thecore_auth_commons 3.4.2 → 3.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4fdbe4e9260df396c669779c3fdaf00ead5e5970d9984bfac66cf7f921401ee4
-  data.tar.gz: ac751c6c84f02de49495b8a04e7c88f9a5b05060356e61b1685ec86589c38971
+  metadata.gz: 29a083c2300c45d950b99efa4ff7e8a5642c11212acd01d392bb07f63fb38a19
+  data.tar.gz: 9a20546917d55959cf5aa5d4c272c43e7f09efc5888d80d05d9edbb634b499f8
 SHA512:
-  metadata.gz: 4fef2c19fc880b692f117526bc30d1e69905c77130a8fb1f6a4cce4cce6a7c6a7d59c7697533cd0c8532aface0bc529dc02b1150d74dbd1b37da76e45bc6ca9f
-  data.tar.gz: a349016ff4cbe7e48a87da6454ec15c761924b16af7a207d5c26e48ac39321aff7ca01ebd7a11e4f8324ad90cc8b85d98cc62b2bb05e947d49d0cd1c4d366e93
+  metadata.gz: dbf9f9bcc726736caf0b785807609235d98b56f2180e9b9bd1af32b1167333c739ab27d6992a038b33d8a859612ce09bb6474f9f9851c5f4f0aa6bb74ebb702b
+  data.tar.gz: edf61e953a0cc68f0d9bde2866499e609241519f9511397cb6730e6549d560cfebbdb2a395ec0f61020c8ca0e8a2089b0c7f4dfe6e59e4dec92629ade6066b67

data/app/controllers/users/omniauth_callbacks_controller.rb

@@ -0,0 +1,40 @@
+# app/controllers/users/omniauth_callbacks_controller.rb
+class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
+  def google_oauth2
+    callback 'Google', from_params, 'google'
+  end
+
+  def entra_id
+    callback 'Microsoft Entra ID', from_params, 'entra_id'
+  end
+
+  def callback name, from_params, provider
+    Rails.logger.info "#{name} callback received with params: #{from_params.inspect}"
+
+    user = ThecoreAuthCommons.check_user from_params[:email], from_params[:name], from_params[:surname], provider
+
+    if user.present?
+      sign_out_all_scopes
+      flash[:notice] = t 'devise.omniauth_callbacks.success', kind: name
+      sign_in_and_redirect user, event: :authentication
+    else
+      flash[:alert] = t 'devise.omniauth_callbacks.failure', kind: name, reason: "#{from_params[:email]} is not authorized."
+      redirect_to new_user_session_path
+    end
+  end
+
+  def from_params
+    Rails.logger.info "Omniauth params: #{auth.info.inspect}"
+    @from_params ||= {
+      uid: auth.uid,
+      email: auth.info.email,
+      # in the params from Microsoft or Google there must be laso the name and surname, maybe with different key, assign them to the name and surname keys in this object
+      name: auth.info.given_name.presence || auth.info.first_name.presence || auth.info.name,
+      surname: auth.info.family_name.presence || auth.info.last_name.presence || auth.info.surname
+    }
+  end
+
+  def auth
+    @auth ||= request.env['omniauth.auth']
+  end
+end

data/app/models/user.rb

@@ -1,6 +1,18 @@
 class User < ApplicationRecord
   # Get the minimum password length from the Environemnt or set it to 8
-  devise :database_authenticatable, :rememberable, :trackable, :timeoutable, :validatable, password_length: ENV.fetch('MIN_PASSWORD_LENGTH', 8).to_i..128, timeout_in: ENV.fetch('SESSION_TIMEOUT_IN_MINUTES', 31).to_i.minutes
+  devise :database_authenticatable, 
+    :rememberable, 
+    :trackable, 
+    :timeoutable,
+    :omniauthable,
+    :validatable,
+    # Devise modules configurations:
+    # Omniauthable allows the user to sign in with external providers
+    :omniauth_providers => [:google_oauth2, :entra_id],
+    # Validatable allows the user to validate their email and password
+    :password_length => ENV.fetch('MIN_PASSWORD_LENGTH', 8).to_i..128,
+    :timeout_in => ENV.fetch('SESSION_TIMEOUT_IN_MINUTES', 31).to_i.minutes
+
 
