osso 0.0.3.15 → 0.0.3.20

data/lib/osso/graphql/resolvers/enterprise_account.rb

@@ -3,22 +3,12 @@
 module Osso
   module GraphQL
     module Resolvers
-      class EnterpriseAccount < ::GraphQL::Schema::Resolver
+      class EnterpriseAccount < BaseResolver
         type Types::EnterpriseAccount, null: false
 
         def resolve(args)
-          return unless admin? || enterprise_authorized?(args[:domain])
-
           Osso::Models::EnterpriseAccount.find_by(domain: args[:domain])
         end
-
-        def admin?
-          context[:scope] == :admin
-        end
-
-        def enterprise_authorized?(domain)
-          context[:scope] == domain
-        end
       end
     end
   end

data/lib/osso/graphql/resolvers/enterprise_accounts.rb

@@ -3,11 +3,11 @@
 module Osso
   module GraphQL
     module Resolvers
-      class EnterpriseAccounts < ::GraphQL::Schema::Resolver
+      class EnterpriseAccounts < BaseResolver
         type Types::EnterpriseAccount.connection_type, null: true
 
         def resolve(sort_column: nil, sort_order: nil)
-          return Array(Osso::Models::EnterpriseAccount.find_by(domain: context[:scope])) if context[:scope] != :admin
+          return Array(Osso::Models::EnterpriseAccount.find_by(domain: context_domain)) unless internal_authorized?
 
           accounts = Osso::Models::EnterpriseAccount
 

data/lib/osso/graphql/resolvers/oauth_clients.rb

@@ -3,11 +3,11 @@
 module Osso
   module GraphQL
     module Resolvers
-      class OAuthClients < ::GraphQL::Schema::Resolver
+      class OAuthClients < BaseResolver
         type [Types::OauthClient], null: true
 
         def resolve
-          return Osso::Models::OauthClient.all if context[:scope] == :admin
+          Osso::Models::OauthClient.all
         end
       end
     end

data/lib/osso/graphql/types.rb

@@ -9,6 +9,8 @@ require_relative 'types/base_connection'
 require_relative 'types/base_object'
 require_relative 'types/base_enum'
 require_relative 'types/base_input_object'
+require_relative 'types/admin_user'
+require_relative 'types/app_config'
 require_relative 'types/identity_provider_service'
 require_relative 'types/identity_provider_status'
 require_relative 'types/identity_provider'
@@ -16,4 +18,3 @@ require_relative 'types/enterprise_account'
 require_relative 'types/redirect_uri'
 require_relative 'types/redirect_uri_input'
 require_relative 'types/oauth_client'
-require_relative 'types/user'

data/lib/osso/graphql/types/admin_user.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require 'graphql'
+
+module Osso
+  module GraphQL
+    module Types
+      class AdminUser < Types::BaseObject
+        description 'An Admin User of Osso'
+
+        field :id, ID, null: false
+        field :email, String, null: false
+        field :scope, String, null: false
+        field :oauth_client_id, ID, null: true
+
+        def self.authorized?(_object, _context)
+          true
+        end
+      end
+    end
+  end
+end

data/lib/osso/graphql/types/app_config.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require 'graphql'
+
+module Osso
+  module GraphQL
+    module Types
+      class AppConfig < Types::BaseObject
+        description 'Configuration values for your application'
+
+        field :id, ID, null: false
+        field :name, String, null: true
+        field :logo_url, String, null: true
+        field :contact_email, String, null: true
+
+        def self.authorized?(_object, context)
+          admin_authorized?(context)
+        end
+      end
+    end
+  end
+end

data/lib/osso/graphql/types/base_object.rb

@@ -10,6 +10,28 @@ module Osso
 
         field :created_at, ::GraphQL::Types::ISO8601DateTime, null: false
         field :updated_at, ::GraphQL::Types::ISO8601DateTime, null: false
+
+        def self.admin_authorized?(context)
+          context[:scope] == 'admin'
+        end
+
+        def self.internal_authorized?(context)
+          %w[admin internal].include?(context[:scope])
+        end
+
+        def self.enterprise_authorized?(context, domain)
+          return false unless domain
+
+          context[:email].split('@')[1] == domain
+        end
+
+        def self.authorized?(object, context)
+          # we first receive the payload object as a hash, but can depend on the
+          # return type to hide the actual objects non-admins shouldn't see
+          return true if object.class == Hash
+
+          internal_authorized?(context) || enterprise_authorized?(context, object&.domain)
+        end
       end
     end
   end

data/lib/osso/graphql/types/enterprise_account.rb

@@ -9,7 +9,6 @@ module Osso
         description 'An Account for a company that wishes to use SAML via Osso'
         implements ::GraphQL::Types::Relay::Node
 
