osso 0.0.3.16 → 0.0.3.17

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6e33fd333f7c329404b9a9bdeb62551629b38a8b615b6aef556bc4b4c0ca2a03
-  data.tar.gz: e8c21ea78f2f33e5b6497c85148ff67221949ded6c34380dcb48a6eb450d6dc6
+  metadata.gz: b28fb9c155136c0d23356543f5d9ae0b15e551293bf18c4fbd44bd3340e6602e
+  data.tar.gz: f5c7495d581f4c27706a3fdeca7618707487308d6bc73d0f2372d4cf8fb1957d
 SHA512:
-  metadata.gz: 76779ec670e1a6c12589a3b2a1f319e8855ba8770a83489787d56c43bb8a23aa9a75ee9b9864dfce76f54061e3829ce639214ba5f5a4c7c8efc699e1776801a6
-  data.tar.gz: 356194bce279f215d58ea36e0e7e188c4ee134a4a4b55ce435fdee255caf23c39974f0b87a305e332a84b7aaf519db6ee13525beecd47117b9f9ebbd765679e3
+  metadata.gz: 67543b72337e89ebc7b7c2f80c42df2d8aa4f0c7001959022858f68e72fda5f409627260b614ba2fb1c1afbe51ecdded8449d84137cb2c85eff16225f9e7c387
+  data.tar.gz: 69fdf0abd7db72588068ec909c84bf95a19e7b93ace562ce86f24e278dc5b54cbb8c1b49f77a18d8f161542931610a9b9cd1e70cf9b0edb41b6397f49a7b4bbb

data/.rubocop.yml

@@ -1,4 +1,5 @@
 AllCops:
+  TargetRubyVersion: 2.6.0
   Exclude:
     - db/**/*
     - lib/osso/db/**/*

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    osso (0.0.3.16)
+    osso (0.0.3.17)
       activesupport (>= 6.0.3.2)
       graphql
       jwt

data/lib/osso/graphql/mutation.rb

@@ -14,6 +14,12 @@ module Osso
         field :delete_oauth_client, mutation: Mutations::DeleteOauthClient
         field :set_redirect_uris, mutation: Mutations::SetRedirectUris
         field :regenerate_oauth_credentials, mutation: Mutations::RegenerateOauthCredentials
+
+        def self.authorized?(_object, _context)
+          # mutations are prevented from executing with ready? so
+          # its a bit odd that this hides it
+          true
+        end
       end
     end
   end

data/lib/osso/graphql/mutations/base_mutation.rb

@@ -15,13 +15,26 @@ module Osso
           error.merge(data: nil)
         end
 
-        def ready?(enterprise_account_id: nil, domain: nil, identity_provider_id: nil, **args)
-          return true if context[:scope] == :admin
+        def ready?(**args)
+          return true if internal_ready?
 
-          domain ||= account_domain(enterprise_account_id) || provider_domain(identity_provider_id)
-          return true if domain == context[:scope]
+          return true if domain_ready?(args[:domain] || domain(**args))
 
-          raise ::GraphQL::ExecutionError, "This user lacks the scope to mutate records belonging to #{args[:domain]}"
+          raise ::GraphQL::ExecutionError, 'This user lacks the permission to make the requested changes'
+        end
+
+        def admin_ready?
+          context[:scope] == 'admin'
+        end
+
+        def internal_ready?
+          return true if admin_ready?
+
+          context[:scope] == 'internal'
+        end
+
+        def domain_ready?(domain)
+          context[:email].split('@')[1] == domain
         end
 
         def account_domain(id)

data/lib/osso/graphql/mutations/configure_identity_provider.rb

@@ -13,22 +13,20 @@ module Osso
         field :identity_provider, Types::IdentityProvider, null: false
         field :errors, [String], null: false
 
-        def resolve(id:, **args)
-          provider = Osso::Models::IdentityProvider.find(id)
+        def resolve(**args)
+          provider = identity_provider(**args)
 
           return response_data(identity_provider: provider) if provider.update(args)
 
-          response_error(errors: provder.errors.messages)
+          response_error(errors: provider.errors.messages)
         end
 
-        def ready?(id:, **_args)
-          return true if context[:scope] == :admin
-
-          domain = Osso::Models::IdentityProvider.find(id)&.domain
-
-          return true if domain == context[:scope]
+        def domain(**args)
+          identity_provider(**args)&.domain
+        end
 
