zaikio-oauth_client 0.4.4 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6d9eee4422926a02561d3e2301d775dc01d5db305df1c81133e5f39458394fa2
-  data.tar.gz: b08b5e225a9e23c2a48c6533e5686df48b689a6953b7ee21459e8e2a884bda92
+  metadata.gz: bf62363ad03a5a1e7c6ee7e6be3100efcb32b1d45ecabe5858da1b2f558b3dcf
+  data.tar.gz: a5f650f66dd13fa05d9d63999fc2d5327d65ecea99c8f895821819f8a6181f60
 SHA512:
-  metadata.gz: 4ac1c2f055825d2bd7b454aae2fbf2d6b89de39ce7a3dc396b798cfc3d03a515222098c354bbdaff4cf7c235542c3596a363a5efdaa064b6617f6ae8892b9a8c
-  data.tar.gz: a233c429b205316024f52944ff25e48bf97e5d504f1a457a0f448d2563341f3cb9e5a6bf27cef6bed9214849d5eaf171f5ec575ea7a7a173e01c205a4e3b7c3d
+  metadata.gz: 58ebc73778fba84f9eae327d8b4250fee238311594340bec36ef04e90c14859fb2ac912df9f2dae37152646075221ac2a07adba3a254ad238bdae9a1089a667f
+  data.tar.gz: a8e4820c7b981f6e9249f667e4c99dccd7f4c2f96d2c42192b87a73409f2fb67decba6e01e36fd3586ae749e819c9869e7a5a9711f5843df7d5d97acd6344ce0

data/README.md

@@ -60,7 +60,7 @@ Zaikio::OAuthClient.configure do |config|
   end
 
   config.around_auth do |access_token, block|
-    Zaikio::Directory.with_token(access_token.token) do
+    Zaikio::Hub.with_token(access_token.token) do
       block.call(access_token)
     end
   end
@@ -93,7 +93,7 @@ Configure sidekiq scheduler in `config/sidekiq.yml`:
 
 ### OAuth Flow
 
-From any point in your application you can start using the Zaikio Directory OAuth2 flow with
+From any point in your application you can start using the Zaikio Hub OAuth2 flow with
 
 ```rb
 redirect_to zaikio_oauth_client.new_session_path
@@ -103,16 +103,29 @@ redirect_to zaikio_oauth_client.new_session_path(client_name: 'my_other_client')
 redirect_to zaikio_oauth_client.new_connection_path(client_name: 'my_other_client')
 ```
 
-This will redirect the user to the OAuth Authorize endpoint of the Zaikio Directory `.../oauth/authorize` and include all necessary parameters like your client_id.
+This will redirect the user to the OAuth Authorize endpoint of the Zaikio Directory
+`.../oauth/authorize` and include all necessary parameters like your client_id. You may
+also pass `show_signup`, `force_login` and `state` parameters through, like so:
+
+```ruby
+# Take the user directly to the signup page
+redirect_to zaikio_oauth_client.new_session_path(show_signup: true)
+
+# Force the user to re-authenticate even if they have an existing session
+redirect_to zaikio_oauth_client.new_session_path(force_login: true)
+
+# Pass a custom Oauth 2.0 state parameter
+redirect_to zaikio_oauth_client.new_session_path(state: "something-my-app-uses")
+```
 
 #### Session handling
 
 The Zaikio gem engine will set a cookie for the user after a successful OAuth flow: `cookies.encrypted[:zaikio_person_id]`.
 
-If you are using for example `Zaikio::Directory::Models`, you can use this snippet to set the current user:
+If you are using for example `Zaikio::Hub::Models`, you can use this snippet to set the current user:
 
 ```ruby
-Current.user ||= Zaikio::Directory::Models::Person.find_by(id: cookies.encrypted[:zaikio_person_id])
+Current.user ||= Zaikio::Hub::Models::Person.find_by(id: cookies.encrypted[:zaikio_person_id])
 ````
 
 You can then use `Current.user` anywhere.
@@ -149,7 +162,7 @@ class ApplicationController < ActionController::Base
     cookies.encrypted[:zaikio_person_id] = access_token.bearer_id unless access_token.organization?
 
     # Sync data on login
-    Zaikio::Directory.with_token(access_token.token) do
+    Zaikio::Hub.with_token(access_token.token) do
       access_token.bearer_klass.find_and_reload!(access_token.bearer_id, includes: :all)
     end
 

data/app/models/zaikio/access_token.rb

@@ -5,8 +5,9 @@ module Zaikio
   class AccessToken < ApplicationRecord
     self.table_name = "zaikio_access_tokens"
 
-    def self.build_from_access_token(access_token) # rubocop:disable Metrics/AbcSize
+    def self.build_from_access_token(access_token, requested_scopes: nil) # rubocop:disable Metrics/AbcSize
       payload = JWT.decode(access_token.token, nil, false).first rescue {} # rubocop:disable Style/RescueModifier
+      scopes = access_token.params["scope"].split(",")
       new(
         id: payload["jti"],
         bearer_type: access_token.params["bearer"]["type"],
@@ -15,7 +16,8 @@ module Zaikio
         token: access_token.token,
         refresh_token: access_token.refresh_token,
         expires_at: Time.strptime(access_token.expires_at.to_s, "%s"),
-        scopes: access_token.params["scope"].split(",")
+        scopes: scopes,
+        requested_scopes: requested_scopes || scopes
       )
     end
 
