zaikio-oauth_client 0.4.3 → 0.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4acce9f2a5a527a4f5e6d407f2a345149215e906ca155488f5bc65fc8a0a3a62
-  data.tar.gz: a8d208cb534f3fa52c41bd959efbd20956e1f5fc8302d9e807b1af60da02c8f7
+  metadata.gz: f73993c6e346ad227b9591f3978d5e8df70f3cbe02a123da0880581c90877090
+  data.tar.gz: 78a28c37466e1c1f572c4691c43b86dd0dcc583089ea04ea53adf546727529fd
 SHA512:
-  metadata.gz: f2cbeff0fd6c94ea3566c7e970f2872741c240f5241a987cc838be5923fcb2a7fdf3e53d639aedcfb8b830d07de3acea1208230479896fb5f501a821cb352a53
-  data.tar.gz: 07ec99742b7fd32aa9c9874257092f7e361cadd3c5dfd95eeb45bbeb09a711bb2b01955e9700b9568dfca82ee696d23293c081977df07861c243edfbb288c39f
+  metadata.gz: 4ead8b3e3d2576cefd9067633f02b814362cb2d8f8b912ffeb25e5d6165a9e980ccb76614c1373e8bf4a4954b6f087632982bd5eaace58d8bc6f3f726206ea1f
+  data.tar.gz: 1979f2d0c8da9a6fdb813dbb02c48b229dd308b742aedf93c63f28545e5d1d11dbcf658f2c35c9e20b2cee5369348ae48cf346f24ba4d3fe5732aff9ba17153d

data/README.md

@@ -60,7 +60,7 @@ Zaikio::OAuthClient.configure do |config|
   end
 
   config.around_auth do |access_token, block|
-    Zaikio::Directory.with_token(access_token.token) do
+    Zaikio::Hub.with_token(access_token.token) do
       block.call(access_token)
     end
   end
@@ -93,7 +93,7 @@ Configure sidekiq scheduler in `config/sidekiq.yml`:
 
 ### OAuth Flow
 
-From any point in your application you can start using the Zaikio Directory OAuth2 flow with
+From any point in your application you can start using the Zaikio Hub OAuth2 flow with
 
 ```rb
 redirect_to zaikio_oauth_client.new_session_path
@@ -109,10 +109,10 @@ This will redirect the user to the OAuth Authorize endpoint of the Zaikio Direct
 
 The Zaikio gem engine will set a cookie for the user after a successful OAuth flow: `cookies.encrypted[:zaikio_person_id]`.
 
-If you are using for example `Zaikio::Directory::Models`, you can use this snippet to set the current user:
+If you are using for example `Zaikio::Hub::Models`, you can use this snippet to set the current user:
 
