zaikio-oauth_client 0.6.0 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 70305a5016ca591d7275d6bf09627865e32417481047c3717099108c251a5d93
-  data.tar.gz: 8274f9034a133d510be6fc6c42e6fb7c96e807fbac4b076ce0f42f13da7b2536
+  metadata.gz: 72f0e0de7e7d6ffc5b63c74cc85d4a6891d7e938273b1cf661a7fe52d4ac3068
+  data.tar.gz: 3999e67bb374120c7f2fd08c7bb25414a45b616f7386b417f85164a4e65251ef
 SHA512:
-  metadata.gz: 9cae8d8c1dee2d253d38764adcd245ed042017c99bc70255db2f236e11d2c77ef20b75f366a30ca59eda1c1ab9673e54b6e7117b5ab2159d78a6afbc38c214fe
-  data.tar.gz: 8cfd8a8df57d6076292ddca2253cb3cd9f79c2411fcadddc265757b5fea67c4dfabb67cd4406459e894708cee9b9d37bf6025cbb3fd455ceb575521cbb3000de
+  metadata.gz: 8196826c87334d5b762671c5fb723229f879da4c462deba8d1459754036d0328cf14f9fb8cbf10e8e67a55bf79dc9b9065523aa12ae46924eed574067d318270
+  data.tar.gz: a25db277b09d543b3f7ecee82a2cfab5b16d4163c2e5be80dc3881935c87622f3e458a02f05ef243adf8db9202d1651eda2267d9531a441006bd8151f284fb45

data/README.md

@@ -103,7 +103,20 @@ redirect_to zaikio_oauth_client.new_session_path(client_name: 'my_other_client')
 redirect_to zaikio_oauth_client.new_connection_path(client_name: 'my_other_client')
 ```
 
-This will redirect the user to the OAuth Authorize endpoint of the Zaikio Directory `.../oauth/authorize` and include all necessary parameters like your client_id.
+This will redirect the user to the OAuth Authorize endpoint of the Zaikio Directory
+`.../oauth/authorize` and include all necessary parameters like your client_id. You may
+also pass `show_signup`, `force_login` and `state` parameters through, like so:
+
+```ruby
+# Take the user directly to the signup page
+redirect_to zaikio_oauth_client.new_session_path(show_signup: true)
+
+# Force the user to re-authenticate even if they have an existing session
+redirect_to zaikio_oauth_client.new_session_path(force_login: true)
+
+# Pass a custom Oauth 2.0 state parameter
+redirect_to zaikio_oauth_client.new_session_path(state: "something-my-app-uses")
+```
 
 #### Session handling
 

data/app/models/zaikio/access_token.rb

@@ -5,8 +5,9 @@ module Zaikio
   class AccessToken < ApplicationRecord
     self.table_name = "zaikio_access_tokens"
 
-    def self.build_from_access_token(access_token) # rubocop:disable Metrics/AbcSize
+    def self.build_from_access_token(access_token, requested_scopes: nil) # rubocop:disable Metrics/AbcSize
       payload = JWT.decode(access_token.token, nil, false).first rescue {} # rubocop:disable Style/RescueModifier
+      scopes = access_token.params["scope"].split(",")
       new(
         id: payload["jti"],
         bearer_type: access_token.params["bearer"]["type"],
@@ -15,7 +16,8 @@ module Zaikio
         token: access_token.token,
         refresh_token: access_token.refresh_token,
         expires_at: Time.strptime(access_token.expires_at.to_s, "%s"),
-        scopes: access_token.params["scope"].split(",")
+        scopes: scopes,
+        requested_scopes: requested_scopes || scopes
       )
     end
 
@@ -38,9 +40,9 @@ module Zaikio
         .where("refresh_token IS NOT NULL")
         .where.not(id: Zaikio::JWTAuth.revoked_token_ids)
     }
-    scope :by_bearer, lambda { |bearer_id:, scopes: [], bearer_type: "Person"|
+    scope :by_bearer, lambda { |bearer_id:, requested_scopes: [], bearer_type: "Person"|
       where(bearer_type: bearer_type, bearer_id: bearer_id)
-        .where("scopes @> ARRAY[?]::varchar[]", scopes)
+        .where("requested_scopes @> ARRAY[?]::varchar[]", requested_scopes)
     }
     scope :usable, lambda { |options|
       by_bearer(**options).valid.or(by_bearer(**options).valid_refresh)
@@ -60,7 +62,7 @@ module Zaikio
     end
 
     def bearer_klass
-      return unless Zaikio.const_defined?("Hub::Models")
+      return unless Zaikio.const_defined?("Hub::Models", false)
 
       if Zaikio::Hub::Models.configuration.respond_to?(:"#{bearer_type.underscore}_class_name")
         Zaikio::Hub::Models.configuration.public_send(:"#{bearer_type.underscore}_class_name").constantize
@@ -76,12 +78,17 @@ module Zaikio
           attributes.slice("token", "refresh_token")
         ).refresh!