-          raise ::GraphQL::ExecutionError, "This user lacks the scope to mutate records belonging to #{domain}"
+        def identity_provider(id:, **_args)
+          @identity_provider ||= Osso::Models::IdentityProvider.find(id)
         end
       end
     end

data/lib/osso/graphql/mutations/create_enterprise_account.rb

@@ -8,12 +8,14 @@ module Osso
 
         argument :domain, String, required: true
         argument :name, String, required: true
+        argument :oauth_client_id, ID, required: false
 
         field :enterprise_account, Types::EnterpriseAccount, null: false
         field :errors, [String], null: false
 
         def resolve(**args)
           enterprise_account = Osso::Models::EnterpriseAccount.new(args)
+          enterprise_account.oauth_client_id ||= context[:oauth_client_id]
 
           return response_data(enterprise_account: enterprise_account) if enterprise_account.save
 

data/lib/osso/graphql/mutations/create_identity_provider.rb

@@ -12,18 +12,27 @@ module Osso
         field :identity_provider, Types::IdentityProvider, null: false
         field :errors, [String], null: false
 
-        def resolve(enterprise_account_id:, service: nil)
-          enterprise_account = Osso::Models::EnterpriseAccount.find(enterprise_account_id)
-          identity_provider = enterprise_account.identity_providers.build(
-            enterprise_account_id: enterprise_account_id,
+        def resolve(service: nil, **args)
+          customer = enterprise_account(**args)
+
+          identity_provider = customer.identity_providers.build(
             service: service,
-            domain: enterprise_account.domain,
+            domain: customer.domain,
+            oauth_client_id: customer.oauth_client_id,
           )
 
           return response_data(identity_provider: identity_provider) if identity_provider.save
 
           response_error(errors: identity_provider.errors.full_messages)
         end
+
+        def domain(**args)
+          enterprise_account(**args)&.domain
+        end
+
+        def enterprise_account(enterprise_account_id:, **_args)
+          @enterprise_account ||= Osso::Models::EnterpriseAccount.find(enterprise_account_id)
+        end
       end
     end
   end

data/lib/osso/graphql/mutations/create_oauth_client.rb

@@ -20,9 +20,7 @@ module Osso
         end
 
         def ready?(*)
-          return true if context[:scope] == :admin
-
-          raise ::GraphQL::ExecutionError, 'Only admin users may mutate OauthClients'
+          admin_ready?
         end
       end
     end

data/lib/osso/graphql/mutations/delete_enterprise_account.rb

@@ -11,22 +11,20 @@ module Osso
         field :enterprise_account, Types::EnterpriseAccount, null: true
         field :errors, [String], null: false
 
-        def resolve(id:)
-          enterprise_account = Osso::Models::EnterpriseAccount.find(id)
-
-          return response_data(enterprise_account: nil) if enterprise_account.destroy
-
-          response_error(errors: enterprise_account.errors.full_messages)
+        def enterprise_account(id:, **_args)
+          @enterprise_account ||= Osso::Models::EnterpriseAccount.find(id)
         end
 
-        def ready?(id:)
-          return true if context[:scope] == :admin
+        def resolve(**args)
+          customer = enterprise_account(**args)
 
-          domain = account_domain(id)
+          return response_data(enterprise_account: nil) if customer.destroy
 
-          return true if domain == context[:scope]
+          response_error(errors: customer.errors.full_messages)
+        end
 
-          raise ::GraphQL::ExecutionError, "This user lacks the scope to mutate records belonging to #{domain}"
+        def domain(**args)
+          enterprise_account(**args).domain
         end
       end
     end

data/lib/osso/graphql/mutations/delete_oauth_client.rb

@@ -20,9 +20,7 @@ module Osso
         end
 
         def ready?(*)
-          return true if context[:scope] == :admin
-
-          raise ::GraphQL::ExecutionError, 'Only admin users may mutate OauthClients'
+          admin_ready?
         end
       end
     end

data/lib/osso/graphql/mutations/regenerate_oauth_credentials.rb

@@ -21,9 +21,7 @@ module Osso
         end
 
         def ready?(*)
-          return true if context[:scope] == :admin
-
-          raise ::GraphQL::ExecutionError, 'Only admin users may mutate OauthClients'
+          admin_ready?
         end
       end
     end

data/lib/osso/graphql/mutations/set_redirect_uris.rb

@@ -24,9 +24,7 @@ module Osso
         end
 
         def ready?(*)
-          return true if context[:scope] == :admin
-
-          raise ::GraphQL::ExecutionError, 'Only admin users may mutate OauthClients'
+          admin_ready?
         end
 
         def update_existing(oauth_client, redirect_uris)

data/lib/osso/graphql/query.rb

@@ -32,6 +32,13 @@ module Osso
         ) do
           argument :id, ID, required: true
         end
+
+        field(
+          :current_user,
+          Types::AdminUser,
+          null: false,
+          resolve: ->(_obj, _args, context) { context.to_h },
+        )
       end
     end
   end

data/lib/osso/graphql/resolvers.rb

@@ -7,6 +7,7 @@ module Osso
   end
 end
 
+require_relative 'resolvers/base_resolver'
 require_relative 'resolvers/enterprise_account'
 require_relative 'resolvers/enterprise_accounts'
 require_relative 'resolvers/oauth_clients'

