osso 0.0.3.12 → 0.0.3.17

data/lib/osso/graphql/types.rb

@@ -9,10 +9,11 @@ require_relative 'types/base_connection'
 require_relative 'types/base_object'
 require_relative 'types/base_enum'
 require_relative 'types/base_input_object'
+require_relative 'types/admin_user'
 require_relative 'types/identity_provider_service'
 require_relative 'types/identity_provider_status'
 require_relative 'types/identity_provider'
 require_relative 'types/enterprise_account'
 require_relative 'types/redirect_uri'
+require_relative 'types/redirect_uri_input'
 require_relative 'types/oauth_client'
-require_relative 'types/user'

data/lib/osso/graphql/types/admin_user.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require 'graphql'
+
+module Osso
+  module GraphQL
+    module Types
+      class AdminUser < Types::BaseObject
+        description 'An Admin User of Osso'
+
+        field :id, ID, null: false
+        field :email, String, null: false
+        field :scope, String, null: false
+        field :oauth_client_id, ID, null: true
+
+        def self.authorized?(_object, _context)
+          true
+        end
+      end
+    end
+  end
+end

data/lib/osso/graphql/types/base_object.rb

@@ -10,6 +10,28 @@ module Osso
 
         field :created_at, ::GraphQL::Types::ISO8601DateTime, null: false
         field :updated_at, ::GraphQL::Types::ISO8601DateTime, null: false
+
+        def self.admin_authorized?(context)
+          context[:scope] == 'admin'
+        end
+
+        def self.internal_authorized?(context)
+          %w[admin internal].include?(context[:scope])
+        end
+
+        def self.enterprise_authorized?(context, domain)
+          return false unless domain
+
+          context[:email].split('@')[1] == domain
+        end
+
+        def self.authorized?(object, context)
+          # we first receive the payload object as a hash, but can depend on the
+          # return type to hide the actual objects non-admins shouldn't see
+          return true if object.class == Hash
+
+          internal_authorized?(context) || enterprise_authorized?(context, object&.domain)
+        end
       end
     end
   end

data/lib/osso/graphql/types/enterprise_account.rb

@@ -9,7 +9,6 @@ module Osso
         description 'An Account for a company that wishes to use SAML via Osso'
         implements ::GraphQL::Types::Relay::Node
 
-        global_id_field :gid
         field :id, ID, null: false
         field :name, String, null: false
         field :domain, String, null: false
@@ -23,10 +22,6 @@ module Osso
         def identity_providers
           object.identity_providers
         end
-
-        def self.authorized?(object, context)
-          super && (context[:scope] == :admin || object.domain == context[:scope])
-        end
       end
     end
   end

data/lib/osso/graphql/types/identity_provider.rb

@@ -7,9 +7,7 @@ module Osso
     module Types
       class IdentityProvider < Types::BaseObject
         description 'Represents a SAML based IDP instance for an EnterpriseAccount'
-        implements ::GraphQL::Types::Relay::Node
 
-        global_id_field :gid
         field :id, ID, null: false
         field :enterprise_account_id, ID, null: false
         field :service, Types::IdentityProviderService, null: true
@@ -23,10 +21,6 @@ module Osso
         def documentation_pdf_url
           ENV['BASE_URL'] + '/identity_provider/documentation/' + @object.id
         end
-
-        def self.authorized?(object, context)
-          super && (context[:scope] == :admin || object.domain == context[:scope])
-        end
       end
     end
   end

data/lib/osso/graphql/types/oauth_client.rb

@@ -7,9 +7,7 @@ module Osso
     module Types
       class OauthClient < Types::BaseObject
         description 'An OAuth client used to consume Osso SAML users'
-        implements ::GraphQL::Types::Relay::Node
 
-        global_id_field :gid
         field :id, ID, null: false
         field :name, String, null: false
         field :client_id, String, null: false
@@ -24,8 +22,8 @@ module Osso
           object.secret
         end
 
