zaikio-oauth_client 0.15.0 → 0.17.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fb0748eddd282729e6a9ca264b17a59d58b9822c5e900f1bc3690b2b10549567
-  data.tar.gz: 191d4f0652fa8dfb9dae28bbfcd550ef8b2114366ef41ad291f25620011e8d3e
+  metadata.gz: 6a2ab7697b4dc9fc67d8558ae29f3ccff27c56c408c1c900e2331ab027c11bf7
+  data.tar.gz: b2a2d6424454e99e57a43cbad9762506d13ffd5709e7ca1dee8f1c2c96d7631b
 SHA512:
-  metadata.gz: 21c66faa4cd6cad8b787b39f919b0e1c30ec718b912f5442ad0fd4c96b7871a0db798bdf84e798d3ddaf441f8ae96819abea31fad7b4a631b12d2983fef378be
-  data.tar.gz: acc5550981b27d38cb986e0b934d4dad992ea7f3c462d9dd1f6c202a304e4cd13bb8e202db070f66f458e3263606601943d1f078d9967125c89b068d82554126
+  metadata.gz: 8dc646a77bc4c31ee4ec0affc44017ebf7dc27cdfbd9c950e2fa6f542c030c82ee3be913f50474cc10f714e3c88132bcd601963170c3a02da05e677e8c2f23f1
+  data.tar.gz: 8b120868bccadf82c34a47e9eba11cfd0c3924a5db89c6463264cb1cc7ccbab7bcdad38d6a56138dfbfa334f9807fb200c470ebba7baa223a87d39b0e3cb212f

data/app/controllers/zaikio/oauth_client/connections_controller.rb

@@ -5,6 +5,10 @@ module Zaikio
 
       private
 
+      def new_path(options = {})
+        zaikio_oauth_client.new_connection_path(options)
+      end
+
       def approve_url(client_name = nil)
         zaikio_oauth_client.approve_connection_url(client_name)
       end

data/app/models/zaikio/access_token.rb

@@ -26,17 +26,17 @@ module Zaikio
     end
 
     # Scopes
-    scope :valid, lambda {
-      where("expires_at > :now", now: Time.current)
+    scope :valid, lambda { |valid_until = Time.current|
+      where("expires_at > :valid_until", valid_until: valid_until)
         .where.not(id: Zaikio::JWTAuth.revoked_token_ids)
     }
     scope :with_invalid_refresh_token, lambda {
       where("created_at <= ?", Time.current - Zaikio::AccessToken.refresh_token_valid_for)
     }
-    scope :valid_refresh, lambda {
-      where("expires_at <= :now AND created_at > :created_at_max",
-            now: Time.current,
-            created_at_max: Time.current - refresh_token_valid_for)
+    scope :valid_refresh, lambda { |valid_until = Time.current|
+      where("expires_at <= :valid_until AND created_at > :created_at_max",
+            valid_until: valid_until,
+            created_at_max: valid_until - refresh_token_valid_for)
         .where.not(refresh_token: nil)
         .where.not(id: Zaikio::JWTAuth.revoked_token_ids)
     }
@@ -44,9 +44,10 @@ module Zaikio
       where(bearer_type: bearer_type, bearer_id: bearer_id)
         .where("requested_scopes @> ARRAY[?]::varchar[]", requested_scopes)
     }
-    scope :usable, lambda { |options|
-      by_bearer(**options).valid.or(by_bearer(**options).valid_refresh)
-                          .order(expires_at: :desc)
+    scope :usable, lambda { |valid_until: Time.current, **options|
+      by_bearer(**options).valid(valid_until).or(
+        by_bearer(**options).valid_refresh
+      ).order(expires_at: :desc)
     }
 
     def expired?
@@ -72,6 +73,8 @@ module Zaikio
     end
 
     def refresh!
+      return unless refresh_token?
+
       Zaikio::OAuthClient.with_oauth_scheme(:basic_auth) do
         refreshed_token = OAuth2::AccessToken.from_hash(
           Zaikio::OAuthClient.for(audience),
@@ -80,16 +83,12 @@ module Zaikio
 
         destroy
 
-        self.class.build_from_access_token(
-          refreshed_token,
-          requested_scopes: requested_scopes
-        ).tap(&:save!)
+        self.class.build_from_access_token(refreshed_token, requested_scopes: requested_scopes).tap(&:save!)
       end
     rescue OAuth2::Error => e
       raise unless e.code == "invalid_grant"
 