data/lib/osso/graphql/resolvers/base_resolver.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Osso
+  module GraphQL
+    module Resolvers
+      class BaseResolver < ::GraphQL::Schema::Resolver
+        def admin_authorized?
+          context[:scope] == 'admin'
+        end
+
+        def internal_authorized?
+          %w[admin internal].include?(context[:scope])
+        end
+
+        def enterprise_authorized?(domain)
+          context[:scope] == domain
+        end
+      end
+    end
+  end
+end

data/lib/osso/graphql/resolvers/enterprise_account.rb

@@ -3,22 +3,12 @@
 module Osso
   module GraphQL
     module Resolvers
-      class EnterpriseAccount < ::GraphQL::Schema::Resolver
+      class EnterpriseAccount < BaseResolver
         type Types::EnterpriseAccount, null: false
 
         def resolve(args)
-          return unless admin? || enterprise_authorized?(args[:domain])
-
           Osso::Models::EnterpriseAccount.find_by(domain: args[:domain])
         end
-
-        def admin?
-          context[:scope] == :admin
-        end
-
-        def enterprise_authorized?(domain)
-          context[:scope] == domain
-        end
       end
     end
   end

data/lib/osso/graphql/resolvers/enterprise_accounts.rb

@@ -3,11 +3,11 @@
 module Osso
   module GraphQL
     module Resolvers
-      class EnterpriseAccounts < ::GraphQL::Schema::Resolver
+      class EnterpriseAccounts < BaseResolver
         type Types::EnterpriseAccount.connection_type, null: true
 
         def resolve(sort_column: nil, sort_order: nil)
-          return Array(Osso::Models::EnterpriseAccount.find_by(domain: context[:scope])) if context[:scope] != :admin
+          return Array(Osso::Models::EnterpriseAccount.find_by(domain: context[:scope])) unless internal_authorized?
 
           accounts = Osso::Models::EnterpriseAccount
 

data/lib/osso/graphql/resolvers/oauth_clients.rb

@@ -3,11 +3,11 @@
 module Osso
   module GraphQL
     module Resolvers
-      class OAuthClients < ::GraphQL::Schema::Resolver
+      class OAuthClients < BaseResolver
         type [Types::OauthClient], null: true
 
         def resolve
-          return Osso::Models::OauthClient.all if context[:scope] == :admin
+          Osso::Models::OauthClient.all
         end
       end
     end

data/lib/osso/graphql/types.rb

@@ -9,6 +9,7 @@ require_relative 'types/base_connection'
 require_relative 'types/base_object'
 require_relative 'types/base_enum'
 require_relative 'types/base_input_object'
+require_relative 'types/admin_user'
 require_relative 'types/identity_provider_service'
 require_relative 'types/identity_provider_status'
 require_relative 'types/identity_provider'
@@ -16,4 +17,3 @@ require_relative 'types/enterprise_account'
 require_relative 'types/redirect_uri'
 require_relative 'types/redirect_uri_input'
 require_relative 'types/oauth_client'
-require_relative 'types/user'

data/lib/osso/graphql/types/admin_user.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require 'graphql'
+
+module Osso
+  module GraphQL
+    module Types
+      class AdminUser < Types::BaseObject
+        description 'An Admin User of Osso'
+
+        field :id, ID, null: false
+        field :email, String, null: false
+        field :scope, String, null: false
+        field :oauth_client_id, ID, null: true
+
+        def self.authorized?(_object, _context)
+          true
+        end
+      end
+    end
+  end
+end

data/lib/osso/graphql/types/base_object.rb

@@ -10,6 +10,28 @@ module Osso
 
         field :created_at, ::GraphQL::Types::ISO8601DateTime, null: false
         field :updated_at, ::GraphQL::Types::ISO8601DateTime, null: false
+
+        def self.admin_authorized?(context)
+          context[:scope] == 'admin'
+        end
+
+        def self.internal_authorized?(context)
+          %w[admin internal].include?(context[:scope])
+        end
+
+        def self.enterprise_authorized?(context, domain)
+          return false unless domain
+
+          context[:email].split('@')[1] == domain
+        end
+
+        def self.authorized?(object, context)
+          # we first receive the payload object as a hash, but can depend on the
+          # return type to hide the actual objects non-admins shouldn't see
+          return true if object.class == Hash
+
+          internal_authorized?(context) || enterprise_authorized?(context, object&.domain)
+        end
       end
     end
   end

data/lib/osso/graphql/types/enterprise_account.rb

@@ -9,7 +9,6 @@ module Osso
         description 'An Account for a company that wishes to use SAML via Osso'
         implements ::GraphQL::Types::Relay::Node
 