-        def self.authorized?(object, context)
-          super && context[:scope] == :admin
+        def self.authorized?(_object, context)
+          admin_authorized?(context)
         end
       end
     end

data/lib/osso/graphql/types/redirect_uri.rb

@@ -7,15 +7,13 @@ module Osso
     module Types
       class RedirectUri < Types::BaseObject
         description 'An allowed redirect URI for an OauthClient'
-        implements ::GraphQL::Types::Relay::Node
 
-        global_id_field :gid
         field :id, ID, null: false
         field :uri, String, null: false
         field :primary, Boolean, null: false
 
-        def self.authorized?(object, context)
-          super && context[:scope] == :admin
+        def self.authorized?(_object, context)
+          context[:scope] == 'admin'
         end
       end
     end

data/lib/osso/graphql/types/redirect_uri_input.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'graphql'
+
+module Osso
+  module GraphQL
+    module Types
+      class RedirectUrisInput < Types::BaseInputObject
+        description 'Attributes for creating or updating a collection of redirect URIs for an Oauth Client'
+        argument :id, ID, 'Database ID', required: false
+        argument :uri, String, 'URI value', required: true
+        argument :primary, Boolean, 'Whether the URI is the primary uri used in IDP initiated login', required: true
+      end
+    end
+  end
+end

data/lib/osso/helpers/auth.rb

@@ -1,12 +1,22 @@
 # frozen_string_literal: true
 
+require 'pry'
 module Osso
   module Helpers
     module Auth
-      attr_accessor :current_scope
+      END_USER_SCOPE = 'end-user'
+      INTERNAL_SCOPE = 'internal'
+      ADMIN_SCOPE    = 'admin'
+
+      attr_accessor :current_user
+
+      def token_protected!
+        decode(token)
+      end
 
       def enterprise_protected!(domain = nil)
         return if admin_authorized?
+        return if internal_authorized?
         return if enterprise_authorized?(domain)
 
         halt 401 if request.post?
@@ -14,14 +24,26 @@ module Osso
         redirect ENV['JWT_URL']
       end
 
-      # use client id in payload to restrict customer
-      # users from accessing dev?
-      def enterprise_authorized?(_domain)
-        payload, _args = decode(token)
+      def enterprise_authorized?(domain)
+        decode(token)
+
+        @current_user[:scope] == END_USER_SCOPE &&
+          @current_user[:email].split('@')[1] == domain
+      rescue JWT::DecodeError
+        false
+      end
 
-        @current_scope = payload['scope']
+      def internal_protected!
+        return if admin_authorized?
+        return if internal_authorized?
 
-        true
+        redirect ENV['JWT_URL']
+      end
+
+      def internal_authorized?
+        decode(token)
+
+        @current_user[:scope] == INTERNAL_SCOPE
       rescue JWT::DecodeError
         false
       end
@@ -33,14 +55,9 @@ module Osso
       end
 
       def admin_authorized?
-        payload, _args = decode(token)
+        decode(token)
 
-        if payload['scope'] == 'admin'
-          @current_scope = :admin
-          return true
-        end
-
-        false
+        @current_user[:scope] == ADMIN_SCOPE
       rescue JWT::DecodeError
         false
       end
@@ -60,12 +77,14 @@ module Osso
       end
 
       def decode(token)
-        JWT.decode(
+        payload, _args = JWT.decode(
           token,
           ENV['JWT_HMAC_SECRET'],
           true,
           { algorithm: 'HS256' },
         )
+
+        @current_user = payload.symbolize_keys
       end
     end
   end

data/lib/osso/lib/route_map.rb

@@ -11,12 +11,12 @@ module Osso
         use Osso::Oauth
 
         post '/graphql' do
-          enterprise_protected!
+          token_protected!
 
