osso 0.0.3.12 → 0.0.3.17

data/lib/osso/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Osso
-  VERSION = '0.0.3.12'
+  VERSION = '0.0.3.17'
 end

data/spec/graphql/mutations/configure_identity_provider_spec.rb

@@ -39,12 +39,15 @@ describe Osso::GraphQL::Schema do
       described_class.execute(
         mutation,
         variables: variables,
-        context: { scope: current_scope },
+        context: current_context,
       )
     end
 
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        { scope: 'admin' }
+      end
+
       it 'configures an identity provider' do
         expect(subject.dig('data', 'configureIdentityProvider', 'identityProvider', 'status')).
           to eq('Configured')
@@ -53,7 +56,12 @@ describe Osso::GraphQL::Schema do
 
     describe 'for an email scoped user' do
       let(:domain) { Faker::Internet.domain_name }
-      let(:current_scope) { domain }
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: "user@#{domain}",
+        }
+      end
       let(:enterprise_account) { create(:enterprise_account, domain: domain) }
       let(:identity_provider) { create(:identity_provider, enterprise_account: enterprise_account, domain: domain) }
 
@@ -65,7 +73,12 @@ describe Osso::GraphQL::Schema do
 
     describe 'for the wrong email scoped user' do
       let(:domain) { Faker::Internet.domain_name }
-      let(:current_scope) { domain }
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: "user@#{domain}",
+        }
+      end
 
       it 'does not configure an identity provider' do
         expect(subject.dig('errors')).to_not be_empty

data/spec/graphql/mutations/create_enterprise_account_spec.rb

@@ -33,12 +33,14 @@ describe Osso::GraphQL::Schema do
       described_class.execute(
         mutation,
         variables: variables,
-        context: { scope: current_scope },
+        context: current_context,
       )
     end
 
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        { scope: 'admin' }
+      end
       it 'creates an Enterprise Account' do
         expect { subject }.to change { Osso::Models::EnterpriseAccount.count }.by(1)
         expect(subject.dig('data', 'createEnterpriseAccount', 'enterpriseAccount', 'domain')).
@@ -47,7 +49,12 @@ describe Osso::GraphQL::Schema do
     end
 
     describe 'for an email scoped user' do
-      let(:current_scope) { domain }
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: "user@#{domain}",
+        }
+      end
 
       it 'creates an Enterprise Account' do
         expect { subject }.to change { Osso::Models::EnterpriseAccount.count }.by(1)
@@ -56,7 +63,9 @@ describe Osso::GraphQL::Schema do
       end
     end
     describe 'for the wrong email scoped user' do
-      let(:current_scope) { 'foo.com' }
+      let(:current_context) do
+        { scope: 'end-user', email: 'user@foo.com' }
+      end
 
       it 'does not create an Enterprise Account' do
         expect { subject }.to_not(change { Osso::Models::EnterpriseAccount.count })

data/spec/graphql/mutations/create_identity_provider_spec.rb

@@ -25,12 +25,14 @@ describe Osso::GraphQL::Schema do
       described_class.execute(
         mutation,
         variables: variables,
-        context: { scope: current_scope },
+        context: current_context,
       )
     end
 
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        { scope: 'admin' }
+      end
       describe 'without a service' do
         let(:variables) { { input: { enterpriseAccountId: enterprise_account.id } } }
 
@@ -54,7 +56,12 @@ describe Osso::GraphQL::Schema do
 
     describe 'for an email scoped user' do
       let(:domain) { Faker::Internet.domain_name }
-      let(:current_scope) { domain }
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: "user@#{domain}",
+        }
+      end
       let(:enterprise_account) { create(:enterprise_account, domain: domain) }
 
       describe 'without a service' do
@@ -80,12 +87,17 @@ describe Osso::GraphQL::Schema do
 
     describe 'for a wrong email scoped user' do
       let(:domain) { Faker::Internet.domain_name }
-      let(:current_scope) { domain }
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: "user@#{domain}",
+        }
+      end
       let(:enterprise_account) { create(:enterprise_account, domain: domain) }
       let(:target_account) { create(:enterprise_account) }
 
       describe 'without a service' do
-        let(:variables) { { input: { enterpriseAccountId: target_account.id } } }
+        let(:variables) { { input: { enterpriseAccountId: target_account.id, domain: domain } } }
 
         it 'does not creates a identity provider' do
           expect { subject }.to_not(change { Osso::Models::IdentityProvider.count })
@@ -93,7 +105,7 @@ describe Osso::GraphQL::Schema do
       end
 
       describe 'with a service' do
-        let(:variables) { { input: { enterpriseAccountId: target_account.id, service: 'OKTA' } } }
+        let(:variables) { { input: { enterpriseAccountId: target_account.id, service: 'OKTA', domain: domain } } }
 
         it 'does not creates a identity provider' do
           expect { subject }.to_not(change { Osso::Models::IdentityProvider.count })

data/spec/graphql/mutations/create_oauth_client_spec.rb

@@ -31,12 +31,14 @@ describe Osso::GraphQL::Schema do
       described_class.execute(
         mutation,
         variables: variables,
-        context: { scope: current_scope },
+        context: current_context,
       )
     end
 
