class NginxOmniauthAdapter::App
Constants
- CONTEXT_RACK_ENV_NAME
- SESSION_PASS_CIPHER_ALGORITHM
Public Class Methods
initialize_context(config)
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 15 def self.initialize_context(config) {}.tap do |ctx| ctx[:config] = config end end
rack(config={})
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 21 def self.rack(config={}) klass = self context = initialize_context(config) app = lambda { |env| env[CONTEXT_RACK_ENV_NAME] = context klass.call(env) } end
Public Instance Methods
adapter_config()
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 36 def adapter_config context[:config] end
adapter_host()
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 40 def adapter_host adapter_config[:host] end
adapter_refresh_interval()
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 131 def adapter_refresh_interval adapter_config[:adapter_refresh_interval] || (60 * 60 * 24 * 30) end
allowed_app_callback_url()
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 52 def allowed_app_callback_url adapter_config[:allowed_app_callback_url] || /./ end
allowed_back_to_url()
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 48 def allowed_back_to_url adapter_config[:allowed_back_to_url] || /./ end
app_refresh_interval()
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 127 def app_refresh_interval adapter_config[:app_refresh_interval] || (60 * 60 * 24) end
context()
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 32 def context request.env[CONTEXT_RACK_ENV_NAME] end
current_flow_id()
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 107 def current_flow_id session[:flow_id] end
current_logged_in_at()
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 123 def current_logged_in_at session[:logged_in_at] && Time.xmlschema(session[:logged_in_at]) end
current_user()
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 111 def current_user session[:user] end
current_user_data()
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 115 def current_user_data session[:user_data] ||= {} end
decrypt_session_param(raw_data)
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 220 def decrypt_session_param(raw_data) data = JSON.parse(raw_data.unpack('m*')[0]) cipher ||= OpenSSL::Cipher.new(SESSION_PASS_CIPHER_ALGORITHM).tap do |c| c.decrypt c.key = secret_key c.iv = data['iv'].unpack('m*')[0] c.auth_data = '' c.auth_tag = data['tag'].unpack('m*')[0] end plaintext = cipher.update(data['data'].unpack('m*')[0]) plaintext << cipher.final Marshal.load(plaintext) end
default_back_to()
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 82 def default_back_to # TODO: '/' end
encrypt_session_param(session_param)
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 199 def encrypt_session_param(session_param) iv = nil cipher ||= OpenSSL::Cipher.new(SESSION_PASS_CIPHER_ALGORITHM).tap do |c| c.encrypt c.key = secret_key c.iv = iv = c.random_iv c.auth_data = '' end plaintext = Marshal.dump(session_param) ciphertext = cipher.update(plaintext) ciphertext << cipher.final URI.encode_www_form_component([{ "iv" => [iv].pack('m*'), "data" => [ciphertext].pack('m*'), "tag" => [cipher.auth_tag].pack('m*'), }.to_json].pack('m*')) end
log(h={})
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 64 def log(h={}) h = { time: Time.now.xmlschema, severity: :info, logged_in: (!!current_user).inspect, provider: current_user && current_user[:provider], uid: current_user && current_user[:uid], flow_id: current_flow_id, }.merge(h) str = h.map { |*kv| kv.join(?:) }.join(?\t) puts str if h[:severity] == :warning || h[:severity] == :error $stderr.puts str end end
on_login_proc()
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 56 def on_login_proc adapter_config[:on_login_proc] || proc { true } end
policy_proc()
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 60 def policy_proc adapter_config[:policy_proc] || proc { true } end
providers()
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 44 def providers adapter_config[:providers] end
sanitized_app_callback_param()
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 95 def sanitized_app_callback_param if allowed_app_callback_url === params[:callback] params[:callback] else nil end end
sanitized_back_to_param()
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 87 def sanitized_back_to_param if allowed_back_to_url === params[:back_to] params[:back_to] else nil end end
secret_key()
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 185 def secret_key context[:secret_key] ||= begin if adapter_config[:secret] adapter_config[:secret].unpack('m*')[0] else cipher = OpenSSL::Cipher.new(SESSION_PASS_CIPHER_ALGORITHM) warn "WARN: :secret not set; generating randomly." warn " If you'd like to persist, set `openssl rand -base64 #{cipher.key_len}` . Note that you have to keep it secret." OpenSSL::Random.random_bytes(cipher.key_len) end end end
set_flow_id!()
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 103 def set_flow_id! session[:flow_id] = SecureRandom.uuid end
update_session!(auth = nil)
click to toggle source
# File lib/nginx_omniauth_adapter/app.rb, line 143 def update_session!(auth = nil) unless session[:app_callback] log severity: :error, message: 'missing app_callback' raise '[BUG] app_callback is missing' end common_session = { logged_in_at: session[:logged_in_at], user_data: current_user_data, } if auth common_session[:user] = { uid: auth[:uid], info: auth[:info], provider: auth[:provider], } else common_session[:user] = session[:user] end adapter_session = common_session.merge( side: :adapter, ) app_session = common_session.merge( side: :app, back_to: session.delete(:back_to), authorized_at: Time.now.xmlschema, ) session.merge!(adapter_session) session_param = encrypt_session_param(app_session) log(message: 'update_session', app_callback: session[:app_callback]) redirect "#{session.delete(:app_callback)}?session=#{session_param}" ensure session[:flow_id] = nil end