zaikio-oauth_client 0.5.0 → 0.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5423f9566cab7cd383ea7f42fa86c7a899e615be78eb3bf0f374a23742df8106
-  data.tar.gz: 5a2b07e3def1d7d55730767b1145265782d9bcde45fabbddace0ebd783c33915
+  metadata.gz: faffe2dacfd78ac4049dc0cb8897bd5f479c0333959433b3613ed7ccf683c270
+  data.tar.gz: 18b59f470cc9fe488d00fab7c57ce5e72edbd916a79f9805447ebb0dd10d2310
 SHA512:
-  metadata.gz: b5e9767b1c46ec96fe4ee6d12efd1b5090f0d032b3e651f2f941ce3ccae5a4151373ba1208a9c169f668cd2452c9701376989848a1465063fb731359d066e3b1
-  data.tar.gz: d14fb1595c1ae862873d4c38fc4ef6cd41b1f29088accca024d59f14f83e628fc91dcf7c70be64d9ccf62ca840c97125720c6b7d8c1873105e51d3b192779fda
+  metadata.gz: 9700b26771536ecedbfeaf5cf48f088e83d209d169e0bf3380c2f19c76c8cd3fd93047f2c4fcbe968db94cc008130c65016842d882564267942ad1bbbdc1148f
+  data.tar.gz: 56ef475c436b106d17b5f145ea3053762414d0bc3c7a3aff87ee796322d63a06774aae1edfb0837dfde61fa49cc113095b2decacb14acdd2e2b1fcb398628db5

data/README.md

@@ -103,7 +103,20 @@ redirect_to zaikio_oauth_client.new_session_path(client_name: 'my_other_client')
 redirect_to zaikio_oauth_client.new_connection_path(client_name: 'my_other_client')
 ```
 
-This will redirect the user to the OAuth Authorize endpoint of the Zaikio Directory `.../oauth/authorize` and include all necessary parameters like your client_id.
+This will redirect the user to the OAuth Authorize endpoint of the Zaikio Directory
+`.../oauth/authorize` and include all necessary parameters like your client_id. You may
+also pass `show_signup`, `force_login` and `state` parameters through, like so:
+
+```ruby
+# Take the user directly to the signup page
+redirect_to zaikio_oauth_client.new_session_path(show_signup: true)
+
+# Force the user to re-authenticate even if they have an existing session
+redirect_to zaikio_oauth_client.new_session_path(force_login: true)
+
+# Pass a custom Oauth 2.0 state parameter
+redirect_to zaikio_oauth_client.new_session_path(state: "something-my-app-uses")
+```
 
 #### Session handling
 

data/app/models/zaikio/access_token.rb

@@ -5,8 +5,9 @@ module Zaikio
   class AccessToken < ApplicationRecord
     self.table_name = "zaikio_access_tokens"
 
-    def self.build_from_access_token(access_token) # rubocop:disable Metrics/AbcSize
+    def self.build_from_access_token(access_token, requested_scopes: nil) # rubocop:disable Metrics/AbcSize
       payload = JWT.decode(access_token.token, nil, false).first rescue {} # rubocop:disable Style/RescueModifier
+      scopes = access_token.params["scope"].split(",")
       new(
         id: payload["jti"],
         bearer_type: access_token.params["bearer"]["type"],
@@ -15,7 +16,8 @@ module Zaikio
         token: access_token.token,
         refresh_token: access_token.refresh_token,
         expires_at: Time.strptime(access_token.expires_at.to_s, "%s"),
-        scopes: access_token.params["scope"].split(",")
+        scopes: scopes,
+        requested_scopes: requested_scopes || scopes
       )
     end
 
@@ -38,9 +40,9 @@ module Zaikio
         .where("refresh_token IS NOT NULL")
         .where.not(id: Zaikio::JWTAuth.revoked_token_ids)
     }
-    scope :by_bearer, lambda { |bearer_id:, scopes: [], bearer_type: "Person"|
+    scope :by_bearer, lambda { |bearer_id:, requested_scopes: [], bearer_type: "Person"|
       where(bearer_type: bearer_type, bearer_id: bearer_id)
-        .where("scopes @> ARRAY[?]::varchar[]", scopes)
+        .where("requested_scopes @> ARRAY[?]::varchar[]", requested_scopes)
     }
     scope :usable, lambda { |options|
       by_bearer(**options).valid.or(by_bearer(**options).valid_refresh)
@@ -60,7 +62,7 @@ module Zaikio
     end
 
     def bearer_klass
-      return unless Zaikio.const_defined?("Directory::Models")
+      return unless Zaikio.const_defined?("Hub::Models", false)
 
       if Zaikio::Hub::Models.configuration.respond_to?(:"#{bearer_type.underscore}_class_name")
         Zaikio::Hub::Models.configuration.public_send(:"#{bearer_type.underscore}_class_name").constantize
@@ -76,7 +78,10 @@ module Zaikio
           attributes.slice("token", "refresh_token")
         ).refresh!