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        { scope: 'admin' }
+      end
       it 'creates an OauthClient' do
         expect { subject }.to change { Osso::Models::OauthClient.count }.by(1)
         expect(subject.dig('data', 'createOauthClient', 'oauthClient', 'clientId')).
@@ -45,7 +47,12 @@ describe Osso::GraphQL::Schema do
     end
 
     describe 'for an email scoped user' do
-      let(:current_scope) { 'foo.com' }
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: 'user@foo.com',
+        }
+      end
 
       it 'does not create an OauthClient Account' do
         expect { subject }.to_not(change { Osso::Models::OauthClient.count })

data/spec/graphql/mutations/delete_enterprise_account_spec.rb

@@ -30,12 +30,15 @@ describe Osso::GraphQL::Schema do
       described_class.execute(
         mutation,
         variables: variables,
-        context: { scope: current_scope },
+        context: current_context,
       )
     end
 
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        { scope: 'admin' }
+      end
+
       it 'deletes an Enterprise Account' do
         expect { subject }.to change { Osso::Models::EnterpriseAccount.count }.by(-1)
         expect(subject.dig('data', 'createEnterpriseAccount', 'enterpriseAccount')).
@@ -44,7 +47,12 @@ describe Osso::GraphQL::Schema do
     end
 
     describe 'for an email scoped user' do
-      let(:current_scope) { domain }
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: "user@#{domain}",
+        }
+      end
 
       it 'deletes the Enterprise Account' do
         expect { subject }.to change { Osso::Models::EnterpriseAccount.count }.by(-1)
@@ -52,8 +60,14 @@ describe Osso::GraphQL::Schema do
           to be_nil
       end
     end
+
     describe 'for the wrong email scoped user' do
-      let(:current_scope) { 'foo.com' }
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: 'user@foo.com',
+        }
+      end
 
       it 'does not delete the Enterprise Account' do
         expect { subject }.to_not(change { Osso::Models::EnterpriseAccount.count })

data/spec/graphql/mutations/delete_oauth_client_spec.rb

@@ -29,21 +29,25 @@ describe Osso::GraphQL::Schema do
       described_class.execute(
         mutation,
         variables: variables,
-        context: { scope: current_scope },
+        context: current_context,
       )
     end
 
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        { scope: 'admin' }
+      end
       it 'deletes the OauthClient' do
         expect { subject }.to change { Osso::Models::OauthClient.count }.by(-1)
       end
     end
 
     describe 'for an email scoped user' do
-      let(:current_scope) { 'foo.com' }
+      let(:current_context) do
+        { scope: 'end-user', email: 'user@foo.com' }
+      end
 
-      it 'does not create an OauthClient Account' do
+      it 'does not deletes the OauthClient' do
         expect { subject }.to_not(change { Osso::Models::OauthClient.count })
       end
     end

data/spec/graphql/query/enterprise_account_spec.rb

@@ -37,12 +37,17 @@ describe Osso::GraphQL::Schema do
       described_class.execute(
         query,
         variables: variables,
-        context: { scope: current_scope },
+        context: current_context,
       )
     end
 
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        {
+          scope: 'admin',
+        }
+      end
+
       it 'returns Enterprise Account for domain' do
         expect(subject['errors']).to be_nil
         expect(subject.dig('data', 'enterpriseAccount', 'domain')).to eq(domain)
@@ -50,7 +55,12 @@ describe Osso::GraphQL::Schema do
     end
 
     describe 'for an email scoped user' do
-      let(:current_scope) { domain }
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: "user@#{domain}",
+        }
+      end
       it 'returns Enterprise Account for domain' do
         expect(subject['errors']).to be_nil
         expect(subject.dig('data', 'enterpriseAccount', 'domain')).to eq(domain)
@@ -58,9 +68,14 @@ describe Osso::GraphQL::Schema do
     end
 
