prx_auth-rails 1.3.0 → 1.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3405e4e72d2c39585111bef4fca339a73ce11ec86a2c288f5c82d8934c0620fe
-  data.tar.gz: 3450063f4c4fdae2464f755222fafee08c627eda3aa8fee1d267db1474db58de
+  metadata.gz: 9a692b8cc459acfdf888599245ff2db7d7ed92a3c967fbccacdd871aa4e78cd7
+  data.tar.gz: 17439da5ec7e7cc7f85d00083a47aaebb6d6bd495db25fa75581bf0758726d6c
 SHA512:
-  metadata.gz: edf33f5cf4bc105818bb069554506f0b2d9ef5b8bb18cd1602b2ceb6384991804b5b3268c6bd5c519c08e8503df51c132a9bec045f13995c1d55088194fff489
-  data.tar.gz: 4aa62706ee892c2335756e2c3ae61171b77acc69bfe0ec06433449726f8e884cee4af2031e55e418c6780e9aedc8bfb1c78359c072c089389422a2d4aa15c95b
+  metadata.gz: 2a185d858e8a50a33e1f18c85e7dabf5f01a46fbc068dd74d222bb48ab03732ced79c60affd45f7e70efd628cfaaf259e9d4781c390470de86a06dd46158bf0c
+  data.tar.gz: d8f2b9c1c1367c2954575950f1ddc731f329f59d111efcb11282d78651a06cf22c74557f834d51ff6fa3ca7360d1cb06ad4736cd2a41d0ff28c5554913fcc193

data/app/assets/config/prx_auth-rails_manifest.js

@@ -0,0 +1,3 @@
+//= link_directory ../javascripts .js
+//= link_directory ../stylesheets .css
+//= link_tree ../images

data/app/assets/images/prx_auth-rails/user.svg

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg width="100%" height="100%" viewBox="0 0 51 51" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" xmlns:serif="http://www.serif.com/" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:1.41421;">
+    <path d="M51,25.5C51,11.44 39.56,0 25.5,0C11.44,0 0,11.44 0,25.5C0,32.927 3.194,39.621 8.277,44.285L8.253,44.306L9.08,45.003C9.134,45.049 9.192,45.086 9.246,45.13C9.685,45.495 10.141,45.841 10.604,46.175C10.755,46.284 10.905,46.392 11.058,46.498C11.553,46.839 12.061,47.163 12.58,47.47C12.693,47.537 12.807,47.602 12.922,47.666C13.49,47.99 14.07,48.295 14.665,48.575C14.708,48.596 14.753,48.614 14.796,48.635C16.734,49.535 18.801,50.196 20.964,50.586C21.02,50.597 21.077,50.607 21.134,50.617C21.806,50.733 22.485,50.826 23.172,50.888C23.255,50.895 23.339,50.9 23.423,50.907C24.107,50.964 24.799,51 25.5,51C26.195,51 26.88,50.964 27.56,50.909C27.647,50.902 27.733,50.897 27.819,50.89C28.501,50.828 29.174,50.738 29.839,50.624C29.896,50.613 29.955,50.603 30.012,50.592C32.142,50.21 34.18,49.564 36.092,48.686C36.163,48.654 36.234,48.623 36.305,48.59C36.877,48.321 37.436,48.031 37.984,47.722C38.12,47.645 38.256,47.567 38.391,47.487C38.89,47.194 39.38,46.887 39.857,46.56C40.029,46.443 40.196,46.32 40.366,46.198C40.773,45.905 41.173,45.602 41.561,45.286C41.648,45.217 41.74,45.156 41.825,45.085L42.673,44.376L42.648,44.355C47.776,39.689 51,32.965 51,25.5ZM1.855,25.5C1.855,12.462 12.462,1.855 25.5,1.855C38.538,1.855 49.145,12.462 49.145,25.5C49.145,32.526 46.062,38.843 41.181,43.177C40.908,42.988 40.634,42.82 40.353,42.679L32.502,38.754C31.797,38.401 31.359,37.693 31.359,36.905L31.359,34.164C31.541,33.939 31.733,33.685 31.932,33.406C32.948,31.971 33.763,30.374 34.357,28.656C35.532,28.097 36.291,26.927 36.291,25.606L36.291,22.319C36.291,21.515 35.996,20.735 35.468,20.122L35.468,15.794C35.516,15.312 35.687,12.597 33.722,10.357C32.013,8.406 29.247,7.418 25.5,7.418C21.753,7.418 18.987,8.406 17.278,10.356C15.313,12.596 15.484,15.313 15.532,15.793L15.532,20.121C15.005,20.734 14.709,21.514 14.709,22.318L14.709,25.605C14.709,26.626 15.167,27.578 15.952,28.221C16.703,31.163 18.249,33.39 18.82,34.145L18.82,36.828C18.82,37.585 18.407,38.281 17.742,38.644L10.41,42.643C10.177,42.77 9.945,42.919 9.713,43.085C4.892,38.753 1.855,32.475 1.855,25.5Z" style="fill:white;fill-rule:nonzero;"/>
+</svg>

