sso-auth 0.0.6 → 0.0.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +7 -0
- data/README.rdoc +5 -11
- data/app/controllers/{sso_auth → sso/auth}/omniauth_callbacks_controller.rb +1 -1
- data/app/controllers/{sso_auth → sso/auth}/sessions_controller.rb +1 -1
- data/config/initializers/devise.rb +62 -24
- data/lib/generators/sso/auth/install_generator.rb +49 -0
- data/lib/generators/{sso-auth/install → sso/auth}/templates/app/controllers/manage/application_controller.rb +0 -0
- data/lib/generators/{sso-auth/install → sso/auth}/templates/app/models/ability.rb +0 -0
- data/lib/generators/{sso-auth/install → sso/auth}/templates/app/models/permission.rb +1 -0
- data/lib/generators/{sso-auth/install → sso/auth}/templates/app/models/user.rb +0 -0
- data/lib/generators/{sso-auth/install → sso/auth}/templates/db/migrate/create_permissions.rb +5 -0
- data/lib/generators/{sso-auth/install → sso/auth}/templates/db/migrate/create_users.rb +0 -0
- data/lib/generators/sso/auth/templates/public/403.html +26 -0
- data/lib/generators/{sso-auth/install → sso/auth}/templates/spec/models/ability_spec.rb +0 -0
- data/lib/sso/auth.rb +10 -0
- data/lib/sso/auth/engine.rb +103 -0
- data/lib/sso/auth/spec_helper.rb +50 -0
- data/lib/sso/auth/version.rb +5 -0
- metadata +56 -71
- data/config/routes.rb +0 -11
- data/lib/generators/sso-auth/install/install_generator.rb +0 -40
- data/lib/generators/sso-auth/install/templates/db/seeds.rb +0 -4
- data/lib/sso-auth.rb +0 -7
- data/lib/sso-auth/engine.rb +0 -100
- data/lib/sso-auth/spec_helper.rb +0 -48
- data/lib/sso-auth/version.rb +0 -3
checksums.yaml
ADDED
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
---
|
|
2
|
+
SHA1:
|
|
3
|
+
metadata.gz: adf457dcf0eac446e4be9b4019d8944c0abf1732
|
|
4
|
+
data.tar.gz: 628575cfab94a454fc20fbcd9d5c5ec7137cd0df
|
|
5
|
+
SHA512:
|
|
6
|
+
metadata.gz: bca87b39ca118375066f7797f82a718d3b06d8e3d3898777f9fe41b9366de39c10d6558a4d425e40a624b6320523d888c92e1eb73a9a05503cffe148707a1aaf
|
|
7
|
+
data.tar.gz: d00ae8083fec8f2465c8db79795af519aa6eda801d83c4c5b415930a4c001c4474042a1755ce3ff2a9bd35ee6e40dbf2325d349052ff8b7daf310f9b7deab031
|
data/README.rdoc
CHANGED
|
@@ -6,23 +6,17 @@ Gemfile
|
|
|
6
6
|
|
|
7
7
|
gem 'sso-auth'
|
|
8
8
|
|
|
9
|
+
Run
|
|
10
|
+
bin/rails g sso:auth:install
|
|
11
|
+
|
|
9
12
|
Layout
|
|
10
13
|
|
|
11
14
|
<body>
|
|
12
|
-
<%= render :partial => "
|
|
15
|
+
<%= render :partial => "sso-auth/shared/user_box" %>
|
|
13
16
|
...
|
|
14
17
|
<%= yield %>
|
|
15
|
-
...
|
|
16
|
-
<%= render :partial => "sso_auth/shared/footer" %>
|
|
17
18
|
</body>
|
|
18
19
|
|
|
19
|
-
Stylesheet
|
|
20
|
-
|
|
21
|
-
*= require ...
|
|
22
|
-
*= require sso_auth/shared // common styles
|
|
23
|
-
*= require custom_sso_auth // customize styles
|
|
24
|
-
*/
|
|
25
|
-
|
|
26
20
|
== License
|
|
27
21
|
|
|
28
|
-
This project rocks and uses MIT-LICENSE.
|
|
22
|
+
This project rocks and uses MIT-LICENSE.
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# encoding: utf-8
|
|
2
2
|
|
|
3
|
-
class
|
|
3
|
+
class Sso::Auth::OmniauthCallbacksController < Devise::OmniauthCallbacksController
|
|
4
4
|
def identity
|
|
5
5
|
sign_in User.find_or_create_by_omniauth_hash(request.env['omniauth.auth']), :event => :authentication
|
|
6
6
|
flash[:notice] = I18n.t('devise.omniauth_callbacks.success', :kind => I18n.t('sso-auth.provider.title'))
|
|
@@ -1,13 +1,19 @@
|
|
|
1
1
|
# Use this hook to configure devise mailer, warden hooks and so forth.
|
|
2
2
|
# Many of these configuration options can be set straight in your model.
|
|
3
3
|
Devise.setup do |config|
|
|
4
|
+
# The secret key used by Devise. Devise uses this key to generate
|
|
5
|
+
# random tokens. Changing this key will render invalid all existing
|
|
6
|
+
# confirmation, reset password and unlock tokens in the database.
|
|
7
|
+
config.secret_key = Settings['devise.secret']
|
|
8
|
+
|
|
4
9
|
# ==> Mailer Configuration
|
|
5
10
|
# Configure the e-mail address which will be shown in Devise::Mailer,
|
|
6
|
-
# note that it will be overwritten if you use your own mailer class
|
|
7
|
-
#
|
|
11
|
+
# note that it will be overwritten if you use your own mailer class
|
|
12
|
+
# with default "from" parameter.
|
|
13
|
+
config.mailer_sender = 'please-change-me-at-config-initializers-devise@example.com'
|
|
8
14
|
|
|
9
15
|
# Configure the class responsible to send e-mails.
|
|
10
|
-
# config.mailer =
|
|
16
|
+
# config.mailer = 'Devise::Mailer'
|
|
11
17
|
|
|
12
18
|
# ==> ORM configuration
|
|
13
19
|
# Load and configure the ORM. Supports :active_record (default) and
|
|
@@ -35,12 +41,12 @@ Devise.setup do |config|
|
|
|
35
41
|
# Configure which authentication keys should be case-insensitive.
|
|
36
42
|
# These keys will be downcased upon creating or modifying a user and when used
|
|
37
43
|
# to authenticate or find a user. Default is :email.
|
|
38
|
-
config.case_insensitive_keys = []
|
|
44
|
+
config.case_insensitive_keys = [ :email ]