     describe 'for the wrong email scoped user' do
-      let(:current_scope) { 'bar.com' }
-      it 'returns Enterprise Account for domain' do
-        expect(subject['errors']).to be_nil
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: 'foo@bar.com',
+        }
+      end
+      it 'does not return Enterprise Account for domain' do
+        expect(subject['errors']).to_not be_nil
         expect(subject.dig('data', 'enterpriseAccount')).to be_nil
       end
     end

data/spec/graphql/query/enterprise_accounts_spec.rb

@@ -5,7 +5,9 @@ require 'spec_helper'
 describe Osso::GraphQL::Schema do
   describe 'EnterpriseAccounts' do
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        { scope: 'admin' }
+      end
 
       it 'returns paginated Enterprise Accounts' do
         %w[A B C].map do |name|
@@ -44,7 +46,7 @@ describe Osso::GraphQL::Schema do
         response = described_class.execute(
           query,
           variables: { first: 2, sortOrder: 'descending', sortColumn: 'name' },
-          context: { scope: current_scope },
+          context: current_context,
         )
 
         expect(response['errors']).to be_nil

data/spec/graphql/query/identity_provider_spec.rb

@@ -32,12 +32,14 @@ describe Osso::GraphQL::Schema do
       described_class.execute(
         query,
         variables: variables,
-        context: { scope: current_scope },
+        context: current_context,
       )
     end
 
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        { scope: 'admin' }
+      end
       it 'returns Identity Provider for id' do
         expect(subject['errors']).to be_nil
         expect(subject.dig('data', 'identityProvider', 'id')).to eq(id)
@@ -45,8 +47,12 @@ describe Osso::GraphQL::Schema do
     end
 
     describe 'for an email scoped user' do
-      let(:current_scope) { domain }
-
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: "user@#{domain}",
+        }
+      end
       it 'returns Enterprise Account for domain' do
         expect(subject['errors']).to be_nil
         expect(subject.dig('data', 'identityProvider', 'domain')).to eq(domain)
@@ -54,8 +60,12 @@ describe Osso::GraphQL::Schema do
     end
 
     describe 'for the wrong email scoped user' do
-      let(:current_scope) { 'bar.com' }
-
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: 'user@bar.com',
+        }
+      end
       it 'returns Enterprise Account for domain' do
         expect(subject['errors']).to_not be_empty
         expect(subject.dig('data', 'enterpriseAccount')).to be_nil

data/spec/graphql/query/oauth_clients_spec.rb

@@ -25,12 +25,14 @@ describe Osso::GraphQL::Schema do
       described_class.execute(
         query,
         variables: nil,
-        context: { scope: current_scope },
+        context: current_context,
       )
     end
 
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        { scope: 'admin' }
+      end
 
       it 'returns Oauth Clients' do
         expect(subject['errors']).to be_nil
@@ -38,11 +40,12 @@ describe Osso::GraphQL::Schema do
       end
     end
 
-    describe 'for an email scoped user' do
-      let(:current_scope) { 'foo.com' }
-
-      it 'returns Oauth Clients' do
-        expect(subject['errors']).to be_nil
+    describe 'for an internal scoped user' do
+      let(:current_context) do
+        { scope: 'internal' }
+      end
+      it 'does not return Oauth Clients' do
+        expect(subject['errors']).to_not be_nil
         expect(subject.dig('data', 'oauthClients')).to be_nil
       end
     end

data/spec/models/identity_provider_spec.rb

@@ -14,4 +14,16 @@ describe Osso::Models::IdentityProvider do
       )
     end
   end
+
+  describe '#saml_options' do
+    it 'returns the required args' do
+      expect(subject.saml_options).
+        to match(
+          domain: subject.domain,
+          idp_cert: subject.sso_cert,
+          idp_sso_target_url: subject.sso_url,
+          issuer: subject.domain,
+        )
+    end
+  end
 end

data/spec/routes/auth_spec.rb

@@ -63,6 +63,24 @@ describe Osso::Auth do
             )
           end.to change { Osso::Models::AuthorizationCode.count }.by(1)
         end
+
+        describe 'for an IDP initiated login' do
+          it 'redirects with a default state' do
+            mock_saml_omniauth
+
+            post(
+              "/auth/saml/#{okta_provider.id}/callback",
+              nil,
+              {
+                'omniauth.auth' => OmniAuth.config.mock_auth[:saml],
+                'identity_provider' => okta_provider,
+              },
+            )
+            expect(last_response).to be_redirect
+            follow_redirect!
+            expect(last_request.url).to match(/.*state=IDP_INITIATED$/)
+          end
+        end
       end
 
       describe 'on subsequent authentications' do