
|
end
|
145
145
|
end
|
146
146
|
|
147
|
-
describe
|
148
|
-
it
|
149
|
-
expect(subject.authorize_params[
|
147
|
+
describe "include_granted_scopes" do
|
148
|
+
it "should default to nil" do
|
149
|
+
expect(subject.authorize_params["include_granted_scopes"]).to eq(nil)
|
150
150
|
end
|
151
151
|
|
152
|
-
it
|
153
|
-
@options = { include_granted_scopes:
|
154
|
-
expect(subject.authorize_params[
|
152
|
+
it "should set the include_granted_scopes parameter if present" do
|
153
|
+
@options = { include_granted_scopes: "true" }
|
154
|
+
expect(subject.authorize_params["include_granted_scopes"]).to eq("true")
|
155
155
|
end
|
156
156
|
end
|
157
157
|
|
158
|
-
describe
|
159
|
-
it
|
160
|
-
@options = { scope:
|
161
|
-
expect(subject.authorize_params[
|
158
|
+
describe "scope" do
|
159
|
+
it "should leave base scopes as is" do
|
160
|
+
@options = { scope: "profile" }
|
161
|
+
expect(subject.authorize_params["scope"]).to eq("profile")
|
162
162
|
end
|
163
163
|
|
164
|
-
it
|
165
|
-
@options = { scope:
|
166
|
-
expect(subject.authorize_params[
|
164
|
+
it "should join scopes" do
|
165
|
+
@options = { scope: "profile,email" }
|
166
|
+
expect(subject.authorize_params["scope"]).to eq("profile email")
|
167
167
|
end
|
168
168
|
|
169
|
-
it
|
170
|
-
@options = { scope:
|
171
|
-
expect(subject.authorize_params[
|
169
|
+
it "should deal with whitespace when joining scopes" do
|
170
|
+
@options = { scope: "profile, email" }
|
171
|
+
expect(subject.authorize_params["scope"]).to eq("profile email")
|
172
172
|
end
|
173
173
|
|
174
|
-
it
|
175
|
-
expect(subject.authorize_params[
|
174
|
+
it "should set default scope to openid, profile, email" do
|
175
|
+
expect(subject.authorize_params["scope"]).to eq("openid profile email")
|
176
176
|
end
|
177
177
|
|
178
|
-
it
|
179
|
-
@options = { scope:
|
180
|
-
expect(subject.authorize_params[
|
178
|
+
it "should support space delimited scopes" do
|
179
|
+
@options = { scope: "profile email" }
|
180
|
+
expect(subject.authorize_params["scope"]).to eq("profile email")
|
181
181
|
end
|
182
182
|
|
183
|
-
it
|
184
|
-
@options = { scope:
|
185
|
-
expect(subject.authorize_params[
|
183
|
+
it "should support extremely badly formed scopes" do
|
184
|
+
@options = { scope: "profile email,foo,steve yeah" }
|
185
|
+
expect(subject.authorize_params["scope"]).to eq("profile email foo steve yeah")
|
186
186
|
end
|
187
187
|
end
|
188
188
|
|
189
|
-
describe
|
190
|
-
it
|
191
|
-
@options = { state:
|
192
|
-
expect(subject.authorize_params[
|
193
|
-
expect(subject.authorize_params[:state]).to eq(
|
194
|
-
expect(subject.session[
|
189
|
+
describe "state" do
|
190
|
+
it "should set the state parameter" do
|
191
|
+
@options = { state: "some_state" }
|
192
|
+
expect(subject.authorize_params["state"]).to eq("some_state")
|
193
|
+
expect(subject.authorize_params[:state]).to eq("some_state")
|
194
|
+
expect(subject.session["omniauth.state"]).to eq("some_state")
|
195
195
|
end
|
196
196
|
|
197
|
-
it
|
198
|
-
allow(subject).to receive(:request) { double(
|
199
|
-
expect(subject.authorize_params[
|
200
|
-
expect(subject.authorize_params[:state]).to eq(
|
201
|
-
expect(subject.session[
|
197
|
+
it "should set the omniauth.state dynamically" do
|
198
|
+
allow(subject).to receive(:request) { double("Request", params: { "state" => "some_state" }, env: {}) }