|
|
39
45
|
|
|
40
46
|
# Configure which authentication keys should have whitespace stripped.
|
|
41
47
|
# These keys will have whitespace before and after removed upon creating or
|
|
42
48
|
# modifying a user and when used to authenticate or find a user. Default is :email.
|
|
43
|
-
config.strip_whitespace_keys = []
|
|
49
|
+
config.strip_whitespace_keys = [ :email ]
|
|
44
50
|
|
|
45
51
|
# Tell if authentication through request.params is enabled. True by default.
|
|
46
52
|
# It can be set to an array that will enable params authentication only for the
|
|
@@ -48,17 +54,18 @@ Devise.setup do |config|
|
|
|
48
54
|
# enable it only for database (email + password) authentication.
|
|
49
55
|
# config.params_authenticatable = true
|
|
50
56
|
|
|
51
|
-
# Tell if authentication through HTTP
|
|
57
|
+
# Tell if authentication through HTTP Auth is enabled. False by default.
|
|
52
58
|
# It can be set to an array that will enable http authentication only for the
|
|
53
|
-
# given strategies, for example, `config.http_authenticatable = [:
|
|
54
|
-
# enable it only for
|
|
59
|
+
# given strategies, for example, `config.http_authenticatable = [:database]` will
|
|
60
|
+
# enable it only for database authentication. The supported strategies are:
|
|
61
|
+
# :database = Support basic authentication with authentication key + password
|
|
55
62
|
# config.http_authenticatable = false
|
|
56
63
|
|
|
57
64
|
# If http headers should be returned for AJAX requests. True by default.
|
|
58
65
|
# config.http_authenticatable_on_xhr = true
|
|
59
66
|
|
|
60
|
-
# The realm used in Http Basic Authentication.
|
|
61
|
-
# config.http_authentication_realm =
|
|
67
|
+
# The realm used in Http Basic Authentication. 'Application' by default.
|
|
68
|
+
# config.http_authentication_realm = 'Application'
|
|
62
69
|
|
|
63
70
|
# It will change confirmation, password recovery and other workflows
|
|
64
71
|
# to behave the same regardless if the e-mail provided was right or wrong.
|
|
@@ -66,12 +73,18 @@ Devise.setup do |config|
|
|
|
66
73
|
# config.paranoid = true
|
|
67
74
|
|
|
68
75
|
# By default Devise will store the user in session. You can skip storage for
|
|
69
|
-
#
|
|
76
|
+
# particular strategies by setting this option.
|
|
70
77
|
# Notice that if you are skipping storage for all authentication paths, you
|
|
71
78
|
# may want to disable generating routes to Devise's sessions controller by
|
|
72
79
|
# passing :skip => :sessions to `devise_for` in your config/routes.rb
|
|
73
80
|
config.skip_session_storage = [:http_auth]