data/app/assets/javascripts/prx_auth-rails/user_widget.js.erb

@@ -0,0 +1,46 @@
+// https://stackoverflow.com/questions/8578617/inject-a-script-tag-with-remote-src-and-wait-for-it-to-execute
+function prxInjectScript(src, callback) {
+  const script = document.createElement('script');
+
+  script.type = 'text/javascript';
+  script.async = false;
+  script.src = src;
+
+  script.onload = function () { script.onload = null; callback(); }
+
+  document.getElementsByTagName('head')[0].appendChild(script);
+}
+
+document.addEventListener('DOMContentLoaded', function () {
+
+  const widget = document.getElementById('prx-user-widget');
+  const account = document.getElementById('prx-user-widget-menu-account');
+
+  const idHost = 'https://' + widget.getAttribute('data-id-host');;
+  const scriptUrl = idHost + '/widget.js';
+
+  prxInjectScript(scriptUrl, function () {
+    const signIn = new PRXSignIn(idHost);
+
+    signIn.signedIn(function (prx) {
+
+      if (!prx.userinfo) {
+        // Not logged in
+        widget.classList.add('no-user-info');
+
+        const url = idHost + '/session?return_to=' + encodeURIComponent(window.location);
+
+        account.innerHTML = '<a class=sign-in href="' + url + '">Sign in</a>';
+      } else {
+        // Logged in
+        widget.classList.add('user-info');
+
+        const account = document.getElementById('prx-user-widget-menu-account');
+        account.innerText = prx.userinfo.email;
+
+        signIn.listApps('prx-user-widget-menu-apps');
+      }
+    });
+  });
+});
+

data/app/assets/stylesheets/prx_auth-rails/user_widget.css

@@ -0,0 +1,69 @@
+#prx-user-widget {
+  display: flex;
+  flex-direction: column;
+  height: 100%;
+  justify-content: center;
+  padding: 0 20px;
+  position: absolute;
+  right: 0;
+  transition-property: opacity;
+  transition-duration: 0.2s;
+}
+@media (max-width: ) {
+  #prx-user-widget {
+    height: auto;
+    top: 0;
+  }
+}
+#prx-user-widget:hover {
+}
+#prx-user-widget:hover .user-icon {
+  opacity: 1;
+}
+#prx-user-widget:hover #prx-user-widget-menu {
+  display: block;
+}
+#prx-user-widget .user-icon {
+  cursor: pointer;
+  height: 2em;
+  opacity: 0.7;
+  width: 2em;
+}
+#prx-user-widget #prx-user-widget-menu {
+  background-color: #1a1a1a;
+  display: none;
+  right: 0;
+  padding: 10px 20px;
+  position: absolute;
+  top: 100%;
+  z-index: 999;
+  display: none;
+}
+
+#prx-user-widget #prx-user-widget-menu h1 {
+  color: white;
+  font-size: .9em;
+  font-weight: 700;
+}
+
+#prx-user-widget #prx-user-widget-menu-apps {
+  padding: 0;
+}
+#prx-user-widget #prx-user-widget-menu-apps ul {
+  border-top: 1px solid #ddd;
+  padding: 15px 0 0;
+}
+
+#prx-user-widget #prx-user-widget-menu-apps ul li a {
+  display: block;
+  font-weight: normal;
+  opacity: 0.7;
+  padding: 5px 0;
+  text-transform: none;
+}
+#prx-user-widget #prx-user-widget-menu-apps ul li a:hover {
+  opacity: 1;
+}
+.prx-home #prx-user-widget.loaded:hover {
+  background: transparent;
+}

data/app/controllers/prx_auth/rails/sessions_controller.rb

@@ -1,5 +1,3 @@
-require 'open-uri'
-
 module PrxAuth::Rails
   class SessionsController < ApplicationController
     include PrxAuth::Rails::Engine.routes.url_helpers
@@ -29,6 +27,11 @@ module PrxAuth::Rails
     def show
     end
 