-        global_id_field :gid
         field :id, ID, null: false
         field :name, String, null: false
         field :domain, String, null: false
@@ -23,10 +22,6 @@ module Osso
         def identity_providers
           object.identity_providers
         end
-
-        def self.authorized?(object, context)
-          super && (context[:scope] == :admin || object.domain == context[:scope])
-        end
       end
     end
   end

data/lib/osso/graphql/types/identity_provider.rb

@@ -7,9 +7,7 @@ module Osso
     module Types
       class IdentityProvider < Types::BaseObject
         description 'Represents a SAML based IDP instance for an EnterpriseAccount'
-        implements ::GraphQL::Types::Relay::Node
 
-        global_id_field :gid
         field :id, ID, null: false
         field :enterprise_account_id, ID, null: false
         field :service, Types::IdentityProviderService, null: true
@@ -23,10 +21,6 @@ module Osso
         def documentation_pdf_url
           ENV['BASE_URL'] + '/identity_provider/documentation/' + @object.id
         end
-
-        def self.authorized?(object, context)
-          super && (context[:scope] == :admin || object.domain == context[:scope])
-        end
       end
     end
   end

data/lib/osso/graphql/types/oauth_client.rb

@@ -7,9 +7,7 @@ module Osso
     module Types
       class OauthClient < Types::BaseObject
         description 'An OAuth client used to consume Osso SAML users'
-        implements ::GraphQL::Types::Relay::Node
 
-        global_id_field :gid
         field :id, ID, null: false
         field :name, String, null: false
         field :client_id, String, null: false
@@ -24,8 +22,8 @@ module Osso
           object.secret
         end
 
-        def self.authorized?(object, context)
-          super && context[:scope] == :admin
+        def self.authorized?(_object, context)
+          admin_authorized?(context)
         end
       end
     end

data/lib/osso/graphql/types/redirect_uri.rb

@@ -7,15 +7,13 @@ module Osso
     module Types
       class RedirectUri < Types::BaseObject
         description 'An allowed redirect URI for an OauthClient'
-        implements ::GraphQL::Types::Relay::Node
 
-        global_id_field :gid
         field :id, ID, null: false
         field :uri, String, null: false
         field :primary, Boolean, null: false
 
-        def self.authorized?(object, context)
-          super && context[:scope] == :admin
+        def self.authorized?(_object, context)
+          context[:scope] == 'admin'
         end
       end
     end

data/lib/osso/helpers/auth.rb

@@ -1,12 +1,22 @@
 # frozen_string_literal: true
 
+require 'pry'
 module Osso
   module Helpers
     module Auth
-      attr_accessor :current_scope
+      END_USER_SCOPE = 'end-user'
+      INTERNAL_SCOPE = 'internal'
+      ADMIN_SCOPE    = 'admin'
+
+      attr_accessor :current_user
+
+      def token_protected!
+        decode(token)
+      end
 
       def enterprise_protected!(domain = nil)
         return if admin_authorized?
+        return if internal_authorized?
         return if enterprise_authorized?(domain)
 
         halt 401 if request.post?
@@ -14,14 +24,26 @@ module Osso
         redirect ENV['JWT_URL']
       end
 
-      # use client id in payload to restrict customer
-      # users from accessing dev?
-      def enterprise_authorized?(_domain)
-        payload, _args = decode(token)
+      def enterprise_authorized?(domain)
+        decode(token)
+
+        @current_user[:scope] == END_USER_SCOPE &&
+          @current_user[:email].split('@')[1] == domain
+      rescue JWT::DecodeError
+        false
+      end
 
-        @current_scope = payload['scope']
+      def internal_protected!
+        return if admin_authorized?
+        return if internal_authorized?
 
-        true
+        redirect ENV['JWT_URL']
+      end
+
+      def internal_authorized?
+        decode(token)
+
+        @current_user[:scope] == INTERNAL_SCOPE
       rescue JWT::DecodeError
         false
       end
@@ -33,14 +55,9 @@ module Osso
       end
 
       def admin_authorized?
-        payload, _args = decode(token)
+        decode(token)
 
-        if payload['scope'] == 'admin'
-          @current_scope = :admin
-          return true
-        end
-
-        false
+        @current_user[:scope] == ADMIN_SCOPE
       rescue JWT::DecodeError
         false
       end
@@ -60,12 +77,14 @@ module Osso
       end
 
       def decode(token)
-        JWT.decode(
+        payload, _args = JWT.decode(
           token,
           ENV['JWT_HMAC_SECRET'],
           true,
           { algorithm: 'HS256' },
         )
+
+        @current_user = payload.symbolize_keys
       end
     end
   end

data/lib/osso/lib/route_map.rb

@@ -11,12 +11,12 @@ module Osso
         use Osso::Oauth
 
         post '/graphql' do
-          enterprise_protected!
+          token_protected!
 