|
|
74
81
|
|
|
82
|
+
# By default, Devise cleans up the CSRF token on authentication to
|
|
83
|
+
# avoid CSRF token fixation attacks. This means that, when using AJAX
|
|
84
|
+
# requests for sign in and sign up, you need to get a new CSRF token
|
|
85
|
+
# from the server. You can disable this option at your own risk.
|
|
86
|
+
# config.clean_up_csrf_token_on_authentication = true
|
|
87
|
+
|
|
75
88
|
# ==> Configuration for :database_authenticatable
|
|
76
89
|
# For bcrypt, this is the cost for hashing the password and defaults to 10. If
|
|
77
90
|
# using other encryptors, it sets how many times you want the password re-encrypted.
|
|
@@ -82,7 +95,7 @@ Devise.setup do |config|
|
|
|
82
95
|
config.stretches = Rails.env.test? ? 1 : 10
|
|
83
96
|
|
|
84
97
|
# Setup a pepper to generate the encrypted password.
|
|
85
|
-
# config.pepper =
|
|
98
|
+
# config.pepper = '<%= SecureRandom.hex(64) %>'
|
|
86
99
|
|
|
87
100
|
# ==> Configuration for :confirmable
|
|
88
101
|
# A period that the user is allowed to access the website even without
|
|
@@ -92,6 +105,14 @@ Devise.setup do |config|
|
|
|
92
105
|
# the user cannot access the website without confirming his account.
|
|
93
106
|
# config.allow_unconfirmed_access_for = 2.days
|
|
94
107
|
|
|
108
|
+
# A period that the user is allowed to confirm their account before their
|
|
109
|
+
# token becomes invalid. For example, if set to 3.days, the user can confirm
|
|
110
|
+
# their account within 3 days after the mail was sent, but on the fourth day
|
|
111
|
+
# their account can't be confirmed with the token any more.
|
|
112
|
+
# Default is nil, meaning there is no restriction on how long a user can take
|
|
113
|
+
# before confirming their account.
|
|
114
|
+
# config.confirm_within = 3.days
|
|
115
|
+
|
|
95
116
|
# If true, requires any email changes to be confirmed (exactly the same way as
|
|
96
117
|
# initial account confirmation) to be applied. Requires additional unconfirmed_email
|
|
97
118
|
# db field (see migrations). Until confirmed new email is stored in
|
|
@@ -113,11 +134,11 @@ Devise.setup do |config|
|
|
|
113
134
|
# config.rememberable_options = {}
|
|
114
135
|
|
|
115
136
|
# ==> Configuration for :validatable
|
|
116
|
-
# Range for password length. Default is
|
|
117
|
-
|
|
137
|
+
# Range for password length. Default is 8..128.
|
|
138
|
+
config.password_length = 8..128
|
|
118
139
|
|
|
119
140
|
# Email regex used to validate email formats. It simply asserts that
|
|
120
|
-
#
|
|
141
|
+
# one (and only one) @ exists in the given string. This is mainly
|
|
121
142
|
# to give user feedback and not to assert the e-mail validity.
|
|
122
143
|
# config.email_regexp = /\A[^@]+@[^@]+\z/
|
|
123
144
|
|
|
@@ -126,6 +147,9 @@ Devise.setup do |config|
|
|
|
126
147
|
# time the user will be asked for credentials again. Default is 30 minutes.
|
|
127
148
|
# config.timeout_in = 30.minutes
|
|
128
149
|
|
|
150
|
+
# If true, expires auth token on session timeout.
|
|
151
|
+
# config.expire_auth_token_on_timeout = false
|
|
152
|
+
|
|
129
153
|
# ==> Configuration for :lockable
|
|
130
154
|
# Defines which strategy will be used to lock an account.
|
|
131
155
|
# :failed_attempts = Locks an account after a number of failed attempts to sign in.
|
|
@@ -149,6 +173,9 @@ Devise.setup do |config|
|
|
|
149
173
|
# Time interval to unlock the account if :time is enabled as unlock_strategy.
|
|
150
174
|
# config.unlock_in = 1.hour
|
|
151
175
|
|
|
176
|
+
# Warn on the last attempt before the account is locked.
|
|
177
|
+
# config.last_attempt_warning = false
|
|
178
|
+
|
|
152
179
|
# ==> Configuration for :recoverable
|
|
153
180
|
#
|
|
154
181
|
# Defines which key will be used when recovering the password for an account
|
|
@@ -164,13 +191,11 @@ Devise.setup do |config|
|
|
|
164
191
|
# :sha1, :sha512 or encryptors from others authentication tools as :clearance_sha1,
|
|
165
192
|
# :authlogic_sha512 (then you should set stretches above to 20 for default behavior)
|
|
166
193
|
# and :restful_authentication_sha1 (then you should set stretches to 10, and copy
|
|
167
|
-
# REST_AUTH_SITE_KEY to pepper)
|
|
194
|
+
# REST_AUTH_SITE_KEY to pepper).
|
|
195
|
+
#
|
|
196
|
+
# Require the `devise-encryptable` gem when using anything other than bcrypt
|
|
168
197
|
# config.encryptor = :sha512
|
|
169
198
|
|
|
170
|
-
# ==> Configuration for :token_authenticatable
|
|
171
|
-
# Defines name of the authentication token params key
|
|
172
|
-
# config.token_authentication_key = :auth_token
|
|
173
|
-
|
|
174
199
|
# ==> Scopes configuration
|
|
175
200
|
# Turn scoped views on. Before rendering "sessions/new", it will first check for
|
|
176
201
|
# "users/sessions/new". It's turned off by default because it's slower if you
|
|
@@ -181,9 +206,8 @@ Devise.setup do |config|
|
|
|
181
206
|
# devise role declared in your routes (usually :user).
|
|
182
207
|
# config.default_scope = :user
|
|
183
208
|
|
|
184
|
-
#
|
|
185
|
-
#
|
|
186
|
-
# The default is true, which means any logout action will sign out all active scopes.
|
|
209
|
+
# Set this configuration to false if you want /users/sign_out to sign out
|
|
210
|
+
# only the current scope. By default, Devise signs out all scopes.
|
|
187
211
|
# config.sign_out_all_scopes = true
|
|
188
212
|
|
|
189
213
|
# ==> Navigation configuration
|
|
@@ -195,7 +219,7 @@ Devise.setup do |config|
|
|
|
195
219
|
# should add them to the navigational formats lists.
|
|
196
220
|
#
|
|
197
221
|
# The "*/*" below is required to match Internet Explorer requests.
|
|
198
|
-
# config.navigational_formats = [
|
|
222
|
+
# config.navigational_formats = ['*/*', :html]
|
|
199
223
|
|
|
200
224
|
# The default HTTP method used to sign out a resource. Default is :delete.
|
|
201
225
|
config.sign_out_via = :delete
|
|
@@ -213,4 +237,18 @@ Devise.setup do |config|
|
|
|
213
237
|
# manager.intercept_401 = false
|
|
214
238
|
# manager.default_strategies(:scope => :user).unshift :some_external_strategy
|
|
215
239
|
# end
|
|
240
|
+
|
|
241
|
+
# ==> Mountable engine configurations
|
|
242
|
+
# When using Devise inside an engine, let's call it `MyEngine`, and this engine
|
|
243
|
+
# is mountable, there are some extra configurations to be taken into account.
|
|
244
|
+
# The following options are available, assuming the engine is mounted as:
|
|
245
|
+
#
|
|
246
|
+
# mount MyEngine, at: '/my_engine'
|
|
247
|
+
#
|
|
248
|
+
# The router that invoked `devise_for`, in the example above, would be:
|
|
249
|
+
# config.router_name = :my_engine
|
|
250
|
+
#
|
|
251
|
+
# When using omniauth, Devise cannot automatically set Omniauth path,
|
|
252
|
+
# so you need to do it manually. For the users scope, it would be:
|
|
253
|
+
# config.omniauth_path_prefix = '/my_engine/users/auth'
|
|
216
254
|
end
|
|
@@ -0,0 +1,49 @@
|
|
|
1
|
+
require 'rails/generators/migration'
|
|
2
|
+
|
|
3
|
+
module Sso
|
|
4
|
+
module Auth
|
|
5
|
+
module Generators
|
|
6
|
+
class InstallGenerator < Rails::Generators::Base
|
|
7
|
+
include Rails::Generators::Migration
|
|
8
|
+
|
|
9
|
+
source_root File.expand_path('../templates', __FILE__)
|
|
10
|
+
|
|
11
|
+
def self.next_migration_number(dirname)
|
|
12
|
+
@number ||= Time.now.strftime('%Y%m%d%H%M%S').to_i
|
|
13
|
+
@number += 1
|
|
14
|
+
end
|
|
15
|
+
|
|
16
|
+
def create_models
|
|
17
|
+
template 'app/models/ability.rb'
|
|
18
|
+
template 'app/models/user.rb'
|
|
19
|
+
template 'app/models/permission.rb'
|
|
20
|
+
end
|
|
21
|
+
|
|
22
|
+
def create_controllers
|
|
23
|
+
template 'app/controllers/manage/application_controller.rb'
|
|
24
|
+
end
|
|
25
|
+
|
|
26
|
+
def add_routes
|
|
27
|
+
route "devise_scope :users do
|
|
28
|
+
get 'sign_out' => 'sso/auth/sessions#destroy', :as => :destroy_user_session
|
|
29
|
+
get 'sign_in' => redirect('/auth/auth/identity'), :as => :new_user_session
|
|
30
|
+
end"
|
|
31
|
+
route "devise_for :users, :path => 'auth', :controllers => {:omniauth_callbacks => 'sso/auth/omniauth_callbacks'}, :skip => [:sessions]"
|
|
32
|
+
end
|
|
33
|
+
|
|
34
|
+
def create_specs
|
|
35
|
+
template 'spec/models/ability_spec.rb'
|
|
36
|
+
end
|
|
37
|
+
|
|
38
|
+
def create_migrations
|
|
39
|
+
migration_template 'db/migrate/create_users.rb'
|
|
40
|
+
migration_template 'db/migrate/create_permissions.rb'
|
|
41
|
+
end
|
|
42
|
+
|
|
43
|
+
def create_403_page
|
|
44
|
+
copy_file 'public/403.html', 'public/403.html'
|
|
45
|
+
end
|
|
46
|
+
end
|
|
47
|
+
end
|
|
48
|
+
end
|
|
49
|
+
end
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
data/lib/generators/{sso-auth/install → sso/auth}/templates/db/migrate/create_permissions.rb
RENAMED
|
@@ -7,5 +7,10 @@ class CreatePermissions < ActiveRecord::Migration
|
|
|
7
7
|
t.timestamps
|
|
8
8
|
end
|
|
9
9
|
add_index :permissions, [:user_id, :role, :context_id, :context_type], :name => 'by_user_and_role_and_context', :uniq => true
|
|
10
|
+
|
|
11
|
+
User.find_or_initialize_by_uid('1').tap do | user |
|
|
12
|
+
user.save(:validate => false)
|
|
13
|
+
user.permissions.create! :role => :manager if user.permissions.empty?