+    def destroy
+      sign_out_user
+      redirect_to after_sign_out_path
+    end
+
     def auth_error
       @auth_error_message = params.require(:error)
     end
@@ -42,6 +45,7 @@ module PrxAuth::Rails
       result_path = if valid_nonce?(jwt_id_claims['nonce']) &&
                         users_match?(jwt_id_claims, jwt_access_claims)
                       sign_in_user(jwt_access_claims)
+                      lookup_and_register_accounts_names
                       after_sign_in_path_for(current_user)
                     else
                       auth_error_sessions_path(error: 'verification_failed')
@@ -59,6 +63,12 @@ module PrxAuth::Rails
       "/"
     end
 
+    def after_sign_out_path
+      return super if defined?(super)
+
+      "https://#{id_host}/session/sign_out"
+    end
+
     def id_claims
       id_token = params.require('id_token')
       validate_token(id_token)
@@ -97,12 +107,15 @@ module PrxAuth::Rails
     end
 
     def validate_token(token)
-      id_host = PrxAuth::Rails.configuration.id_host
       prx_auth_cert = Rack::PrxAuth::Certificate.new("https://#{id_host}/api/v1/certs")
       auth_validator = Rack::PrxAuth::AuthValidator.new(token, prx_auth_cert, id_host)
       auth_validator.
         claims.
         with_indifferent_access
     end
+
+    def id_host
+      PrxAuth::Rails.configuration.id_host
+    end
   end
 end

data/config/initializers/assets.rb

@@ -0,0 +1 @@
+Rails.application.config.assets.precompile << %w(prx_auth-rails_manifest.js)

data/lib/prx_auth/rails/engine.rb

@@ -1,5 +1,9 @@
 module PrxAuth
   module Rails
-    class Engine < ::Rails::Engine; end
+    class Engine < ::Rails::Engine
+      config.to_prepare do
+        ::ApplicationController.helper_method [:current_user, :account_name_for]
+      end
+    end
   end
 end

data/lib/prx_auth/rails/ext/controller.rb

@@ -1,13 +1,18 @@
 require 'prx_auth/rails/token'
+require 'open-uri'
 
 module PrxAuth
   module Rails
     module Controller
+
+      PRX_ACCOUNT_NAME_MAPPING_KEY = 'prx.account.name.mapping'.freeze
+      PRX_TOKEN_SESSION_KEY = 'prx.auth'.freeze
+
       def prx_auth_token
         rack_auth_token = env_prx_auth_token
         return rack_auth_token if rack_auth_token.present?
 
-        session['prx.auth'] && Rack::PrxAuth::TokenData.new(session['prx.auth'])
+        session[PRX_TOKEN_SESSION_KEY] && Rack::PrxAuth::TokenData.new(session[PRX_TOKEN_SESSION_KEY])
       end
 
       def prx_authenticated?
@@ -26,12 +31,59 @@ module PrxAuth
         PrxAuth::Rails::Token.new(prx_auth_token)
       end
 
+      def lookup_and_register_accounts_names
+        session[PRX_ACCOUNT_NAME_MAPPING_KEY] =
+          lookup_account_names_mapping
+      end
+
+      def account_name_for(id)
+        id = id.to_i
+
+        session[PRX_ACCOUNT_NAME_MAPPING_KEY] ||= {}
+
+        name =
+          if session[PRX_ACCOUNT_NAME_MAPPING_KEY].has_key?(id)
+            session[PRX_ACCOUNT_NAME_MAPPING_KEY][id]
+          else
+            session[PRX_ACCOUNT_NAME_MAPPING_KEY][id] = lookup_account_name_for(id)
+          end
+
+        name = "[#{id}] Unknown Account Name" unless name.present?
+
+        name
+      end
+
       def sign_in_user(token)
-        session['prx.auth'] = token
+        session[PRX_TOKEN_SESSION_KEY] = token
+      end
+
+      def sign_out_user
+        session.delete(PRX_TOKEN_SESSION_KEY)
       end
 
