zaikio-oauth_client 0.6.1 → 0.8.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +14 -1
- data/app/models/zaikio/access_token.rb +10 -6
- data/lib/zaikio/oauth_client.rb +40 -24
- data/lib/zaikio/oauth_client/authenticatable.rb +5 -3
- data/lib/zaikio/oauth_client/version.rb +1 -1
- metadata +45 -3
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 32791412d8324e894c609e9ba73c1bc2fabb756117b91d81012d208730dfd5c2
|
|
4
|
+
data.tar.gz: a1af7430748c3bce9e0d8058de85edcbdf0e2ecc3b568b389184e13b8945753d
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 6a33fdbb048a31fb157b006606ecbebbe69ac7950e17a25e1c3817f02485b15d8e7726c10fc8277ca57b6ea0a4781264d3055f188a0883613b053605e9a990a6
|
|
7
|
+
data.tar.gz: 6e404b985ce76339e9edf1612b2db4d0d686c9b75f67ae8f4ff131c80e806a5911a223681d2abbbbbf03b72c3e155c66a891e45a696da403cdac095c2b1513f2
|
data/README.md
CHANGED
|
@@ -103,7 +103,20 @@ redirect_to zaikio_oauth_client.new_session_path(client_name: 'my_other_client')
|
|
|
103
103
|
redirect_to zaikio_oauth_client.new_connection_path(client_name: 'my_other_client')
|
|
104
104
|
```
|
|
105
105
|
|
|
106
|
-
This will redirect the user to the OAuth Authorize endpoint of the Zaikio Directory
|
|
106
|
+
This will redirect the user to the OAuth Authorize endpoint of the Zaikio Directory
|
|
107
|
+
`.../oauth/authorize` and include all necessary parameters like your client_id. You may
|
|
108
|
+
also pass `show_signup`, `force_login` and `state` parameters through, like so:
|
|
109
|
+
|
|
110
|
+
```ruby
|
|
111
|
+
# Take the user directly to the signup page
|
|
112
|
+
redirect_to zaikio_oauth_client.new_session_path(show_signup: true)
|
|
113
|
+
|
|
114
|
+
# Force the user to re-authenticate even if they have an existing session
|
|
115
|
+
redirect_to zaikio_oauth_client.new_session_path(force_login: true)
|
|
116
|
+
|
|
117
|
+
# Pass a custom Oauth 2.0 state parameter
|
|
118
|
+
redirect_to zaikio_oauth_client.new_session_path(state: "something-my-app-uses")
|
|
119
|
+
```
|
|
107
120
|
|
|
108
121
|
#### Session handling
|
|
109
122
|
|
|
@@ -62,7 +62,7 @@ module Zaikio
|
|
|
62
62
|
end
|
|
63
63
|
|
|
64
64
|
def bearer_klass
|
|
65
|
-
return unless Zaikio.const_defined?("Hub::Models")
|
|
65
|
+
return unless Zaikio.const_defined?("Hub::Models", false)
|
|
66
66
|
|
|
67
67
|
if Zaikio::Hub::Models.configuration.respond_to?(:"#{bearer_type.underscore}_class_name")
|
|
68
68
|
Zaikio::Hub::Models.configuration.public_send(:"#{bearer_type.underscore}_class_name").constantize
|
|
@@ -78,15 +78,19 @@ module Zaikio
|
|
|
78
78
|
attributes.slice("token", "refresh_token")
|
|
79
79
|
).refresh!
|
|
80
80
|
|
|
81
|
-
|
|
81
|
+
destroy
|
|
82
|
+
|
|
83
|
+
self.class.build_from_access_token(
|
|
82
84
|
refreshed_token,
|
|
83
85
|
requested_scopes: requested_scopes
|
|
84
|
-
)
|
|
86
|
+
).tap(&:save!)
|
|
87
|
+
end
|
|
88
|
+
rescue OAuth2::Error => e
|
|
89
|
+
raise unless e.code == "invalid_grant"
|
|
85
90
|
|
|
86
|
-
|
|
91
|
+
destroy
|
|
87
92
|
|
|
88
|
-
|
|
89
|
-
end
|
|
93
|
+
nil
|
|
90
94
|
end
|
|
91
95
|
end
|
|
92
96
|
end
|
data/lib/zaikio/oauth_client.rb
CHANGED
|
@@ -57,34 +57,50 @@ module Zaikio
|
|
|
57
57
|
end
|
|
58
58
|
end
|
|
59
59
|
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
60
|
+
# Finds the best possible access token, using the DB or an API call
|
|
61
|
+
# * If the token has expired, it will be refreshed using the refresh_token flow
|
|
62
|
+
# (if this fails, we fallback to getting a new token using client_credentials)
|
|
63
|
+
# * If the token does not exist, we'll get a new one using the client_credentials flow
|
|
64
|
+
def get_access_token(bearer_id:, client_name: nil, bearer_type: "Person", scopes: nil)
|
|
65
|
+
client_config = client_config_for(client_name || self.client_name)
|
|
63
66
|
scopes ||= client_config.default_scopes_for(bearer_type)
|
|
64
67
|
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
68
|
+
token = find_usable_access_token(client_name: client_config.client_name,
|
|
69
|
+
bearer_type: bearer_type,
|
|
70
|
+
bearer_id: bearer_id,
|
|
71
|
+
requested_scopes: scopes)
|
|
72
|
+
|
|
73
|
+
token = token.refresh! if token&.expired?