|
|
14
|
+
end
|
|
10
15
|
end
|
|
11
16
|
end
|
|
File without changes
|
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
<!DOCTYPE html>
|
|
2
|
+
<html>
|
|
3
|
+
<head>
|
|
4
|
+
<title>Access Denied (403)</title>
|
|
5
|
+
<style type="text/css">
|
|
6
|
+
body { background-color: #fff; color: #666; text-align: center; font-family: arial, sans-serif; }
|
|
7
|
+
div.dialog {
|
|
8
|
+
width: 25em;
|
|
9
|
+
padding: 0 4em;
|
|
10
|
+
margin: 4em auto 0 auto;
|
|
11
|
+
border: 1px solid #ccc;
|
|
12
|
+
border-right-color: #999;
|
|
13
|
+
border-bottom-color: #999;
|
|
14
|
+
}
|
|
15
|
+
h1 { font-size: 100%; color: #f00; line-height: 1.5em; }
|
|
16
|
+
</style>
|
|
17
|
+
</head>
|
|
18
|
+
|
|
19
|
+
<body>
|
|
20
|
+
<!-- This file lives in public/403.html -->
|
|
21
|
+
<div class="dialog">
|
|
22
|
+
<h1>Access Denied</h1>
|
|
23
|
+
<p>You don't have permission to access this page.</p>
|
|
24
|
+
</div>
|
|
25
|
+
</body>
|
|
26
|
+
</html>
|
|
File without changes
|
data/lib/sso/auth.rb
ADDED
|
@@ -0,0 +1,103 @@
|
|
|
1
|
+
module Sso
|
|
2
|
+
module Auth
|
|
3
|
+
class Engine < ::Rails::Engine
|
|
4
|
+
isolate_namespace Sso::Auth
|
|
5
|
+
|
|
6
|
+
config.after_initialize do
|
|
7
|
+
begin
|
|
8
|
+
Settings.define 'sso.url', :env_var => 'SSO_URL', :require => true
|
|
9
|
+
Settings.define 'sso.key', :env_var => 'SSO_KEY', :require => true
|
|
10
|
+
Settings.define 'sso.secret', :env_var => 'SSO_SECRET', :require => true
|
|
11
|
+
Settings.define 'devise.secret', :env_var => 'DEVISE_SECRET', :require => true
|
|
12
|
+
|
|
13
|
+
Settings.resolve!
|
|
14
|
+
rescue => e
|
|
15
|
+
puts "WARNING! #{e.message}"
|
|
16
|
+
end
|
|
17
|
+
end
|
|
18
|
+
|
|
19
|
+
initializer "sso_client.devise", :before => 'devise.omniauth' do |app|
|
|
20
|
+
require File.expand_path("../../../omniauth/strategies/identity", __FILE__)
|
|
21
|
+
Devise.setup do |config|
|
|
22
|
+
config.omniauth :identity, Settings['sso.key'], Settings['sso.secret'], :client_options => { :site => Settings['sso.url'] }
|
|
23
|
+
end
|
|
24
|
+
end
|
|
25
|
+
|
|
26
|
+
config.to_prepare do
|
|
27
|
+
ActionController::Base.class_eval do
|
|
28
|
+
define_singleton_method :sso_authenticate_and_authorize do
|
|
29
|
+
before_filter :authenticate_user!
|
|
30
|
+
before_filter :authorize_manage_application!
|
|
31
|
+
rescue_from CanCan::AccessDenied do |exception|
|
|
32
|
+
render :file => "#{Rails.root}/public/403", :formats => [:html], :status => 403, :layout => false
|
|
33
|
+
end
|
|
34
|
+
end
|
|
35
|
+
|
|
36
|
+
define_singleton_method :sso_load_and_authorize_resource do
|
|
37
|
+
sso_authenticate_and_authorize
|
|
38
|
+
inherit_resources
|
|
39
|
+
load_and_authorize_resource
|
|
40
|
+
end
|
|
41
|
+
|
|
42
|
+
protected
|
|
43
|
+
|
|
44
|
+
define_method :authorize_manage_application! do
|
|
45
|
+
authorize! :manage, :application
|
|
46
|
+
end
|
|
47
|
+
end
|
|
48
|
+
ActiveRecord::Base.class_eval do
|
|
49
|
+
def self.sso_auth_user
|
|
50
|
+
has_many :permissions, :dependent => :destroy
|
|
51
|
+
|
|
52
|
+
devise :omniauthable, :trackable, :timeoutable
|
|
53
|
+
|
|
54
|
+
Permission.available_roles.each do |role|
|
|
55
|
+
define_method "#{role}_of?" do |context|
|
|
56
|
+
permissions.for_role(role).for_context(context).exists?
|
|
57
|
+
end
|
|
58
|
+
define_method "#{role}?" do
|
|
59
|
+
permissions.for_role(role).exists?
|
|
60
|
+
end
|
|
61
|
+
end
|
|
62
|
+
|
|
63
|
+
define_method :sso_auth_name do
|
|
64
|
+
email? ? "#{name} <#{email}>" : name
|
|
65
|
+
end
|
|
66
|
+
|
|
67
|
+
define_singleton_method :find_or_create_by_omniauth_hash do |omniauth_hash|
|
|
68
|
+
user = User.find_by_uid(omniauth_hash[:uid])
|
|
69
|
+
user ||= User.find_by_email(omniauth_hash[:info][:email]) if omniauth_hash[:info][:email].present?
