Merge branch 'master' into live

Prevent future mistakes

AGENTS.md

@@ -7,16 +7,13 @@ ejabberd, Discourse, Mastodon, remoteStorage, Nostr, LNDHub, and BTCPay.
 ## Development environment
 
 Development runs in Docker Compose — run all commands against the `web` container.
-Start services: `docker compose up` (web, ldap, redis, garage, liquor-cabinet, strfry).
+Start services: `docker compose up` (web, ldap, redis, minio, liquor-cabinet, strfry).
 The `web` service runs `bin/dev` (foreman: Puma + Tailwind CSS watcher) and embeds
 Solid Queue workers (`SOLID_QUEUE_IN_PUMA=true`).
 
-First-time LDAP and database setup is automated: the `ldap-init` service
-creates the 389ds back-end, then the `web` entrypoint seeds LDAP and the
-databases on first start and runs `db:prepare` on every boot. Manual
-equivalents: `docker compose exec ldap dsconf localhost backend create
---suffix="dc=kosmos,dc=org" --be-name="dev"` and `docker compose run --rm web
-bin/rails ldap:setup`.
+First-time LDAP setup (after creating the 389ds backend once):
+`docker compose exec ldap dsconf localhost backend create --suffix="dc=kosmos,dc=org" --be_name="dev"`
+then `docker compose run web bin/rails ldap:setup`.
 
 ## Common commands (prefix with `docker compose exec web`)
 

README.md

@@ -14,14 +14,13 @@ so:
 
 1. Make sure [Docker Compose is installed][1] and Docker is running (included in
    Docker Desktop)
-2. Run `docker compose up --build` and wait until all services have started
+3. Run `docker compose up --build` and wait until all services have started
    (389ds might take an extra minute to be ready). This will take a while when
    running for the first time, so you might want to do something else in the
    meantime.
-
-On the first start, the `ldap-init` service creates the 389ds back-end, and the
-`web` container then seeds the LDAP directory and the databases automatically.
-On every start, `web` also applies any pending database migrations.
+4. `docker-compose exec ldap dsconf localhost backend create --suffix="dc=kosmos,dc=org" --be-name="dev"`
+5. `docker compose run web rails ldap:setup`
+6. `docker compose run web rails db:setup`
 
 After these steps, you should have a working Rails app with a handful of test
 users running on [http://localhost:3000](http://localhost:3000).
@@ -72,12 +71,15 @@ containers you want to run to the `up` command, like so:
 
 #### LDAP server
 
-On first start, the `ldap-init` service creates the dirsrv back-end
-automatically, and the `web` container then seeds it with development entries.
-To do either step manually (for example, after changing the setup), run:
+After creating the Docker container for the first time (or after deleting it),
+you need to run the following command once, in order to create the dirsrv
+back-end:
 
-    docker compose exec ldap dsconf localhost backend create --suffix="dc=kosmos,dc=org" --be-name="dev"
-    docker compose run --rm web bin/rails ldap:setup
+    docker-compose exec ldap dsconf localhost backend create --suffix="dc=kosmos,dc=org" --be-name="dev"
+
+Now you can seed the back-end with data using this Rails task:
+
+    bundle exec rails ldap:setup
 
 The setup task will first delete any existing entries in the directory tree
 ("dc=kosmos,dc=org"), and then create our development entries.
@@ -86,42 +88,20 @@ Note that all 389ds data is stored in the `389ds-data` volume. So if you want
 to start over with a fresh installation, delete both that volume as well as the
 container.
 
-To reset the development environment completely, remove all volumes plus the
-generated database files and the first-run marker, then start over:
+#### Minio / remoteStorage
 
-    docker compose down -v
-    rm -f db/*.sqlite3 tmp/.setup-complete
-    docker compose up --build
+If you want to run remoteStorage accounts locally, you will have to create the
+respective bucket first. With the `minio` container running (run by default
+when using Docker Compose), follow these steps:
 
-#### Garage / remoteStorage
-
-remoteStorage accounts use the `garage` S3-compatible object store. On first
-start, Garage automatically configures a single-node cluster and creates the
-`remotestorage` bucket together with a `dev-key1` access key (secret
-`1234567890123456`), so no manual setup is required.
-
-If you want to run remoteStorage accounts locally, the `garage` container is
-started by default when using Docker Compose. To run just the remoteStorage
-stack:
-
-* `docker compose up web redis garage liquor-cabinet`
-
-The S3 API is available at http://localhost:3900 (region `garage`). If you want
-to start over with a fresh storage, delete the `garage-data` volume as well as
-the container.
-
-#### Accessing remoteStorage from another machine
-
-remoteStorage clients force HTTPS for any host except `localhost`, and browsers
-block plain-HTTP requests to a LAN IP as mixed content. To connect to the dev
-remoteStorage from a browser on another machine (including production apps such
-as Inspektor), forward the ports over SSH and connect as `localhost`:
-
-    ssh -N -L 3000:localhost:3000 -L 4567:localhost:4567 <user>@<dev-host>
-
-Then use `<user>@localhost:3000` as the remoteStorage address in the client.
-WeFinger discovery and storage requests are served through the forwarded ports,
-so no TLS setup is needed.
+* `docker compose up web redis minio liquor-cabinet`
+* Head to http://localhost:9001 and log in with user `minioadmin`, password
+  `minioadmin`
+* Create a new bucket called `remotestorage` (or whatever you
+  change the `S3_BUCKET` config to)
+* Create a new key with ID "dev-key" and secret "123456789" (or whatever you
+  change `S3_ACCESS_KEY` and `S3_SECRET_KEY` to). Leave the policy field empty,
+  as it will automatically allow access to the bucket you created.
 