       private
 
+      def lookup_account_name_for(id)
+        id = id.to_i
+
+        res = lookup_account_names_mapping([id])
+        res[id]
+      end
+
+      def lookup_account_names_mapping(ids=current_user.resources)
+        id_host = PrxAuth::Rails.configuration.id_host
+        ids_param = ids.map(&:to_s).join(',')
+
+        options = {}
+        options[:ssl_verify_mode] = OpenSSL::SSL::VERIFY_NONE if ::Rails.env.development?
+
+        accounts = URI.open("https://#{id_host}/api/v1/accounts?account_ids=#{ids_param}", options).read
+
+        mapping = JSON.parse(accounts)['accounts'].map { |acct| [acct['id'], acct['display_name']] }.to_h
+
+        mapping
+      end
+
       def env_prx_auth_token
         if !defined? @_prx_auth_token
           @_prx_auth_token = request.env['prx.auth'] && PrxAuth::Rails::Token.new(request.env['prx.auth'])

data/lib/prx_auth/rails/version.rb

@@ -1,5 +1,5 @@
 module PrxAuth
   module Rails
-    VERSION = "1.3.0"
+    VERSION = "1.7.0"
   end
 end

data/test/prx_auth/rails/sessions_controller_test.rb

@@ -32,9 +32,11 @@ module PrxAuth::Rails
 
     test 'create should validate a token and set the session variable' do
       @controller.stub(:validate_token, @stub_claims) do
-        session[@nonce_session_key] = '123'
-        post :create, params: @token_params, format: :json
-        assert session['prx.auth']['id_token']['nonce'] == '123'
+        @controller.stub(:lookup_and_register_accounts_names, nil) do
+          session[@nonce_session_key] = '123'
+          post :create, params: @token_params, format: :json
+          assert session['prx.auth']['id_token']['nonce'] == '123'
+        end
       end
     end
 
@@ -48,16 +50,18 @@ module PrxAuth::Rails
 
     test 'create should reset the nonce after consumed' do
       @controller.stub(:validate_token, @stub_claims) do
-        session[@nonce_session_key] = '123'
-        post :create, params: @token_params, format: :json
-
-        assert session[@nonce_session_key] == nil
-        assert response.code == '302'
-        assert response.body.match?(/after-sign-in-path/)
+        @controller.stub(:lookup_and_register_accounts_names, nil) do
+          session[@nonce_session_key] = '123'
+          post :create, params: @token_params, format: :json
+
+          assert session[@nonce_session_key] == nil
+          assert response.code == '302'
+          assert response.body.match?(/after-sign-in-path/)
+        end
       end
     end
 
-    test 'should respond with aredirect to the auth error page / code if the nonce does not match' do
+    test 'should respond with redirect to the auth error page / code if the nonce does not match' do
       @controller.stub(:validate_token, @stub_claims) do
         session[@nonce_session_key] = 'nonce-does-not-match'
         post :create, params: @token_params, format: :json
@@ -82,13 +86,19 @@ module PrxAuth::Rails
       @controller.stub(:id_claims, @stub_claims) do
         @controller.stub(:access_claims, @stub_claims.merge('sub' => '444')) do
 
-        session[@nonce_session_key] = '123'
-        post :create, params: @token_params, format: :json
+          session[@nonce_session_key] = '123'
+          post :create, params: @token_params, format: :json
 
-        assert response.code == '302'
-        assert response.body.match?(/error=verification_failed/)
-      end
+          assert response.code == '302'
+          assert response.body.match?(/error=verification_failed/)
+        end
       end
     end
+
+    test 'should clear the user token on sign out' do
+      session[PrxAuth::Rails::Controller::PRX_TOKEN_SESSION_KEY] = 'some-token'
+      post :destroy
+      assert session[PrxAuth::Rails::Controller::PRX_TOKEN_SESSION_KEY] == nil
+    end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: prx_auth-rails
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.7.0
 platform: ruby
 authors:
 - Chris Rhoden
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-01-19 00:00:00.000000000 Z
+date: 2021-03-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionpack
@@ -165,9 +165,14 @@ files:
 - LICENSE.txt
 - README.md
 - Rakefile
+- app/assets/config/prx_auth-rails_manifest.js
+- app/assets/images/prx_auth-rails/user.svg
+- app/assets/javascripts/prx_auth-rails/user_widget.js.erb
+- app/assets/stylesheets/prx_auth-rails/user_widget.css
 - app/controllers/prx_auth/rails/sessions_controller.rb
 - app/views/prx_auth/rails/sessions/auth_error.html.erb
 - app/views/prx_auth/rails/sessions/show.html.erb
+- config/initializers/assets.rb
 - config/routes.rb
 - lib/prx_auth/rails.rb
 - lib/prx_auth/rails/configuration.rb