|
|
70
|
+
user ||= User.new
|
|
71
|
+
user.uid = omniauth_hash[:uid]
|
|
72
|
+
attributes = omniauth_hash[:extra][:raw_info][:user].dup || {}
|
|
73
|
+
attributes.delete(:uid)
|
|
74
|
+
attributes = attributes.merge(omniauth_hash[:info])
|
|
75
|
+
attributes[:raw_info] = omniauth_hash[:extra][:raw_info].to_json
|
|
76
|
+
attributes.each do |attribute, value|
|
|
77
|
+
user.send("#{attribute}=", value) if user.respond_to?("#{attribute}=")
|
|
78
|
+
end
|
|
79
|
+
user.save(:validate => false)
|
|
80
|
+
user
|
|
81
|
+
end
|
|
82
|
+
end
|
|
83
|
+
|
|
84
|
+
def self.sso_auth_permission(options)
|
|
85
|
+
define_singleton_method :available_roles do
|
|
86
|
+
options[:roles].map(&:to_s)
|
|
87
|
+
end
|
|
88
|
+
|
|
89
|
+
belongs_to :context, :polymorphic => true
|
|
90
|
+
belongs_to :user
|
|
91
|
+
|
|
92
|
+
validates_inclusion_of :role, :in => available_roles + available_roles.map(&:to_sym)
|
|
93
|
+
validates_presence_of :role, :user
|
|
94
|
+
validates_uniqueness_of :role, :scope => [:user_id, :context_id, :context_type]
|
|
95
|
+
|
|
96
|
+
scope :for_role, ->(role) { where(:role => role) }
|
|
97
|
+
scope :for_context, ->(context) { where(:context_id => context.try(:id), :context_type => context.try(:class)) }
|
|
98
|
+
end
|
|
99
|
+
end
|
|
100
|
+
end
|
|
101
|
+
end
|
|
102
|
+
end
|
|
103
|
+
end
|
|
@@ -0,0 +1,50 @@
|
|
|
1
|
+
module Sso
|
|
2
|
+
module Auth
|
|
3
|
+
module SpecHelper
|
|
4
|
+
|
|
5
|
+
def ability_for(user)
|
|
6
|
+
Ability.new(user)
|
|
7
|
+
end
|
|
8
|
+
|
|
9
|
+
def create_user
|
|
10
|
+
@sequence ||= 0
|
|
11
|
+
@sequence += 1
|
|
12
|
+
User.new.tap do |user|
|
|
13
|
+
user.uid = @sequence
|
|
14
|
+
user.save(:validate => false)
|
|
15
|
+
end
|
|
16
|
+
end
|
|
17
|
+
|
|
18
|
+
def user_with_role(role, context=nil, prefix=nil, user=nil)
|
|
19
|
+
@roles ||= {}
|
|
20
|
+
@roles["#{prefix}_#{role}"] ||= {}
|
|
21
|
+
@roles["#{prefix}_#{role}"][context] ||= (user || create_user).tap do |user|
|
|
22
|
+
user.permissions.create!({:context => context, :role => role}, :without_protection => true)
|
|
23
|
+
end
|
|
24
|
+
end
|
|
25
|
+
|
|
26
|
+
def user
|
|
27
|
+
@user ||= create_user
|
|
28
|
+
end
|
|
29
|
+
|
|
30
|
+
def another_user
|
|
31
|
+
@another_user ||= create_user
|
|
32
|
+
end
|
|
33
|
+
|
|
34
|
+
Permission.available_roles.each do | role |
|
|
35
|
+
define_method "#{role}_of" do |context, params={}|
|
|
36
|
+
user_with_role role, context, nil, params[:user]
|
|
37
|
+
end
|
|
38
|
+
define_method "#{role}" do
|
|
39
|
+
self.send("#{role}_of", nil)
|
|
40
|
+
end
|
|
41
|
+
define_method "another_#{role}_of" do |context, params={}|
|
|
42
|
+
user_with_role role, context, "another", params[:user]
|
|
43
|
+
end
|
|
44
|
+
define_method "another_#{role}" do
|
|
45
|
+
self.send("another_#{role}_of", nil)
|
|
46
|
+
end
|
|
47
|
+
end
|
|
48
|
+
end
|
|
49
|
+
end
|
|
50
|
+
end
|
metadata
CHANGED
|
@@ -1,174 +1,167 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: sso-auth
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.0.
|
|
5
|
-
prerelease:
|
|
4
|
+
version: 0.0.7
|
|
6
5
|
platform: ruby
|
|
7
6
|
authors:
|
|
8
7
|
- http://openteam.ru
|
|
9
8
|
autorequire:
|
|
10
9
|
bindir: bin
|
|
11
10
|
cert_chain: []
|
|
12
|
-
date: 2013-
|
|
11
|
+
date: 2013-11-29 00:00:00.000000000 Z
|
|
13
12
|
dependencies:
|
|
14
13
|
- !ruby/object:Gem::Dependency
|
|
15
14
|
name: cancan
|
|
16
15
|
requirement: !ruby/object:Gem::Requirement
|
|
17
|
-
none: false
|
|
18
16
|
requirements:
|
|
19
|
-
- -
|
|
17
|
+
- - '>='
|
|
20
18
|
- !ruby/object:Gem::Version
|
|
21
19
|
version: '0'
|
|
22
20
|
type: :runtime
|
|
23
21
|
prerelease: false
|
|
24
22
|
version_requirements: !ruby/object:Gem::Requirement
|
|
25
|
-
none: false
|
|
26
23
|
requirements:
|
|
27
|
-
- -
|
|
24
|
+
- - '>='
|
|
28
25
|
- !ruby/object:Gem::Version
|
|
29
26
|
version: '0'
|
|
30
27
|
- !ruby/object:Gem::Dependency
|
|
31
28
|
name: configliere
|
|
32
29
|
requirement: !ruby/object:Gem::Requirement
|
|
33
|
-
none: false
|
|
34
30
|
requirements:
|
|
35
|
-
- -
|
|
31
|
+
- - '>='
|
|
36
32
|
- !ruby/object:Gem::Version
|
|
37
33
|
version: '0'
|
|
38
34
|
type: :runtime
|
|
39
35
|
prerelease: false
|
|
40
36
|
version_requirements: !ruby/object:Gem::Requirement
|
|
41
|
-
none: false
|
|
42
37
|
requirements:
|
|
43
|
-
- -
|
|
38
|
+
- - '>='
|
|
44
39
|
- !ruby/object:Gem::Version
|
|
45
40
|
version: '0'
|
|
46
41
|
- !ruby/object:Gem::Dependency
|
|
47
42
|
name: devise
|
|
48
43
|
requirement: !ruby/object:Gem::Requirement
|
|
49
|
-
none: false
|
|
50
44
|
requirements:
|
|
51
|
-
- -
|
|
45
|
+
- - '>='
|
|
52
46
|
- !ruby/object:Gem::Version
|
|
53
47
|
version: '0'
|
|
54
48
|