 
-        access_token = self.class.build_from_access_token(refreshed_token)
+        access_token = self.class.build_from_access_token(
+          refreshed_token,
+          requested_scopes: requested_scopes
+        )
 
         transaction { destroy if access_token.save! }
 

data/db/migrate/20210222135920_enhance_access_token_index.rb

@@ -0,0 +1,7 @@
+class EnhanceAccessTokenIndex < ActiveRecord::Migration[6.1]
+  def change
+    remove_index :zaikio_access_tokens, %i[bearer_type bearer_id]
+    add_index :zaikio_access_tokens, %i[audience bearer_type bearer_id],
+              name: :zaikio_access_tokens_lookup_index
+  end
+end

data/db/migrate/20210224154303_add_requested_scopes_to_zaikio_access_tokens.rb

@@ -0,0 +1,6 @@
+class AddRequestedScopesToZaikioAccessTokens < ActiveRecord::Migration[6.1]
+  def change
+    add_column :zaikio_access_tokens, :requested_scopes, :string, array: true, default: [], null: false
+    Zaikio::AccessToken.update_all("requested_scopes = scopes, updated_at = now()")
+  end
+end

data/lib/zaikio/oauth_client.rb

@@ -63,7 +63,11 @@ module Zaikio
         scopes ||= client_config.default_scopes_for(bearer_type)
 
         access_token = Zaikio::AccessToken.where(audience: client_config.client_name)
-                                          .usable(bearer_type: bearer_type, bearer_id: bearer_id, scopes: scopes)
+                                          .usable(
+                                            bearer_type: bearer_type,
+                                            bearer_id: bearer_id,
+                                            requested_scopes: scopes
+                                          )
                                           .first
 
         if access_token.blank?
@@ -72,7 +76,8 @@ module Zaikio
               bearer_type: bearer_type,
               bearer_id: bearer_id,
               scopes: scopes
-            )
+            ),
+            requested_scopes: scopes
           )
           access_token.save!
         elsif access_token&.expired?

data/lib/zaikio/oauth_client/authenticatable.rb

@@ -4,11 +4,13 @@ module Zaikio
       extend ActiveSupport::Concern
 
       def new
-        cookies.encrypted[:origin] = params[:origin]
+        opts = params.permit(:client_name, :show_signup, :force_login, :state)
+        client_name = opts.delete(:client_name)
 
         redirect_to oauth_client.auth_code.authorize_url(
-          redirect_uri: approve_url(params[:client_name]),
-          scope: oauth_scope
+          redirect_uri: approve_url(client_name),
+          scope: oauth_scope,
+          **opts
         )
       end
 
@@ -49,10 +51,10 @@ module Zaikio
       def create_access_token
         access_token_response = oauth_client.auth_code.get_token(params[:code])
 
-        access_token = Zaikio::AccessToken.build_from_access_token(access_token_response)
-        access_token.save!
-
-        access_token
+        Zaikio::AccessToken.build_from_access_token(
+          access_token_response,
+          requested_scopes: client_config.default_scopes
+        ).tap(&:save!)
       end
 
       def client_name

data/lib/zaikio/oauth_client/version.rb

@@ -1,5 +1,5 @@
 module Zaikio
   module OAuthClient
-    VERSION = "0.5.0".freeze
+    VERSION = "0.7.1".freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: zaikio-oauth_client
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.7.1
 platform: ruby
 authors:
 - Zaikio GmbH
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-02-12 00:00:00.000000000 Z
+date: 2021-03-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -111,6 +111,8 @@ files:
 - config/routes.rb
 - db/migrate/20190426155505_enable_postgres_extensions_for_uuids.rb
 - db/migrate/20191017132048_create_zaikio_access_tokens.rb
+- db/migrate/20210222135920_enhance_access_token_index.rb
+- db/migrate/20210224154303_add_requested_scopes_to_zaikio_access_tokens.rb
 - lib/tasks/zaikio_tasks.rake
 - lib/zaikio/oauth_client.rb
 - lib/zaikio/oauth_client/authenticatable.rb