           result = Osso::GraphQL::Schema.execute(
             params[:query],
             variables: params[:variables],
-            context: { scope: current_scope },
+            context: current_user.symbolize_keys,
           )
 
           json result

data/lib/osso/models/oauth_client.rb

@@ -5,6 +5,7 @@ module Osso
   module Models
     class OauthClient < ActiveRecord::Base
       has_many :access_tokens
+      has_many :enterprise_accounts
       has_many :refresh_tokens
       has_many :identity_providers
       has_many :redirect_uris

data/lib/osso/routes/admin.rb

@@ -14,13 +14,13 @@ module Osso
 
     namespace '/admin' do
       get '' do
-        admin_protected!
+        internal_protected!
 
         erb :admin
       end
 
       get '/enterprise' do
-        admin_protected!
+        internal_protected!
 
         erb :admin
       end

data/lib/osso/routes/auth.rb

@@ -27,7 +27,11 @@ module Osso
       end
     end
 
-    namespace '/auth' do
+    namespace '/auth' do # rubocop:disable Metrics/BlockLength
+      get '/failure' do
+        @error = params[:message]
+        erb :error
+      end
       # Enterprise users are sent here after authenticating against
       # their Identity Provider. We find or create a user record,
       # and then create an authorization code for that user. The user
@@ -67,9 +71,9 @@ module Osso
       end
 
       def provider_state
-        return 'IDP_INITIATED' if valid_idp_initiated_flow
+        return @provider_state = 'IDP_INITIATED' if valid_idp_initiated_flow
 
-        session[:osso_oauth_state]
+        session.delete(:osso_oauth_state)
       end
 
       def valid_idp_initiated_flow

data/lib/osso/routes/oauth.rb

@@ -7,37 +7,43 @@ module Osso
     include AppConfig
     register Sinatra::Namespace
 
-    namespace '/oauth' do
+    namespace '/oauth' do # rubocop:disable Metrics/BlockLength
       # Send your users here in order to being an authentication
       # flow. This flow follows the authorization grant oauth
       # spec with one exception - you must also pass the domain
-      # of the user who wants to sign in.
+      # of the user who wants to sign in. If the sign in request
+      # is valid, the user is redirected to their Identity Provider.
+      # Once they complete IdP login, they will be returned to the
+      # redirect_uri with an authorization code parameter.
       get '/authorize' do
-        @enterprise = Models::EnterpriseAccount.
-          includes(:identity_providers).
-          find_by!(domain: params[:domain])
-
         Rack::OAuth2::Server::Authorize.new do |req, _res|
           client = Models::OauthClient.find_by!(identifier: req.client_id)
           session[:osso_oauth_redirect_uri] = req.verify_redirect_uri!(client.redirect_uri_values)
+          session[:osso_oauth_state] = params[:state]
         end.call(env)
 
-        if @enterprise.single_provider?
-          session[:osso_oauth_state] = params[:state]
-          redirect "/auth/saml/#{@enterprise.provider.id}"
-        end
+        enterprise = Models::EnterpriseAccount.
+          includes(:identity_providers).
+          find_by!(domain: params[:domain])
+
+        redirect "/auth/saml/#{enterprise.provider.id}" if enterprise.single_provider?
 
         # TODO: multiple provider support
         # erb :multiple_providers
 
       rescue Rack::OAuth2::Server::Authorize::BadRequest => e
         @error = e
-        return erb :error
+        erb :error
+      rescue ActiveRecord::RecordNotFound => e
+        @error = e
+        @error = 'No OAuth Client exists for the provided client_id' if e.model == 'Osso::Models::OauthClient'
+        @error = "No Customer exists with the domain #{params[:domain]}" if e.model == 'Osso::Models::EnterpriseAccount'
+        erb :error
       end
 
       # Exchange an authorization code for an access token.
-      # In addition to the authorization code, you must include all 
-      # paramaters required by OAuth spec: redirect_uri, client ID, 
+      # In addition to the authorization code, you must include all
+      # paramaters required by OAuth spec: redirect_uri, client ID,
       # and client secret
       post '/token' do
         Rack::OAuth2::Server::Token.new do |req, res|
@@ -50,7 +56,8 @@ module Osso
         end.call(env)
       end
 
-      # Use the access token to request a user profile
+      # Use the access token to request a profile for the user who
+      # just logged in. Access tokens are short-lived.
       get '/me' do
         json Models::AccessToken.
           includes(:user).

data/lib/osso/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Osso
-  VERSION = '0.0.3.16'
+  VERSION = '0.0.3.17'
 end

data/spec/graphql/mutations/configure_identity_provider_spec.rb

@@ -39,12 +39,15 @@ describe Osso::GraphQL::Schema do
       described_class.execute(
         mutation,
         variables: variables,
-        context: { scope: current_scope },
+        context: current_context,
       )
     end
 
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        { scope: 'admin' }
+      end
+
       it 'configures an identity provider' do
         expect(subject.dig('data', 'configureIdentityProvider', 'identityProvider', 'status')).
           to eq('Configured')
@@ -53,7 +56,12 @@ describe Osso::GraphQL::Schema do
 
     describe 'for an email scoped user' do
       let(:domain) { Faker::Internet.domain_name }
-      let(:current_scope) { domain }
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: "user@#{domain}",
+        }
+      end
       let(:enterprise_account) { create(:enterprise_account, domain: domain) }
       let(:identity_provider) { create(:identity_provider, enterprise_account: enterprise_account, domain: domain) }
 