 
-        access_token = self.class.build_from_access_token(refreshed_token)
+        destroy
 
-        transaction { destroy if access_token.save! }
-
-        access_token
+        self.class.build_from_access_token(
+          refreshed_token,
+          requested_scopes: requested_scopes
+        ).tap(&:save!)
       end
+    rescue OAuth2::Error => e
+      raise unless e.code == "invalid_grant"
+
+      nil
     end
   end
 end

data/db/migrate/20210224154303_add_requested_scopes_to_zaikio_access_tokens.rb

@@ -0,0 +1,6 @@
+class AddRequestedScopesToZaikioAccessTokens < ActiveRecord::Migration[6.1]
+  def change
+    add_column :zaikio_access_tokens, :requested_scopes, :string, array: true, default: [], null: false
+    Zaikio::AccessToken.update_all("requested_scopes = scopes, updated_at = now()")
+  end
+end

data/lib/zaikio/oauth_client.rb

@@ -57,29 +57,50 @@ module Zaikio
         end
       end
 
-      def get_access_token(client_name: nil, bearer_type: "Person", bearer_id: nil, scopes: nil) # rubocop:disable Metrics/MethodLength
-        client_name ||= self.client_name
-        client_config = client_config_for(client_name)
+      # Finds the best possible access token, using the DB or an API call
+      #   * If the token has expired, it will be refreshed using the refresh_token flow
+      #     (if this fails, we fallback to getting a new token using client_credentials)
+      #   * If the token does not exist, we'll get a new one using the client_credentials flow
+      def get_access_token(bearer_id:, client_name: nil, bearer_type: "Person", scopes: nil)
+        client_config = client_config_for(client_name || self.client_name)
         scopes ||= client_config.default_scopes_for(bearer_type)
 
-        access_token = Zaikio::AccessToken.where(audience: client_config.client_name)
-                                          .usable(bearer_type: bearer_type, bearer_id: bearer_id, scopes: scopes)
-                                          .first
-
-        if access_token.blank?
-          access_token = Zaikio::AccessToken.build_from_access_token(
-            client_config.token_by_client_credentials(
-              bearer_type: bearer_type,
-              bearer_id: bearer_id,
-              scopes: scopes
-            )
+        token = find_usable_access_token(client_name: client_config.client_name,
+                                         bearer_type: bearer_type,
+                                         bearer_id: bearer_id,
+                                         requested_scopes: scopes)
+
+        token = token.refresh! if token&.expired?
+
+        token ||= fetch_new_token(client_config: client_config,
+                                  bearer_type: bearer_type,
+                                  bearer_id: bearer_id,
+                                  scopes: scopes)
+        token
+      end
+
+      # Finds the best usable access token. Note that this token may have expired and
+      # would require refreshing.
+      def find_usable_access_token(client_name:, bearer_type:, bearer_id:, requested_scopes:)
+        Zaikio::AccessToken
+          .where(audience: client_name)
+          .usable(
+            bearer_type: bearer_type,
+            bearer_id: bearer_id,
+            requested_scopes: requested_scopes
           )
-          access_token.save!
-        elsif access_token&.expired?
-          access_token = access_token.refresh!
-        end
+          .first
+      end
 
-        access_token
+      def fetch_new_token(client_config:, bearer_type:, bearer_id:, scopes:)
+        Zaikio::AccessToken.build_from_access_token(
+          client_config.token_by_client_credentials(
+            bearer_type: bearer_type,
+            bearer_id: bearer_id,
+            scopes: scopes
+          ),
+          requested_scopes: scopes
+        ).tap(&:save!)
       end
 
       def get_plain_scopes(scopes)

data/lib/zaikio/oauth_client/authenticatable.rb

@@ -4,11 +4,13 @@ module Zaikio
       extend ActiveSupport::Concern
 
       def new
-        cookies.encrypted[:origin] = params[:origin]
+        opts = params.permit(:client_name, :show_signup, :force_login, :state)
+        client_name = opts.delete(:client_name)
 
         redirect_to oauth_client.auth_code.authorize_url(
-          redirect_uri: approve_url(params[:client_name]),
-          scope: oauth_scope
+          redirect_uri: approve_url(client_name),
+          scope: oauth_scope,
+          **opts
         )
       end
 
@@ -49,10 +51,10 @@ module Zaikio
       def create_access_token
         access_token_response = oauth_client.auth_code.get_token(params[:code])
 
-        access_token = Zaikio::AccessToken.build_from_access_token(access_token_response)
-        access_token.save!
-
-        access_token
+        Zaikio::AccessToken.build_from_access_token(
+          access_token_response,
+          requested_scopes: client_config.default_scopes
+        ).tap(&:save!)
       end
 
       def client_name

data/lib/zaikio/oauth_client/version.rb

@@ -1,5 +1,5 @@
 module Zaikio
   module OAuthClient
-    VERSION = "0.6.0".freeze
+    VERSION = "0.8.0".freeze
   end
 end

metadata

@@ -1,17 +1,59 @@
 --- !ruby/object:Gem::Specification
 name: zaikio-oauth_client
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.8.0
 platform: ruby
 authors:
 - Zaikio GmbH
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-02-23 00:00:00.000000000 Z
+date: 2021-03-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: rails
+  name: actionpack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.0.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.0.0
+- !ruby/object:Gem::Dependency
+  name: activerecord
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.0.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.0.0
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.0.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.0.0
+- !ruby/object:Gem::Dependency
+  name: railties
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -112,6 +154,7 @@ files:
 - db/migrate/20190426155505_enable_postgres_extensions_for_uuids.rb
 - db/migrate/20191017132048_create_zaikio_access_tokens.rb
 - db/migrate/20210222135920_enhance_access_token_index.rb
+- db/migrate/20210224154303_add_requested_scopes_to_zaikio_access_tokens.rb
 - lib/tasks/zaikio_tasks.rake
 - lib/zaikio/oauth_client.rb
 - lib/zaikio/oauth_client/authenticatable.rb