|
199
|
+
expect(subject.authorize_params["state"]).to eq("some_state")
|
200
|
+
expect(subject.authorize_params[:state]).to eq("some_state")
|
201
|
+
expect(subject.session["omniauth.state"]).to eq("some_state")
|
202
202
|
end
|
203
203
|
end
|
204
204
|
|
205
|
-
describe
|
206
|
-
it
|
207
|
-
@options = { authorize_options: %i[scope foo request_visible_actions], scope:
|
208
|
-
expect(subject.authorize_params[
|
209
|
-
expect(subject.authorize_params[
|
210
|
-
expect(subject.authorize_params[
|
205
|
+
describe "overrides" do
|
206
|
+
it "should include top-level options that are marked as :authorize_options" do
|
207
|
+
@options = { authorize_options: %i[scope foo request_visible_actions], scope: "http://bar", foo: "baz", request_visible_actions: "something" }
|
208
|
+
expect(subject.authorize_params["scope"]).to eq("http://bar")
|
209
|
+
expect(subject.authorize_params["foo"]).to eq("baz")
|
210
|
+
expect(subject.authorize_params["request_visible_actions"]).to eq("something")
|
211
211
|
end
|
212
212
|
|
213
|
-
describe
|
213
|
+
describe "request overrides" do
|
214
214
|
%i[access_type login_hint prompt scope state].each do |k|
|
215
215
|
context "authorize option #{k}" do
|
216
|
-
let(:request) { double(
|
216
|
+
let(:request) { double("Request", params: { k.to_s => "http://example.com" }, cookies: {}, env: {}) }
|
217
217
|
|
218
218
|
it "should set the #{k} authorize option dynamically in the request" do
|
219
|
-
@options = { k:
|
220
|
-
expect(subject.authorize_params[k.to_s]).to eq(
|
219
|
+
@options = { k: "" }
|
220
|
+
expect(subject.authorize_params[k.to_s]).to eq("http://example.com")
|
221
221
|
end
|
222
222
|
end
|
223
223
|
end
|
224
224
|
|
225
|
-
describe
|
226
|
-
let(:request) { double(
|
225
|
+
describe "custom authorize_options" do
|
226
|
+
let(:request) { double("Request", params: { "foo" => "something" }, cookies: {}, env: {}) }
|
227
227
|
|
228
|
-
it
|
229
|
-
@options = { authorize_options: [:foo], foo:
|
230
|
-
expect(subject.authorize_params[
|
228
|
+
it "should support request overrides from custom authorize_options" do
|
229
|
+
@options = { authorize_options: [:foo], foo: "" }
|
230
|
+
expect(subject.authorize_params["foo"]).to eq("something")
|
231
231
|
end
|
232
232
|
end
|
233
233
|
end
|
234
234
|
end
|
235
235
|
end
|
236
236
|
|
237
|
-
describe
|
238
|
-
it
|
239
|
-
@options = { authorize_params: { request_visible_actions:
|
240
|
-
expect(subject.authorize_params[
|
241
|
-
expect(subject.authorize_params[
|
242
|
-
expect(subject.authorize_params[
|
243
|
-
expect(subject.authorize_params[
|
237
|
+
describe "#authorize_params" do
|
238
|
+
it "should include any authorize params passed in the :authorize_params option" do
|
239
|
+
@options = { authorize_params: { request_visible_actions: "something", foo: "bar", baz: "zip" }, bad: "not_included" }
|
240
|
+
expect(subject.authorize_params["request_visible_actions"]).to eq("something")
|
241
|
+
expect(subject.authorize_params["foo"]).to eq("bar")
|
242
|
+
expect(subject.authorize_params["baz"]).to eq("zip")
|
243
|
+
expect(subject.authorize_params["bad"]).to eq(nil)
|
244
244
|
end
|
245
245
|
end
|
246
246
|
|
247
|
-
describe
|
248
|
-
it
|
249
|
-
@options = { token_params: { foo:
|
250
|
-
expect(subject.token_params[
|
251
