zaikio-oauth_client 0.5.1 → 0.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e5cfd64269f31591bd1ee84ff353faeb5d4a14664a1082f4ce7cec90dc743c7d
-  data.tar.gz: bbe382d142e53ed1f7f2193ab58506b460496cc04fcff3c1b7c9630d848192de
+  metadata.gz: 32f871e3c1b27ab91ce3bbaa35d4ac460cc12d93401c1b73d4dd618cd83d1f00
+  data.tar.gz: 1ce0459fdb769c4f5c7e31287cccc16d6fce74a819557dfa1c5c6cd3120991ee
 SHA512:
-  metadata.gz: 42735a555e9ce9356756ca979849f7e42dd0e779d33f1ebaed26c8c8df42588dc7674ef6b24a18f023e23a64e21743db7c9e5f108a2ac2004f1f140c17083ff2
-  data.tar.gz: 574a6706443d8e9cfc0294d61cd79c3e3959daffd914593f0a45c7e120e420189cd629abf4d607ecd7b37379c98e8a3192b9f4446936e9f5c35ebcd28b4e89a2
+  metadata.gz: 567ac3217d0b63498fc6d18292c4b1fcdd6d8407c2341daae177388e2e68104bfd0aab00990606099b7e9f5d10dc13e7572586271eb0f76c8c6200520db81f81
+  data.tar.gz: b9366a697539fa31138e2ddc8b9f02f9dd6ed6cd11113bbc8ed3c1732301044395b19d033eda14d5b7bb7ad7c32f0836be6e89a000b2f7dd6270f05385846283

data/README.md

@@ -103,7 +103,20 @@ redirect_to zaikio_oauth_client.new_session_path(client_name: 'my_other_client')
 redirect_to zaikio_oauth_client.new_connection_path(client_name: 'my_other_client')
 ```
 
-This will redirect the user to the OAuth Authorize endpoint of the Zaikio Directory `.../oauth/authorize` and include all necessary parameters like your client_id.
+This will redirect the user to the OAuth Authorize endpoint of the Zaikio Directory
+`.../oauth/authorize` and include all necessary parameters like your client_id. You may
+also pass `show_signup`, `force_login` and `state` parameters through, like so:
+
+```ruby
+# Take the user directly to the signup page
+redirect_to zaikio_oauth_client.new_session_path(show_signup: true)
+
+# Force the user to re-authenticate even if they have an existing session
+redirect_to zaikio_oauth_client.new_session_path(force_login: true)
+
+# Pass a custom Oauth 2.0 state parameter
+redirect_to zaikio_oauth_client.new_session_path(state: "something-my-app-uses")
+```
 
 #### Session handling
 

data/app/models/zaikio/access_token.rb

@@ -5,8 +5,9 @@ module Zaikio
   class AccessToken < ApplicationRecord
     self.table_name = "zaikio_access_tokens"
 
-    def self.build_from_access_token(access_token) # rubocop:disable Metrics/AbcSize
+    def self.build_from_access_token(access_token, requested_scopes: nil) # rubocop:disable Metrics/AbcSize
       payload = JWT.decode(access_token.token, nil, false).first rescue {} # rubocop:disable Style/RescueModifier
+      scopes = access_token.params["scope"].split(",")
       new(
         id: payload["jti"],
         bearer_type: access_token.params["bearer"]["type"],
@@ -15,7 +16,8 @@ module Zaikio
         token: access_token.token,
         refresh_token: access_token.refresh_token,
         expires_at: Time.strptime(access_token.expires_at.to_s, "%s"),
-        scopes: access_token.params["scope"].split(",")
+        scopes: scopes,
+        requested_scopes: requested_scopes || scopes
       )
     end
 
@@ -38,9 +40,9 @@ module Zaikio
         .where("refresh_token IS NOT NULL")
         .where.not(id: Zaikio::JWTAuth.revoked_token_ids)
     }
-    scope :by_bearer, lambda { |bearer_id:, scopes: [], bearer_type: "Person"|
+    scope :by_bearer, lambda { |bearer_id:, requested_scopes: [], bearer_type: "Person"|
       where(bearer_type: bearer_type, bearer_id: bearer_id)
-        .where("scopes @> ARRAY[?]::varchar[]", scopes)
+        .where("requested_scopes @> ARRAY[?]::varchar[]", requested_scopes)
     }
     scope :usable, lambda { |options|
       by_bearer(**options).valid.or(by_bearer(**options).valid_refresh)
@@ -60,7 +62,7 @@ module Zaikio
     end
 
     def bearer_klass
-      return unless Zaikio.const_defined?("Hub::Models")
+      return unless Zaikio.const_defined?("Hub::Models", false)
 
       if Zaikio::Hub::Models.configuration.respond_to?(:"#{bearer_type.underscore}_class_name")
         Zaikio::Hub::Models.configuration.public_send(:"#{bearer_type.underscore}_class_name").constantize
@@ -76,7 +78,10 @@ module Zaikio
           attributes.slice("token", "refresh_token")
         ).refresh!
