2019-04-30 08:27:42 +08:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2022-01-06 20:28:46 +08:00
|
|
|
require "discourse_connect_base"
|
2017-03-01 11:58:24 +08:00
|
|
|
|
2017-08-24 11:01:11 +08:00
|
|
|
RSpec.describe Users::OmniauthCallbacksController do
|
2023-11-10 06:47:59 +08:00
|
|
|
fab!(:user)
|
2017-03-01 11:58:24 +08:00
|
|
|
|
|
|
|
before { OmniAuth.config.test_mode = true }
|
|
|
|
|
|
|
|
after do
|
2017-05-09 11:26:24 +08:00
|
|
|
Rails.application.env_config["omniauth.auth"] = OmniAuth.config.mock_auth[:google_oauth2] = nil
|
2021-03-02 15:13:04 +08:00
|
|
|
Rails.application.env_config["omniauth.origin"] = nil
|
2017-03-01 11:58:24 +08:00
|
|
|
OmniAuth.config.test_mode = false
|
|
|
|
end
|
|
|
|
|
2018-03-01 15:33:00 +08:00
|
|
|
describe ".find_authenticator" do
|
|
|
|
it "fails if a provider is disabled" do
|
|
|
|
SiteSetting.enable_twitter_logins = false
|
|
|
|
|
|
|
|
expect do Users::OmniauthCallbacksController.find_authenticator("twitter") end.to raise_error(
|
|
|
|
Discourse::InvalidAccess,
|
|
|
|
)
|
|
|
|
end
|
|
|
|
|
|
|
|
it "fails for unknown" do
|
|
|
|
expect do
|
|
|
|
Users::OmniauthCallbacksController.find_authenticator("twitter1")
|
|
|
|
end.to raise_error(Discourse::InvalidAccess)
|
|
|
|
end
|
|
|
|
|
|
|
|
it "finds an authenticator when enabled" do
|
|
|
|
SiteSetting.enable_twitter_logins = true
|
|
|
|
|
|
|
|
expect(Users::OmniauthCallbacksController.find_authenticator("twitter")).not_to eq(nil)
|
|
|
|
end
|
2018-07-09 12:25:58 +08:00
|
|
|
|
|
|
|
context "with a plugin-contributed auth provider" do
|
|
|
|
let :provider do
|
2018-07-31 23:18:50 +08:00
|
|
|
provider = Auth::AuthProvider.new
|
2018-07-23 23:51:57 +08:00
|
|
|
provider.authenticator =
|
|
|
|
Class
|
|
|
|
.new(Auth::Authenticator) do
|
|
|
|
def name
|
|
|
|
"ubuntu"
|
|
|
|
end
|
2023-01-09 19:18:21 +08:00
|
|
|
|
2018-07-23 23:51:57 +08:00
|
|
|
def enabled?
|
|
|
|
SiteSetting.ubuntu_login_enabled
|
|
|
|
end
|
|
|
|
end
|
|
|
|
.new
|
|
|
|
|
2018-07-09 12:25:58 +08:00
|
|
|
provider
|
|
|
|
end
|
|
|
|
|
2018-07-23 23:51:57 +08:00
|
|
|
before { DiscoursePluginRegistry.register_auth_provider(provider) }
|
|
|
|
|
|
|
|
after { DiscoursePluginRegistry.reset! }
|
2018-07-09 12:25:58 +08:00
|
|
|
|
|
|
|
it "finds an authenticator when enabled" do
|
|
|
|
SiteSetting.stubs(:ubuntu_login_enabled).returns(true)
|
|
|
|
|
|
|
|
expect(Users::OmniauthCallbacksController.find_authenticator("ubuntu")).to be(
|
|
|
|
provider.authenticator,
|
|
|
|
)
|
|
|
|
end
|
|
|
|
|
|
|
|
it "fails if an authenticator is disabled" do
|
|
|
|
SiteSetting.stubs(:ubuntu_login_enabled).returns(false)
|
|
|
|
|
|
|
|
expect { Users::OmniauthCallbacksController.find_authenticator("ubuntu") }.to raise_error(
|
|
|
|
Discourse::InvalidAccess,
|
|
|
|
)
|
|
|
|
end
|
|
|
|
end
|
2018-03-01 15:33:00 +08:00
|
|
|
end
|
|
|
|
|
2022-07-28 00:14:14 +08:00
|
|
|
describe "Google Oauth2" do
|
2017-03-01 11:58:24 +08:00
|
|
|
before { SiteSetting.enable_google_oauth2_logins = true }
|
|
|
|
|
2019-08-08 22:49:09 +08:00
|
|
|
it "should display the failure message if needed" do
|
|
|
|
get "/auth/failure"
|
|
|
|
expect(response.status).to eq(200)
|
2019-08-12 17:55:02 +08:00
|
|
|
expect(response.body).to include(I18n.t("login.omniauth_error.generic"))
|
2019-08-08 22:49:09 +08:00
|
|
|
end
|
|
|
|
|
2019-08-08 18:57:28 +08:00
|
|
|
describe "request" do
|
|
|
|
it "should error for non existant authenticators" do
|
|
|
|
post "/auth/fake_auth"
|
|
|
|
expect(response.status).to eq(404)
|
|
|
|
get "/auth/fake_auth"
|
|
|
|
expect(response.status).to eq(403)
|
|
|
|
end
|
|
|
|
|
2019-08-12 17:55:02 +08:00
|
|
|
it "should error for disabled authenticators" do
|
|
|
|
SiteSetting.enable_google_oauth2_logins = false
|
|
|
|
post "/auth/google_oauth2"
|
|
|
|
expect(response.status).to eq(404)
|
|
|
|
get "/auth/google_oauth2"
|
|
|
|
expect(response.status).to eq(403)
|
|
|
|
end
|
|
|
|
|
|
|
|
it "should handle common errors" do
|
|
|
|
OmniAuth::Strategies::GoogleOauth2
|
|
|
|
.any_instance
|
|
|
|
.stubs(:mock_request_call)
|
|
|
|
.raises(
|
|
|
|
OAuth::Unauthorized.new(
|
|
|
|
mock().tap do |m|
|
|
|
|
m.stubs(:code).returns(403)
|
|
|
|
m.stubs(:message).returns("Message")
|
2023-01-09 19:18:21 +08:00
|
|
|
end,
|
|
|
|
),
|
2019-08-12 17:55:02 +08:00
|
|
|
)
|
|
|
|
post "/auth/google_oauth2"
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
expect(response.location).to include("/auth/failure?message=request_error")
|
|
|
|
|
|
|
|
OmniAuth::Strategies::GoogleOauth2
|
|
|
|
.any_instance
|
|
|
|
.stubs(:mock_request_call)
|
|
|
|
.raises(JWT::InvalidIatError.new)
|
|
|
|
post "/auth/google_oauth2"
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
expect(response.location).to include("/auth/failure?message=invalid_iat")
|
|
|
|
end
|
|
|
|
|
2019-08-08 18:57:28 +08:00
|
|
|
it "should only start auth with a POST request" do
|
|
|
|
post "/auth/google_oauth2"
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
get "/auth/google_oauth2"
|
|
|
|
expect(response.status).to eq(200)
|
|
|
|
end
|
|
|
|
|
|
|
|
context "with CSRF protection enabled" do
|
|
|
|
before { ActionController::Base.allow_forgery_protection = true }
|
|
|
|
after { ActionController::Base.allow_forgery_protection = false }
|
|
|
|
|
|
|
|
it "should be CSRF protected" do
|
|
|
|
post "/auth/google_oauth2"
|