|
-
expect(subject.token_params[
|
247
|
+
describe "#token_params" do
|
248
|
+
it "should include any token params passed in the :token_params option" do
|
249
|
+
@options = { token_params: { foo: "bar", baz: "zip" } }
|
250
|
+
expect(subject.token_params["foo"]).to eq("bar")
|
251
|
+
expect(subject.token_params["baz"]).to eq("zip")
|
252
252
|
end
|
253
253
|
end
|
254
254
|
|
255
|
-
describe
|
256
|
-
it
|
257
|
-
@options = { token_options: %i[scope foo], scope:
|
258
|
-
expect(subject.token_params[
|
259
|
-
expect(subject.token_params[
|
260
|
-
expect(subject.token_params[
|
255
|
+
describe "#token_options" do
|
256
|
+
it "should include top-level options that are marked as :token_options" do
|
257
|
+
@options = { token_options: %i[scope foo], scope: "bar", foo: "baz", bad: "not_included" }
|
258
|
+
expect(subject.token_params["scope"]).to eq("bar")
|
259
|
+
expect(subject.token_params["foo"]).to eq("baz")
|
260
|
+
expect(subject.token_params["bad"]).to eq(nil)
|
261
261
|
end
|
262
262
|
end
|
263
263
|
|
264
|
-
describe
|
265
|
-
it
|
264
|
+
describe "#callback_path" do
|
265
|
+
it "has the correct default callback path" do
|
266
|
+
@options = { callback_path: "/auth/globus/callback" }
|
266
267
|
expect(subject.callback_path).to eq("/auth/globus/callback")
|
267
268
|
end
|
268
269
|
|
269
|
-
it
|
270
|
-
@options = { callback_path:
|
271
|
-
expect(subject.callback_path).to eq(
|
270
|
+
it "should set the callback_path parameter if present" do
|
271
|
+
@options = { callback_path: "/auth/foo/callback" }
|
272
|
+
expect(subject.callback_path).to eq("/auth/foo/callback")
|
272
273
|
end
|
273
274
|
end
|
274
275
|
|
275
|
-
describe
|
276
|
+
describe "#info" do
|
276
277
|
let(:client) do
|
277
|
-
OAuth2::Client.new(
|
278
|
+
OAuth2::Client.new("abc", "def") do |builder|
|
278
279
|
builder.request :url_encoded
|
279
280
|
builder.adapter :test do |stub|
|
280
281
|
stub.get("/v2/oauth2/userinfo") { [200, { "content-type" => "application/json" }, response_hash.to_json] }
|
@@ -284,23 +285,23 @@ describe OmniAuth::Strategies::Globus do
|
|
284
285
|
let(:access_token) { OAuth2::AccessToken.from_hash(client, {}) }
|
285
286
|
before { allow(subject).to receive(:access_token).and_return(access_token) }
|
286
287
|
|
287
|
-
context
|
288
|
+
context "with email" do
|
288
289
|
let(:response_hash) do
|
289
|
-
{ email:
|
290
|
+
{ email: "something@domain.invalid" }
|
290
291
|
end
|
291
292
|
|
292
|
-
it
|
293
|
-
expect(subject.info[:email]).to eq(
|
293
|
+
it "should return email" do
|
294
|
+
expect(subject.info[:email]).to eq("something@domain.invalid")
|
294
295
|
end
|
295
296
|
end
|
296
297
|
end
|
297
298
|
|
298
|
-
describe
|
299
|
+
describe "#extra" do
|
299
300
|
let(:client) do
|
300
|
-
OAuth2::Client.new(
|
301
|
+
OAuth2::Client.new("abc", "def") do |builder|
|
301
302
|
builder.request :url_encoded
|
302
303
|
builder.adapter :test do |stub|
|
303
|
-
stub.get(
|
304
|
+
stub.get("/v2/oauth2/userinfo") { [200, { "content-type" => "application/json" }, '{"sub": "12345"}'] }
|
304
305
|
end
|
305
306
|
end
|
306
307
|
end
|
@@ -308,9 +309,9 @@ describe OmniAuth::Strategies::Globus do
|
|
308
309
|
|
309
310
|
before { allow(subject).to receive(:access_token).and_return(access_token) }
|
310
311
|
|
311
|
-
describe
|
312
|
-
shared_examples
|