           result = Osso::GraphQL::Schema.execute(
             params[:query],
             variables: params[:variables],
-            context: { scope: current_scope },
+            context: current_user.symbolize_keys,
           )
 
           json result

data/lib/osso/models/identity_provider.rb

@@ -19,20 +19,14 @@ module Osso
       end
 
       def saml_options
-        attributes.slice(
-          'domain',
-          'idp_cert',
-          'idp_sso_target_url',
-        ).symbolize_keys
+        {
+          domain: domain,
+          idp_sso_target_url: sso_url,
+          idp_cert: sso_cert,
+          issuer: domain,
+        }
       end
 
-      # def saml_options
-      #   raise(
-      #     NoMethodError,
-      #     '#saml_options must be defined on each provider specific subclass',
-      #   )
-      # end
-
       def assertion_consumer_service_url
         [
           ENV.fetch('BASE_URL'),

data/lib/osso/models/oauth_client.rb

@@ -5,6 +5,7 @@ module Osso
   module Models
     class OauthClient < ActiveRecord::Base
       has_many :access_tokens
+      has_many :enterprise_accounts
       has_many :refresh_tokens
       has_many :identity_providers
       has_many :redirect_uris
@@ -17,6 +18,10 @@ module Osso
         redirect_uris.find(&:primary)
       end
 
+      def redirect_uri_values
+        redirect_uris.map(&:uri)
+      end
+
       def generate_secrets
         self.identifier = SecureRandom.hex(16)
         self.secret = SecureRandom.hex(32)

data/lib/osso/models/redirect_uri.rb

@@ -4,17 +4,6 @@ module Osso
   module Models
     class RedirectUri < ActiveRecord::Base
       belongs_to :oauth_client
-
-      # TODO
-      # before_validation :set_primary, on: :creaet, :update
-
-      private
-
-      def set_primary
-        if primary_was.true? && primary.false?
-
-        end
-      end
     end
   end
 end

data/lib/osso/routes/admin.rb

@@ -14,13 +14,13 @@ module Osso
 
     namespace '/admin' do
       get '' do
-        admin_protected!
+        internal_protected!
 
         erb :admin
       end
 
       get '/enterprise' do
-        admin_protected!
+        internal_protected!
 
         erb :admin
       end

data/lib/osso/routes/auth.rb

@@ -14,10 +14,6 @@ module Osso
       /[0-9a-f]{8}-[0-9a-f]{3,4}-[0-9a-f]{4}-[0-9a-f]{3,4}-[0-9a-f]{12}/.
         freeze
 
-    def self.internal_redirect?(env)
-      env['HTTP_REFERER']&.match(env['SERVER_NAME'])
-    end
-
     use OmniAuth::Builder do
       OmniAuth::MultiProvider.register(
         self,
@@ -26,21 +22,24 @@ module Osso
         path_prefix: '/auth/saml',
         callback_suffix: 'callback',
       ) do |identity_provider_id, _env|
-        provider = Models::IdentityProvider.find(identity_provider_id)
-        provider.saml_options
+        Models::IdentityProvider.find(identity_provider_id).
+          saml_options
       end
     end
 
-    namespace '/auth' do
+    namespace '/auth' do # rubocop:disable Metrics/BlockLength
+      get '/failure' do
+        @error = params[:message]
+        erb :error
+      end
       # Enterprise users are sent here after authenticating against
       # their Identity Provider. We find or create a user record,
       # and then create an authorization code for that user. The user
       # is redirected back to your application with this code
-      # as a URL query param, which you then exhange for an access token
+      # as a URL query param, which you then exchange for an access token.
       post '/saml/:id/callback' do
         provider = Models::IdentityProvider.find(params[:id])
-        oauth_client = provider.oauth_client
-        redirect_uri = env['redirect_uri'] || oauth_client.default_redirect_uri.uri
+        @oauth_client = provider.oauth_client
 
         attributes = env['omniauth.auth']&.
           extra&.
@@ -56,11 +55,29 @@ module Osso
         end
 
         authorization_code = user.authorization_codes.create!(
-          oauth_client: oauth_client,
+          oauth_client: @oauth_client,
           redirect_uri: redirect_uri,
         )
 