2019-08-12 17:55:02 +08:00
|
|
|
expect(response.status).to eq(302)
|
|
|
|
expect(response.location).to include("/auth/failure?message=csrf_detected")
|
2019-08-08 18:57:28 +08:00
|
|
|
|
|
|
|
post "/auth/google_oauth2", params: { authenticity_token: "faketoken" }
|
2019-08-12 17:55:02 +08:00
|
|
|
expect(response.status).to eq(302)
|
|
|
|
expect(response.location).to include("/auth/failure?message=csrf_detected")
|
2019-08-08 18:57:28 +08:00
|
|
|
|
|
|
|
get "/session/csrf.json"
|
2020-05-07 23:04:12 +08:00
|
|
|
token = response.parsed_body["csrf"]
|
2019-08-08 18:57:28 +08:00
|
|
|
|
|
|
|
post "/auth/google_oauth2", params: { authenticity_token: token }
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
end
|
2019-08-09 21:44:03 +08:00
|
|
|
|
|
|
|
it "should not be CSRF protected if it is the only auth method" do
|
|
|
|
get "/auth/google_oauth2"
|
|
|
|
expect(response.status).to eq(200)
|
|
|
|
SiteSetting.enable_local_logins = false
|
|
|
|
get "/auth/google_oauth2"
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
end
|
2019-08-08 18:57:28 +08:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2022-07-28 00:14:14 +08:00
|
|
|
context "when in readonly mode" do
|
2022-05-13 23:52:01 +08:00
|
|
|
use_redis_snapshotting
|
|
|
|
|
|
|
|
it "should return a 503" do
|
|
|
|
Discourse.enable_readonly_mode
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback"
|
|
|
|
expect(response.code).to eq("503")
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2022-07-28 00:14:14 +08:00
|
|
|
context "when in staff writes only mode" do
|
2022-05-18 02:06:08 +08:00
|
|
|
use_redis_snapshotting
|
|
|
|
|
|
|
|
before { Discourse.enable_readonly_mode(Discourse::STAFF_WRITES_ONLY_MODE_KEY) }
|
|
|
|
|
|
|
|
it "returns a 503 for non-staff" do
|
|
|
|
mock_auth(user.email, user.username, user.name)
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
expect(response.status).to eq(503)
|
|
|
|
logged_on_user = Discourse.current_user_provider.new(request.env).current_user
|
|
|
|
|
|
|
|
expect(logged_on_user).to eq(nil)
|
|
|
|
end
|
|
|
|
|
|
|
|
it "completes for staff" do
|
|
|
|
user.update!(admin: true)
|
|
|
|
mock_auth(user.email, user.username, user.name)
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
logged_on_user = Discourse.current_user_provider.new(request.env).current_user
|
|
|
|
|
|
|
|
expect(logged_on_user).not_to eq(nil)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-05-05 03:35:03 +08:00
|
|
|
context "without an `omniauth.auth` env" do
|
|
|
|
it "should return a 404" do
|
|
|
|
get "/auth/eviltrout/callback"
|
2017-05-09 04:33:43 +08:00
|
|
|
expect(response.code).to eq("404")
|
2017-05-05 03:35:03 +08:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2018-09-05 05:54:50 +08:00
|
|
|
describe "when user not found" do
|
|
|
|
let(:email) { "somename@gmail.com" }
|
2021-12-08 03:06:44 +08:00
|
|
|
let(:username) { "somename" }
|
|
|
|
let(:name) { "Some Name" }
|
2018-09-05 05:54:50 +08:00
|
|
|
|
2021-12-08 03:06:44 +08:00
|
|
|
before { mock_auth(email, username, name) }
|
2018-09-05 05:54:50 +08:00
|
|
|
|
|
|
|
it "should return the right response" do
|
2019-05-15 16:55:31 +08:00
|
|
|
destination_url = "/somepath"
|
2018-09-05 05:54:50 +08:00
|
|
|
Rails.application.env_config["omniauth.origin"] = destination_url
|
|
|
|
|
2019-11-25 20:31:57 +08:00
|
|
|
events = DiscourseEvent.track_events { get "/auth/google_oauth2/callback.json" }
|
2020-11-13 22:41:54 +08:00
|
|
|
expect(events.any? { |e| e[:event_name] == :before_auth }).to eq(true)
|
2019-11-25 20:31:57 +08:00
|
|
|
expect(
|
|
|
|
events.any? do |e|
|
|
|
|
e[:event_name] === :after_auth && Auth::GoogleOAuth2Authenticator === e[:params][0] &&
|
|
|
|
!e[:params][1].failed?
|
2023-01-09 19:18:21 +08:00
|
|
|
end,
|
2019-11-25 20:31:57 +08:00
|
|
|
).to eq(true)
|
2018-09-05 05:54:50 +08:00
|
|
|
|
2019-10-08 19:10:43 +08:00
|
|
|
expect(response.status).to eq(302)
|
2018-09-05 05:54:50 +08:00
|
|
|
|
2019-10-08 19:10:43 +08:00
|
|
|
data = JSON.parse(cookies[:authentication_data])
|
2018-09-05 05:54:50 +08:00
|
|
|
|
2019-10-08 19:10:43 +08:00
|
|
|
expect(data["email"]).to eq(email)
|
2021-12-08 03:06:44 +08:00
|
|
|
expect(data["username"]).to eq(username)
|
|
|
|
expect(data["name"]).to eq(name)
|
2019-10-08 19:10:43 +08:00
|
|
|
expect(data["auth_provider"]).to eq("google_oauth2")
|
|
|
|
expect(data["email_valid"]).to eq(true)
|
2020-06-18 18:01:02 +08:00
|
|
|
expect(data["can_edit_username"]).to eq(true)
|
2019-10-08 19:10:43 +08:00
|
|
|
expect(data["destination_url"]).to eq(destination_url)
|
2024-06-24 12:19:32 +08:00
|
|
|
expect(read_secure_session["oauth"]).to eq("true")
|
2018-09-05 05:54:50 +08:00
|
|
|
end
|
|
|
|
|
2021-07-13 07:15:06 +08:00
|
|
|
it "should return the right response for staged users" do
|
2021-12-08 03:06:44 +08:00
|
|
|
Fabricate(:user, username: username, email: email, staged: true)
|
2021-07-13 07:15:06 +08:00
|
|
|
|
|
|
|
destination_url = "/somepath"
|
|
|
|
Rails.application.env_config["omniauth.origin"] = destination_url
|
|
|
|
|
|
|
|
events = DiscourseEvent.track_events { get "/auth/google_oauth2/callback.json" }
|
|
|
|
expect(events.any? { |e| e[:event_name] == :before_auth }).to eq(true)
|
|
|
|
expect(
|
|
|
|
events.any? do |e|
|
|
|
|
e[:event_name] === :after_auth && Auth::GoogleOAuth2Authenticator === e[:params][0] &&
|
|
|
|
!e[:params][1].failed?
|
2023-01-09 19:18:21 +08:00
|
|
|
end,
|
2021-07-13 07:15:06 +08:00
|
|
|
).to eq(true)
|
|
|
|
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
|
|
|
|
data = JSON.parse(cookies[:authentication_data])
|
|
|
|
|
|
|
|
expect(data["email"]).to eq(email)
|
2021-12-08 03:06:44 +08:00
|
|
|
expect(data["username"]).to eq(username)
|
2021-07-13 07:15:06 +08:00
|
|
|
expect(data["auth_provider"]).to eq("google_oauth2")
|
|
|
|
expect(data["email_valid"]).to eq(true)
|
|
|
|
expect(data["can_edit_username"]).to eq(true)
|
|
|
|
expect(data["name"]).to eq("Some Name")
|
|
|
|
expect(data["destination_url"]).to eq(destination_url)
|
|
|
|
end
|
|
|
|
|
2018-09-05 05:54:50 +08:00
|
|
|
it "should include destination url in response" do
|
2019-05-15 16:55:31 +08:00
|
|
|
destination_url = "/cookiepath"
|
2018-09-05 05:54:50 +08:00
|
|
|
cookies[:destination_url] = destination_url
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
|
2019-10-08 19:10:43 +08:00
|
|
|
data = JSON.parse(cookies[:authentication_data])
|
|
|
|
expect(data["destination_url"]).to eq(destination_url)
|
2018-09-05 05:54:50 +08:00
|
|
|
end
|
2021-03-02 15:13:04 +08:00
|
|
|
|
2021-08-03 00:57:52 +08:00
|
|
|
it "should return an associate url when multiple login methods are enabled" do
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
|
|
|
|
data = JSON.parse(cookies[:authentication_data])
|
|
|
|
expect(data["associate_url"]).to start_with("/associate/")
|
|
|
|
|
|
|
|
SiteSetting.enable_local_logins = false
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
data = JSON.parse(cookies[:authentication_data])
|
|
|
|
expect(data["associate_url"]).to eq(nil)
|
|
|
|
end
|
|
|
|
|
2022-02-07 20:02:26 +08:00
|
|
|
it "does not use email for username suggestions if disabled in settings" do
|
|
|
|
SiteSetting.use_email_for_username_and_name_suggestions = false
|
|
|
|
username = ""
|
|
|
|
name = ""
|
|
|
|
email = "billmailbox@test.com"
|
|
|
|
mock_auth(email, username, name)
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
data = JSON.parse(cookies[:authentication_data])
|
|
|
|
|
|
|
|
expect(data["username"]).to eq("user1") # not "billmailbox" that can be extracted from email
|
|
|
|
end
|
|
|
|
|
|
|
|
it "uses email for username suggestions if enabled in settings" do
|
|
|
|
SiteSetting.use_email_for_username_and_name_suggestions = true
|
|
|
|
username = ""
|
|
|
|
name = ""
|
|
|
|
email = "billmailbox@test.com"
|
|
|
|
mock_auth(email, username, name)
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
data = JSON.parse(cookies[:authentication_data])
|
|
|
|
|
|
|
|
expect(data["username"]).to eq("billmailbox")
|
|
|
|
end
|
|
|
|
|
2022-04-29 21:00:13 +08:00
|
|
|
it "stops using name for username suggestions if disabled in settings" do
|
|
|
|
SiteSetting.use_name_for_username_suggestions = false
|
|
|
|
username = ""
|
|
|
|
name = "John Smith"
|
|
|
|
email = "billmailbox@test.com"
|
|
|
|
mock_auth(email, username, name)
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
data = JSON.parse(cookies[:authentication_data])
|
|
|
|
|
|
|
|
expect(data["username"]).to eq("user1")
|
|
|
|
end
|
|
|
|
|
2021-03-02 15:13:04 +08:00
|
|
|
describe "when site is invite_only" do
|
|
|
|
before { SiteSetting.invite_only = true }
|
|
|
|
|
|
|
|
it "should return the right response without any origin" do
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
|
|
|
|
data = JSON.parse(response.cookies["authentication_data"])
|
|
|
|
|
|
|
|
expect(data["requires_invite"]).to eq(true)
|
|
|
|
end
|
|
|
|
|
|
|
|
it "returns the right response for an invalid origin" do
|
|
|
|
Rails.application.env_config["omniauth.origin"] = "/invitesinvites"
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
end
|
|
|
|
|
|
|
|
it "should return the right response when origin is invites page" do
|
|
|
|
origin =
|
|
|
|
Rails.application.routes.url_helpers.invite_url(
|
|
|
|
Fabricate(:invite).invite_key,
|
|
|
|
host: Discourse.base_url,
|
|
|
|
)
|
|
|
|
|
|
|
|
Rails.application.env_config["omniauth.origin"] = origin
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
expect(response).to redirect_to(origin)
|
|
|
|
|
|
|
|
data = JSON.parse(response.cookies["authentication_data"])
|
|
|
|
|
|
|
|
expect(data["requires_invite"]).to eq(nil)
|
|
|
|
end
|
|
|
|
end
|
2018-09-05 05:54:50 +08:00
|
|
|
end
|
|
|
|
|
2017-03-01 11:58:24 +08:00
|
|
|
describe "when user has been verified" do
|
2021-12-08 03:06:44 +08:00
|
|
|
let(:uid) { 12_345 }
|
2017-03-01 11:58:24 +08:00
|
|
|
|
2021-12-08 03:06:44 +08:00
|
|
|
before { mock_auth(user.email, "Somenickname", "Some name", uid) }
|
2017-03-01 11:58:24 +08:00
|
|
|
|
|
|
|
it "should return the right response" do
|
2017-06-08 07:05:33 +08:00
|
|
|
expect(user.email_confirmed?).to eq(false)
|
|
|
|
|
2017-06-01 16:19:42 +08:00
|
|
|
events = DiscourseEvent.track_events { get "/auth/google_oauth2/callback.json" }
|
|
|
|
|
2017-06-08 07:05:33 +08:00
|
|
|
expect(events.map { |event| event[:event_name] }).to include(
|
|
|
|
:user_logged_in,
|
|
|
|
:user_first_logged_in,
|
|
|
|
)
|
2017-03-01 11:58:24 +08:00
|
|
|
|
2019-10-08 19:10:43 +08:00
|
|
|
expect(response.status).to eq(302)
|
2017-03-01 11:58:24 +08:00
|
|
|
|
2019-10-08 19:10:43 +08:00
|
|
|
data = JSON.parse(cookies[:authentication_data])
|
2017-03-01 11:58:24 +08:00
|
|
|
|
2019-10-08 19:10:43 +08:00
|
|
|
expect(data["authenticated"]).to eq(true)
|
|
|
|
expect(data["awaiting_activation"]).to eq(false)
|
|
|
|
expect(data["awaiting_approval"]).to eq(false)
|
|
|
|
expect(data["not_allowed_from_ip_address"]).to eq(false)
|
|
|
|
expect(data["admin_not_allowed_from_ip_address"]).to eq(false)
|
2017-06-08 07:05:33 +08:00
|
|
|
|
|
|
|
user.reload
|
|
|
|
expect(user.email_confirmed?).to eq(true)
|
|
|
|
end
|
|
|
|
|
2020-03-22 04:24:49 +08:00
|
|
|
it "should return the authenticated response with the correct path for subfolders" do
|
|
|
|
set_subfolder "/forum"
|
|
|
|
events = DiscourseEvent.track_events { get "/auth/google_oauth2/callback.json" }
|
|
|
|
|
|
|
|
expect(
|
|
|
|
response.headers["Set-Cookie"].match(%r{^authentication_data=.*; path=/forum}),
|
|
|
|
).not_to eq(nil)
|
|
|
|
|
|
|
|
expect(events.map { |event| event[:event_name] }).to include(
|
|
|
|
:user_logged_in,
|
|
|
|
:user_first_logged_in,
|
|
|
|
)
|
|
|
|
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
|
|
|
|
data = JSON.parse(response.cookies["authentication_data"])
|
|
|
|
|
|
|
|
expect(data["authenticated"]).to eq(true)
|
|
|
|
