zaikio-oauth_client 0.9.0 → 0.12.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6e956bf122053d559c2dd918f4b90a23c10559bc5578442bc26dbe1530a3396b
-  data.tar.gz: 0d594a45ddf589b03d9e43817885377d963934345fa6cb936b367fe64761e08a
+  metadata.gz: 2e0377cbc59afa07b79f540877cbba7c79c0a23240202cdd1e1b0b1f79d21104
+  data.tar.gz: 3b99c3429d501c37bb259046159794df88a26789d519a7ec50203961a62cfd43
 SHA512:
-  metadata.gz: 38355e0660ea6b2fd2c1b13a23a75626b5d4ae4efd3e64eb21396893e4a2ffc39c34824f373e994f596e4064455a8ad596b63b5e595c16afa844ffcddc90e56a
-  data.tar.gz: 1cb76ea316682fc4a4394d27ad252cc67496e95fa9034ba7054ad6e9b472a211f78cb1c839c9f4c745b143804c04aef5c85616c4f6f344f378e19bf12420db53
+  metadata.gz: f6b9f87688b92771ee8bb9ae1eea9ae9c83a09f393860925698ffa7adf515478b70d1621e438420ae39642a27c8c193a5a8232e1d028c58858428d8835b685e2
+  data.tar.gz: 153edcd1c0eb91874efd44ad501c157ad5210da20447064b07d59967593cb59a2e940767f3a3c32943ae550a55e0f537a737bcab4f17fe6d373ff44f049c06f8

data/README.md

@@ -133,12 +133,12 @@ redirect_to zaikio_oauth_client.new_subscription_path(plan: "free")
 
 #### Session handling
 
-The Zaikio gem engine will set a cookie for the user after a successful OAuth flow: `cookies.encrypted[:zaikio_person_id]`.
+The Zaikio gem engine will set a cookie for the user after a successful OAuth flow: `session[:zaikio_person_id]`.
 
 If you are using for example `Zaikio::Hub::Models`, you can use this snippet to set the current user:
 
 ```ruby
-Current.user ||= Zaikio::Hub::Models::Person.find_by(id: cookies.encrypted[:zaikio_person_id])
+Current.user ||= Zaikio::Hub::Models::Person.find_by(id: session[:zaikio_person_id])
 ````
 
 You can then use `Current.user` anywhere.
@@ -172,7 +172,7 @@ Additionally you can also specify your own redirect handlers in your `Applicatio
 ```rb
 class ApplicationController < ActionController::Base
   def after_approve_path_for(access_token, origin)
-    cookies.encrypted[:zaikio_person_id] = access_token.bearer_id unless access_token.organization?
+    session[:zaikio_person_id] = access_token.bearer_id unless access_token.organization?
 
     # Sync data on login
     Zaikio::Hub.with_token(access_token.token) do
@@ -183,10 +183,15 @@ class ApplicationController < ActionController::Base
   end
 
   def after_destroy_path_for(access_token_id)
-    cookies.delete :zaikio_person_id
+    reset_session
 
     main_app.root_path
   end
+
+  def error_path_for(error_code, description: nil)
+    # Handle error
+    main_app.root_path
+  end
 end
 ```
 