 ### Adding npm modules to use with Stimulus controllers
 

app/controllers/rs/oauth_controller.rb

@@ -1,10 +1,7 @@
 class Rs::OauthController < ApplicationController
-  skip_before_action :verify_authenticity_token, only: :token
-
   prepend_before_action :assert_redirect_uri, only: [:new, :create]
   before_action :require_signed_in_with_username, only: :new
   before_action :authenticate_user!, only: :create
-  before_action :set_cors_headers, only: :token
 
   def new
     @user          = User.where(cn: params[:username].downcase, ou: Setting.primary_domain).first
@@ -12,12 +9,9 @@ class Rs::OauthController < ApplicationController
     @redirect_uri  = params[:redirect_uri]
     @client_id     = params[:client_id]
     @state         = params[:state]
-    @response_type = params[:response_type].presence || "token"
-    @code_challenge = params[:code_challenge]
-    @code_challenge_method = params[:code_challenge_method].presence || "S256"
     @root_access_requested = (@scopes & [":r",":rw"]).any?
 
-    @denial_url = error_url(@redirect_uri, "error=access_denied", @state)
+    @denial_url = url_with_state("#{@redirect_uri}#error=access_denied", @state)
 
     @expire_at_dates = [["Never", nil],
                         ["In 1 month", 1.month.from_now],
@@ -26,41 +20,35 @@ class Rs::OauthController < ApplicationController
     unless current_user == @user
       sign_out :user
 
-      redirect_params = {
-        scope: params[:scope],
-        redirect_uri: params[:redirect_uri],
-        client_id: params[:client_id],
-        state: params[:state]
-      }
-
-      if @response_type == "code"
-        redirect_params[:response_type] = "code"
-        redirect_params[:code_challenge] = @code_challenge
-        redirect_params[:code_challenge_method] = @code_challenge_method
-      end
-
-      redirect_to new_rs_oauth_url(@user.cn, redirect_params)
+      redirect_to new_rs_oauth_url(@user.cn,
+                                   scope: params[:scope],
+                                   redirect_uri: params[:redirect_uri],
+                                   client_id: params[:client_id],
+                                   state: params[:state])
       return
     end
 
     unless @client_id.present?
-      error_redirect(@redirect_uri, "error=invalid_request", @state) and return
+      redirect_to(url_with_state("#{@redirect_uri}#error=invalid_request", @state),
+                  allow_other_host: true) and return
     end
 
     if @scopes.empty?
-      error_redirect(@redirect_uri, "error=invalid_scope", @state) and return
+      redirect_to(url_with_state("#{@redirect_uri}#error=invalid_scope", @state),
+                  allow_other_host: true) and return
     end
 
     unless hostname_of(@client_id) == hostname_of(@redirect_uri)
-      error_redirect(@redirect_uri, "error=invalid_client", @state) and return
-    end
-
-    if @response_type == "code" &&
-       (@code_challenge.blank? || @code_challenge_method != "S256")
-      error_redirect(@redirect_uri, "error=invalid_request", @state) and return
+      redirect_to(url_with_state("#{@redirect_uri}#error=invalid_client", @state),
+                  allow_other_host: true) and return
     end
 
     @client_id.gsub!(/http(s)?:\/\//, "")
+
+    if auth = current_user.remote_storage_authorizations.valid.where(permissions: @scopes, client_id: @client_id).first
+      redirect_to(url_with_state("#{@redirect_uri}#access_token=#{auth.token}", @state),
+                  allow_other_host: true) and return
+    end
   end
 
   def create
@@ -69,7 +57,6 @@ class Rs::OauthController < ApplicationController
       http_status :forbidden and return
     end
 