expect(data["awaiting_activation"]).to eq(false)
|
|
|
|
expect(data["awaiting_approval"]).to eq(false)
|
|
|
|
expect(data["not_allowed_from_ip_address"]).to eq(false)
|
|
|
|
expect(data["admin_not_allowed_from_ip_address"]).to eq(false)
|
|
|
|
|
|
|
|
user.reload
|
|
|
|
expect(user.email_confirmed?).to eq(true)
|
|
|
|
end
|
|
|
|
|
2017-06-08 07:05:33 +08:00
|
|
|
it "should confirm email even when the tokens are expired" do
|
|
|
|
user.email_tokens.update_all(confirmed: false, expired: true)
|
|
|
|
|
|
|
|
user.reload
|
|
|
|
expect(user.email_confirmed?).to eq(false)
|
|
|
|
|
|
|
|
events = DiscourseEvent.track_events { get "/auth/google_oauth2/callback.json" }
|
|
|
|
|
|
|
|
expect(events.map { |event| event[:event_name] }).to include(
|
|
|
|
:user_logged_in,
|
|
|
|
:user_first_logged_in,
|
|
|
|
)
|
|
|
|
|
2019-10-08 19:10:43 +08:00
|
|
|
expect(response.status).to eq(302)
|
2017-06-08 07:05:33 +08:00
|
|
|
|
|
|
|
user.reload
|
|
|
|
expect(user.email_confirmed?).to eq(true)
|
2017-03-01 11:58:24 +08:00
|
|
|
end
|
|
|
|
|
2021-03-31 20:40:58 +08:00
|
|
|
it "should treat a staged user the same as an unregistered user" do
|
2017-12-12 20:08:57 +08:00
|
|
|
user.update!(staged: true, registration_ip_address: nil)
|
|
|
|
|
|
|
|
user.reload
|
|
|
|
expect(user.staged).to eq(true)
|
|
|
|
expect(user.registration_ip_address).to eq(nil)
|
|
|
|
|
|
|
|
events = DiscourseEvent.track_events { get "/auth/google_oauth2/callback.json" }
|
|
|
|
|
2021-03-31 20:40:58 +08:00
|
|
|
expect(events.map { |event| event[:event_name] }).to include(:before_auth, :after_auth)
|
2017-12-12 20:08:57 +08:00
|
|
|
|
2019-10-08 19:10:43 +08:00
|
|
|
expect(response.status).to eq(302)
|
2017-12-12 20:08:57 +08:00
|
|
|
|
2021-03-31 20:40:58 +08:00
|
|
|
data = JSON.parse(cookies[:authentication_data])
|
|
|
|
expect(data["username"]).to eq("Somenickname")
|
|
|
|
|
|
|
|
user.reload
|
|
|
|
expect(user.staged).to eq(true)
|
|
|
|
expect(user.registration_ip_address).to eq(nil)
|
|
|
|
|
|
|
|
# Now register
|
|
|
|
UsersController.any_instance.stubs(:honeypot_value).returns(nil)
|
|
|
|
UsersController.any_instance.stubs(:challenge_value).returns(nil)
|
|
|
|
post "/u.json",
|
|
|
|
params: {
|
|
|
|
name: "My new name",
|
|
|
|
username: "mynewusername",
|
|
|
|
email: user.email,
|
|
|
|
}
|
|
|
|
|
|
|
|
expect(response.status).to eq(200)
|
|
|
|
|
2017-12-12 20:08:57 +08:00
|
|
|
user.reload
|
|
|
|
expect(user.staged).to eq(false)
|
|
|
|
expect(user.registration_ip_address).to be_present
|
2021-03-31 20:40:58 +08:00
|
|
|
expect(user.name).to eq("My new name")
|
2017-12-12 20:08:57 +08:00
|
|
|
end
|
|
|
|
|
2019-08-28 19:49:11 +08:00
|
|
|
it "should activate user with matching email" do
|
|
|
|
user.update!(password: "securepassword", active: false, registration_ip_address: "1.1.1.1")
|
|
|
|
|
|
|
|
user.reload
|
|
|
|
expect(user.active).to eq(false)
|
|
|
|
expect(user.confirm_password?("securepassword")).to eq(true)
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
|
|
|
|
user.reload
|
|
|
|
expect(user.active).to eq(true)
|
|
|
|
|
|
|
|
# Delete the password, it may have been set by someone else
|
|
|
|
expect(user.confirm_password?("securepassword")).to eq(false)
|
|
|
|
end
|
|
|
|
|
2022-01-20 18:54:38 +08:00
|
|
|
it "should work if the user has no email_tokens, and an invite" do
|
|
|
|
# Confirming existing email_tokens has a side effect of redeeming invites.
|
|
|
|
# Pretend we don't have any email_tokens
|
|
|
|
user.email_tokens.destroy_all
|
|
|
|
|
|
|
|
invite = Fabricate(:invite, invited_by: Fabricate(:admin))
|
|
|
|
invite.update_column(:email, user.email) # (avoid validation)
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
|
|
|
|
expect(invite.reload.invalidated_at).not_to eq(nil)
|
|
|
|
end
|
|
|
|
|
2021-12-23 18:53:17 +08:00
|
|
|
it "should update name/username/email when SiteSetting.auth_overrides_* are enabled" do
|
2020-06-18 18:01:02 +08:00
|
|
|
SiteSetting.email_editable = false
|
2021-02-08 18:04:33 +08:00
|
|
|
SiteSetting.auth_overrides_email = true
|
|
|
|
SiteSetting.auth_overrides_name = true
|
|
|
|
SiteSetting.auth_overrides_username = true
|
2020-06-18 18:01:02 +08:00
|
|
|
|
2021-12-08 03:06:44 +08:00
|
|
|
UserAssociatedAccount.create!(
|
|
|
|
provider_name: "google_oauth2",
|
|
|
|
user_id: user.id,
|
|
|
|
provider_uid: uid,
|
|
|
|
)
|
2020-06-18 18:01:02 +08:00
|
|
|
|
|
|
|
old_email = user.email
|
|
|
|
user.update!(name: "somename", username: "somusername", email: "email@example.com")
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
|
|
|
|
user.reload
|
|
|
|
expect(user.email).to eq(old_email)
|
|
|
|
expect(user.username).to eq("Somenickname")
|
|
|
|
expect(user.name).to eq("Some name")
|
|
|
|
end
|
|
|
|
|
2021-12-07 00:49:04 +08:00
|
|
|
it "should preserve username when several users login with the same username" do
|
|
|
|
SiteSetting.auth_overrides_username = true
|
|
|
|
|
|
|
|
# if several users have username "bill" on the external site,
|
|
|
|
# they will have usernames bill, bill1, bill2 etc in Discourse:
|
|
|
|
Fabricate(:user, username: "bill")
|
|
|
|
Fabricate(:user, username: "bill1")
|
|
|
|
Fabricate(:user, username: "bill2")
|
|
|
|
Fabricate(:user, username: "bill4")
|
|
|
|
|
|
|
|
# the number should be preserved during subsequent logins
|
|
|
|
# bill3 should remain bill3
|
|
|
|
user.update!(username: "bill3")
|
|
|
|
|
|
|
|
uid = "12345"
|
|
|
|
UserAssociatedAccount.create!(
|
|
|
|
provider_name: "google_oauth2",
|
|
|
|
user_id: user.id,
|
|
|
|
provider_uid: uid,
|
|
|
|
)
|
|
|
|
mock_auth(user.email, "bill", uid)
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
|
|
|
|
user.reload
|
|
|
|
expect(user.username).to eq("bill3")
|
|
|
|
end
|
|
|
|
|
2020-06-18 18:01:02 +08:00
|
|
|
it "will not update email if not verified" do
|
|
|
|
SiteSetting.email_editable = false
|
2021-02-08 18:04:33 +08:00
|
|
|
SiteSetting.auth_overrides_email = true
|
2020-06-18 18:01:02 +08:00
|
|
|
|
|
|
|
OmniAuth.config.mock_auth[:google_oauth2][:extra][:raw_info][:email_verified] = false
|
|
|
|
|
|
|
|
UserAssociatedAccount.create!(
|
|
|
|
provider_name: "google_oauth2",
|
|
|
|
user_id: user.id,
|
|
|
|
provider_uid: "123545",
|
|
|
|
)
|
|
|
|
|
|
|
|
old_email = user.email
|
|
|
|
user.update!(email: "email@example.com")
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
|
|
|
|
user.reload
|
|
|
|
expect(user.email).to eq("email@example.com")
|
|
|
|
end
|
|
|
|
|
2021-02-08 18:04:33 +08:00
|
|
|