@@ -38,9 +40,9 @@ module Zaikio
         .where("refresh_token IS NOT NULL")
         .where.not(id: Zaikio::JWTAuth.revoked_token_ids)
     }
-    scope :by_bearer, lambda { |bearer_id:, scopes: [], bearer_type: "Person"|
+    scope :by_bearer, lambda { |bearer_id:, requested_scopes: [], bearer_type: "Person"|
       where(bearer_type: bearer_type, bearer_id: bearer_id)
-        .where("scopes @> ARRAY[?]::varchar[]", scopes)
+        .where("requested_scopes @> ARRAY[?]::varchar[]", requested_scopes)
     }
     scope :usable, lambda { |options|
       by_bearer(**options).valid.or(by_bearer(**options).valid_refresh)
@@ -60,10 +62,10 @@ module Zaikio
     end
 
     def bearer_klass
-      return unless Zaikio.const_defined?("Directory::Models")
+      return unless Zaikio.const_defined?("Hub::Models")
 
-      if Zaikio::Directory::Models.configuration.respond_to?(:"#{bearer_type.underscore}_class_name")
-        Zaikio::Directory::Models.configuration.public_send(:"#{bearer_type.underscore}_class_name").constantize
+      if Zaikio::Hub::Models.configuration.respond_to?(:"#{bearer_type.underscore}_class_name")
+        Zaikio::Hub::Models.configuration.public_send(:"#{bearer_type.underscore}_class_name").constantize
       else
         "Zaikio::#{bearer_type}".constantize
       end
@@ -76,7 +78,10 @@ module Zaikio
           attributes.slice("token", "refresh_token")
         ).refresh!
 
-        access_token = self.class.build_from_access_token(refreshed_token)
+        access_token = self.class.build_from_access_token(
+          refreshed_token,
+          requested_scopes: requested_scopes
+        )
 
         transaction { destroy if access_token.save! }
 

data/db/migrate/20210222135920_enhance_access_token_index.rb

@@ -0,0 +1,7 @@
+class EnhanceAccessTokenIndex < ActiveRecord::Migration[6.1]
+  def change
+    remove_index :zaikio_access_tokens, %i[bearer_type bearer_id]
+    add_index :zaikio_access_tokens, %i[audience bearer_type bearer_id],
+              name: :zaikio_access_tokens_lookup_index
+  end
+end

data/db/migrate/20210224154303_add_requested_scopes_to_zaikio_access_tokens.rb

@@ -0,0 +1,6 @@
+class AddRequestedScopesToZaikioAccessTokens < ActiveRecord::Migration[6.1]
+  def change
+    add_column :zaikio_access_tokens, :requested_scopes, :string, array: true, default: [], null: false
+    Zaikio::AccessToken.update_all("requested_scopes = scopes, updated_at = now()")
+  end
+end

data/lib/zaikio/oauth_client.rb

@@ -63,7 +63,11 @@ module Zaikio
         scopes ||= client_config.default_scopes_for(bearer_type)
 
         access_token = Zaikio::AccessToken.where(audience: client_config.client_name)
-                                          .usable(bearer_type: bearer_type, bearer_id: bearer_id, scopes: scopes)
+                                          .usable(
+                                            bearer_type: bearer_type,
+                                            bearer_id: bearer_id,
+                                            requested_scopes: scopes
+                                          )
                                           .first
 
         if access_token.blank?
@@ -72,7 +76,8 @@ module Zaikio
               bearer_type: bearer_type,
               bearer_id: bearer_id,
               scopes: scopes
-            )
+            ),
+            requested_scopes: scopes
           )
           access_token.save!
         elsif access_token&.expired?

data/lib/zaikio/oauth_client/authenticatable.rb

@@ -4,11 +4,13 @@ module Zaikio
       extend ActiveSupport::Concern
 
       def new
-        cookies.encrypted[:origin] = params[:origin]
+        opts = params.permit(:client_name, :show_signup, :force_login, :state)
+        client_name = opts.delete(:client_name)
 
         redirect_to oauth_client.auth_code.authorize_url(
-          redirect_uri: approve_url(params[:client_name]),
-          scope: oauth_scope
+          redirect_uri: approve_url(client_name),
+          scope: oauth_scope,
+          **opts
         )
       end
 
@@ -49,10 +51,10 @@ module Zaikio
       def create_access_token
         access_token_response = oauth_client.auth_code.get_token(params[:code])
 
-        access_token = Zaikio::AccessToken.build_from_access_token(access_token_response)
-        access_token.save!
-
-        access_token
+        Zaikio::AccessToken.build_from_access_token(
+          access_token_response,
+          requested_scopes: client_config.default_scopes
+        ).tap(&:save!)
       end
 
       def client_name

data/lib/zaikio/oauth_client/version.rb

@@ -1,5 +1,5 @@
 module Zaikio
   module OAuthClient
-    VERSION = "0.4.4".freeze
+    VERSION = "0.7.0".freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: zaikio-oauth_client
 version: !ruby/object:Gem::Version
-  version: 0.4.4
+  version: 0.7.0
 platform: ruby
 authors:
 - Zaikio GmbH
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-01-20 00:00:00.000000000 Z
+date: 2021-03-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -111,6 +111,8 @@ files:
 - config/routes.rb
 - db/migrate/20190426155505_enable_postgres_extensions_for_uuids.rb
 - db/migrate/20191017132048_create_zaikio_access_tokens.rb
+- db/migrate/20210222135920_enhance_access_token_index.rb
+- db/migrate/20210224154303_add_requested_scopes_to_zaikio_access_tokens.rb
 - lib/tasks/zaikio_tasks.rake
 - lib/zaikio/oauth_client.rb
 - lib/zaikio/oauth_client/authenticatable.rb