thecore_auth_commons 3.6.2 → 3.6.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a2e252301334fb7245c39abbf78f6f999e3025ba309ff34167ba9cde0fba26db
-  data.tar.gz: 962f5fb41a22bccc567bcc1a10094a705ae488af244bb84af3f9cb330de2caa5
+  metadata.gz: 3e5604a65938fe43fe952c42c11bdc339ff3217d7d0ca63b659ae5c871c9be5f
+  data.tar.gz: a7a71c049092955e8e2d47c0117ed62e693d7505ea21cb74ad0d9a3837ab4d13
 SHA512:
-  metadata.gz: 3e10fd5b4b36f478eeb6612c9336400e3cf9a49b0ce8938a74b8bb77e9108c464b96478e6d45c1a38fa4acf947675e6246878dd668e86d94a86e621856d0edf1
-  data.tar.gz: d50a7f9e96935300394691c04da037ded09759e5268c840ae2817172ecb550873b133ac0de3d517ff88711df08ae207c870f2c5f4857ff608240b061e4b6870b
+  metadata.gz: f13691ce6ca514d637d5031ac1e1555a5a23823e9b669c4c4333d237d8a8c4e0761177932471784597e305cc6a4d46907336921cc096cbf325fb1f93434caa70
+  data.tar.gz: dec750f7817baa78f77da553e0dc0cc787b4765937ca2ebf6822de8cd23d1f657af4e19450843c2c5d10852028ac644af8f5db6a9bda43d00659f000c411d6f9

data/README.md

@@ -112,7 +112,7 @@ Deleting a `LdapServer` record keeps all users whose `auth_source` is `"ldap #{i
 
 ### OAuth2 (Entra ID / Google)
 
-Handled by `Users::OmniauthCallbacksController`. On callback, `ThecoreAuthCommons.check_user` finds or creates the user (with a random secure password) and sets `auth_source` to `'google'` or `'microsoft'`. New OAuth users are created as admin.
+Handled by `Users::OmniauthCallbacksController`. On callback, `ThecoreAuthCommons.check_user` finds the user by the provider-verified email or creates them (random secure password, `auth_source` `'google'` or `'microsoft'`, no admin, no roles: an administrator assigns those). An existing user's password, admin flag and `auth_source` are never changed by an OAuth login.
 
 ## Password policy
 

data/lib/thecore_auth_commons/version.rb

@@ -1,3 +1,3 @@
 module ThecoreAuthCommons
-  VERSION = "3.6.2".freeze
+  VERSION = "3.6.3".freeze
 end

data/lib/thecore_auth_commons.rb

@@ -30,18 +30,22 @@ module ThecoreAuthCommons
     ENV["GOOGLE_CLIENT_ID"].present? && ENV["GOOGLE_CLIENT_SECRET"].present?
   end
 
-  # Controlla se l'utente esiste, altrimenti lo crea con una password casuale
-  # e lo restituisce. Se l'utente esiste già, lo restituisce senza modificarlo.
-
+  # Restituisce l'utente con l'email verificata dal provider OAuth, creandolo se non esiste:
+  # password casuale, auth_source = provider, nessun admin e nessun ruolo (si assegnano a mano).
+  # Di un utente esistente aggiorna solo nome e cognome: password, admin e auth_source restano,
+  # così chi ha anche una password locale può continuare a usarla. nil se l'utente non è salvabile.
   def self.check_user(email, name, surname, provider)
-    u = User.find_or_initialize_by(email: email)
-    u.name = name
-    u.surname = surname
-    u.password = u.password_confirmation = generate_secure_password
-    u.auth_source = provider # 'google' or 'microsoft'
-    u.admin = true
+    return if email.blank?
+
+    u = User.find_or_initialize_by(email: email.to_s.strip.downcase)
+    u.name = name if u.respond_to?(:name=)
+    u.surname = surname if u.respond_to?(:surname=)
+    if u.new_record?
+      u.password = u.password_confirmation = generate_secure_password
+      u.auth_source = provider # 'google' or 'microsoft'
+    end
     u.save if u.changed?
-    u
+    u if u.persisted?
   end
 
   INITIAL_ADMIN_PASSWORD_FILE = "admin_initial_password".freeze

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: thecore_auth_commons
 version: !ruby/object:Gem::Version
-  version: 3.6.2
+  version: 3.6.3
 platform: ruby
 authors:
 - Gabriele Tassoni