it "shows error when auth_overrides_email causes a validation error" do
|
2020-11-23 19:06:08 +08:00
|
|
|
SiteSetting.email_editable = false
|
2021-02-08 18:04:33 +08:00
|
|
|
SiteSetting.auth_overrides_email = true
|
2020-11-23 19:06:08 +08:00
|
|
|
|
2021-12-08 03:06:44 +08:00
|
|
|
UserAssociatedAccount.create!(
|
|
|
|
provider_name: "google_oauth2",
|
|
|
|
user_id: user.id,
|
|
|
|
provider_uid: uid,
|
|
|
|
)
|
2020-11-23 19:06:08 +08:00
|
|
|
|
|
|
|
google_email = user.email
|
|
|
|
user.update!(email: "anotheremail@example.com")
|
|
|
|
Fabricate(:user, email: google_email) # Another user has the google account email
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback"
|
|
|
|
expect(response.status).to eq(200)
|
|
|
|
expect(response.body).to include(I18n.t("errors.messages.taken"))
|
|
|
|
expect(session[:current_user_id]).to eq(nil)
|
|
|
|
|
|
|
|
user.reload
|
|
|
|
expect(user.email).to eq("anotheremail@example.com")
|
|
|
|
end
|
|
|
|
|
2020-01-15 18:27:12 +08:00
|
|
|
context "when user has TOTP enabled" do
|
2018-03-01 15:47:07 +08:00
|
|
|
before { user.create_totp(enabled: true) }
|
|
|
|
|
|
|
|
it "should return the right response" do
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
|
2019-10-08 19:10:43 +08:00
|
|
|
expect(response.status).to eq(302)
|
2018-03-01 15:47:07 +08:00
|
|
|
|
2019-10-08 19:10:43 +08:00
|
|
|
data = JSON.parse(cookies[:authentication_data])
|
2018-03-01 15:47:07 +08:00
|
|
|
|
2019-10-08 19:10:43 +08:00
|
|
|
expect(data["email"]).to eq(user.email)
|
|
|
|
expect(data["omniauth_disallow_totp"]).to eq(true)
|
2018-05-30 12:14:04 +08:00
|
|
|
|
|
|
|
user.update!(email: "different@user.email")
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
|
2019-10-08 19:10:43 +08:00
|
|
|
expect(response.status).to eq(302)
|
|
|
|
expect(JSON.parse(cookies[:authentication_data])["email"]).to eq(user.email)
|
2018-03-01 15:47:07 +08:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2024-06-19 07:32:30 +08:00
|
|
|
context "when user has TOTP enabled but enforce_second_factor_on_external_auth is false" do
|
|
|
|
before { user.create_totp(enabled: true) }
|
|
|
|
|
|
|
|
it "should return the right response" do
|
|
|
|
SiteSetting.enforce_second_factor_on_external_auth = false
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
|
|
|
|
data = JSON.parse(cookies[:authentication_data])
|
|
|
|
|
|
|
|
expect(data["authenticated"]).to eq(true)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2020-01-15 18:27:12 +08:00
|
|
|
context "when user has security key enabled" do
|
|
|
|
before { Fabricate(:user_security_key_with_random_credential, user: user) }
|
|
|
|
|
|
|
|
it "should return the right response" do
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
|
|
|
|
data = JSON.parse(cookies[:authentication_data])
|
|
|
|
|
|
|
|
expect(data["email"]).to eq(user.email)
|
|
|
|
expect(data["omniauth_disallow_totp"]).to eq(true)
|
|
|
|
|
|
|
|
user.update!(email: "different@user.email")
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
expect(JSON.parse(cookies[:authentication_data])["email"]).to eq(user.email)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2018-10-05 02:31:08 +08:00
|
|
|
context "when sso_payload cookie exist" do
|
|
|
|
before do
|
2021-02-08 18:04:33 +08:00
|
|
|
SiteSetting.enable_discourse_connect_provider = true
|
|
|
|
SiteSetting.discourse_connect_secret = "topsecret"
|
2018-10-05 02:31:08 +08:00
|
|
|
|
2022-01-06 20:28:46 +08:00
|
|
|
@sso = DiscourseConnectBase.new
|
2018-10-05 02:31:08 +08:00
|
|
|
@sso.nonce = "mynonce"
|
2021-02-08 18:04:33 +08:00
|
|
|
@sso.sso_secret = SiteSetting.discourse_connect_secret
|
2018-10-05 02:31:08 +08:00
|
|
|
@sso.return_sso_url = "http://somewhere.over.rainbow/sso"
|
|
|
|
cookies[:sso_payload] = @sso.payload
|
|
|
|
|
2021-12-08 03:06:44 +08:00
|
|
|
provider_uid = 12_345
|
|
|
|
UserAssociatedAccount.create!(
|
|
|
|
provider_name: "google_oauth2",
|
|
|
|
provider_uid: provider_uid,
|
|
|
|
user: user,
|
|
|
|
)
|
2018-10-05 02:31:08 +08:00
|
|
|
|
2021-12-08 03:06:44 +08:00
|
|
|
mock_auth(user.email, nil, nil, provider_uid)
|
2018-10-05 02:31:08 +08:00
|
|
|
end
|
|
|
|
|
|
|
|
it "should return the right response" do
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
|
2019-10-08 19:10:43 +08:00
|
|
|
expect(response.status).to eq(302)
|
2018-10-05 02:31:08 +08:00
|
|
|
|
2019-10-08 19:10:43 +08:00
|
|
|
data = JSON.parse(cookies[:authentication_data])
|
2018-10-05 02:31:08 +08:00
|
|
|
|
2019-10-08 19:10:43 +08:00
|
|
|
expect(data["destination_url"]).to match(%r{/session/sso_provider\?sso\=.*\&sig\=.*})
|
2018-10-05 02:31:08 +08:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-03-01 11:58:24 +08:00
|
|
|
context "when user has not verified his email" do
|
|
|
|
before do
|
2021-12-08 03:06:44 +08:00
|
|
|
provider_uid = "12345"
|
|
|
|
UserAssociatedAccount.create!(
|
|
|
|
provider_name: "google_oauth2",
|
|
|
|
provider_uid: provider_uid,
|
|
|
|
user: user,
|
|
|
|
)
|
2017-03-01 11:58:24 +08:00
|
|
|
user.update!(active: false)
|
|
|
|
|
2021-12-08 03:06:44 +08:00
|
|
|
another_email = "another_email@test.com"
|
|
|
|
mock_auth(another_email, nil, nil, provider_uid)
|
2017-03-01 11:58:24 +08:00
|
|
|
end
|
|
|
|
|
|
|
|
it "should return the right response" do
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
|
2019-10-08 19:10:43 +08:00
|
|
|
expect(response.status).to eq(302)
|
2017-03-01 11:58:24 +08:00
|
|
|
|
2019-10-08 19:10:43 +08:00
|
|
|
data = JSON.parse(cookies[:authentication_data])
|
2017-03-01 11:58:24 +08:00
|
|
|
|
|
|
|
expect(user.reload.active).to eq(false)
|
2019-10-08 19:10:43 +08:00
|
|
|
expect(data["authenticated"]).to eq(false)
|
|
|
|
expect(data["awaiting_activation"]).to eq(true)
|
2017-03-01 11:58:24 +08:00
|
|
|
end
|
|
|
|
end
|
2019-03-19 20:39:13 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
it "doesn't attempt redirect to external origin" do
|
|
|
|
post "/auth/google_oauth2?origin=https://example.com/external"
|
|
|
|
get "/auth/google_oauth2/callback"
|
2019-05-15 16:55:31 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
expect(response.status).to eq 302
|
|
|
|
expect(response.location).to eq "http://test.localhost/"
|
2019-03-19 20:39:13 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
cookie_data = JSON.parse(response.cookies["authentication_data"])
|
|
|
|
expect(cookie_data["destination_url"]).to eq("/")
|
|
|
|
end
|
2019-03-19 20:39:13 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
it "redirects to internal origin" do