type: :runtime
|
|
55
49
|
prerelease: false
|
|
56
50
|
version_requirements: !ruby/object:Gem::Requirement
|
|
57
|
-
none: false
|
|
58
51
|
requirements:
|
|
59
|
-
- -
|
|
52
|
+
- - '>='
|
|
53
|
+
- !ruby/object:Gem::Version
|
|
54
|
+
version: '0'
|
|
55
|
+
- !ruby/object:Gem::Dependency
|
|
56
|
+
name: devise-russian
|
|
57
|
+
requirement: !ruby/object:Gem::Requirement
|
|
58
|
+
requirements:
|
|
59
|
+
- - '>='
|
|
60
|
+
- !ruby/object:Gem::Version
|
|
61
|
+
version: '0'
|
|
62
|
+
type: :runtime
|
|
63
|
+
prerelease: false
|
|
64
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
65
|
+
requirements:
|
|
66
|
+
- - '>='
|
|
60
67
|
- !ruby/object:Gem::Version
|
|
61
68
|
version: '0'
|
|
62
69
|
- !ruby/object:Gem::Dependency
|
|
63
70
|
name: omniauth
|
|
64
71
|
requirement: !ruby/object:Gem::Requirement
|
|
65
|
-
none: false
|
|
66
72
|
requirements:
|
|
67
|
-
- -
|
|
73
|
+
- - '>='
|
|
68
74
|
- !ruby/object:Gem::Version
|
|
69
75
|
version: '0'
|
|
70
76
|
type: :runtime
|
|
71
77
|
prerelease: false
|
|
72
78
|
version_requirements: !ruby/object:Gem::Requirement
|
|
73
|
-
none: false
|
|
74
79
|
requirements:
|
|
75
|
-
- -
|
|
80
|
+
- - '>='
|
|
76
81
|
- !ruby/object:Gem::Version
|
|
77
82
|
version: '0'
|
|
78
83
|
- !ruby/object:Gem::Dependency
|
|
79
84
|
name: omniauth-oauth2
|
|
80
85
|
requirement: !ruby/object:Gem::Requirement
|
|
81
|
-
none: false
|
|
82
86
|
requirements:
|
|
83
|
-
- -
|
|
87
|
+
- - '>='
|
|
84
88
|
- !ruby/object:Gem::Version
|
|
85
89
|
version: '0'
|
|
86
90
|
type: :runtime
|
|
87
91
|
prerelease: false
|
|
88
92
|
version_requirements: !ruby/object:Gem::Requirement
|
|
89
|
-
none: false
|
|
90
93
|
requirements:
|
|
91
|
-
- -
|
|
94
|
+
- - '>='
|
|
92
95
|
- !ruby/object:Gem::Version
|
|
93
96
|
version: '0'
|
|
94
97
|
- !ruby/object:Gem::Dependency
|
|
95
98
|
name: annotate
|
|
96
99
|
requirement: !ruby/object:Gem::Requirement
|
|
97
|
-
none: false
|
|
98
100
|
requirements:
|
|
99
|
-
- -
|
|
101
|
+
- - '>='
|
|
100
102
|
- !ruby/object:Gem::Version
|
|
101
103
|
version: '0'
|
|
102
104
|
type: :development
|
|
103
105
|
prerelease: false
|
|
104
106
|
version_requirements: !ruby/object:Gem::Requirement
|
|
105
|
-
none: false
|
|
106
107
|
requirements:
|
|
107
|
-
- -
|
|
108
|
+
- - '>='
|
|
108
109
|
- !ruby/object:Gem::Version
|
|
109
110
|
version: '0'
|
|
110
111
|
- !ruby/object:Gem::Dependency
|
|
111
112
|
name: rails
|
|
112
113
|
requirement: !ruby/object:Gem::Requirement
|
|
113
|
-
none: false
|
|
114
114
|
requirements:
|
|
115
|
-
- -
|
|
115
|
+
- - '>='
|
|
116
116
|
- !ruby/object:Gem::Version
|
|
117
117
|
version: '0'
|
|
118
118
|
type: :development
|
|
119
119
|
prerelease: false
|
|
120
120
|
version_requirements: !ruby/object:Gem::Requirement
|
|
121
|
-
none: false
|
|
122
121
|
requirements:
|
|
123
|
-
- -
|
|
122
|
+
- - '>='
|
|
124
123
|
- !ruby/object:Gem::Version
|
|
125
124
|
version: '0'
|
|
126
125
|
- !ruby/object:Gem::Dependency
|
|
127
126
|
name: rspec-rails
|
|
128
127
|
requirement: !ruby/object:Gem::Requirement
|
|
129
|
-
none: false
|
|
130
128
|
requirements:
|
|
131
|
-
- -
|
|
129
|
+
- - '>='
|
|
132
130
|
- !ruby/object:Gem::Version
|
|
133
131
|
version: '0'
|
|
134
132
|
type: :development
|
|
135
133
|
prerelease: false
|
|
136
134
|
version_requirements: !ruby/object:Gem::Requirement
|
|
137
|
-
none: false
|
|
138
135
|
requirements:
|
|
139
|
-
- -
|
|
136
|
+
- - '>='
|
|
140
137
|
- !ruby/object:Gem::Version
|
|
141
138
|
version: '0'
|
|
142
139
|
- !ruby/object:Gem::Dependency
|
|
143
140
|
name: shoulda-matchers
|
|
144
141
|
requirement: !ruby/object:Gem::Requirement
|
|
145
|
-
none: false
|
|
146
142
|
requirements:
|
|
147
|
-
- -
|
|
143
|
+
- - '>='
|
|
148
144
|
- !ruby/object:Gem::Version
|
|
149
145
|
version: '0'
|
|
150
146
|
type: :development
|
|
151
147
|
prerelease: false
|
|
152
148
|
version_requirements: !ruby/object:Gem::Requirement
|
|
153
|
-
none: false
|
|
154
149
|
requirements:
|
|
155
|
-
- -
|
|
150
|
+
- - '>='
|
|
156
151
|
- !ruby/object:Gem::Version
|
|
157
152
|
version: '0'
|
|
158
153
|
- !ruby/object:Gem::Dependency
|
|
159
154
|
name: sqlite3
|
|
160
155
|
requirement: !ruby/object:Gem::Requirement
|
|
161
|
-
none: false
|
|
162
156
|
requirements:
|
|
163
|
-
- -
|
|
157
|
+
- - '>='
|
|
164
158
|
- !ruby/object:Gem::Version
|
|
165
159
|
version: '0'
|
|
166
160
|
type: :development
|
|
167
161
|
prerelease: false
|
|
168
162
|
version_requirements: !ruby/object:Gem::Requirement
|
|
169
|
-
none: false
|
|
170
163
|
requirements:
|
|
171
|
-
- -
|
|
164
|
+
- - '>='
|
|
172
165
|
- !ruby/object:Gem::Version
|
|
173
166
|
version: '0'
|
|
174
167
|
description: Description of SsoAuth.