@@ -65,7 +73,12 @@ describe Osso::GraphQL::Schema do
 
     describe 'for the wrong email scoped user' do
       let(:domain) { Faker::Internet.domain_name }
-      let(:current_scope) { domain }
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: "user@#{domain}",
+        }
+      end
 
       it 'does not configure an identity provider' do
         expect(subject.dig('errors')).to_not be_empty

data/spec/graphql/mutations/create_enterprise_account_spec.rb

@@ -33,12 +33,14 @@ describe Osso::GraphQL::Schema do
       described_class.execute(
         mutation,
         variables: variables,
-        context: { scope: current_scope },
+        context: current_context,
       )
     end
 
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        { scope: 'admin' }
+      end
       it 'creates an Enterprise Account' do
         expect { subject }.to change { Osso::Models::EnterpriseAccount.count }.by(1)
         expect(subject.dig('data', 'createEnterpriseAccount', 'enterpriseAccount', 'domain')).
@@ -47,7 +49,12 @@ describe Osso::GraphQL::Schema do
     end
 
     describe 'for an email scoped user' do
-      let(:current_scope) { domain }
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: "user@#{domain}",
+        }
+      end
 
       it 'creates an Enterprise Account' do
         expect { subject }.to change { Osso::Models::EnterpriseAccount.count }.by(1)
@@ -56,7 +63,9 @@ describe Osso::GraphQL::Schema do
       end
     end
     describe 'for the wrong email scoped user' do
-      let(:current_scope) { 'foo.com' }
+      let(:current_context) do
+        { scope: 'end-user', email: 'user@foo.com' }
+      end
 
       it 'does not create an Enterprise Account' do
         expect { subject }.to_not(change { Osso::Models::EnterpriseAccount.count })

data/spec/graphql/mutations/create_identity_provider_spec.rb

@@ -25,12 +25,14 @@ describe Osso::GraphQL::Schema do
       described_class.execute(
         mutation,
         variables: variables,
-        context: { scope: current_scope },
+        context: current_context,
       )
     end
 
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        { scope: 'admin' }
+      end
       describe 'without a service' do
         let(:variables) { { input: { enterpriseAccountId: enterprise_account.id } } }
 
@@ -54,7 +56,12 @@ describe Osso::GraphQL::Schema do
 
     describe 'for an email scoped user' do
       let(:domain) { Faker::Internet.domain_name }
-      let(:current_scope) { domain }
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: "user@#{domain}",
+        }
+      end
       let(:enterprise_account) { create(:enterprise_account, domain: domain) }
 
       describe 'without a service' do
@@ -80,12 +87,17 @@ describe Osso::GraphQL::Schema do
 
     describe 'for a wrong email scoped user' do
       let(:domain) { Faker::Internet.domain_name }
-      let(:current_scope) { domain }
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: "user@#{domain}",
+        }
+      end
       let(:enterprise_account) { create(:enterprise_account, domain: domain) }
       let(:target_account) { create(:enterprise_account) }
 
       describe 'without a service' do
-        let(:variables) { { input: { enterpriseAccountId: target_account.id } } }
+        let(:variables) { { input: { enterpriseAccountId: target_account.id, domain: domain } } }
 
         it 'does not creates a identity provider' do
           expect { subject }.to_not(change { Osso::Models::IdentityProvider.count })
@@ -93,7 +105,7 @@ describe Osso::GraphQL::Schema do
       end
 
       describe 'with a service' do
-        let(:variables) { { input: { enterpriseAccountId: target_account.id, service: 'OKTA' } } }
+        let(:variables) { { input: { enterpriseAccountId: target_account.id, service: 'OKTA', domain: domain } } }
 
         it 'does not creates a identity provider' do
           expect { subject }.to_not(change { Osso::Models::IdentityProvider.count })

data/spec/graphql/mutations/create_oauth_client_spec.rb

@@ -31,12 +31,14 @@ describe Osso::GraphQL::Schema do
       described_class.execute(
         mutation,
         variables: variables,
-        context: { scope: current_scope },
+        context: current_context,
       )
     end
 
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        { scope: 'admin' }
+      end
       it 'creates an OauthClient' do
         expect { subject }.to change { Osso::Models::OauthClient.count }.by(1)
         expect(subject.dig('data', 'createOauthClient', 'oauthClient', 'clientId')).
@@ -45,7 +47,12 @@ describe Osso::GraphQL::Schema do
     end
 
     describe 'for an email scoped user' do
-      let(:current_scope) { 'foo.com' }
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: 'user@foo.com',
+        }
+      end
 
       it 'does not create an OauthClient Account' do
         expect { subject }.to_not(change { Osso::Models::OauthClient.count })

data/spec/graphql/mutations/delete_enterprise_account_spec.rb

@@ -30,12 +30,15 @@ describe Osso::GraphQL::Schema do
       described_class.execute(
         mutation,
         variables: variables,
-        context: { scope: current_scope },
+        context: current_context,
       )
     end
 