-    response_type = params[:response_type].presence || "token"
     permissions  = parse_scopes params[:scope]
     redirect_uri = params[:redirect_uri].presence
     client_id    = params[:client_id].presence
@@ -77,71 +64,32 @@ class Rs::OauthController < ApplicationController
     expire_at    = params[:expire_at].presence
 
     if permissions.empty?
-      error_redirect(redirect_uri, "error=invalid_scope", state, response_type) and return
+      redirect_to(url_with_state("#{redirect_uri}#error=invalid_scope", state),
+                  allow_other_host: true) and return
     end
 
     unless client_id.present?
-      error_redirect(redirect_uri, "error=invalid_request", state, response_type) and return
+      redirect_to(url_with_state("#{redirect_uri}#error=invalid_request", state),
+                  allow_other_host: true) and return
     end
 
     unless hostname_of(client_id) == hostname_of(redirect_uri)
-      error_redirect(redirect_uri, "error=invalid_client", state, response_type) and return
+      redirect_to(url_with_state("#{redirect_uri}#error=invalid_client", state),
+                  allow_other_host: true) and return
     end
 
     client_id.gsub!(/http(s)?:\/\//, "")
 
-    if response_type == "code"
-      challenge = params[:code_challenge].presence
-      method = params[:code_challenge_method].presence || "S256"
-
-      if challenge.blank? || method != "S256"
-        error_redirect(redirect_uri, "error=invalid_request", state, response_type) and return
-      end
-
-      code = RsOauthManager::IssueCode.call(
-        user: current_user,
-        client_id: client_id,
-        redirect_uri: redirect_uri,
-        permissions: permissions,
-        expire_at: expire_at,
-        code_challenge: challenge,
-        code_challenge_method: method
-      )
-
-      redirect_to url_with_state("#{redirect_uri}?code=#{CGI.escape(code.code)}", state),
-                  allow_other_host: true
-    else
-      auth = current_user.remote_storage_authorizations.create!(
-        permissions: permissions,
-        client_id: client_id,
-        redirect_uri: redirect_uri,
-        app_name: client_id,
-        expire_at: expire_at
-      )
-
-      redirect_to url_with_state("#{redirect_uri}#access_token=#{auth.token}", state),
-                  allow_other_host: true
-    end
-  end
-
-  def token
-    return head :ok if request.options?
-
-    unless params[:grant_type] == "authorization_code"
-      return render json: { error: "unsupported_grant_type" }, status: :bad_request
-    end
-
-    auth = RsOauthManager::ExchangeCode.call(
-      code: params[:code],
-      client_id: params[:client_id],
-      redirect_uri: params[:redirect_uri],
-      code_verifier: params[:code_verifier]
+    auth = current_user.remote_storage_authorizations.create!(
+      permissions: permissions,
+      client_id: client_id,
+      redirect_uri: redirect_uri,
+      app_name: client_id,
+      expire_at: expire_at
     )
 
-    response.headers["Cache-Control"] = "no-store"
-    render json: token_response(auth)
-  rescue RsOauthManagerService::InvalidGrant
-    render json: { error: "invalid_grant" }, status: :bad_request
+    redirect_to url_with_state("#{redirect_uri}#access_token=#{auth.token}", state),
+                allow_other_host: true
   end
 
   private
@@ -157,42 +105,24 @@ class Rs::OauthController < ApplicationController
     end
   end
 
-  def set_cors_headers
-    headers["Access-Control-Allow-Origin"] = "*"
-    headers["Access-Control-Allow-Methods"] = "POST, OPTIONS"
-    headers["Access-Control-Allow-Headers"] = "Content-Type"
-  end
-
-  def token_response(auth)
-    body = {
-      access_token: auth.token,
-      token_type: "bearer",
-      scope: auth.permissions.join(" ")
-    }
-
-    if auth.expire_at.present?
-      body[:expires_in] = (auth.expire_at - Time.current).to_i
-    end
-
-    body
-  end
-
   def hostname_of(uri)
-    RsOauthManagerService.hostname_of(uri)
+    uri.gsub(/http(s)?:\/\//, "").split(":")[0].split("/")[0]
   end
 
   def parse_scopes(scope_string)
-    RsOauthManagerService.parse_scopes(scope_string)
-  end
+    return [] if scope_string.blank?
 
-  def error_redirect(redirect_uri, error, state, response_type = @response_type)
-    redirect_to error_url(redirect_uri, error, state, response_type),
-                allow_other_host: true
-  end
+    scopes = scope_string.
+      gsub(/\[|\]/, "").
+      gsub(/\,/, " ").
+      gsub(/\/:/, ":").
+      split(/\s/).map(&:strip).
+      reject(&:empty?)
 