-        redirect(redirect_uri + "?code=#{CGI.escape(authorization_code.token)}&state=#{session[:oauth_state]}")
+        # Mark IDP as active
+
+        redirect(redirect_uri + "?code=#{CGI.escape(authorization_code.token)}&state=#{provider_state}")
+      end
+
+      def redirect_uri
+        return @oauth_client.primary_redirect_uri.uri if valid_idp_initiated_flow
+
+        session[:osso_oauth_redirect_uri]
+      end
+
+      def provider_state
+        return @provider_state = 'IDP_INITIATED' if valid_idp_initiated_flow
+
+        session.delete(:osso_oauth_state)
+      end
+
+      def valid_idp_initiated_flow
+        !session[:osso_oauth_redirect_uri] && !session[:osso_oauth_state]
       end
     end
   end

data/lib/osso/routes/oauth.rb

@@ -6,38 +6,45 @@ module Osso
   class Oauth < Sinatra::Base
     include AppConfig
     register Sinatra::Namespace
-    # rubocop:disable Metrics/BlockLength
-    namespace '/oauth' do
+
+    namespace '/oauth' do # rubocop:disable Metrics/BlockLength
       # Send your users here in order to being an authentication
       # flow. This flow follows the authorization grant oauth
       # spec with one exception - you must also pass the domain
-      # of the user who wants to sign in.
+      # of the user who wants to sign in. If the sign in request
+      # is valid, the user is redirected to their Identity Provider.
+      # Once they complete IdP login, they will be returned to the
+      # redirect_uri with an authorization code parameter.
       get '/authorize' do
-        @enterprise = Models::EnterpriseAccount.
-          includes(:identity_providers).
-          find_by!(domain: params[:domain])
-
         Rack::OAuth2::Server::Authorize.new do |req, _res|
           client = Models::OauthClient.find_by!(identifier: req.client_id)
-          req.verify_redirect_uri!(client.redirect_uri_values)
+          session[:osso_oauth_redirect_uri] = req.verify_redirect_uri!(client.redirect_uri_values)
+          session[:osso_oauth_state] = params[:state]
         end.call(env)
 
-        if @enterprise.single_provider?
-          session[:oauth_state] = params[:state]
-          redirect "/auth/saml/#{@enterprise.provider.id}"
-        end
+        enterprise = Models::EnterpriseAccount.
+          includes(:identity_providers).
+          find_by!(domain: params[:domain])
+
+        redirect "/auth/saml/#{enterprise.provider.id}" if enterprise.single_provider?
 
         # TODO: multiple provider support
         # erb :multiple_providers
 
       rescue Rack::OAuth2::Server::Authorize::BadRequest => e
         @error = e
-        return erb :error
+        erb :error
+      rescue ActiveRecord::RecordNotFound => e
+        @error = e
+        @error = 'No OAuth Client exists for the provided client_id' if e.model == 'Osso::Models::OauthClient'
+        @error = "No Customer exists with the domain #{params[:domain]}" if e.model == 'Osso::Models::EnterpriseAccount'
+        erb :error
       end
 
-      # Exchange an authorization code token for an access token.
-      # In addition to the token, you must include all paramaters
-      # required by Oauth spec: redirect_uri, client ID, and client secret
+      # Exchange an authorization code for an access token.
+      # In addition to the authorization code, you must include all
+      # paramaters required by OAuth spec: redirect_uri, client ID,
+      # and client secret
       post '/token' do
         Rack::OAuth2::Server::Token.new do |req, res|
           code = Models::AuthorizationCode.
@@ -49,7 +56,8 @@ module Osso
         end.call(env)
       end
 
-      # Use the access token to request a user profile
+      # Use the access token to request a profile for the user who
+      # just logged in. Access tokens are short-lived.
       get '/me' do
         json Models::AccessToken.
           includes(:user).
@@ -60,4 +68,3 @@ module Osso
     end
   end
 end
-# rubocop:enable Metrics/BlockLength