-        global_id_field :gid
         field :id, ID, null: false
         field :name, String, null: false
         field :domain, String, null: false
@@ -23,10 +22,6 @@ module Osso
         def identity_providers
           object.identity_providers
         end
-
-        def self.authorized?(object, context)
-          super && (context[:scope] == :admin || object.domain == context[:scope])
-        end
       end
     end
   end

data/lib/osso/graphql/types/identity_provider.rb

@@ -7,9 +7,7 @@ module Osso
     module Types
       class IdentityProvider < Types::BaseObject
         description 'Represents a SAML based IDP instance for an EnterpriseAccount'
-        implements ::GraphQL::Types::Relay::Node
 
-        global_id_field :gid
         field :id, ID, null: false
         field :enterprise_account_id, ID, null: false
         field :service, Types::IdentityProviderService, null: true
@@ -23,10 +21,6 @@ module Osso
         def documentation_pdf_url
           ENV['BASE_URL'] + '/identity_provider/documentation/' + @object.id
         end
-
-        def self.authorized?(object, context)
-          super && (context[:scope] == :admin || object.domain == context[:scope])
-        end
       end
     end
   end

data/lib/osso/graphql/types/oauth_client.rb

@@ -7,9 +7,7 @@ module Osso
     module Types
       class OauthClient < Types::BaseObject
         description 'An OAuth client used to consume Osso SAML users'
-        implements ::GraphQL::Types::Relay::Node
 
-        global_id_field :gid
         field :id, ID, null: false
         field :name, String, null: false
         field :client_id, String, null: false
@@ -24,8 +22,8 @@ module Osso
           object.secret
         end
 
-        def self.authorized?(object, context)
-          super && context[:scope] == :admin
+        def self.authorized?(_object, context)
+          admin_authorized?(context)
         end
       end
     end

data/lib/osso/graphql/types/redirect_uri.rb

@@ -7,15 +7,13 @@ module Osso
     module Types
       class RedirectUri < Types::BaseObject
         description 'An allowed redirect URI for an OauthClient'
-        implements ::GraphQL::Types::Relay::Node
 
-        global_id_field :gid
         field :id, ID, null: false
         field :uri, String, null: false
         field :primary, Boolean, null: false
 
-        def self.authorized?(object, context)
-          super && context[:scope] == :admin
+        def self.authorized?(_object, context)
+          context[:scope] == 'admin'
         end
       end
     end

data/lib/osso/helpers/auth.rb

@@ -3,10 +3,21 @@
 module Osso
   module Helpers
     module Auth
-      attr_accessor :current_scope
+      END_USER_SCOPE = 'end-user'
+      INTERNAL_SCOPE = 'internal'
+      ADMIN_SCOPE    = 'admin'
+
+      attr_accessor :current_user
+
+      def token_protected!
+        decode(token)
+      rescue JWT::DecodeError
+        halt 401
+      end
 
       def enterprise_protected!(domain = nil)
         return if admin_authorized?
+        return if internal_authorized?
         return if enterprise_authorized?(domain)
 
         halt 401 if request.post?
@@ -14,33 +25,42 @@ module Osso
         redirect ENV['JWT_URL']
       end
 
-      # use client id in payload to restrict customer
-      # users from accessing dev?
-      def enterprise_authorized?(_domain)
-        payload, _args = decode(token)
-
-        @current_scope = payload['scope']
+      def internal_protected!
+        return if admin_authorized?
+        return if internal_authorized?
 
-        true
-      rescue JWT::DecodeError
-        false
+        redirect ENV['JWT_URL']
       end
 
       def admin_protected!
-        return if admin_authorized?
+        return true if admin_authorized?
 
         redirect ENV['JWT_URL']
       end
 
-      def admin_authorized?
-        payload, _args = decode(token)
+      private
 
-        if payload['scope'] == 'admin'
-          @current_scope = :admin
-          return true
-        end
+      def enterprise_authorized?(domain)
+        decode(token)
 
+        @current_user[:scope] == END_USER_SCOPE &&
+          @current_user[:email].split('@')[1] == domain
+      rescue JWT::DecodeError
         false
+      end
+
+      def internal_authorized?
+        decode(token)
+
+        @current_user[:scope] == INTERNAL_SCOPE
+      rescue JWT::DecodeError
+        false
+      end
+
+      def admin_authorized?
+        decode(token)
+
+        @current_user[:scope] == ADMIN_SCOPE
       rescue JWT::DecodeError
         false
       end
@@ -60,12 +80,14 @@ module Osso
       end
 
       def decode(token)
-        JWT.decode(
+        payload, _args = JWT.decode(
           token,
           ENV['JWT_HMAC_SECRET'],
           true,
           { algorithm: 'HS256' },
         )
+
+        @current_user = payload.symbolize_keys
       end
     end
   end

data/lib/osso/lib/route_map.rb

@@ -11,12 +11,12 @@ module Osso
         use Osso::Oauth
 
         post '/graphql' do
-          enterprise_protected!
+          token_protected!
 