-  def error_url(redirect_uri, error, state, response_type = @response_type)
-    separator = response_type == "code" ? "?" : "#"
-    url_with_state("#{redirect_uri}#{separator}#{error}", state)
+    scopes = [":r"] if scopes.include?("*:r")
+    scopes = [":rw"] if scopes.include?("*:rw")
+
+    scopes
   end
 
   def url_with_state(url, state)

app/controllers/services/remotestorage_controller.rb

@@ -1,7 +1,7 @@
 class Services::RemotestorageController < Services::BaseController
   before_action :authenticate_user!
   before_action :require_service_available
-  before_action :require_service_enabled
+  before_action :require_feature_enabled
 
   # Dashboard
   def show
@@ -17,8 +17,8 @@ class Services::RemotestorageController < Services::BaseController
       http_status :not_found unless Setting.remotestorage_enabled?
     end
 
-    def require_service_enabled
-      unless current_user.service_enabled?(:remotestorage)
+    def require_feature_enabled
+      unless Flipper.enabled?(:remotestorage, current_user)
         http_status :forbidden
       end
     end

app/controllers/services/rs_auths_controller.rb

@@ -1,7 +1,8 @@
 class Services::RsAuthsController < Services::BaseController
   before_action :authenticate_user!
-  before_action :require_service_enabled
+  before_action :require_feature_enabled
   before_action :require_service_available
+  # before_action :require_service_enabled
   before_action :find_rs_auth, only: [:destroy, :launch_app]
 
   def index
@@ -22,12 +23,9 @@ class Services::RsAuthsController < Services::BaseController
   end
 
   def launch_app
-    user_address =
-      if Rails.env.development?
-        "#{current_user.cn}@#{request.host_with_port}"
-      else
-        current_user.address
-      end
+    user_address = Rails.env.development? ?
+      "#{current_user.cn}@localhost:3000" :
+      current_user.address
 
     launch_url = "#{@auth.launch_url}#remotestorage=#{user_address}"
 
@@ -36,8 +34,8 @@ class Services::RsAuthsController < Services::BaseController
 
   private
 
-    def require_service_enabled
-      unless current_user.service_enabled?(:remotestorage)
+    def require_feature_enabled
+      unless Flipper.enabled?(:remotestorage, current_user)
         http_status :forbidden
       end
     end

app/controllers/webfinger_controller.rb

@@ -88,42 +88,19 @@ class WebfingerController < WellKnownController
   end
 
   def remotestorage_link
-    auth_url =
-      if Rails.env.development?
-        new_rs_oauth_url(@username)
-      else
-        new_rs_oauth_url(@username, host: Setting.rs_accounts_domain)
-      end
-
-    storage_url = "#{remotestorage_storage_base_url}/#{@username}"
+    auth_url = new_rs_oauth_url(@username, host: Setting.rs_accounts_domain)
+    storage_url = "#{Setting.rs_storage_url}/#{@username}"
 
     {
       rel: "http://tools.ietf.org/id/draft-dejong-remotestorage",
       href: storage_url,
       properties: {
-        "http://remotestorage.io/spec/version" => "draft-dejong-remotestorage-27",
+        "http://remotestorage.io/spec/version" => "draft-dejong-remotestorage-13",
         "http://tools.ietf.org/html/rfc6749#section-4.2" => auth_url,
-        "http://tools.ietf.org/html/rfc6749#section-3.1" => auth_url,
-        "http://tools.ietf.org/html/rfc6749#section-3.2" => token_endpoint_url,
-        "http://tools.ietf.org/html/rfc7636" => "S256",
         "http://tools.ietf.org/html/rfc6750#section-2.3" => nil, # access token via a HTTP query parameter
         "http://tools.ietf.org/html/rfc7233": "GET", # content range requests
         "http://remotestorage.io/spec/web-authoring": nil
       }
     }
   end
-
-  def token_endpoint_url
-    return rs_oauth_token_url if Rails.env.development?
-
-    rs_oauth_token_url(host: Setting.rs_accounts_domain)
-  end
-
-  def remotestorage_storage_base_url
-    return Setting.rs_storage_url unless Rails.env.development?
-
-    uri = URI.parse(Setting.rs_storage_url)
-    uri.host = request.host
-    uri.to_s
-  end
 end

app/models/rs_authorization_code.rb

@@ -1,37 +0,0 @@
-class RsAuthorizationCode < ApplicationRecord
-  belongs_to :user
-
-  CODE_TTL = 60.seconds
-
-  serialize :permissions, coder: YAML
-
-  attr_accessor :code
-
-  before_validation :generate_code
-
-  scope :active, -> { where(expires_at: Time.current..) }
-
-  def self.find_by_code(raw_code)
-    return nil if raw_code.blank?
-
-    find_by(code_digest: Digest::SHA256.hexdigest(raw_code))
-  end
-
-  def expired?
-    expires_at <= Time.current
-  end
-
-  def consume!
-    destroy!
-  end
-
-  private
-
-    def generate_code
-      return if code_digest.present?
-
-      self.code = SecureRandom.urlsafe_base64(32)
-      self.code_digest = Digest::SHA256.hexdigest(code)
-      self.expires_at ||= CODE_TTL.from_now
-    end
-end

app/services/rs_oauth_manager/exchange_code.rb

@@ -1,35 +0,0 @@
-module RsOauthManager
-  class ExchangeCode < RsOauthManagerService
-    def initialize(code:, client_id:, redirect_uri:, code_verifier:)
-      @code = code
-      @client_id = client_id
-      @redirect_uri = redirect_uri
-      @code_verifier = code_verifier
-    end
-
-    def call
-      auth_code = RsAuthorizationCode.find_by_code(@code)
-      raise InvalidGrant if auth_code.nil? || auth_code.expired?
-
-      raise InvalidGrant unless hostname_of(@client_id) == hostname_of(@redirect_uri)
-      raise InvalidGrant unless @redirect_uri == auth_code.redirect_uri
-
-      raise InvalidGrant unless VerifyPkce.call(
-        code_challenge: auth_code.code_challenge,
-        code_challenge_method: auth_code.code_challenge_method,
-        code_verifier: @code_verifier
-      )
-
-      auth = auth_code.user.remote_storage_authorizations.create!(
-        permissions: auth_code.permissions,
-        client_id: auth_code.client_id,
-        redirect_uri: auth_code.redirect_uri,
-        app_name: auth_code.client_id,
-        expire_at: auth_code.permission_expire_at
-      )
-
-      auth_code.consume!
-      auth
-    end
-  end
-end

app/services/rs_oauth_manager/issue_code.rb

@@ -1,27 +0,0 @@
-module RsOauthManager
-  class IssueCode < RsOauthManagerService
-    def initialize(user:, client_id:, redirect_uri:, permissions:,
-                   code_challenge:, code_challenge_method: "S256",
-                   expire_at: nil)
-      @user = user
-      @client_id = client_id
-      @redirect_uri = redirect_uri
-      @permissions = permissions
-      @code_challenge = code_challenge
-      @code_challenge_method = code_challenge_method
-      @expire_at = expire_at
-    end
-
-    def call
-      RsAuthorizationCode.create!(
-        user: @user,
-        client_id: @client_id,
-        redirect_uri: @redirect_uri,
-        permissions: @permissions,
-        permission_expire_at: @expire_at,
-        code_challenge: @code_challenge,
-        code_challenge_method: @code_challenge_method
-      )
-    end
-  end
-end

app/services/rs_oauth_manager/verify_pkce.rb

@@ -1,21 +0,0 @@
-module RsOauthManager
-  class VerifyPkce < RsOauthManagerService
-    def initialize(code_challenge:, code_challenge_method:, code_verifier:)
-      @code_challenge = code_challenge
-      @code_challenge_method = code_challenge_method
-      @code_verifier = code_verifier.to_s
-    end
-
-    def call
-      return false unless @code_challenge_method == "S256"
-
-      expected = Base64.urlsafe_encode64(
-        Digest::SHA256.digest(@code_verifier), padding: false
-      )
-
-      ActiveSupport::SecurityUtils.secure_compare(
-        expected, @code_challenge.to_s
-      )
-    end
-  end
-end

app/services/rs_oauth_manager_service.rb

@@ -1,27 +0,0 @@
-class RsOauthManagerService < ApplicationService
-  InvalidGrant = Class.new(StandardError)
-
-  def self.parse_scopes(scope_string)
-    return [] if scope_string.blank?
-
-    scopes = scope_string.
-      gsub(/\[|\]/, "").
-      gsub(/\,/, " ").
-      gsub(/\/:/, ":").
-      split(/\s/).map(&:strip).
-      reject(&:empty?)
-
-    scopes = [":r"] if scopes.include?("*:r")
-    scopes = [":rw"] if scopes.include?("*:rw")
-
-    scopes
-  end
-
-  def self.hostname_of(uri)
-    uri.to_s.gsub(/http(s)?:\/\//, "").split(":")[0].split("/")[0]
-  end
-
-  def hostname_of(uri)
-    self.class.hostname_of(uri)
-  end
-end

app/views/admin/users/show.html.erb

@@ -305,7 +305,7 @@
           <td>remoteStorage</td>
           <td>
             <%= render FormElements::ToggleComponent.new(
-              enabled: @services_enabled.include?("remotestorage"),
+              enabled: Flipper.enabled?(:remotestorage, current_user) && @services_enabled.include?("remotestorage"),
               input_enabled: false
             ) %>
           </td>

app/views/dashboard/index.html.erb

@@ -43,7 +43,8 @@
           <% end %>
         </div>
       <% end %>
-      <% if Setting.remotestorage_enabled? %>
+      <% if Setting.remotestorage_enabled? &&
+            Flipper.enabled?(:remotestorage, current_user) %>
         <div class="border border-gray-300 rounded-md hover:border-gray-400
                     bg-[length:80%] bg-[center_top_-156px] bg-no-repeat
                     bg-[url(/img/logos/icon_remotestorage.svg)]">

app/views/rs/oauth/new.html.erb

@@ -40,9 +40,6 @@
       <%= f.hidden_field :user_id, value: @user.id %>
       <%= f.hidden_field :client_id, value: @client_id %>
       <%= f.hidden_field :state, value: @state %>
-      <%= f.hidden_field :response_type, value: @response_type %>
-      <%= f.hidden_field :code_challenge, value: @code_challenge %>
-      <%= f.hidden_field :code_challenge_method, value: @code_challenge_method %>
       <p class="mt-8 mb-6">
         <%= f.label :expire_at, "Permission expires:", class: "mr-1.5" %>
         <%= f.select :expire_at, options_for_select(@expire_at_dates) %>

app/views/shared/_sidenav_settings.html.erb

@@ -25,7 +25,8 @@
   active: @settings_section.to_s == "lightning"
 ) %>
 <% end %>
-<% if Setting.remotestorage_enabled? %>
+<% if Setting.remotestorage_enabled? &&
+      Flipper.enabled?(:remotestorage, current_user) %>
 <%= render SidenavLinkComponent.new(
   name: "Storage", path: setting_path(:remotestorage), icon: "remotestorage",
   active: @settings_section.to_s == "remotestorage"

config/routes.rb

@@ -115,8 +115,6 @@ Rails.application.routes.draw do
   end
 
   namespace :rs do
-    post  'oauth/token', to: 'oauth#token', as: :oauth_token
-    match 'oauth/token', to: 'oauth#token', via: :options
     resource :oauth, only: [:new, :create], path_names: {
       new: ':username', create: ':username'
     }, controller: 'oauth'

config/sidekiq.yml

@@ -1,4 +1,6 @@
 :concurrency: 2
+production:
+  :concurrency: 10
 :queues:
   - default
   - mailers

db/migrate/20261102120000_create_rs_authorization_codes.rb

@@ -1,19 +0,0 @@
-class CreateRsAuthorizationCodes < ActiveRecord::Migration[8.1]
-  def change
-    create_table :rs_authorization_codes do |t|
-      t.references :user, null: false, foreign_key: true
-      t.string   :client_id,             null: false
-      t.string   :redirect_uri,          null: false
-      t.text     :permissions,           default: [].to_yaml
-      t.datetime :permission_expire_at
-      t.string   :code_digest,           null: false
-      t.string   :code_challenge,        null: false
-      t.string   :code_challenge_method, null: false, default: "S256"
-      t.datetime :expires_at,            null: false
-
-      t.timestamps
-    end
-
-    add_index :rs_authorization_codes, :code_digest, unique: true
-  end
-end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.1].define(version: 2026_11_02_120000) do
+ActiveRecord::Schema[8.1].define(version: 2025_05_28_092931) do
   create_table "active_storage_attachments", force: :cascade do |t|
     t.bigint "blob_id", null: false
     t.datetime "created_at", null: false
@@ -117,22 +117,6 @@ ActiveRecord::Schema[8.1].define(version: 2026_11_02_120000) do
     t.index ["web_app_id"], name: "index_remote_storage_authorizations_on_web_app_id"
   end
 
-  create_table "rs_authorization_codes", force: :cascade do |t|
-    t.string "client_id", null: false
-    t.string "code_challenge", null: false
-    t.string "code_challenge_method", default: "S256", null: false
-    t.string "code_digest", null: false
-    t.datetime "created_at", null: false
-    t.datetime "expires_at", null: false
-    t.datetime "permission_expire_at"
-    t.text "permissions", default: "--- []\n"
-    t.string "redirect_uri", null: false
-    t.datetime "updated_at", null: false
-    t.integer "user_id", null: false
-    t.index ["code_digest"], name: "index_rs_authorization_codes_on_code_digest", unique: true
-    t.index ["user_id"], name: "index_rs_authorization_codes_on_user_id"
-  end
-
   create_table "settings", force: :cascade do |t|
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
@@ -180,6 +164,5 @@ ActiveRecord::Schema[8.1].define(version: 2026_11_02_120000) do
   add_foreign_key "active_storage_variant_records", "active_storage_blobs", column: "blob_id"
   add_foreign_key "remote_storage_authorizations", "app_catalog_web_apps", column: "web_app_id"
   add_foreign_key "remote_storage_authorizations", "users"
-  add_foreign_key "rs_authorization_codes", "users"
   add_foreign_key "zaps", "users"
 end

db/seeds.rb

@@ -1,9 +1,8 @@
+require 'sidekiq/testing'
+
 ldap = LdapService.new
 
-original_queue_adapter = ActiveJob::Base.queue_adapter
-ActiveJob::Base.queue_adapter = :inline
-
-begin
+Sidekiq::Testing.inline! do
   ldap.delete_all_users!
 
   puts "Create user: admin"
@@ -26,6 +25,4 @@ begin
       password: "user is user", confirmed: true
     })
   end
-ensure
-  ActiveJob::Base.queue_adapter = original_queue_adapter
 end

docker-compose.yml

@@ -1,7 +1,6 @@
 services:
   ldap:
     image: 4teamwork/389ds:latest
-    platform: linux/amd64
     volumes:
       - 389ds-data:/data
     networks:
@@ -13,21 +12,6 @@ services:
       DS_DM_PASSWORD: passthebutter
       SUFFIX_NAME: "dc=kosmos,dc=org"
 