@@ -234,6 +239,21 @@ class MyControllerTest < ActionDispatch::IntegrationTest
 end
 ```
 
+For system tests (e.g. with a separate browser instance), there's a special helper:
+
+```rb
+class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
+  include Zaikio::OAuthClient::SystemTestHelper
+
+  test "does request" do
+    person = people(:my_person)
+    logged_in_as(person)
+
+    visit "/"
+  end
+end
+```
+
 #### Authenticated requests
 
 Now further requests to the Directory API or to other Zaikio APIs should be made. For this purpose the OAuthClient provides a helper method `with_auth` that automatically fetches an access token from the database, requests a refresh token or creates a new access token via client credentials flow.

data/app/controllers/zaikio/oauth_client/subscriptions_controller.rb

@@ -2,15 +2,23 @@ module Zaikio
   module OAuthClient
     class SubscriptionsController < ConnectionsController
       def new
-        opts = params.permit(:client_name, :state, :plan)
-        client_name = opts.delete(:client_name)
-        plan = opts.delete(:plan)
+        opts = params.permit(:client_name, :state, :plan, :organization_id)
+        opts[:redirect_with_error] = 1
+        opts[:state] ||= session[:state] = SecureRandom.urlsafe_base64(32)
+
+        plan            = opts.delete(:plan)
+        organization_id = opts.delete(:organization_id)
+
+        subscription_scope = if organization_id.present?
+                               "Org/#{organization_id}.subscription_create"
+                             else
+                               "Org.subscription_create"
+                             end
 
-        subscription_scope = "Org.subscription_create"
         subscription_scope << ".#{plan}" if plan.present?
 
         redirect_to oauth_client.auth_code.authorize_url(
-          redirect_uri: approve_url(client_name),
+          redirect_uri: approve_url(opts.delete(:client_name)),
           scope: subscription_scope,
           **opts
         )

data/config/locales/de.yml

@@ -0,0 +1,4 @@
+de:
+  zaikio:
+    oauth_client:
+      error_occured: "Beim Login ist ein Fehler aufgetreten: %{error} %{description}. Bitte versuche es nochmal."

data/config/locales/en.yml

@@ -1,6 +1,7 @@
 en:
   zaikio:
+    oauth_client:
+      error_occured: "An error occurred during login: %{error} %{description}. Please try again."
     forms:
       optional: Optional
       learn_more: Learn more
-

data/lib/zaikio/oauth_client.rb

@@ -1,5 +1,6 @@
 require "oauth2"
 
+require "zaikio/oauth_client/error"
 require "zaikio/oauth_client/engine"
 require "zaikio/oauth_client/configuration"
 require "zaikio/oauth_client/authenticatable"
@@ -82,14 +83,25 @@ module Zaikio
       # Finds the best usable access token. Note that this token may have expired and
       # would require refreshing.
       def find_usable_access_token(client_name:, bearer_type:, bearer_id:, requested_scopes:)
-        Zaikio::AccessToken
-          .where(audience: client_name)
-          .usable(
-            bearer_type: bearer_type,
-            bearer_id: bearer_id,
-            requested_scopes: requested_scopes
-          )
-          .first
+        configuration.logger.debug "Try to fetch token for client_name: #{client_name}, "\
+          "bearer #{bearer_type}/#{bearer_id}, requested_scopes: #{requested_scopes}"
+
+        fetch_access_token = lambda {
+          Zaikio::AccessToken
+            .where(audience: client_name)
+            .usable(
+              bearer_type: bearer_type,
+              bearer_id: bearer_id,
+              requested_scopes: requested_scopes
+            )
+            .first
+        }
+
+        if configuration.logger.respond_to?(:silence)
+          configuration.logger.silence { fetch_access_token.call }
+        else
+          fetch_access_token.call
+        end
       end
 
       def fetch_new_token(client_config:, bearer_type:, bearer_id:, scopes:)

data/lib/zaikio/oauth_client/authenticatable.rb

@@ -5,7 +5,9 @@ module Zaikio
 
       def new
         opts = params.permit(:client_name, :show_signup, :force_login, :state)
+        opts[:redirect_with_error] = 1
         client_name = opts.delete(:client_name)
+        opts[:state] ||= session[:state] = SecureRandom.urlsafe_base64(32)
 
         redirect_to oauth_client.auth_code.authorize_url(
           redirect_uri: approve_url(client_name),
@@ -15,12 +17,27 @@ module Zaikio
       end
 
       def approve
+        if params[:error].present?
+          redirect_to send(
+            respond_to?(:error_path_for) ? :error_path_for : :default_error_path_for,
+            params[:error],
+            description: params[:error_description]
+          ) and return
+        end
+
+        if session[:state].present? && params[:state] != session[:state]
+          return redirect_to send(
+            respond_to?(:error_path_for) ? :error_path_for : :default_error_path_for,
+            "invalid_state"
+          )
+        end
+
         access_token = create_access_token
 
-        origin = cookies.encrypted[:origin]
-        cookies.delete :origin
+        origin = session[:origin]
+        session.delete(:origin)
 
-        cookies.encrypted[:zaikio_access_token_id] = access_token.id unless access_token.organization?
+        session[:zaikio_access_token_id] = access_token.id unless access_token.organization?
 
         redirect_to send(
           respond_to?(:after_approve_path_for) ? :after_approve_path_for : :default_after_approve_path_for,
@@ -29,8 +46,9 @@ module Zaikio
       end
 
       def destroy
-        access_token_id = cookies.encrypted[:zaikio_access_token_id]
-        cookies.delete :zaikio_access_token_id
+        access_token_id = session[:zaikio_access_token_id]
+        session.delete(:zaikio_access_token_id)
+        session.delete(:origin)
 
         redirect_to send(
           respond_to?(:after_destroy_path_for) ? :after_destroy_path_for : :default_after_destroy_path_for,
@@ -77,13 +95,23 @@ module Zaikio
       end
 
       def default_after_approve_path_for(access_token, origin)