313
|
-
context
|
312
|
+
describe "id_token" do
|
313
|
+
shared_examples "id_token issued by valid issuer" do |issuer| # rubocop:disable Metrics/BlockLength
|
314
|
+
context "when the id_token is passed into the access token" do
|
314
315
|
let(:token_info) do
|
315
316
|
{
|
316
317
|
identity_provider_display_name: "ORCID",
|
@@ -324,18 +325,18 @@ describe OmniAuth::Strategies::Globus do
|
|
324
325
|
iss: "https://auth.globus.org"
|
325
326
|
}
|
326
327
|
end
|
327
|
-
let(:id_token) { JWT.encode(token_info,
|
328
|
-
let(:access_token) { OAuth2::AccessToken.from_hash(client,
|
328
|
+
let(:id_token) { JWT.encode(token_info, "secret") }
|
329
|
+
let(:access_token) { OAuth2::AccessToken.from_hash(client, "id_token" => id_token) }
|
329
330
|
|
330
|
-
it
|
331
|
+
it "should include id_token when set on the access_token" do
|
331
332
|
expect(subject.extra).to include(id_token: id_token)
|
332
333
|
end
|
333
334
|
end
|
334
335
|
end
|
335
336
|
|
336
|
-
it_behaves_like
|
337
|
+
it_behaves_like "id_token issued by valid issuer", "https://auth.globus.org"
|
337
338
|
|
338
|
-
context
|
339
|
+
context "when the id_token is issued by an invalid issuer" do
|
339
340
|
let(:token_info) do
|
340
341
|
{
|
341
342
|
identity_provider_display_name: "ORCID",
|
@@ -349,138 +350,138 @@ describe OmniAuth::Strategies::Globus do
|
|
349
350
|
iss: "https://fake.globus.org"
|
350
351
|
}
|
351
352
|
end
|
352
|
-
let(:id_token) { JWT.encode(token_info,
|
353
|
-
let(:access_token) { OAuth2::AccessToken.from_hash(client,
|
353
|
+
let(:id_token) { JWT.encode(token_info, "secret") }
|
354
|
+
let(:access_token) { OAuth2::AccessToken.from_hash(client, "id_token" => id_token) }
|
354
355
|
|
355
|
-
it
|
356
|
+
it "raises JWT::InvalidIssuerError" do
|
356
357
|
expect { subject.extra }.to raise_error(JWT::InvalidIssuerError)
|
357
358
|
end
|
358
359
|
end
|
359
360
|
|
360
|
-
context
|
361
|
-
it
|
361
|
+
context "when the id_token is missing" do
|
362
|
+
it "should not include id_token" do
|
362
363
|
expect(subject.extra).not_to have_key(:id_token)
|
363
364
|
end
|
364
365
|
|
365
|
-
it
|
366
|
+
it "should not include id_info" do
|
366
367
|
expect(subject.extra).not_to have_key(:id_info)
|
367
368
|
end
|
368
369
|
end
|
369
370
|
end
|
370
371
|
|
371
|
-
describe
|
372
|
-
context
|
372
|
+
describe "raw_info" do
|
373
|
+
context "when skip_info is true" do
|
373
374
|
before { subject.options[:skip_info] = true }
|
374
375
|
|
375
|
-
it
|
376
|
+
it "should not include raw_info" do
|
376
377
|
expect(subject.extra).not_to have_key(:raw_info)
|
377
378
|
end
|
378
379
|
end
|
379
380
|
|
380
|
-
context
|
381
|
+
context "when skip_info is false" do
|
381
382
|
before { subject.options[:skip_info] = false }
|
382
383
|
|
383
|
-
it
|
384
|
-
expect(subject.extra[:raw_info]).to eq(
|
384
|
+
it "should include raw_info" do
|
385
|
+
expect(subject.extra[:raw_info]).to eq("sub" => "12345")
|
385
386
|
end
|
386
387
|
end
|
387
388
|
end
|
388
389
|
end
|
389
390
|
|
390
|
-
describe
|
391
|
-
it
|
391
|
+
describe "build_access_token" do
|
392
|
+
it "should use a hybrid authorization request_uri if this is an AJAX request with a code parameter" do
|
392
393
|
allow(request).to receive(:xhr?).and_return(true)
|
393
|
-
allow(request).to receive(:params).and_return(
|
394
|
+
allow(request).to receive(:params).and_return("code" => "valid_code")
|
394
395
|
|
395
396
|
client = double(:client)
|
396
397
|
auth_code = double(:auth_code)
|
397
398
|
allow(client).to receive(:auth_code).and_return(auth_code)
|
398
399
|
expect(subject).to receive(:client).and_return(client)
|
399
|
-
expect(auth_code).to receive(:get_token).with(
|
400
|
+
expect(auth_code).to receive(:get_token).with("valid_code", { redirect_uri: "postmessage" }, {})
|
400
401
|
|
401
402
|
expect(subject).not_to receive(:orig_build_access_token)
|
402
403
|
subject.build_access_token
|
403
404
|
end
|
404
405
|
|
405
|
-
it
|
406
|
+
it "should use a hybrid authorization request_uri if this is an AJAX request (mobile) with a code parameter" do
|
406
407
|
allow(request).to receive(:xhr?).and_return(true)
|
407
|
-
allow(request).to receive(:params).and_return(
|
408
|
+
allow(request).to receive(:params).and_return("code" => "valid_code", "redirect_uri" => "")
|
408
409
|
|
409
410
|
client = double(:client)
|
410
411
|
auth_code = double(:auth_code)
|
411
412
|
allow(client).to receive(:auth_code).and_return(auth_code)
|
412
413
|
expect(subject).to receive(:client).and_return(client)
|
413
|
-
expect(auth_code).to receive(:get_token).with(
|
414
|
+
expect(auth_code).to receive(:get_token).with("valid_code", { redirect_uri: "" }, {})
|
414
415
|
|
415
416
|
expect(subject).not_to receive(:orig_build_access_token)
|
416
417
|
subject.build_access_token
|
417
418
|
end
|
418
419
|
|
419
|
-
it
|
420
|
+
it "should use the request_uri from params if this not an AJAX request (request from installed app) with a code parameter" do
|
420
421
|
allow(request).to receive(:xhr?).and_return(false)
|
421
|
-
allow(request).to receive(:params).and_return(
|
422
|
+
allow(request).to receive(:params).and_return("code" => "valid_code", "redirect_uri" => "redirect_uri")
|
422
423
|
|
423
424
|
client = double(:client)
|
424
425
|
auth_code = double(:auth_code)
|
425
426
|
allow(client).to receive(:auth_code).and_return(auth_code)
|
426
427
|
expect(subject).to receive(:client).and_return(client)
|
427
|
-
expect(auth_code).to receive(:get_token).with(
|
428
|
+
expect(auth_code).to receive(:get_token).with("valid_code", { redirect_uri: "redirect_uri" }, {})
|
428
429
|
|
429
430
|
expect(subject).not_to receive(:orig_build_access_token)
|
430
431
|
subject.build_access_token
|
431
432
|
end
|
432
433
|
|
433
|
-
it
|
434
|
+
it "should read access_token from hash if this is not an AJAX request with a code parameter" do
|
434
435
|
allow(request).to receive(:xhr?).and_return(false)
|
435
|
-
allow(request).to receive(:params).and_return(
|
436
|
-
expect(subject).to receive(:verify_token).with(
|
436
|
+
allow(request).to receive(:params).and_return("access_token" => "valid_access_token")
|
437
|
+
expect(subject).to receive(:verify_token).with("valid_access_token").and_return true
|
437
438
|
expect(subject).to receive(:client).and_return(:client)
|
438
439
|
|
439
440
|
token = subject.build_access_token
|
440
441
|
expect(token).to be_instance_of(::OAuth2::AccessToken)
|
441
|
-
expect(token.token).to eq(
|
442
|
+
expect(token.token).to eq("valid_access_token")
|
442
443
|
expect(token.client).to eq(:client)
|
443
444
|
end
|
444
445
|
|
445
|
-
it
|
446
|
+
it "reads the code from a json request body" do
|
446
447
|