-  ldap-init:
-    image: 4teamwork/389ds:latest
-    platform: linux/amd64
-    networks:
-      - internal_network
-    volumes:
-      - ./docker/ldap-init.sh:/ldap-init.sh:ro
-    environment:
-      LDAP_ADMIN_PASSWORD: passthebutter
-      LDAP_SUFFIX: "dc=kosmos,dc=org"
-    depends_on:
-      ldap:
-        condition: service_healthy
-    command: ["/bin/sh", "/ldap-init.sh"]
-
   redis:
     restart: always
     image: redis:7-alpine
@@ -42,7 +26,7 @@ services:
   web:
     build: .
     tty: true
-    command: ["bash", "docker/web-entrypoint.sh"]
+    command: bash -c "rm -f /akkounts/tmp/pids/server.pid; bin/dev"
     volumes:
       - .:/akkounts
       - /akkounts/node_modules
@@ -73,28 +57,20 @@ services:
       NOSTR_PRIVATE_KEY: 7c3ef7e448505f0615137af38569d01807d3b05b5005d5ecf8aaafcd40323cea
       NOSTR_RELAY_URL: ws://strfry:7777
     depends_on:
-      ldap:
-        condition: service_started
-      ldap-init:
-        condition: service_completed_successfully
-      redis:
-        condition: service_started
+      - ldap
+      - redis
 
-  garage:
-    image: dxflrs/garage:v2.4.1
-    command: ["/garage", "server", "--single-node", "--default-bucket"]
+  minio:
+    image: quay.io/minio/minio:latest
+    command: "server /data --console-address ':9001'"
     networks:
       - external_network
       - internal_network
     ports:
-      - "3900:3900"
+      - "9000:9000"
+      - "9001:9001"
     volumes:
-      - ./docker/garage/garage.toml:/etc/garage.toml:ro
-      - garage-data:/var/lib/garage
-    environment:
-      GARAGE_DEFAULT_ACCESS_KEY: dev-key1
-      GARAGE_DEFAULT_SECRET_KEY: "1234567890123456"
-      GARAGE_DEFAULT_BUCKET: remotestorage
+      - minio-data:/data
 
   liquor-cabinet:
     image: gitea.kosmos.org/5apps/liquor-cabinet:2.0.0-rc.1
@@ -103,21 +79,17 @@ services:
       - internal_network
     ports:
       - "4567:4567"
-    volumes:
-      - ./docker/liquor-cabinet/rainbows.conf.rb:/etc/liquor-cabinet/rainbows.conf.rb:ro
-    command: ["bundle", "exec", "rainbows", "-c", "/etc/liquor-cabinet/rainbows.conf.rb", "--listen", "0.0.0.0:4567"]
     environment:
       RACK_ENV: staging
       REDIS_HOST: redis
       REDIS_PORT: 6379
       REDIS_DB: 1
-      S3_ENDPOINT: http://garage:3900
-      S3_REGION: garage
-      S3_ACCESS_KEY: dev-key1
-      S3_SECRET_KEY: "1234567890123456"
+      S3_ENDPOINT: http://minio:9000
+      S3_ACCESS_KEY: dev-key
+      S3_SECRET_KEY: 123456789
       S3_BUCKET: remotestorage
     depends_on:
-      - garage
+      - minio
       - redis
 
   strfry:
@@ -155,7 +127,7 @@ networks:
 volumes:
   389ds-data:
     driver: local
-  garage-data:
+  minio-data:
     driver: local
   redis-data:
     driver: local

docker/garage/garage.toml

@@ -1,14 +0,0 @@
-metadata_dir = "/var/lib/garage/meta"
-data_dir = "/var/lib/garage/data"
-db_engine = "sqlite"
-
-replication_factor = 1
-
-rpc_bind_addr = "[::]:3901"
-rpc_public_addr = "127.0.0.1:3901"
-rpc_secret = "1799bccfd7411eddcf9ebd316bc1f5287ad12a68094e1c6ac6abde7e6feae1ec"
-
-[s3_api]
-s3_region = "garage"
-api_bind_addr = "[::]:3900"
-root_domain = ".s3.garage.localhost"

docker/ldap-init.sh

@@ -1,14 +0,0 @@
-#!/bin/sh
-set -e
-
-SUFFIX="${LDAP_SUFFIX:-dc=kosmos,dc=org}"
-URI="ldap://ldap:3389"
-
-if dsconf -D "cn=Directory Manager" -w "$LDAP_ADMIN_PASSWORD" "$URI" \
-     backend suffix list --suffix 2>/dev/null | grep -Fqx "$SUFFIX"; then
-  echo "LDAP backend for $SUFFIX already exists, skipping."
-else
-  echo "Creating LDAP backend for $SUFFIX..."
-  dsconf -D "cn=Directory Manager" -w "$LDAP_ADMIN_PASSWORD" "$URI" \
-    backend create --suffix "$SUFFIX" --be-name dev
-fi