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        { scope: 'admin' }
+      end
+
       it 'deletes an Enterprise Account' do
         expect { subject }.to change { Osso::Models::EnterpriseAccount.count }.by(-1)
         expect(subject.dig('data', 'createEnterpriseAccount', 'enterpriseAccount')).
@@ -44,7 +47,12 @@ describe Osso::GraphQL::Schema do
     end
 
     describe 'for an email scoped user' do
-      let(:current_scope) { domain }
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: "user@#{domain}",
+        }
+      end
 
       it 'deletes the Enterprise Account' do
         expect { subject }.to change { Osso::Models::EnterpriseAccount.count }.by(-1)
@@ -52,8 +60,14 @@ describe Osso::GraphQL::Schema do
           to be_nil
       end
     end
+
     describe 'for the wrong email scoped user' do
-      let(:current_scope) { 'foo.com' }
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: 'user@foo.com',
+        }
+      end
 
       it 'does not delete the Enterprise Account' do
         expect { subject }.to_not(change { Osso::Models::EnterpriseAccount.count })

data/spec/graphql/mutations/delete_oauth_client_spec.rb

@@ -29,21 +29,25 @@ describe Osso::GraphQL::Schema do
       described_class.execute(
         mutation,
         variables: variables,
-        context: { scope: current_scope },
+        context: current_context,
       )
     end
 
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        { scope: 'admin' }
+      end
       it 'deletes the OauthClient' do
         expect { subject }.to change { Osso::Models::OauthClient.count }.by(-1)
       end
     end
 
     describe 'for an email scoped user' do
-      let(:current_scope) { 'foo.com' }
+      let(:current_context) do
+        { scope: 'end-user', email: 'user@foo.com' }
+      end
 
-      it 'does not create an OauthClient Account' do
+      it 'does not deletes the OauthClient' do
         expect { subject }.to_not(change { Osso::Models::OauthClient.count })
       end
     end

data/spec/graphql/query/enterprise_account_spec.rb

@@ -37,12 +37,17 @@ describe Osso::GraphQL::Schema do
       described_class.execute(
         query,
         variables: variables,
-        context: { scope: current_scope },
+        context: current_context,
       )
     end
 
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        {
+          scope: 'admin',
+        }
+      end
+
       it 'returns Enterprise Account for domain' do
         expect(subject['errors']).to be_nil
         expect(subject.dig('data', 'enterpriseAccount', 'domain')).to eq(domain)
@@ -50,7 +55,12 @@ describe Osso::GraphQL::Schema do
     end
 
     describe 'for an email scoped user' do
-      let(:current_scope) { domain }
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: "user@#{domain}",
+        }
+      end
       it 'returns Enterprise Account for domain' do
         expect(subject['errors']).to be_nil
         expect(subject.dig('data', 'enterpriseAccount', 'domain')).to eq(domain)
@@ -58,9 +68,14 @@ describe Osso::GraphQL::Schema do
     end
 
     describe 'for the wrong email scoped user' do
-      let(:current_scope) { 'bar.com' }
-      it 'returns Enterprise Account for domain' do
-        expect(subject['errors']).to be_nil
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: 'foo@bar.com',
+        }
+      end
+      it 'does not return Enterprise Account for domain' do
+        expect(subject['errors']).to_not be_nil
         expect(subject.dig('data', 'enterpriseAccount')).to be_nil
       end
     end

data/spec/graphql/query/enterprise_accounts_spec.rb

@@ -5,7 +5,9 @@ require 'spec_helper'
 describe Osso::GraphQL::Schema do
   describe 'EnterpriseAccounts' do
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        { scope: 'admin' }
+      end
 
       it 'returns paginated Enterprise Accounts' do
         %w[A B C].map do |name|
@@ -44,7 +46,7 @@ describe Osso::GraphQL::Schema do
         response = described_class.execute(
           query,
           variables: { first: 2, sortOrder: 'descending', sortColumn: 'name' },
-          context: { scope: current_scope },
+          context: current_context,
         )
 
         expect(response['errors']).to be_nil

data/spec/graphql/query/identity_provider_spec.rb

@@ -32,12 +32,14 @@ describe Osso::GraphQL::Schema do
       described_class.execute(
         query,
         variables: variables,
-        context: { scope: current_scope },
+        context: current_context,
       )
     end
 