       destroy
-
       nil
     end
   end

data/lib/zaikio/oauth_client/authenticatable.rb

@@ -4,7 +4,8 @@ module Zaikio
       extend ActiveSupport::Concern
 
       def new
-        opts = params.permit(:client_name, :show_signup, :prompt, :force_login, :state, :lang)
+        opts = params.permit(:client_name, :show_signup, :prompt, :prompt_email_confirmation,
+                             :force_login, :state, :lang)
         opts[:lang] ||= I18n.locale if defined?(I18n)
         client_name = opts.delete(:client_name)
         opts[:state] ||= session[:state] = SecureRandom.urlsafe_base64(32)
@@ -16,7 +17,7 @@ module Zaikio
         )
       end
 
-      def approve  # rubocop:disable Metrics/MethodLength,Metrics/AbcSize
+      def approve  # rubocop:disable Metrics/MethodLength,Metrics/AbcSize,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
         if params[:error].present?
           redirect_to send(
             respond_to?(:error_path_for) ? :error_path_for : :default_error_path_for,
@@ -36,6 +37,7 @@ module Zaikio
 
         origin = session[:origin]
         session.delete(:origin)
+        session.delete(:oauth_attempts)
 
         session[:zaikio_access_token_id] = access_token.id unless access_token.organization?
 
@@ -43,6 +45,13 @@ module Zaikio
           respond_to?(:after_approve_path_for) ? :after_approve_path_for : :default_after_approve_path_for,
           access_token, origin
         )
+      rescue OAuth2::Error => e
+        raise e unless e.code == "invalid_grant"
+        raise e if session[:oauth_attempts].to_i >= 3
+
+        session[:oauth_attempts] = session[:oauth_attempts].to_i + 1
+
+        redirect_to new_path(client_name: params[:client_name])
       end
 
       def destroy
@@ -58,6 +67,10 @@ module Zaikio
 
       private
 
+      def new_path(options = {})
+        zaikio_oauth_client.new_session_path(options)
+      end
+
       def approve_url(client_name = nil)
         zaikio_oauth_client.approve_session_url(client_name)
       end

data/lib/zaikio/oauth_client/version.rb

@@ -1,5 +1,5 @@
 module Zaikio
   module OAuthClient
-    VERSION = "0.15.0".freeze
+    VERSION = "0.17.0".freeze
   end
 end

data/lib/zaikio/oauth_client.rb

@@ -69,9 +69,10 @@ module Zaikio
         token = find_usable_access_token(client_name: client_config.client_name,
                                          bearer_type: bearer_type,
                                          bearer_id: bearer_id,
-                                         requested_scopes: scopes)
+                                         requested_scopes: scopes,
+                                         valid_for: valid_for)
 
-        token = token.refresh! if token && (token.expired? || token.expires_at < valid_for.from_now)
+        token = token.refresh! if token&.expired?
 
         token ||= fetch_new_token(client_config: client_config,
                                   bearer_type: bearer_type,
@@ -82,7 +83,7 @@ module Zaikio
 
       # Finds the best usable access token. Note that this token may have expired and
       # would require refreshing.
-      def find_usable_access_token(client_name:, bearer_type:, bearer_id:, requested_scopes:)  # rubocop:disable Metrics/MethodLength
+      def find_usable_access_token(client_name:, bearer_type:, bearer_id:, requested_scopes:, valid_for: 30.seconds)  # rubocop:disable Metrics/MethodLength
         configuration.logger.debug "Try to fetch token for client_name: #{client_name}, "\
                                    "bearer #{bearer_type}/#{bearer_id}, requested_scopes: #{requested_scopes}"
 
@@ -92,7 +93,8 @@ module Zaikio
             .usable(
               bearer_type: bearer_type,
               bearer_id: bearer_id,
-              requested_scopes: requested_scopes
+              requested_scopes: requested_scopes,
+              valid_until: valid_for.from_now
             )
             .first
         }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: zaikio-oauth_client
 version: !ruby/object:Gem::Version
-  version: 0.15.0
+  version: 0.17.0
 platform: ruby
 authors:
 - Zaikio GmbH
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-08-13 00:00:00.000000000 Z
+date: 2021-09-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionpack
@@ -187,7 +187,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.3
+rubygems_version: 3.2.22
 signing_key: 
 specification_version: 4
 summary: Zaikio Platform Connectivity