body = StringIO.new(%({"code":"json_access_token"}))
|
447
448
|
client = double(:client)
|
448
449
|
auth_code = double(:auth_code)
|
449
450
|
|
450
451
|
allow(request).to receive(:xhr?).and_return(false)
|
451
|
-
allow(request).to receive(:content_type).and_return(
|
452
|
+
allow(request).to receive(:content_type).and_return("application/json")
|
452
453
|
allow(request).to receive(:body).and_return(body)
|
453
454
|
allow(client).to receive(:auth_code).and_return(auth_code)
|
454
455
|
expect(subject).to receive(:client).and_return(client)
|
455
456
|
|
456
|
-
expect(auth_code).to receive(:get_token).with(
|
457
|
+
expect(auth_code).to receive(:get_token).with("json_access_token", { redirect_uri: "postmessage" }, {})
|
457
458
|
|
458
459
|
subject.build_access_token
|
459
460
|
end
|
460
461
|
|
461
|
-
it
|
462
|
+
it "should use callback_url without query_string if this is not an AJAX request" do
|
462
463
|
allow(request).to receive(:xhr?).and_return(false)
|
463
|
-
allow(request).to receive(:params).and_return(
|
464
|
-
allow(request).to receive(:content_type).and_return(
|
464
|
+
allow(request).to receive(:params).and_return("code" => "valid_code")
|
465
|
+
allow(request).to receive(:content_type).and_return("application/x-www-form-urlencoded")
|
465
466
|
|
466
467
|
client = double(:client)
|
467
468
|
auth_code = double(:auth_code)
|
468
469
|
allow(client).to receive(:auth_code).and_return(auth_code)
|
469
|
-
allow(subject).to receive(:callback_url).and_return(
|
470
|
+
allow(subject).to receive(:callback_url).and_return("redirect_uri_without_query_string")
|
470
471
|
|
471
472
|
expect(subject).to receive(:client).and_return(client)
|
472
|
-
expect(auth_code).to receive(:get_token).with(
|
473
|
+
expect(auth_code).to receive(:get_token).with("valid_code", { redirect_uri: "redirect_uri_without_query_string" }, {})
|
473
474
|
subject.build_access_token
|
474
475
|
end
|
475
476
|
end
|
476
477
|
|
477
|
-
describe
|
478
|
+
describe "verify_token" do
|
478
479
|
before(:each) do
|
479
480
|
subject.options.client_options[:connection_build] = proc do |builder|
|
480
481
|
builder.request :url_encoded
|
481
482
|
builder.adapter :test do |stub|
|
482
|
-
stub.get(
|
483
|
-
[200, {
|
483
|
+
stub.get("/v2/oauth2/userinfo?access_token=valid_access_token") do
|
484
|
+
[200, { "Content-Type" => "application/json; charset=UTF-8" }, JSON.dump(
|
484
485
|
{
|
485
486
|
identity_provider_display_name: "ORCID",
|
486
487
|
sub: "abc",
|
@@ -494,8 +495,8 @@ describe OmniAuth::Strategies::Globus do
|
|
494
495
|
}
|
495
496
|
)]
|
496
497
|
end
|
497
|
-
stub.get(
|
498
|
-
[400, {
|
498
|
+
stub.get("/v2/oauth2/userinfo?access_token=invalid_access_token") do
|
499
|
+
[400, { "Content-Type" => "application/json; charset=UTF-8" }, JSON.dump(error_description: "Invalid Value")]
|
499
500
|
end
|
500
501
|
end
|
501
502
|
end
|
@@ -505,9 +506,9 @@ describe OmniAuth::Strategies::Globus do
|
|
505
506
|
# expect(subject.send(:verify_token, 'valid_access_token')).to eq(true)
|
506
507
|
# end
|
507
508
|
|
508
|
-
it
|
509
|
+
it "should raise error if access_token is invalid" do
|
509
510
|
expect do
|
510
|
-
subject.send(:verify_token,
|
511
|
+
subject.send(:verify_token, "invalid_access_token")
|
511
512
|
end.to raise_error(OAuth2::Error)
|
512
513
|
end
|
513
514
|
end
|