|
|
74
|
+
|
|
75
|
+
token ||= fetch_new_token(client_config: client_config,
|
|
76
|
+
bearer_type: bearer_type,
|
|
77
|
+
bearer_id: bearer_id,
|
|
78
|
+
scopes: scopes)
|
|
79
|
+
token
|
|
80
|
+
end
|
|
81
|
+
|
|
82
|
+
# Finds the best usable access token. Note that this token may have expired and
|
|
83
|
+
# would require refreshing.
|
|
84
|
+
def find_usable_access_token(client_name:, bearer_type:, bearer_id:, requested_scopes:)
|
|
85
|
+
Zaikio::AccessToken
|
|
86
|
+
.where(audience: client_name)
|
|
87
|
+
.usable(
|
|
88
|
+
bearer_type: bearer_type,
|
|
89
|
+
bearer_id: bearer_id,
|
|
90
|
+
requested_scopes: requested_scopes
|
|
81
91
|
)
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
access_token = access_token.refresh!
|
|
85
|
-
end
|
|
92
|
+
.first
|
|
93
|
+
end
|
|
86
94
|
|
|
87
|
-
|
|
95
|
+
def fetch_new_token(client_config:, bearer_type:, bearer_id:, scopes:)
|
|
96
|
+
Zaikio::AccessToken.build_from_access_token(
|
|
97
|
+
client_config.token_by_client_credentials(
|
|
98
|
+
bearer_type: bearer_type,
|
|
99
|
+
bearer_id: bearer_id,
|
|
100
|
+
scopes: scopes
|
|
101
|
+
),
|
|
102
|
+
requested_scopes: scopes
|
|
103
|
+
).tap(&:save!)
|
|
88
104
|
end
|
|
89
105
|
|
|
90
106
|
def get_plain_scopes(scopes)
|
|
@@ -4,11 +4,13 @@ module Zaikio
|
|
|
4
4
|
extend ActiveSupport::Concern
|
|
5
5
|
|
|
6
6
|
def new
|
|
7
|
-
|
|
7
|
+
opts = params.permit(:client_name, :show_signup, :force_login, :state)
|
|
8
|
+
client_name = opts.delete(:client_name)
|
|
8
9
|
|
|
9
10
|
redirect_to oauth_client.auth_code.authorize_url(
|
|
10
|
-
redirect_uri: approve_url(
|
|
11
|
-
scope: oauth_scope
|
|
11
|
+
redirect_uri: approve_url(client_name),
|
|
12
|
+
scope: oauth_scope,
|
|
13
|
+
**opts
|
|
12
14
|
)
|
|
13
15
|
end
|
|
14
16
|
|
metadata
CHANGED
|
@@ -1,17 +1,59 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: zaikio-oauth_client
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.
|
|
4
|
+
version: 0.8.1
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Zaikio GmbH
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2021-
|
|
11
|
+
date: 2021-03-31 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
|
-
name:
|
|
14
|
+
name: actionpack
|
|
15
|
+
requirement: !ruby/object:Gem::Requirement
|
|
16
|
+
requirements:
|
|
17
|
+
- - ">="
|
|
18
|
+
- !ruby/object:Gem::Version
|
|
19
|
+
version: 5.0.0
|
|
20
|
+
type: :runtime
|
|
21
|
+
prerelease: false
|
|
22
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
23
|
+
requirements:
|
|
24
|
+
- - ">="
|
|
25
|
+
- !ruby/object:Gem::Version
|
|
26
|
+
version: 5.0.0
|
|
27
|
+
- !ruby/object:Gem::Dependency
|
|
28
|
+
name: activerecord
|
|
29
|
+
requirement: !ruby/object:Gem::Requirement
|
|
30
|
+
requirements:
|
|
31
|
+
- - ">="
|
|
32
|
+
- !ruby/object:Gem::Version
|
|
33
|
+
version: 5.0.0
|
|
34
|
+
type: :runtime
|
|
35
|
+
prerelease: false
|
|
36
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
37
|
+
requirements:
|
|
38
|
+
- - ">="
|
|
39
|
+
- !ruby/object:Gem::Version
|
|
40
|
+
version: 5.0.0
|
|
41
|
+
- !ruby/object:Gem::Dependency
|
|
42
|
+
name: activesupport
|
|
43
|
+
requirement: !ruby/object:Gem::Requirement
|
|
44
|
+
requirements:
|
|
45
|
+
- - ">="
|
|
46
|
+
- !ruby/object:Gem::Version
|
|
47
|
+
version: 5.0.0
|
|
48
|
+
type: :runtime
|
|
49
|
+
prerelease: false
|
|
50
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
51
|
+
requirements:
|
|
52
|
+
- - ">="
|
|
53
|
+
- !ruby/object:Gem::Version
|
|
54
|
+
version: 5.0.0
|
|
55
|
+
- !ruby/object:Gem::Dependency
|
|
56
|
+
name: railties
|
|
15
57
|
requirement: !ruby/object:Gem::Requirement
|
|
16
58
|
requirements:
|
|
17
59
|
- - ">="
|