           result = Osso::GraphQL::Schema.execute(
             params[:query],
             variables: params[:variables],
-            context: { scope: current_scope },
+            context: current_user.symbolize_keys,
           )
 
           json result

data/lib/osso/models/app_config.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module Osso
+  module Models
+    class AppConfig < ::ActiveRecord::Base
+      validate :limit_to_one, on: :create
+
+      def self.find
+        first
+      end
+
+      private
+
+      def limit_to_one
+        return if Osso::Models::AppConfig.count.zero?
+
+        errors[:base] << 'AppConfig already exists'
+      end
+    end
+  end
+end
+
+# == Schema Information
+#
+# Table name: app_configs
+#
+#  id            :uuid             not null, primary key
+#  contact_email :string
+#  logo_url      :string
+#  name          :string
+#  created_at    :datetime         not null
+#  updated_at    :datetime         not null
+#

data/lib/osso/models/models.rb

@@ -10,6 +10,7 @@ module Osso
 end
 
 require_relative 'access_token'
+require_relative 'app_config'
 require_relative 'authorization_code'
 require_relative 'enterprise_account'
 require_relative 'oauth_client'

data/lib/osso/models/oauth_client.rb

@@ -5,6 +5,7 @@ module Osso
   module Models
     class OauthClient < ActiveRecord::Base
       has_many :access_tokens
+      has_many :enterprise_accounts
       has_many :refresh_tokens
       has_many :identity_providers
       has_many :redirect_uris
@@ -22,8 +23,8 @@ module Osso
       end
 
       def generate_secrets
-        self.identifier = SecureRandom.hex(16)
-        self.secret = SecureRandom.hex(32)
+        self.identifier ||= SecureRandom.hex(16)
+        self.secret ||= SecureRandom.hex(32)
       end
     end
   end

data/lib/osso/models/redirect_uri.rb

@@ -4,17 +4,6 @@ module Osso
   module Models
     class RedirectUri < ActiveRecord::Base
       belongs_to :oauth_client
-
-      # TODO
-      # before_validation :set_primary, on: :creaet, :update
-
-      private
-
-      def set_primary
-        if primary_was.true? && primary.false?
-
-        end
-      end
     end
   end
 end

data/lib/osso/routes/admin.rb

@@ -13,14 +13,20 @@ module Osso
     end
 
     namespace '/admin' do
+      get '/login' do
+        token_protected!
+
+        erb :admin
+      end
+
       get '' do
-        admin_protected!
+        internal_protected!
 
         erb :admin
       end
 
       get '/enterprise' do
-        admin_protected!
+        token_protected!
 
         erb :admin
       end

data/lib/osso/routes/auth.rb

@@ -14,10 +14,6 @@ module Osso
       /[0-9a-f]{8}-[0-9a-f]{3,4}-[0-9a-f]{4}-[0-9a-f]{3,4}-[0-9a-f]{12}/.
         freeze
 
-    def self.internal_redirect?(env)
-      env['HTTP_REFERER']&.match(env['SERVER_NAME'])
-    end
-
     use OmniAuth::Builder do
       OmniAuth::MultiProvider.register(
         self,
@@ -26,21 +22,24 @@ module Osso
         path_prefix: '/auth/saml',
         callback_suffix: 'callback',
       ) do |identity_provider_id, _env|
-        provider = Models::IdentityProvider.find(identity_provider_id)
-        provider.saml_options
+        Models::IdentityProvider.find(identity_provider_id).
+          saml_options
       end
     end
 
-    namespace '/auth' do
+    namespace '/auth' do # rubocop:disable Metrics/BlockLength
+      get '/failure' do
+        @error = params[:message]
+        erb :error
+      end
       # Enterprise users are sent here after authenticating against
       # their Identity Provider. We find or create a user record,
       # and then create an authorization code for that user. The user
       # is redirected back to your application with this code
-      # as a URL query param, which you then exhange for an access token
+      # as a URL query param, which you then exchange for an access token.
       post '/saml/:id/callback' do
         provider = Models::IdentityProvider.find(params[:id])
-        oauth_client = provider.oauth_client
-        redirect_uri = env['redirect_uri'] || oauth_client.primary_redirect_uri.uri
+        @oauth_client = provider.oauth_client
 
         attributes = env['omniauth.auth']&.
           extra&.
@@ -56,11 +55,29 @@ module Osso
         end
 
         authorization_code = user.authorization_codes.create!(
-          oauth_client: oauth_client,
+          oauth_client: @oauth_client,
           redirect_uri: redirect_uri,
         )
 
-        redirect(redirect_uri + "?code=#{CGI.escape(authorization_code.token)}&state=#{session[:oauth_state]}")
+        # Mark IDP as active
+
+        redirect(redirect_uri + "?code=#{CGI.escape(authorization_code.token)}&state=#{provider_state}")
+      end
+
+      def redirect_uri
+        return @oauth_client.primary_redirect_uri.uri if valid_idp_initiated_flow
+
+        session[:osso_oauth_redirect_uri]
+      end
+
+      def provider_state
+        return @provider_state = 'IDP_INITIATED' if valid_idp_initiated_flow
+
+        session.delete(:osso_oauth_state)
+      end
+
+      def valid_idp_initiated_flow
+        !session[:osso_oauth_redirect_uri] && !session[:osso_oauth_state]
       end
     end
   end