-        cookies.encrypted[:zaikio_person_id] = access_token.bearer_id unless access_token.organization?
+        session[:zaikio_person_id] = access_token.bearer_id unless access_token.organization?
 
         origin || main_app.root_path
       end
 
       def default_after_destroy_path_for(_access_token_id)
-        cookies.delete :zaikio_person_id
+        session.delete(:origin)
+
+        main_app.root_path
+      end
+
+      def default_error_path_for(error_code, description: nil)
+        raise Zaikio::OAuthClient::InvalidScopesError, description if error_code == "invalid_scope"
+
+        unless error_code == "access_denied"
+          flash[:alert] = I18n.t("zaikio.oauth_client.error_occured", error: error_code, description: description)
+        end
 
         main_app.root_path
       end

data/lib/zaikio/oauth_client/configuration.rb

@@ -13,7 +13,6 @@ module Zaikio
       }.freeze
 
       attr_accessor :host
-      attr_writer :logger
       attr_reader :client_configurations, :environment, :around_auth_block,
                   :sessions_controller_name, :connections_controller_name, :subscriptions_controller_name
 
@@ -23,10 +22,16 @@ module Zaikio
         @sessions_controller_name = "sessions"
         @connections_controller_name = "connections"
         @subscriptions_controller_name = "subscriptions"
+        Zaikio::AccessToken.logger = logger
       end
 
       def logger
-        @logger ||= Logger.new($stdout)
+        @logger ||= ActiveSupport::Logger.new($stdout)
+      end
+
+      def logger=(logger)
+        @logger = logger
+        Zaikio::AccessToken.logger = @logger
       end
 
       def register_client(name)

data/lib/zaikio/oauth_client/error.rb

@@ -0,0 +1,5 @@
+module Zaikio
+  module OAuthClient
+    class InvalidScopesError < StandardError; end
+  end
+end

data/lib/zaikio/oauth_client/system_test_helper.rb

@@ -0,0 +1,18 @@
+require_relative "./test_helper"
+
+module Zaikio
+  module OAuthClient
+    module SystemTestHelper
+      include ::Zaikio::OAuthClient::TestHelper
+
+      def set_session(key, value)
+        visit "/zaikio/oauth_client/test_helper/session?#{{ key: key, id: value }.to_query}"
+      end
+
+      def get_session(key)
+        visit "/zaikio/oauth_client/test_helper/get_session?#{{ key: key }.to_query}"
+        page.text
+      end
+    end
+  end
+end

data/lib/zaikio/oauth_client/test_helper.rb

@@ -3,13 +3,48 @@ module Zaikio
     module TestHelper
       extend ActiveSupport::Concern
 
-      def logged_in_as(person)
-        # We need to manually encrypt the value since the tests cookie jar does not
-        # support encrypted or signed cookies
-        encrypted_cookies = ActionDispatch::Request.new(Rails.application.env_config.deep_dup).cookie_jar
-        encrypted_cookies.encrypted[:zaikio_person_id] = person.id
+      class TestSessionController < ActionController::Base
+        def show
+          if session[params[:key]].nil?
+            head :no_content
+          else
+            render plain: session[params[:key]]
+          end
+        end
+
+        def create
+          session[params[:key]] = params[:id]
+
+          head :ok
+        end
+      end
+
+      included do
+        # This is needed as it is not possible to set sesison values in an ActionDispatch::IntegrationTest
+        # This creates a dummy controller to set the session
+        Rails.application.routes.disable_clear_and_finalize = true # Keep existing routes
+        Rails.application.routes.draw do
+          get "/zaikio/oauth_client/test_helper/get_session", to: "zaikio/oauth_client/test_helper/test_session#show"
+          get "/zaikio/oauth_client/test_helper/session", to: "zaikio/oauth_client/test_helper/test_session#create"
+        end
+      end
 
-        cookies["zaikio_person_id"] = encrypted_cookies["zaikio_person_id"]
+      def get_session(key)
+        get "/zaikio/oauth_client/test_helper/get_session", params: { key: key }
+
+        if response.status == 204
+          nil
+        else
+          response.body
+        end
+      end
+
+      def set_session(key, value)
+        get "/zaikio/oauth_client/test_helper/session", params: { id: value, key: key }
+      end
+
+      def logged_in_as(person)
+        set_session(:zaikio_person_id, person.id)
       end
     end
   end

data/lib/zaikio/oauth_client/version.rb

@@ -1,5 +1,5 @@
 module Zaikio
   module OAuthClient
-    VERSION = "0.9.0".freeze
+    VERSION = "0.12.1".freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: zaikio-oauth_client
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.12.1
 platform: ruby
 authors:
 - Zaikio GmbH
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-04-13 00:00:00.000000000 Z
+date: 2021-04-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionpack
@@ -86,20 +86,20 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.2.1
+        version: '0.5'
     - - "<"
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.2.1
+        version: '0.5'
     - - "<"
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: pg
   requirement: !ruby/object:Gem::Requirement
@@ -150,6 +150,7 @@ files:
 - app/jobs/zaikio/cleanup_access_tokens_job.rb
 - app/models/zaikio/access_token.rb
 - config/initializers/inflections.rb
+- config/locales/de.yml
 - config/locales/en.yml
 - config/routes.rb
 - db/migrate/20190426155505_enable_postgres_extensions_for_uuids.rb
@@ -162,13 +163,15 @@ files:
 - lib/zaikio/oauth_client/client_configuration.rb
 - lib/zaikio/oauth_client/configuration.rb
 - lib/zaikio/oauth_client/engine.rb
+- lib/zaikio/oauth_client/error.rb
+- lib/zaikio/oauth_client/system_test_helper.rb
 - lib/zaikio/oauth_client/test_helper.rb
 - lib/zaikio/oauth_client/version.rb
 homepage: https://github.com/zaikio/zaikio-oauth_client
 licenses:
 - MIT
 metadata:
-  changelog_uri: https://github.com/zaikio/zaikio-oauth_client/blob/master/CHANGELOG.md
+  changelog_uri: https://github.com/zaikio/zaikio-oauth_client/blob/main/CHANGELOG.md
 post_install_message: 
 rdoc_options: []
 require_paths: