zaikio-oauth_client 0.17.0 → 0.18.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a2ab7697b4dc9fc67d8558ae29f3ccff27c56c408c1c900e2331ab027c11bf7
-  data.tar.gz: b2a2d6424454e99e57a43cbad9762506d13ffd5709e7ca1dee8f1c2c96d7631b
+  metadata.gz: 4f6d99b08d0e3fc512ce6a4bf8184be7c7d95144f3798062756f8f8159f86655
+  data.tar.gz: 4ed2286c417bdac976e6ad1f26c4ec84fc8d18b52312b082fd548800edfbec9b
 SHA512:
-  metadata.gz: 8dc646a77bc4c31ee4ec0affc44017ebf7dc27cdfbd9c950e2fa6f542c030c82ee3be913f50474cc10f714e3c88132bcd601963170c3a02da05e677e8c2f23f1
-  data.tar.gz: 8b120868bccadf82c34a47e9eba11cfd0c3924a5db89c6463264cb1cc7ccbab7bcdad38d6a56138dfbfa334f9807fb200c470ebba7baa223a87d39b0e3cb212f
+  metadata.gz: fb66005f53cbb480678247a36aa77af00c32fb93cdf4ca9615aa3bf51efa82e83e60fdf4f61d68123e331a369451db548b40a8cc0f8e57cec3d6cd686872918f
+  data.tar.gz: 63e5d71e4025046ef18c1759d582262f319581a8462092026b7f21e19640250ce94f6caefe5a6365e823c910eb4d8a390cb3a65a328a579739b06387e2732141

data/README.md

@@ -14,7 +14,17 @@ Then run `bundle install`.
 
 ## Setup & Configuration
 
-### 1. Copy & run Migrations
+### 1. Setup Active Record encryption
+
+Setup [Active Record Encryption](https://guides.rubyonrails.org/active_record_encryption.html#setup) by running:
+
+```
+rails db:encryption:init
+```
+
+(Continue generating the credentials each for different environments)
+
+### 2. Copy & run Migrations
 
 ```bash
 rails zaikio_oauth_client:install:migrations
@@ -24,7 +34,7 @@ rails db:migrate
 This will create the tables:
 + `zaikio_access_tokens`
 
-### 2. Mount routes
+### 3. Mount routes
 
 Add this to `config/routes.rb`:
 
@@ -32,7 +42,7 @@ Add this to `config/routes.rb`:
 mount Zaikio::OAuthClient::Engine => "/zaikio"
 ```
 
-### 3. Configure Gem
+### 4. Configure Gem
 
 ```rb
 # config/initializers/zaikio_oauth_client.rb
@@ -70,7 +80,7 @@ end
 ```
 
 
-### 4. Clean up outdated access tokens (recommended)
+### 5. Clean up outdated access tokens (recommended)
 
 To avoid keeping all expired oath and refresh tokens in your database, we recommend to implement their scheduled deletion. We recommend therefore to use a schedule gems such as [sidekiq](https://github.com/mperham/sidekiq) and [sidekiq-scheduler](https://github.com/moove-it/sidekiq-scheduler).
 

data/app/controllers/zaikio/oauth_client/subscriptions_controller.rb

@@ -20,7 +20,7 @@ module Zaikio
           redirect_uri: approve_url(opts.delete(:client_name)),
           scope: subscription_scope,
           **opts
-        )
+        ), allow_other_host: true
       end
     end
   end

data/app/models/zaikio/access_token.rb

@@ -5,6 +5,10 @@ module Zaikio
   class AccessToken < ApplicationRecord
     self.table_name = "zaikio_access_tokens"
 
+    # Encryption
+    encrypts :token
+    encrypts :refresh_token
+
     def self.build_from_access_token(access_token, requested_scopes: nil)
       payload = JWT.decode(access_token.token, nil, false).first rescue {} # rubocop:disable Style/RescueModifier
       scopes = access_token.params["scope"].split(",")
@@ -63,7 +67,7 @@ module Zaikio
     end
 
     def bearer_klass
-      return unless Zaikio.const_defined?("Hub::Models", false)
+      return unless Zaikio.const_defined?("Hub::Models", false) # rubocop:disable Performance/StringIdentifierArgument
 
       if Zaikio::Hub::Models.configuration.respond_to?(:"#{bearer_type.underscore}_class_name")
         Zaikio::Hub::Models.configuration.public_send(:"#{bearer_type.underscore}_class_name").constantize

data/db/migrate/20220425130923_encrypt_tokens.rb

@@ -0,0 +1,45 @@
+class EncryptTokens < ActiveRecord::Migration[7.0]
+  def change
+    reversible do |dir|
+      dir.up do
+        rename_column :zaikio_access_tokens, :token, :unencrypted_token
+        rename_column :zaikio_access_tokens, :refresh_token, :unencrypted_refresh_token
+
+        add_column :zaikio_access_tokens, :token, :string
+        add_column :zaikio_access_tokens, :refresh_token, :string
+
+        Zaikio::AccessToken.find_each do |access_token|
+          access_token.update(
+            token: access_token.unencrypted_token,
+            refresh_token: access_token.unencrypted_refresh_token
+          )
+        end
+
+        change_column_null :zaikio_access_tokens, :token, false
+
+        remove_column :zaikio_access_tokens, :unencrypted_token, :string
+        remove_column :zaikio_access_tokens, :unencrypted_refresh_token, :string
+      end
+
+      dir.down do
+        add_column :zaikio_access_tokens, :unencrypted_token, :string
+        add_column :zaikio_access_tokens, :unencrypted_refresh_token, :string
+
+        Zaikio::AccessToken.find_each do |access_token|
+          access_token.update_columns(
+            unencrypted_token: access_token.token,
+            unencrypted_refresh_token: access_token.refresh_token
+          )
+        end
+
+        remove_column :zaikio_access_tokens, :token, :string
+        remove_column :zaikio_access_tokens, :refresh_token, :string
+
+        rename_column :zaikio_access_tokens, :unencrypted_token, :token
+        rename_column :zaikio_access_tokens, :unencrypted_refresh_token, :refresh_token
+
+        change_column_null :zaikio_access_tokens, :token, false
+      end
+    end
+  end
+end

data/lib/zaikio/oauth_client/authenticatable.rb

@@ -14,7 +14,7 @@ module Zaikio
           redirect_uri: approve_url(client_name),
           scope: oauth_scope,
           **opts
-        )
+        ), allow_other_host: true
       end
 
       def approve  # rubocop:disable Metrics/MethodLength,Metrics/AbcSize,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
@@ -46,7 +46,7 @@ module Zaikio
           access_token, origin
         )
       rescue OAuth2::Error => e
-        raise e unless e.code == "invalid_grant"
+        raise e unless e.code == "invalid_grant" || e.code == "invalid_request"
         raise e if session[:oauth_attempts].to_i >= 3
 
         session[:oauth_attempts] = session[:oauth_attempts].to_i + 1

data/lib/zaikio/oauth_client/version.rb

@@ -1,5 +1,5 @@
 module Zaikio
   module OAuthClient
-    VERSION = "0.17.0".freeze
+    VERSION = "0.18.0".freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: zaikio-oauth_client
 version: !ruby/object:Gem::Version
-  version: 0.17.0
+  version: 0.18.0
 platform: ruby
 authors:
 - Zaikio GmbH
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-09-23 00:00:00.000000000 Z
+date: 2022-04-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionpack
@@ -157,6 +157,7 @@ files:
 - db/migrate/20191017132048_create_zaikio_access_tokens.rb
 - db/migrate/20210222135920_enhance_access_token_index.rb
 - db/migrate/20210224154303_add_requested_scopes_to_zaikio_access_tokens.rb
+- db/migrate/20220425130923_encrypt_tokens.rb
 - lib/tasks/zaikio_tasks.rake
 - lib/zaikio/oauth_client.rb
 - lib/zaikio/oauth_client/authenticatable.rb