|
|
@@ -178,58 +171,50 @@ executables: []
|
|
|
178
171
|
extensions: []
|
|
179
172
|
extra_rdoc_files: []
|
|
180
173
|
files:
|
|
181
|
-
- app/controllers/
|
|
182
|
-
- app/controllers/
|
|
174
|
+
- app/controllers/sso/auth/omniauth_callbacks_controller.rb
|
|
175
|
+
- app/controllers/sso/auth/sessions_controller.rb
|
|
183
176
|
- app/views/sso-auth/shared/_user_box.html.erb
|
|
184
177
|
- config/initializers/devise.rb
|
|
185
178
|
- config/locales/en.yml
|
|
186
179
|
- config/locales/ru.yml
|
|
187
|
-
-
|
|
188
|
-
- lib/generators/sso
|
|
189
|
-
- lib/generators/sso
|
|
190
|
-
- lib/generators/sso
|
|
191
|
-
- lib/generators/sso
|
|
192
|
-
- lib/generators/sso
|
|
193
|
-
- lib/generators/sso
|
|
194
|
-
- lib/generators/sso
|
|
195
|
-
- lib/generators/sso
|
|
196
|
-
- lib/generators/sso-auth/install/templates/spec/models/ability_spec.rb
|
|
180
|
+
- lib/generators/sso/auth/install_generator.rb
|
|
181
|
+
- lib/generators/sso/auth/templates/app/controllers/manage/application_controller.rb
|
|
182
|
+
- lib/generators/sso/auth/templates/app/models/ability.rb
|
|
183
|
+
- lib/generators/sso/auth/templates/app/models/permission.rb
|
|
184
|
+
- lib/generators/sso/auth/templates/app/models/user.rb
|
|
185
|
+
- lib/generators/sso/auth/templates/db/migrate/create_permissions.rb
|
|
186
|
+
- lib/generators/sso/auth/templates/db/migrate/create_users.rb
|
|
187
|
+
- lib/generators/sso/auth/templates/public/403.html
|
|
188
|
+
- lib/generators/sso/auth/templates/spec/models/ability_spec.rb
|
|
197
189
|
- lib/omniauth/strategies/identity.rb
|
|
198
|
-
- lib/sso
|
|
199
|
-
- lib/sso
|
|
200
|
-
- lib/sso
|
|
201
|
-
- lib/sso
|
|
190
|
+
- lib/sso/auth/engine.rb
|
|
191
|
+
- lib/sso/auth/spec_helper.rb
|
|
192
|
+
- lib/sso/auth/version.rb
|
|
193
|
+
- lib/sso/auth.rb
|
|
202
194
|
- MIT-LICENSE
|
|
203
195
|
- Rakefile
|
|
204
196
|
- README.rdoc
|
|
205
197
|
homepage:
|
|
206
198
|
licenses: []
|
|
199
|
+
metadata: {}
|
|
207
200
|
post_install_message:
|
|
208
201
|
rdoc_options: []
|
|
209
202
|
require_paths:
|
|
210
203
|
- lib
|
|
211
204
|
required_ruby_version: !ruby/object:Gem::Requirement
|
|
212
|
-
none: false
|
|
213
205
|
requirements:
|
|
214
|
-
- -
|
|
206
|
+
- - '>='
|
|
215
207
|
- !ruby/object:Gem::Version
|
|
216
208
|
version: '0'
|
|
217
|
-
segments:
|
|
218
|
-
- 0
|
|
219
|
-
hash: -4140832109074497253
|
|
220
209
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
|
221
|
-
none: false
|
|
222
210
|
requirements:
|
|
223
|
-
- -
|
|
211
|
+
- - '>='
|
|
224
212
|
- !ruby/object:Gem::Version
|
|
225
213
|
version: '0'
|
|
226
|
-
segments:
|
|
227
|
-
- 0
|
|
228
|
-
hash: -4140832109074497253
|
|
229
214
|
requirements: []
|
|
230
215
|
rubyforge_project:
|
|
231
|
-
rubygems_version: 1.
|
|
216
|
+
rubygems_version: 2.1.11
|
|
232
217
|
signing_key:
|
|
233
|
-
specification_version:
|
|
218
|
+
specification_version: 4
|
|
234
219
|
summary: Summary of SsoAuth.
|
|
235
220
|
test_files: []
|
data/config/routes.rb
DELETED
|
@@ -1,11 +0,0 @@
|
|
|
1
|
-
Rails.application.routes.draw do
|
|
2
|
-
devise_for :users, :path => 'auth',
|
|
3
|
-
:controllers => {:omniauth_callbacks => 'sso_auth/omniauth_callbacks'},
|
|
4
|
-
:skip => [:sessions]
|
|
5
|
-
|
|
6
|
-
devise_scope :users do
|
|
7
|
-
get 'sign_out' => 'sso-auth/sessions#destroy', :as => :destroy_user_session
|
|
8
|
-
get 'sign_in' => redirect('/auth/auth/identity'), :as => :new_user_session
|
|
9
|
-
end
|
|
10
|
-
end
|
|
11
|
-
|
|
@@ -1,40 +0,0 @@
|
|
|
1
|
-
require 'rails/generators/migration'
|
|
2
|
-
|
|
3
|
-
module SsoAuth
|
|
4
|
-
module Generators
|
|
5
|
-
class InstallGenerator < Rails::Generators::Base
|
|
6
|
-
include Rails::Generators::Migration
|
|
7
|
-
|
|
8
|
-
source_root File.expand_path('../templates', __FILE__)
|
|
9
|
-
|
|
10
|
-
def self.next_migration_number(dirname)
|
|
11
|
-
@number ||= Time.now.strftime('%Y%m%d%H%M%S').to_i
|
|
12
|
-
@number += 1
|
|
13
|
-
end
|
|
14
|
-
|
|
15
|
-
def create_models
|
|
16
|
-
template 'app/models/ability.rb'
|
|
17
|
-
template 'app/models/user.rb'
|
|
18
|
-
template 'app/models/permission.rb'
|
|
19
|
-
end
|
|
20
|
-
|
|
21
|
-
def create_controllers
|
|
22
|
-
template 'app/controllers/manage/application_controller.rb'
|
|
23
|
-
end
|
|
24
|
-
|
|
25
|
-
def create_seeds
|
|
26
|
-
template 'db/seeds.rb'
|
|
27
|
-
end
|
|
28
|
-
|
|
29
|
-
def create_specs
|
|
30
|
-
template 'spec/models/ability_spec.rb'
|
|
31
|
-
end
|
|
32
|
-
|
|
33
|
-
def create_migrations
|
|
34
|
-
migration_template 'db/migrate/create_users.rb'
|
|
35
|
-
migration_template 'db/migrate/create_permissions.rb'
|
|
36
|
-
end
|
|
37
|
-
|
|
38
|
-
end
|
|
39
|
-
end
|
|
40
|
-
end
|
data/lib/sso-auth.rb
DELETED
data/lib/sso-auth/engine.rb
DELETED
|
@@ -1,100 +0,0 @@
|
|
|
1
|
-
module SsoAuth
|
|
2
|
-
class Engine < ::Rails::Engine
|
|
3
|
-
isolate_namespace SsoAuth
|
|
4
|
-
|
|
5
|
-
config.after_initialize do
|
|
6
|
-
begin
|
|
7
|
-
Settings.define 'sso.url', :env_var => 'SSO_URL', :require => true
|
|
8
|
-
Settings.define 'sso.key', :env_var => 'SSO_KEY', :require => true
|
|
9
|
-
Settings.define 'sso.secret', :env_var => 'SSO_SECRET', :require => true
|
|
10
|
-
|
|
11
|
-
Settings.resolve!
|
|
12
|
-
rescue => e
|
|
13
|
-
puts "WARNING! #{e.message}"
|
|
14
|
-
end
|
|
15
|
-
end
|
|
16
|
-
|
|
17
|
-
initializer "sso_client.devise", :before => 'devise.omniauth' do |app|
|
|
18
|
-
require File.expand_path("../../../lib/omniauth/strategies/identity", __FILE__)
|
|
19
|
-
Devise.setup do |config|
|
|
20
|
-
config.omniauth :identity, Settings['sso.key'], Settings['sso.secret'], :client_options => { :site => Settings['sso.url'] }
|
|
21
|
-
end
|
|
22
|
-
end
|
|
23
|
-
|
|
24
|
-
config.to_prepare do
|
|
25
|
-
ActionController::Base.class_eval do
|
|
26
|
-
define_singleton_method :sso_authenticate_and_authorize do
|
|
27
|
-
before_filter :authenticate_user!