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        { scope: 'admin' }
+      end
       it 'returns Identity Provider for id' do
         expect(subject['errors']).to be_nil
         expect(subject.dig('data', 'identityProvider', 'id')).to eq(id)
@@ -45,8 +47,12 @@ describe Osso::GraphQL::Schema do
     end
 
     describe 'for an email scoped user' do
-      let(:current_scope) { domain }
-
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: "user@#{domain}",
+        }
+      end
       it 'returns Enterprise Account for domain' do
         expect(subject['errors']).to be_nil
         expect(subject.dig('data', 'identityProvider', 'domain')).to eq(domain)
@@ -54,8 +60,12 @@ describe Osso::GraphQL::Schema do
     end
 
     describe 'for the wrong email scoped user' do
-      let(:current_scope) { 'bar.com' }
-
+      let(:current_context) do
+        {
+          scope: 'end-user',
+          email: 'user@bar.com',
+        }
+      end
       it 'returns Enterprise Account for domain' do
         expect(subject['errors']).to_not be_empty
         expect(subject.dig('data', 'enterpriseAccount')).to be_nil

data/spec/graphql/query/oauth_clients_spec.rb

@@ -25,12 +25,14 @@ describe Osso::GraphQL::Schema do
       described_class.execute(
         query,
         variables: nil,
-        context: { scope: current_scope },
+        context: current_context,
       )
     end
 
     describe 'for an admin user' do
-      let(:current_scope) { :admin }
+      let(:current_context) do
+        { scope: 'admin' }
+      end
 
       it 'returns Oauth Clients' do
         expect(subject['errors']).to be_nil
@@ -38,11 +40,12 @@ describe Osso::GraphQL::Schema do
       end
     end
 
-    describe 'for an email scoped user' do
-      let(:current_scope) { 'foo.com' }
-
-      it 'returns Oauth Clients' do
-        expect(subject['errors']).to be_nil
+    describe 'for an internal scoped user' do
+      let(:current_context) do
+        { scope: 'internal' }
+      end
+      it 'does not return Oauth Clients' do
+        expect(subject['errors']).to_not be_nil
         expect(subject.dig('data', 'oauthClients')).to be_nil
       end
     end

data/spec/routes/oauth_spec.rb

@@ -8,7 +8,10 @@ describe Osso::Oauth do
   describe 'get /oauth/authorize' do
     describe 'with a valid client ID and redirect URI' do
       describe 'for a domain that does not belong to an enterprise' do
-        it '404s' do
+        # TODO: better error handling and test
+        it 'renders an error page' do
+          described_class.set(:views, spec_views)
+
           create(:enterprise_with_okta, domain: 'foo.com')
 
           get(
@@ -19,7 +22,7 @@ describe Osso::Oauth do
             redirect_uri: client.redirect_uri_values.sample,
           )
 
-          expect(last_response.status).to eq(404)
+          expect(last_response.status).to eq(200)
         end
       end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: osso
 version: !ruby/object:Gem::Version
-  version: 0.0.3.16
+  version: 0.0.3.17
 platform: ruby
 authors:
 - Sam Bauch
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-08-17 00:00:00.000000000 Z
+date: 2020-08-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -284,11 +284,13 @@ files:
 - lib/osso/graphql/mutations/set_redirect_uris.rb
 - lib/osso/graphql/query.rb
 - lib/osso/graphql/resolvers.rb
+- lib/osso/graphql/resolvers/base_resolver.rb
 - lib/osso/graphql/resolvers/enterprise_account.rb
 - lib/osso/graphql/resolvers/enterprise_accounts.rb
 - lib/osso/graphql/resolvers/oauth_clients.rb
 - lib/osso/graphql/schema.rb
 - lib/osso/graphql/types.rb
+- lib/osso/graphql/types/admin_user.rb
 - lib/osso/graphql/types/base_connection.rb
 - lib/osso/graphql/types/base_enum.rb
 - lib/osso/graphql/types/base_input_object.rb
@@ -300,7 +302,6 @@ files:
 - lib/osso/graphql/types/oauth_client.rb
 - lib/osso/graphql/types/redirect_uri.rb
 - lib/osso/graphql/types/redirect_uri_input.rb
-- lib/osso/graphql/types/user.rb
 - lib/osso/helpers/auth.rb
 - lib/osso/helpers/helpers.rb
 - lib/osso/lib/app_config.rb
@@ -350,6 +351,7 @@ files:
 - spec/spec_helper.rb
 - spec/support/spec_app.rb
 - spec/support/views/admin.erb
+- spec/support/views/error.erb
 homepage: https://github.com/enterprise-oss/osso-rb
 licenses:
 - MIT

data/lib/osso/graphql/types/user.rb

@@ -1,17 +0,0 @@
-# frozen_string_literal: true
-
-require 'graphql'
-require_relative 'base_object'
-
-module Osso
-  module GraphQL
-    module Types
-      class User < Types::BaseObject
-        description 'A User of the application'
-
-        field :id, ID, null: false
-        field :name, String, null: true
-      end
-    end
-  end
-end