 ```ruby
-Current.user ||= Zaikio::Directory::Models::Person.find_by(id: cookies.encrypted[:zaikio_person_id])
+Current.user ||= Zaikio::Hub::Models::Person.find_by(id: cookies.encrypted[:zaikio_person_id])
 ````
 
 You can then use `Current.user` anywhere.
@@ -149,7 +149,7 @@ class ApplicationController < ActionController::Base
     cookies.encrypted[:zaikio_person_id] = access_token.bearer_id unless access_token.organization?
 
     # Sync data on login
-    Zaikio::Directory.with_token(access_token.token) do
+    Zaikio::Hub.with_token(access_token.token) do
       access_token.bearer_klass.find_and_reload!(access_token.bearer_id, includes: :all)
     end
 

data/app/models/zaikio/access_token.rb

@@ -5,8 +5,9 @@ module Zaikio
   class AccessToken < ApplicationRecord
     self.table_name = "zaikio_access_tokens"
 
-    def self.build_from_access_token(access_token) # rubocop:disable Metrics/AbcSize
+    def self.build_from_access_token(access_token, requested_scopes: nil) # rubocop:disable Metrics/AbcSize
       payload = JWT.decode(access_token.token, nil, false).first rescue {} # rubocop:disable Style/RescueModifier
+      scopes = access_token.params["scope"].split(",")
       new(
         id: payload["jti"],
         bearer_type: access_token.params["bearer"]["type"],
@@ -15,7 +16,8 @@ module Zaikio
         token: access_token.token,
         refresh_token: access_token.refresh_token,
         expires_at: Time.strptime(access_token.expires_at.to_s, "%s"),
-        scopes: access_token.params["scope"].split(",")
+        scopes: scopes,
+        requested_scopes: requested_scopes || scopes
       )
     end
 
@@ -38,13 +40,13 @@ module Zaikio
         .where("refresh_token IS NOT NULL")
         .where.not(id: Zaikio::JWTAuth.revoked_token_ids)
     }
-    scope :by_bearer, lambda { |bearer_type: "Person", bearer_id:, scopes: []|
+    scope :by_bearer, lambda { |bearer_id:, requested_scopes: [], bearer_type: "Person"|
       where(bearer_type: bearer_type, bearer_id: bearer_id)
-        .where("scopes @> ARRAY[?]::varchar[]", scopes)
+        .where("requested_scopes @> ARRAY[?]::varchar[]", requested_scopes)
     }
     scope :usable, lambda { |options|
       by_bearer(**options).valid.or(by_bearer(**options).valid_refresh)
-                        .order(expires_at: :desc)
+                          .order(expires_at: :desc)
     }
 
     def expired?
@@ -60,10 +62,10 @@ module Zaikio
     end
 
     def bearer_klass
-      return unless Zaikio.const_defined?("Directory::Models")
+      return unless Zaikio.const_defined?("Hub::Models")
 
-      if Zaikio::Directory::Models.configuration.respond_to?(:"#{bearer_type.underscore}_class_name")
-        Zaikio::Directory::Models.configuration.public_send(:"#{bearer_type.underscore}_class_name").constantize
+      if Zaikio::Hub::Models.configuration.respond_to?(:"#{bearer_type.underscore}_class_name")
+        Zaikio::Hub::Models.configuration.public_send(:"#{bearer_type.underscore}_class_name").constantize
       else
         "Zaikio::#{bearer_type}".constantize
       end
@@ -76,7 +78,10 @@ module Zaikio
           attributes.slice("token", "refresh_token")
         ).refresh!
 
-        access_token = self.class.build_from_access_token(refreshed_token)
+        access_token = self.class.build_from_access_token(
+          refreshed_token,
+          requested_scopes: requested_scopes
+        )
 
         transaction { destroy if access_token.save! }
 

data/db/migrate/20210222135920_enhance_access_token_index.rb

@@ -0,0 +1,7 @@
+class EnhanceAccessTokenIndex < ActiveRecord::Migration[6.1]
+  def change
+    remove_index :zaikio_access_tokens, %i[bearer_type bearer_id]
+    add_index :zaikio_access_tokens, %i[audience bearer_type bearer_id],
+              name: :zaikio_access_tokens_lookup_index
+  end
+end

data/db/migrate/20210224154303_add_requested_scopes_to_zaikio_access_tokens.rb

@@ -0,0 +1,6 @@
+class AddRequestedScopesToZaikioAccessTokens < ActiveRecord::Migration[6.1]
+  def change
+    add_column :zaikio_access_tokens, :requested_scopes, :string, array: true, default: [], null: false
+    Zaikio::AccessToken.update_all("requested_scopes = scopes, updated_at = now()")
+  end
+end

data/lib/zaikio/oauth_client.rb

@@ -45,7 +45,7 @@ module Zaikio
         access_token = if options_or_access_token.is_a?(Zaikio::AccessToken)
                          options_or_access_token
                        else
-                         get_access_token(options_or_access_token)
+                         get_access_token(**options_or_access_token)
                        end
 
         return unless block_given?
@@ -63,7 +63,11 @@ module Zaikio
         scopes ||= client_config.default_scopes_for(bearer_type)
 
         access_token = Zaikio::AccessToken.where(audience: client_config.client_name)
-                                          .usable(bearer_type: bearer_type, bearer_id: bearer_id, scopes: scopes)
+                                          .usable(
+                                            bearer_type: bearer_type,
+                                            bearer_id: bearer_id,
+                                            requested_scopes: scopes
+                                          )
                                           .first
 
         if access_token.blank?
@@ -72,7 +76,8 @@ module Zaikio
               bearer_type: bearer_type,
               bearer_id: bearer_id,
               scopes: scopes
-            )
+            ),
+            requested_scopes: scopes
           )
           access_token.save!
         elsif access_token&.expired?

data/lib/zaikio/oauth_client/authenticatable.rb

@@ -49,10 +49,10 @@ module Zaikio
       def create_access_token
         access_token_response = oauth_client.auth_code.get_token(params[:code])
 
-        access_token = Zaikio::AccessToken.build_from_access_token(access_token_response)
-        access_token.save!
-
-        access_token
+        Zaikio::AccessToken.build_from_access_token(
+          access_token_response,
+          requested_scopes: client_config.default_scopes
+        ).tap(&:save!)
       end
 
       def client_name

data/lib/zaikio/oauth_client/configuration.rb

@@ -25,7 +25,7 @@ module Zaikio
       end
 
       def logger
-        @logger ||= Logger.new(STDOUT)
+        @logger ||= Logger.new($stdout)
       end
 
       def register_client(name)

data/lib/zaikio/oauth_client/version.rb

@@ -1,5 +1,5 @@
 module Zaikio
   module OAuthClient
-    VERSION = "0.4.3".freeze
+    VERSION = "0.6.1".freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: zaikio-oauth_client
 version: !ruby/object:Gem::Version
-  version: 0.4.3
+  version: 0.6.1
 platform: ruby
 authors:
 - Zaikio GmbH
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-01-15 00:00:00.000000000 Z
+date: 2021-02-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -111,6 +111,8 @@ files:
 - config/routes.rb
 - db/migrate/20190426155505_enable_postgres_extensions_for_uuids.rb
 - db/migrate/20191017132048_create_zaikio_access_tokens.rb
+- db/migrate/20210222135920_enhance_access_token_index.rb
+- db/migrate/20210224154303_add_requested_scopes_to_zaikio_access_tokens.rb
 - lib/tasks/zaikio_tasks.rake
 - lib/zaikio/oauth_client.rb
 - lib/zaikio/oauth_client/authenticatable.rb