thecore_auth_commons 3.5.1 → 3.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3501e3a58433ec76fbd5795ccfbcf56eb01a422cb539919ada0f28409b53b87b
-  data.tar.gz: de30dc1c6dc253724b3bf464097fb16af162ab0bab653315068c78b1c5a42577
+  metadata.gz: 29a083c2300c45d950b99efa4ff7e8a5642c11212acd01d392bb07f63fb38a19
+  data.tar.gz: 9a20546917d55959cf5aa5d4c272c43e7f09efc5888d80d05d9edbb634b499f8
 SHA512:
-  metadata.gz: 0d0affe0df19b7690ca6bb8a9e90f9f9161dc0c5fe81a1322e92ab49d26e25e122387fc8cb5b1da7156f41ee695cb532c0d6dbedc90ed5ca69cd0d70df2e3006
-  data.tar.gz: 6df28ffee4f2a7595cc7c23d038ac6bd67384c71dcdb96be1e5c6b0e5f78ef736bf6e38c76eaeae1d95d2bfccdbdfd6ca6520495f69843c0d0d3ee95e56c51f2
+  metadata.gz: dbf9f9bcc726736caf0b785807609235d98b56f2180e9b9bd1af32b1167333c739ab27d6992a038b33d8a859612ce09bb6474f9f9851c5f4f0aa6bb74ebb702b
+  data.tar.gz: edf61e953a0cc68f0d9bde2866499e609241519f9511397cb6730e6549d560cfebbdb2a395ec0f61020c8ca0e8a2089b0c7f4dfe6e59e4dec92629ade6066b67

data/app/controllers/users/omniauth_callbacks_controller.rb

@@ -0,0 +1,40 @@
+# app/controllers/users/omniauth_callbacks_controller.rb
+class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
+  def google_oauth2
+    callback 'Google', from_params, 'google'
+  end
+
+  def entra_id
+    callback 'Microsoft Entra ID', from_params, 'entra_id'
+  end
+
+  def callback name, from_params, provider
+    Rails.logger.info "#{name} callback received with params: #{from_params.inspect}"
+
+    user = ThecoreAuthCommons.check_user from_params[:email], from_params[:name], from_params[:surname], provider
+
+    if user.present?
+      sign_out_all_scopes
+      flash[:notice] = t 'devise.omniauth_callbacks.success', kind: name
+      sign_in_and_redirect user, event: :authentication
+    else
+      flash[:alert] = t 'devise.omniauth_callbacks.failure', kind: name, reason: "#{from_params[:email]} is not authorized."
+      redirect_to new_user_session_path
+    end
+  end
+
+  def from_params
+    Rails.logger.info "Omniauth params: #{auth.info.inspect}"
+    @from_params ||= {
+      uid: auth.uid,
+      email: auth.info.email,
+      # in the params from Microsoft or Google there must be laso the name and surname, maybe with different key, assign them to the name and surname keys in this object
+      name: auth.info.given_name.presence || auth.info.first_name.presence || auth.info.name,
+      surname: auth.info.family_name.presence || auth.info.last_name.presence || auth.info.surname
+    }
+  end
+
+  def auth
+    @auth ||= request.env['omniauth.auth']
+  end
+end

data/app/models/user.rb

@@ -1,6 +1,18 @@
 class User < ApplicationRecord
   # Get the minimum password length from the Environemnt or set it to 8
-  devise :database_authenticatable, :rememberable, :trackable, :timeoutable, :validatable, password_length: ENV.fetch('MIN_PASSWORD_LENGTH', 8).to_i..128, timeout_in: ENV.fetch('SESSION_TIMEOUT_IN_MINUTES', 31).to_i.minutes
+  devise :database_authenticatable, 
+    :rememberable, 
+    :trackable, 
+    :timeoutable,
+    :omniauthable,
+    :validatable,
+    # Devise modules configurations:
+    # Omniauthable allows the user to sign in with external providers
+    :omniauth_providers => [:google_oauth2, :entra_id],
+    # Validatable allows the user to validate their email and password
+    :password_length => ENV.fetch('MIN_PASSWORD_LENGTH', 8).to_i..128,
+    :timeout_in => ENV.fetch('SESSION_TIMEOUT_IN_MINUTES', 31).to_i.minutes
+
 
   # REFERENCES
   has_many :role_users, dependent: :destroy, inverse_of: :user

data/config/initializers/omniauth.rb

@@ -0,0 +1,30 @@
+include Devise::OmniAuth::UrlHelpers if defined?(Devise::OmniAuth::UrlHelpers)
+
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider(
+    :entra_id,
+    {
+      client_id: ENV['ENTRA_CLIENT_ID'],
+      client_secret: ENV['ENTRA_CLIENT_SECRET'],
+      tenant_id: ENV['ENTRA_TENANT_ID'], # Needed for Microsoft
+      scope: 'openid profile email User.Read',
+      response_type: 'code'
+    },
+    {
+      label: "Microsoft"
+    }
+  )
+  provider(
+    :google_oauth2, 
+    ENV['GOOGLE_CLIENT_ID'], 
+    ENV['GOOGLE_CLIENT_SECRET'], 
+    {
+      scope: 'email,profile',
+      prompt: 'select_account',
+      access_type: 'online'
+    }
+  )
+end
+
+OmniAuth.config.allowed_request_methods = [:get, :post]
+OmniAuth.config.silence_get_warning = true

data/lib/thecore_auth_commons/version.rb

@@ -1,3 +1,3 @@
 module ThecoreAuthCommons
-  VERSION = "3.5.1".freeze
+  VERSION = "3.5.2".freeze
 end

data/lib/thecore_auth_commons.rb

@@ -13,6 +13,20 @@ require "thecore_auth_commons/engine"
 require "thecore/seed"
 
 module ThecoreAuthCommons
+  def self.oauth_vars? 
+    (ENV['ENTRA_CLIENT_ID'].present? && ENV['ENTRA_CLIENT_SECRET'].present? && ENV['ENTRA_TENANT_ID'].present?) || (ENV['GOOGLE_CLIENT_ID'].present? && ENV['GOOGLE_CLIENT_SECRET'].present?)
+  end
+
+  def self.check_user email, name, surname, provider
+    u = User.find_or_initialize_by(email: email)
+    u.name = name
+    u.surname = surname
+    u.password = u.password_confirmation = generate_secure_password
+    u.auth_source = provider # 'google' or 'microsoft'
+    u.admin = true
+    u.save if u.changed?
+    u
+  end
 
   def self.import_ldap_users_task
     puts "== Avvio sincronizzazione utenti da LDAP =="

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: thecore_auth_commons
 version: !ruby/object:Gem::Version
-  version: 3.5.1
+  version: 3.5.2
 platform: ruby
 authors:
 - Gabriele Tassoni
@@ -235,6 +235,7 @@ extra_rdoc_files: []
 files:
 - README.md
 - Rakefile
+- app/controllers/users/omniauth_callbacks_controller.rb
 - app/controllers/users/sessions_controller.rb
 - app/jobs/background_ldap_import_job.rb
 - app/models/action.rb
@@ -254,6 +255,7 @@ files:
 - config/initializers/add_to_db_migrations.rb
 - config/initializers/after_initialize.rb
 - config/initializers/concern_cancancan.rb
+- config/initializers/omniauth.rb
 - config/locales/en.permissions.yml
 - config/locales/en.thecore_auth_commons.yml
 - config/locales/it.permissions.yml