 
-        access_token = self.class.build_from_access_token(refreshed_token)
+        access_token = self.class.build_from_access_token(
+          refreshed_token,
+          requested_scopes: requested_scopes
+        )
 
         transaction { destroy if access_token.save! }
 

data/db/migrate/20210222135920_enhance_access_token_index.rb

@@ -0,0 +1,7 @@
+class EnhanceAccessTokenIndex < ActiveRecord::Migration[6.1]
+  def change
+    remove_index :zaikio_access_tokens, %i[bearer_type bearer_id]
+    add_index :zaikio_access_tokens, %i[audience bearer_type bearer_id],
+              name: :zaikio_access_tokens_lookup_index
+  end
+end

data/db/migrate/20210224154303_add_requested_scopes_to_zaikio_access_tokens.rb

@@ -0,0 +1,6 @@
+class AddRequestedScopesToZaikioAccessTokens < ActiveRecord::Migration[6.1]
+  def change
+    add_column :zaikio_access_tokens, :requested_scopes, :string, array: true, default: [], null: false
+    Zaikio::AccessToken.update_all("requested_scopes = scopes, updated_at = now()")
+  end
+end

data/lib/zaikio/oauth_client.rb

@@ -63,7 +63,11 @@ module Zaikio
         scopes ||= client_config.default_scopes_for(bearer_type)
 
         access_token = Zaikio::AccessToken.where(audience: client_config.client_name)
-                                          .usable(bearer_type: bearer_type, bearer_id: bearer_id, scopes: scopes)
+                                          .usable(
+                                            bearer_type: bearer_type,
+                                            bearer_id: bearer_id,
+                                            requested_scopes: scopes
+                                          )
                                           .first
 
         if access_token.blank?
@@ -72,7 +76,8 @@ module Zaikio
               bearer_type: bearer_type,
               bearer_id: bearer_id,
               scopes: scopes
-            )
+            ),
+            requested_scopes: scopes
           )
           access_token.save!
         elsif access_token&.expired?

data/lib/zaikio/oauth_client/authenticatable.rb

@@ -4,11 +4,13 @@ module Zaikio
       extend ActiveSupport::Concern
 
       def new
-        cookies.encrypted[:origin] = params[:origin]
+        opts = params.permit(:client_name, :show_signup, :force_login, :state)
+        client_name = opts.delete(:client_name)
 
         redirect_to oauth_client.auth_code.authorize_url(
-          redirect_uri: approve_url(params[:client_name]),
-          scope: oauth_scope
+          redirect_uri: approve_url(client_name),
+          scope: oauth_scope,
+          **opts
         )
       end
 
@@ -49,10 +51,10 @@ module Zaikio
       def create_access_token
         access_token_response = oauth_client.auth_code.get_token(params[:code])
 
-        access_token = Zaikio::AccessToken.build_from_access_token(access_token_response)
-        access_token.save!
-
-        access_token
+        Zaikio::AccessToken.build_from_access_token(
+          access_token_response,
+          requested_scopes: client_config.default_scopes
+        ).tap(&:save!)
       end
 
       def client_name

data/lib/zaikio/oauth_client/version.rb

@@ -1,5 +1,5 @@
 module Zaikio
   module OAuthClient
-    VERSION = "0.5.1".freeze
+    VERSION = "0.7.2".freeze
   end
 end

metadata

@@ -1,17 +1,59 @@
 --- !ruby/object:Gem::Specification
 name: zaikio-oauth_client
 version: !ruby/object:Gem::Version
-  version: 0.5.1
+  version: 0.7.2
 platform: ruby
 authors:
 - Zaikio GmbH
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-02-12 00:00:00.000000000 Z
+date: 2021-03-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: rails
+  name: actionpack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.0.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.0.0
+- !ruby/object:Gem::Dependency
+  name: activerecord
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.0.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.0.0
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.0.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.0.0
+- !ruby/object:Gem::Dependency
+  name: railties
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -111,6 +153,8 @@ files:
 - config/routes.rb
 - db/migrate/20190426155505_enable_postgres_extensions_for_uuids.rb
 - db/migrate/20191017132048_create_zaikio_access_tokens.rb
+- db/migrate/20210222135920_enhance_access_token_index.rb
+- db/migrate/20210224154303_add_requested_scopes_to_zaikio_access_tokens.rb
 - lib/tasks/zaikio_tasks.rake
 - lib/zaikio/oauth_client.rb
 - lib/zaikio/oauth_client/authenticatable.rb