|
|
|
|
post "/auth/google_oauth2?origin=http://test.localhost/t/123"
|
|
|
|
get "/auth/google_oauth2/callback"
|
2019-05-15 16:55:31 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
expect(response.status).to eq 302
|
|
|
|
expect(response.location).to eq "http://test.localhost/t/123"
|
2019-03-19 20:39:13 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
cookie_data = JSON.parse(response.cookies["authentication_data"])
|
|
|
|
expect(cookie_data["destination_url"]).to eq("/t/123")
|
|
|
|
end
|
2020-08-26 22:52:21 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
it "redirects to internal origin on subfolder" do
|
|
|
|
set_subfolder "/subpath"
|
2020-08-26 22:52:21 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
post "/auth/google_oauth2?origin=http://test.localhost/subpath/t/123"
|
|
|
|
get "/auth/google_oauth2/callback"
|
2020-08-26 22:52:21 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
expect(response.status).to eq 302
|
|
|
|
expect(response.location).to eq "http://test.localhost/subpath/t/123"
|
2020-08-26 22:52:21 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
cookie_data = JSON.parse(response.cookies["authentication_data"])
|
|
|
|
expect(cookie_data["destination_url"]).to eq("/subpath/t/123")
|
|
|
|
end
|
2020-01-09 01:06:03 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
it "never redirects to /auth/ origin" do
|
|
|
|
post "/auth/google_oauth2?origin=http://test.localhost/auth/google_oauth2"
|
|
|
|
get "/auth/google_oauth2/callback"
|
2020-01-09 01:06:03 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
expect(response.status).to eq 302
|
|
|
|
expect(response.location).to eq "http://test.localhost/"
|
2020-01-09 01:06:03 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
cookie_data = JSON.parse(response.cookies["authentication_data"])
|
|
|
|
expect(cookie_data["destination_url"]).to eq("/")
|
|
|
|
end
|
2020-08-26 22:52:21 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
it "never redirects to /auth/ origin on subfolder" do
|
|
|
|
set_subfolder "/subpath"
|
2020-08-26 22:52:21 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
post "/auth/google_oauth2?origin=http://test.localhost/subpath/auth/google_oauth2"
|
|
|
|
get "/auth/google_oauth2/callback"
|
2020-08-26 22:52:21 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
expect(response.status).to eq 302
|
|
|
|
expect(response.location).to eq "http://test.localhost/subpath"
|
2020-08-26 22:52:21 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
cookie_data = JSON.parse(response.cookies["authentication_data"])
|
|
|
|
expect(cookie_data["destination_url"]).to eq("/subpath")
|
|
|
|
end
|
2019-03-19 20:39:13 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
it "redirects to relative origin" do
|
|
|
|
post "/auth/google_oauth2?origin=/t/123"
|
|
|
|
get "/auth/google_oauth2/callback"
|
2019-05-15 16:55:31 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
expect(response.status).to eq 302
|
|
|
|
expect(response.location).to eq "http://test.localhost/t/123"
|
2019-03-19 20:39:13 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
cookie_data = JSON.parse(response.cookies["authentication_data"])
|
|
|
|
expect(cookie_data["destination_url"]).to eq("/t/123")
|
|
|
|
end
|
2019-03-19 20:39:13 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
it "redirects with query" do
|
|
|
|
post "/auth/google_oauth2?origin=/t/123?foo=bar"
|
|
|
|
get "/auth/google_oauth2/callback"
|
2019-05-15 16:55:31 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
expect(response.status).to eq 302
|
|
|
|
expect(response.location).to eq "http://test.localhost/t/123?foo=bar"
|
2019-03-19 20:39:13 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
cookie_data = JSON.parse(response.cookies["authentication_data"])
|
|
|
|
expect(cookie_data["destination_url"]).to eq("/t/123?foo=bar")
|
|
|
|
end
|
2019-03-19 20:39:13 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
it "removes authentication_data cookie on logout" do
|
|
|
|
post "/auth/google_oauth2?origin=https://example.com/external"
|
|
|
|
get "/auth/google_oauth2/callback"
|
2019-03-19 20:39:13 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
provider = log_in_user(Fabricate(:user))
|
2019-03-19 20:39:13 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
expect(cookies["authentication_data"]).to be
|
2019-03-19 20:39:13 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
log_out_user(provider)
|
2019-03-19 20:39:13 +08:00
|
|
|
|
2021-07-07 17:54:18 +08:00
|
|
|
expect(cookies["authentication_data"]).to be_nil
|
2019-03-19 20:39:13 +08:00
|
|
|
end
|
2021-12-06 19:06:35 +08:00
|
|
|
|
|
|
|
it "removes disallowed characters from username" do
|
|
|
|
username = "strange_name*&^"
|
|
|
|
fixed_username = "strange_name"
|
|
|
|
|
|
|
|
mock_auth("user.with.strange.username@gmail.com", username)
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
data = JSON.parse(cookies[:authentication_data])
|
|
|
|
|
|
|
|
expect(data["username"]).to eq(fixed_username)
|
|
|
|
end
|
2021-12-09 20:30:27 +08:00
|
|
|
|
2022-07-28 00:14:14 +08:00
|
|
|
context "when groups are enabled" do
|
2022-10-13 23:04:42 +08:00
|
|
|
let(:private_key) { OpenSSL::PKey::RSA.generate(2048) }
|
2021-12-09 20:30:27 +08:00
|
|
|
let(:group1) { { id: "12345", name: "group1" } }
|
|
|
|
let(:group2) { { id: "67890", name: "group2" } }
|
|
|
|
let(:uid) { "12345" }
|
|
|
|
let(:token) { "1245678" }
|
|
|
|
let(:domain) { "mydomain.com" }
|
|
|
|
|
|
|
|
def mock_omniauth_for_groups(groups)
|
|
|
|
mock_auth = OmniAuth.config.mock_auth[:google_oauth2]
|
|
|
|
OmniAuth.config.mock_auth[:google_oauth2] = mock_auth
|
|
|
|
Rails.application.env_config["omniauth.auth"] = mock_auth
|
2022-10-13 23:04:42 +08:00
|
|
|
|
|
|
|
SiteSetting.google_oauth2_hd_groups_service_account_admin_email = "admin@example.com"
|
|
|
|
SiteSetting.google_oauth2_hd_groups_service_account_json = {
|
|
|
|
"private_key" => private_key.to_s,
|
|
|
|
:"client_email" => "discourse-group-sync@example.iam.gserviceaccount.com",
|
|
|
|
}.to_json
|
|
|
|
SiteSetting.google_oauth2_hd_groups = true
|
|
|
|
|
|
|
|
stub_request(:post, "https://oauth2.googleapis.com/token").to_return do |request|
|
|
|
|
jwt = Rack::Utils.parse_query(request.body)["assertion"]
|
|
|
|
decoded_token = JWT.decode(jwt, private_key.public_key, true, { algorithm: "RS256" })
|
|
|
|
{
|
|
|
|
status: 200,
|
|
|
|
body: { "access_token" => token, "type" => "bearer" }.to_json,
|
|
|
|
headers: {
|
|
|
|