   # REFERENCES
   has_many :role_users, dependent: :destroy, inverse_of: :user

data/config/initializers/omniauth.rb

@@ -0,0 +1,30 @@
+include Devise::OmniAuth::UrlHelpers if defined?(Devise::OmniAuth::UrlHelpers)
+
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider(
+    :entra_id,
+    {
+      client_id: ENV['ENTRA_CLIENT_ID'],
+      client_secret: ENV['ENTRA_CLIENT_SECRET'],
+      tenant_id: ENV['ENTRA_TENANT_ID'], # Needed for Microsoft
+      scope: 'openid profile email User.Read',
+      response_type: 'code'
+    },
+    {
+      label: "Microsoft"
+    }
+  )
+  provider(
+    :google_oauth2, 
+    ENV['GOOGLE_CLIENT_ID'], 
+    ENV['GOOGLE_CLIENT_SECRET'], 
+    {
+      scope: 'email,profile',
+      prompt: 'select_account',
+      access_type: 'online'
+    }
+  )
+end
+
+OmniAuth.config.allowed_request_methods = [:get, :post]
+OmniAuth.config.silence_get_warning = true

data/lib/thecore_auth_commons/version.rb

@@ -1,3 +1,3 @@
 module ThecoreAuthCommons
-  VERSION = "3.4.2".freeze
+  VERSION = "3.5.2".freeze
 end

data/lib/thecore_auth_commons.rb

@@ -4,12 +4,29 @@ require 'kaminari'
 require 'activerecord-nulldb-adapter'
 require "thecore_settings"
 require "net/ldap"
+require 'omniauth'
+require 'omniauth-google-oauth2'
+require 'omniauth-entra-id'
 
 require "thecore_auth_commons/engine"
 
 require "thecore/seed"
 
 module ThecoreAuthCommons
+  def self.oauth_vars? 
+    (ENV['ENTRA_CLIENT_ID'].present? && ENV['ENTRA_CLIENT_SECRET'].present? && ENV['ENTRA_TENANT_ID'].present?) || (ENV['GOOGLE_CLIENT_ID'].present? && ENV['GOOGLE_CLIENT_SECRET'].present?)
+  end
+
+  def self.check_user email, name, surname, provider
+    u = User.find_or_initialize_by(email: email)
+    u.name = name
+    u.surname = surname
+    u.password = u.password_confirmation = generate_secure_password
+    u.auth_source = provider # 'google' or 'microsoft'
+    u.admin = true
+    u.save if u.changed?
+    u
+  end
 
   def self.import_ldap_users_task
     puts "== Avvio sincronizzazione utenti da LDAP =="

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: thecore_auth_commons
 version: !ruby/object:Gem::Version
-  version: 3.4.2
+  version: 3.5.2
 platform: ruby
 authors:
 - Gabriele Tassoni
@@ -23,6 +23,48 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: omniauth
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
+- !ruby/object:Gem::Dependency
+  name: omniauth-google-oauth2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.2'
+- !ruby/object:Gem::Dependency
+  name: omniauth-entra-id
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: devise
   requirement: !ruby/object:Gem::Requirement
@@ -193,6 +235,7 @@ extra_rdoc_files: []
 files:
 - README.md
 - Rakefile
+- app/controllers/users/omniauth_callbacks_controller.rb
 - app/controllers/users/sessions_controller.rb
 - app/jobs/background_ldap_import_job.rb
 - app/models/action.rb
@@ -212,6 +255,7 @@ files:
 - config/initializers/add_to_db_migrations.rb
 - config/initializers/after_initialize.rb
 - config/initializers/concern_cancancan.rb
+- config/initializers/omniauth.rb
 - config/locales/en.permissions.yml
 - config/locales/en.thecore_auth_commons.yml
 - config/locales/it.permissions.yml