|
|
28
|
-
before_filter :authorize_manage_application!
|
|
29
|
-
rescue_from CanCan::AccessDenied do |exception|
|
|
30
|
-
render :file => "#{Rails.root}/public/403", :formats => [:html], :status => 403, :layout => false
|
|
31
|
-
end
|
|
32
|
-
end
|
|
33
|
-
|
|
34
|
-
define_singleton_method :sso_load_and_authorize_resource do
|
|
35
|
-
sso_authenticate_and_authorize
|
|
36
|
-
inherit_resources
|
|
37
|
-
load_and_authorize_resource
|
|
38
|
-
end
|
|
39
|
-
|
|
40
|
-
protected
|
|
41
|
-
|
|
42
|
-
define_method :authorize_manage_application! do
|
|
43
|
-
authorize! :manage, :application
|
|
44
|
-
end
|
|
45
|
-
end
|
|
46
|
-
ActiveRecord::Base.class_eval do
|
|
47
|
-
def self.sso_auth_user
|
|
48
|
-
has_many :permissions, :dependent => :destroy
|
|
49
|
-
|
|
50
|
-
devise :omniauthable, :trackable, :timeoutable
|
|
51
|
-
|
|
52
|
-
Permission.available_roles.each do |role|
|
|
53
|
-
define_method "#{role}_of?" do |context|
|
|
54
|
-
permissions.for_role(role).for_context(context).exists?
|
|
55
|
-
end
|
|
56
|
-
define_method "#{role}?" do
|
|
57
|
-
permissions.for_role(role).exists?
|
|
58
|
-
end
|
|
59
|
-
end
|
|
60
|
-
|
|
61
|
-
define_method :sso_auth_name do
|
|
62
|
-
email? ? "#{name} <#{email}>" : name
|
|
63
|
-
end
|
|
64
|
-
|
|
65
|
-
define_singleton_method :find_or_create_by_omniauth_hash do |omniauth_hash|
|
|
66
|
-
user = User.find_by_uid(omniauth_hash[:uid])
|
|
67
|
-
user ||= User.find_by_email(omniauth_hash[:info][:email]) if omniauth_hash[:info][:email].present?
|
|
68
|
-
user ||= User.new
|
|
69
|
-
user.uid = omniauth_hash[:uid]
|
|
70
|
-
attributes = omniauth_hash[:extra][:raw_info][:user].dup || {}
|
|
71
|
-
attributes.delete(:uid)
|
|
72
|
-
attributes = attributes.merge(omniauth_hash[:info])
|
|
73
|
-
attributes[:raw_info] = omniauth_hash[:extra][:raw_info].to_json
|
|
74
|
-
attributes.each do |attribute, value|
|
|
75
|
-
user.send("#{attribute}=", value) if user.respond_to?("#{attribute}=")
|
|
76
|
-
end
|
|
77
|
-
user.save(:validate => false)
|
|
78
|
-
user
|
|
79
|
-
end
|
|
80
|
-
end
|
|
81
|
-
|
|
82
|
-
def self.sso_auth_permission(options)
|
|
83
|
-
define_singleton_method :available_roles do
|
|
84
|
-
options[:roles].map(&:to_s)
|
|
85
|
-
end
|
|
86
|
-
|
|
87
|
-
belongs_to :context, :polymorphic => true
|
|
88
|
-
belongs_to :user
|
|
89
|
-
|
|
90
|
-
validates_inclusion_of :role, :in => available_roles + available_roles.map(&:to_sym)
|
|
91
|
-
validates_presence_of :role, :user
|
|
92
|
-
validates_uniqueness_of :role, :scope => [:user_id, :context_id, :context_type]
|
|
93
|
-
|
|
94
|
-
scope :for_role, ->(role) { where(:role => role) }
|
|
95
|
-
scope :for_context, ->(context) { where(:context_id => context.try(:id), :context_type => context.try(:class)) }
|
|
96
|
-
end
|
|
97
|
-
end
|
|
98
|
-
end
|
|
99
|
-
end
|
|
100
|
-
end
|
data/lib/sso-auth/spec_helper.rb
DELETED
|
@@ -1,48 +0,0 @@
|
|
|
1
|
-
module SsoAuth
|
|
2
|
-
module SpecHelper
|
|
3
|
-
|
|
4
|
-
def ability_for(user)
|
|
5
|
-
Ability.new(user)
|
|
6
|
-
end
|
|
7
|
-
|
|
8
|
-
def create_user
|
|
9
|
-
@sequence ||= 0
|
|
10
|
-
@sequence += 1
|
|
11
|
-
User.new.tap do |user|
|
|
12
|
-
user.uid = @sequence
|
|
13
|
-
user.save(:validate => false)
|
|
14
|
-
end
|
|
15
|
-
end
|
|
16
|
-
|
|
17
|
-
def user_with_role(role, context=nil, prefix=nil, user=nil)
|
|
18
|
-
@roles ||= {}
|
|
19
|
-
@roles["#{prefix}_#{role}"] ||= {}
|
|
20
|
-
@roles["#{prefix}_#{role}"][context] ||= (user || create_user).tap do |user|
|
|
21
|
-
user.permissions.create!({:context => context, :role => role}, :without_protection => true)
|
|
22
|
-
end
|
|
23
|
-
end
|
|
24
|
-
|
|
25
|
-
def user
|
|
26
|
-
@user ||= create_user
|
|
27
|
-
end
|
|
28
|
-
|
|
29
|
-
def another_user
|
|
30
|
-
@another_user ||= create_user
|
|
31
|
-
end
|
|
32
|
-
|
|
33
|
-
Permission.available_roles.each do | role |
|
|
34
|
-
define_method "#{role}_of" do |context, params={}|
|
|
35
|
-
user_with_role role, context, nil, params[:user]
|
|
36
|
-
end
|
|
37
|
-
define_method "#{role}" do
|
|
38
|
-
self.send("#{role}_of", nil)
|
|
39
|
-
end
|
|
40
|
-
define_method "another_#{role}_of" do |context, params={}|
|
|
41
|
-
user_with_role role, context, "another", params[:user]
|
|
42
|
-
end
|
|
43
|
-
define_method "another_#{role}" do
|
|
44
|
-
self.send("another_#{role}_of", nil)
|
|
45
|
-
end
|
|
46
|
-
end
|
|
47
|
-
end
|
|
48
|
-
end
|
data/lib/sso-auth/version.rb
DELETED