"Content-Type" => "application/json",
|
|
|
|
},
|
|
|
|
}
|
|
|
|
end
|
|
|
|
|
|
|
|
stub_request(
|
|
|
|
:get,
|
|
|
|
"https://admin.googleapis.com/admin/directory/v1/groups?userKey=#{mock_auth.uid}",
|
2023-01-09 19:18:21 +08:00
|
|
|
)
|
2022-10-13 23:04:42 +08:00
|
|
|
.with(headers: { "Authorization" => "Bearer #{token}" })
|
|
|
|
.to_return do
|
|
|
|
{
|
|
|
|
status: 200,
|
|
|
|
body: { groups: groups }.to_json,
|
|
|
|
headers: {
|
|
|
|
"Content-Type" => "application/json",
|
|
|
|
},
|
|
|
|
}
|
|
|
|
end
|
2021-12-09 20:30:27 +08:00
|
|
|
end
|
|
|
|
|
|
|
|
before do
|
|
|
|
SiteSetting.google_oauth2_hd = domain
|
2022-10-13 23:04:42 +08:00
|
|
|
SiteSetting.google_oauth2_hd_groups_service_account_admin_email = "test@example.com"
|
|
|
|
SiteSetting.google_oauth2_hd_groups_service_account_json = "{}"
|
2021-12-09 20:30:27 +08:00
|
|
|
SiteSetting.google_oauth2_hd_groups = true
|
|
|
|
end
|
|
|
|
|
|
|
|
it "updates associated groups" do
|
|
|
|
mock_omniauth_for_groups([group1, group2])
|
|
|
|
get "/auth/google_oauth2/callback.json", params: { code: "abcde", hd: domain }
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
|
|
|
|
associated_groups = AssociatedGroup.where(provider_name: "google_oauth2")
|
|
|
|
expect(associated_groups.length).to eq(2)
|
|
|
|
expect(associated_groups.exists?(name: group1[:name])).to eq(true)
|
|
|
|
expect(associated_groups.exists?(name: group2[:name])).to eq(true)
|
|
|
|
|
|
|
|
user_associated_groups = UserAssociatedGroup.where(user_id: user.id)
|
|
|
|
expect(user_associated_groups.length).to eq(2)
|
|
|
|
expect(
|
|
|
|
user_associated_groups.exists?(associated_group_id: associated_groups.first.id),
|
|
|
|
).to eq(true)
|
|
|
|
expect(
|
|
|
|
user_associated_groups.exists?(associated_group_id: associated_groups.second.id),
|
|
|
|
).to eq(true)
|
|
|
|
|
|
|
|
mock_omniauth_for_groups([group1])
|
|
|
|
get "/auth/google_oauth2/callback.json", params: { code: "abcde", hd: domain }
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
|
|
|
|
user_associated_groups = UserAssociatedGroup.where(user_id: user.id)
|
|
|
|
expect(user_associated_groups.length).to eq(1)
|
|
|
|
expect(
|
|
|
|
user_associated_groups.exists?(associated_group_id: associated_groups.first.id),
|
|
|
|
).to eq(true)
|
|
|
|
expect(
|
|
|
|
user_associated_groups.exists?(associated_group_id: associated_groups.second.id),
|
|
|
|
).to eq(false)
|
|
|
|
|
|
|
|
mock_omniauth_for_groups([])
|
|
|
|
get "/auth/google_oauth2/callback.json", params: { code: "abcde", hd: domain }
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
|
|
|
|
user_associated_groups = UserAssociatedGroup.where(user_id: user.id)
|
|
|
|
expect(user_associated_groups.length).to eq(0)
|
|
|
|
expect(
|
|
|
|
user_associated_groups.exists?(associated_group_id: associated_groups.first.id),
|
|
|
|
).to eq(false)
|
|
|
|
expect(
|
|
|
|
user_associated_groups.exists?(associated_group_id: associated_groups.second.id),
|
|
|
|
).to eq(false)
|
|
|
|
end
|
|
|
|
|
|
|
|
it "handles failure to retrieve groups" do
|
|
|
|
mock_omniauth_for_groups([])
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json", params: { code: "abcde", hd: domain }
|
|
|
|
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
|
|
|
|
associated_groups = AssociatedGroup.where(provider_name: "google_oauth2")
|
|
|
|
expect(associated_groups.exists?).to eq(false)
|
|
|
|
end
|
|
|
|
end
|
2017-03-01 11:58:24 +08:00
|
|
|
end
|
2017-09-12 23:36:17 +08:00
|
|
|
|
2018-12-11 21:19:00 +08:00
|
|
|
context "when attempting reconnect" do
|
2019-05-07 11:12:20 +08:00
|
|
|
fab!(:user2) { Fabricate(:user) }
|
2021-12-08 03:06:44 +08:00
|
|
|
let(:user1_provider_id) { "12345" }
|
|
|
|
let(:user2_provider_id) { "123456" }
|
|
|
|
|
2018-12-11 21:19:00 +08:00
|
|
|
before do
|
2021-12-08 03:06:44 +08:00
|
|
|
UserAssociatedAccount.create!(
|
|
|
|
provider_name: "google_oauth2",
|
|
|
|
provider_uid: user1_provider_id,
|
|
|
|
user: user,
|
|
|
|
)
|
|
|
|
UserAssociatedAccount.create!(
|
|
|
|
provider_name: "google_oauth2",
|
|
|
|
provider_uid: user2_provider_id,
|
|
|
|
user: user2,
|
2023-01-09 19:18:21 +08:00
|
|
|
)
|
2018-12-11 21:19:00 +08:00
|
|
|
|
2021-12-08 03:06:44 +08:00
|
|
|
mock_auth("someother_email@test.com", nil, nil, user1_provider_id)
|
2018-12-11 21:19:00 +08:00
|
|
|
end
|
|
|
|
|
|
|
|
it "should not reconnect normally" do
|
|
|
|
# Log in normally
|
2019-08-08 18:57:28 +08:00
|
|
|
post "/auth/google_oauth2"
|
2018-12-11 21:19:00 +08:00
|
|
|
expect(response.status).to eq(302)
|
|
|
|
expect(session[:auth_reconnect]).to eq(false)
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
2019-10-08 19:10:43 +08:00
|
|
|
expect(response.status).to eq(302)
|
2018-12-11 21:19:00 +08:00
|
|
|
expect(session[:current_user_id]).to eq(user.id)
|
|
|
|
|
|
|
|
# Log into another user
|
2021-12-08 03:06:44 +08:00
|
|
|
OmniAuth.config.mock_auth[:google_oauth2].uid = user2_provider_id
|
2019-08-08 18:57:28 +08:00
|
|
|
post "/auth/google_oauth2"
|
2018-12-11 21:19:00 +08:00
|
|
|
expect(response.status).to eq(302)
|
|
|
|
expect(session[:auth_reconnect]).to eq(false)
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
2019-10-08 19:10:43 +08:00
|
|
|
expect(response.status).to eq(302)
|
2018-12-11 21:19:00 +08:00
|
|
|
expect(session[:current_user_id]).to eq(user2.id)
|
2019-03-07 19:31:04 +08:00
|
|
|
expect(UserAssociatedAccount.count).to eq(2)
|
2018-12-11 21:19:00 +08:00
|
|
|
end
|
|
|
|
|
2019-07-17 19:34:02 +08:00
|
|
|
it "should redirect to associate URL if parameter supplied" do
|
2018-12-11 21:19:00 +08:00
|
|
|
# Log in normally
|
2019-08-08 18:57:28 +08:00
|
|
|
post "/auth/google_oauth2?reconnect=true"
|
2018-12-11 21:19:00 +08:00
|
|
|
expect(response.status).to eq(302)
|
|
|
|
expect(session[:auth_reconnect]).to eq(true)
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
2019-10-08 19:10:43 +08:00
|
|
|
expect(response.status).to eq(302)
|
2018-12-11 21:19:00 +08:00
|
|
|
expect(session[:current_user_id]).to eq(user.id)
|
|
|
|
|
|
|
|
# Clear cookie after login
|
|
|
|
expect(session[:auth_reconnect]).to eq(nil)
|
|
|
|
|
|
|
|
# Disconnect
|
2019-03-07 19:31:04 +08:00
|
|
|
UserAssociatedAccount.find_by(user_id: user.id).destroy
|
2018-12-11 21:19:00 +08:00
|
|
|
|
|
|
|
# Reconnect flow:
|
2019-08-08 18:57:28 +08:00
|
|
|
post "/auth/google_oauth2?reconnect=true"
|
2018-12-11 21:19:00 +08:00
|
|
|
expect(response.status).to eq(302)
|
|
|
|
expect(session[:auth_reconnect]).to eq(true)
|
|
|
|
|
2021-12-08 03:06:44 +08:00
|
|
|
OmniAuth.config.mock_auth[:google_oauth2].uid = user2_provider_id
|
2018-12-11 21:19:00 +08:00
|
|
|
get "/auth/google_oauth2/callback.json"
|
2019-07-17 19:34:02 +08:00
|
|
|
expect(response.status).to eq(302)
|
|
|
|
expect(response.redirect_url).to start_with("http://test.localhost/associate/")
|
|
|
|
|
2018-12-11 21:19:00 +08:00
|
|
|
expect(session[:current_user_id]).to eq(user.id)
|
2019-07-24 18:45:36 +08:00
|
|
|
expect(UserAssociatedAccount.count).to eq(1) # Reconnect has not yet happened
|
2018-12-11 21:19:00 +08:00
|
|
|
end
|
|
|
|
|
2021-03-31 17:23:12 +08:00
|
|
|
it 'stores and redirects to \'origin\' parameter' do
|
|
|
|
# Log in normally
|
|
|
|
post "/auth/google_oauth2?origin=http://test.localhost/atesturl"
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
expect(session[:destination_url]).to eq("http://test.localhost/atesturl")
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
expect(response.status).to eq(302)
|
|
|
|
expect(response.redirect_url).to eq("http://test.localhost/atesturl")
|
|
|
|
end
|
2018-12-11 21:19:00 +08:00
|
|
|
end
|
|
|
|
|
2017-09-12 23:36:17 +08:00
|
|
|
context "after changing email" do
|
|
|
|
def login(identity)
|
2021-12-08 03:06:44 +08:00
|
|
|
mock_auth(identity[:email], nil, nil, "123545#{identity[:username]}")
|
2017-09-12 23:36:17 +08:00
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
2019-10-08 19:10:43 +08:00
|
|
|
expect(response.status).to eq(302)
|
|
|
|
JSON.parse(cookies[:authentication_data])
|
2017-09-12 23:36:17 +08:00
|
|
|
end
|
|
|
|
|
|
|
|
it "activates the correct email" do
|
|
|
|
old_email = "old@email.com"
|
|
|
|
old_identity = { name: "Bob", username: "bob", email: old_email }
|
|
|
|
user = Fabricate(:user, email: old_email)
|
|
|
|
new_email = "new@email.com"
|
|
|
|
new_identity = { name: "Bob", username: "boguslaw", email: new_email }
|
|
|
|
|
2020-02-20 07:52:21 +08:00
|
|
|
updater = EmailUpdater.new(guardian: user.guardian, user: user)
|
2017-09-12 23:36:17 +08:00
|
|
|
updater.change_to(new_email)
|
|
|
|
|
|
|
|
user.reload
|
|
|
|
expect(user.email).to eq(old_email)
|
|
|
|
|
|
|
|
response = login(old_identity)
|
|
|
|
expect(response["authenticated"]).to eq(true)
|
|
|
|
|
|
|
|
user.reload
|
|
|
|
expect(user.email).to eq(old_email)
|
|
|
|
|
2018-07-25 23:33:42 +08:00
|
|
|
delete "/session/#{user.username}" # log out
|
|
|
|
|
2017-09-12 23:36:17 +08:00
|
|
|
response = login(new_identity)
|
|
|
|
expect(response["authenticated"]).to eq(nil)
|
|
|
|
expect(response["email"]).to eq(new_email)
|
|
|
|
end
|
|
|
|
end
|
2021-12-06 19:06:35 +08:00
|
|
|
|
|
|
|
context "when user is staged" do
|
|
|
|
fab!(:staged_user) do
|
|
|
|
Fabricate(:user, username: "staged_user", email: "staged.user@gmail.com", staged: true)
|
2023-01-09 19:18:21 +08:00
|
|
|
end
|
2021-12-06 19:06:35 +08:00
|
|
|
|
|
|
|
it "should use username of the staged user if username is not present in payload" do
|
|
|
|
mock_auth(staged_user.email, nil)
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
data = JSON.parse(cookies[:authentication_data])
|
|
|
|
|
|
|
|
expect(data["username"]).to eq(staged_user.username)
|
|
|
|
end
|
|
|
|
|
|
|
|
it "should use username of the staged user if username in payload is the same" do
|
2021-12-16 23:44:07 +08:00
|
|
|
# it's important to check this, because we had regressions
|
|
|
|
# when usernames were changed to the same username with "1" added at the end
|
|
|
|
|
2021-12-06 19:06:35 +08:00
|
|
|
mock_auth(staged_user.email, staged_user.username)
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
data = JSON.parse(cookies[:authentication_data])
|
|
|
|
|
|
|
|
expect(data["username"]).to eq(staged_user.username)
|
|
|
|
end
|
|
|
|
|
|
|
|
it "should override username of the staged user if payload contains a new username" do
|
|
|
|
new_username = "new_username"
|
|
|
|
mock_auth(staged_user.email, new_username)
|
|
|
|
|
|
|
|
get "/auth/google_oauth2/callback.json"
|
|
|
|
data = JSON.parse(cookies[:authentication_data])
|
|
|
|
|
|
|
|
expect(data["username"]).to eq(new_username)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2021-12-08 03:06:44 +08:00
|
|
|
def mock_auth(email, nickname = nil, name = nil, uid = "12345")
|
2021-12-06 19:06:35 +08:00
|
|
|
OmniAuth.config.mock_auth[:google_oauth2] = OmniAuth::AuthHash.new(
|
|
|
|
provider: "google_oauth2",
|
2021-12-07 00:49:04 +08:00
|
|
|
uid: uid,
|
2021-12-06 19:06:35 +08:00
|
|
|
info: OmniAuth::AuthHash::InfoHash.new(email: email, nickname: nickname, name: name),
|
|
|
|
extra: {
|
|
|
|
raw_info: OmniAuth::AuthHash.new(email_verified: true),
|
|
|
|
},
|
|
|
|
)
|
|
|
|
|
|
|
|
Rails.application.env_config["omniauth.auth"] = OmniAuth.config.mock_auth[:google_oauth2]
|
|
|
|
end
|
2017-03-01 11:58:24 +08:00
|
|
|
end
|
2023-10-25 20:52:33 +08:00
|
|
|
|
|
|
|
describe "with a fake provider" do
|
|
|
|
class FakeAuthenticator < Auth::ManagedAuthenticator
|
|
|
|
class Strategy
|
|
|
|
include OmniAuth::Strategy
|
|
|
|
def other_phase
|
2023-11-30 10:49:55 +08:00
|
|
|
[418, {}, ["I am a teapot"]]
|
2023-10-25 20:52:33 +08:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def name
|
|
|
|
"fake"
|
|
|
|
end
|
|
|
|
|
|
|
|
def enabled?
|
|
|
|
false
|
|
|
|
end
|
|
|
|
|
|
|
|
def register_middleware(omniauth)
|
|
|
|
omniauth.provider Strategy, name: :fake
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2023-11-21 18:45:51 +08:00
|
|
|
let(:fake_auth_provider) { Auth::AuthProvider.new(authenticator: FakeAuthenticator.new) }
|
|
|
|
|
2023-10-25 20:52:33 +08:00
|
|
|
before do
|
2023-11-21 18:45:51 +08:00
|
|
|
DiscoursePluginRegistry.register_auth_provider(fake_auth_provider)
|
2023-10-25 20:52:33 +08:00
|
|
|
OmniAuth.config.test_mode = false
|
|
|
|
end
|
|
|
|
|
2023-11-21 18:45:51 +08:00
|
|
|
after { DiscoursePluginRegistry.auth_providers.delete(fake_auth_provider) }
|
|
|
|
|
2023-10-25 20:52:33 +08:00
|
|
|
it "does not run 'other_phase' for disabled auth methods" do
|
|
|
|
get "/auth/fake/blah"
|
|
|
|
expect(response.status).to eq(404)
|
|
|
|
end
|
|
|
|
|
|
|
|
it "does not leak 'other_phase' for disabled auth methods onto other methods" do
|
|
|
|
get "/auth/twitter/blah"
|
|
|
|
expect(response.status).to eq(404)
|
|
|
|
end
|
|
|
|
|
|
|
|
it "runs 'other_phase' for enabled auth methods" do
|
|
|
|
FakeAuthenticator.any_instance.stubs(:enabled?).returns(true)
|
|
|
|
get "/auth/fake/blah"
|
|
|
|
expect(response.status).to eq(418)
|
|
|
|
end
|
|
|
|
end
|
2017-03-01 11:58:24 +08:00
|
|
|
end
|