docker/liquor-cabinet/rainbows.conf.rb

@@ -1,5 +0,0 @@
-Rainbows! do
-  use :ThreadPool
-  worker_connections 16
-  client_max_body_size 100 * 1024 * 1024
-end

docker/web-entrypoint.sh

@@ -1,14 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-if [ ! -f tmp/.setup-complete ]; then
-  echo "First start: setting up LDAP entries and databases..."
-  bin/rails ldap:setup
-  bin/rails db:setup
-  touch tmp/.setup-complete
-else
-  bin/rails db:prepare
-fi
-
-rm -f tmp/pids/server.pid
-exec bin/dev

package.json

@@ -11,7 +11,7 @@
     "postcss-preset-env": "^7.8.3",
     "tailwindcss": "^3.4.0"
   },
-  "version": "0.11.1",
+  "version": "0.11.0",
   "scripts": {
     "build:css:tailwind": "bun ./node_modules/tailwindcss/lib/cli.js --postcss -i ./app/assets/stylesheets/application.tailwind.css -o ./app/assets/builds/application.css",
     "build:css": "bun run build:css:tailwind"

spec/controllers/rs/oauth_controller_spec.rb

@@ -128,8 +128,8 @@ RSpec.describe Rs::OauthController, type: :controller do
             }
           end
 
-          it "does not reuse the existing token (renders the consent dialog)" do
-            expect(response.response_code).to eq(200)
+          it "redirects to the redirect_uri with the existing token" do
+            expect(response).to redirect_to("https://example.com#access_token=#{@auth.token}")
           end
         end
 
@@ -147,66 +147,36 @@ RSpec.describe Rs::OauthController, type: :controller do
             expect(response).to redirect_to("https://app.example.com#error=invalid_client")
           end
         end
-      end
 
-      context "when response_type is code" do
-        before do
-          get :new, params: {
-            username: user.cn,
-            redirect_uri: "https://example.com",
-            client_id: "example.com",
-            scope: "documents",
-            response_type: "code",
-            code_challenge: "challenge123",
-            code_challenge_method: "S256",
-            state: "foobar123"
-          }
+        context "with different redirect_uri" do
+          before do
+            get :new, params: {
+              username: user.cn,
+              scope: "documents,[photos], contacts:rw videos:r tasks/work/:r",
+              redirect_uri: "https://example.com/a_new_route",
+              client_id: "https://example.com"
+            }
+          end
+
+          it "redirects to the new redirect_uri" do
+            expect(response).to redirect_to("https://example.com/a_new_route#access_token=#{@auth.token}")
+          end
         end
 
-        it "renders the consent dialog and exposes the code challenge" do
-          expect(response.response_code).to eq(200)
-          expect(assigns["response_type"]).to eq("code")
-          expect(assigns["code_challenge"]).to eq("challenge123")
-          expect(assigns["code_challenge_method"]).to eq("S256")
-        end
+        context "with state param given" do
+          before do
+            get :new, params: {
+              username: user.cn,
+              scope: "documents,[photos], contacts:rw videos:r tasks/work/:r",
+              redirect_uri: "https://example.com",
+              client_id: "https://example.com",
+              state: "foobar123"
+            }
+          end
 
-        it "uses a query-based denial url" do
-          expect(assigns["denial_url"]).to eq("https://example.com?error=access_denied&state=foobar123")
-        end
-      end
-
-      context "when response_type is code without a code_challenge" do
-        before do
-          get :new, params: {
-            username: user.cn,
-            redirect_uri: "https://example.com",
-            client_id: "example.com",
-            scope: "documents",
-            response_type: "code",
-            state: "foobar123"
-          }
-        end
-
-        it "redirects with invalid_request using a query param" do
-          expect(response).to redirect_to("https://example.com?error=invalid_request&state=foobar123")
-        end
-      end
-
-      context "when response_type is code with the plain method" do
-        before do
-          get :new, params: {
-            username: user.cn,
-            redirect_uri: "https://example.com",
-            client_id: "example.com",
-            scope: "documents",
-            response_type: "code",
-            code_challenge: "challenge123",
-            code_challenge_method: "plain"
-          }
-        end
-
-        it "redirects with invalid_request" do
-          expect(response).to redirect_to("https://example.com?error=invalid_request")
+          it "redirects to the redirect_uri with token and state" do
+            expect(response).to redirect_to("https://example.com#access_token=#{@auth.token}&state=foobar123")
+          end
         end
       end
 
@@ -314,7 +284,6 @@ RSpec.describe Rs::OauthController, type: :controller do
 
       after do
         user.remote_storage_authorizations.destroy_all
-        RsAuthorizationCode.destroy_all
       end
 
       context "when no valid token exists" do
@@ -443,63 +412,6 @@ RSpec.describe Rs::OauthController, type: :controller do
         end
       end
 
-      context "with response_type=code" do
-        before do
-          post :create, params: {
-            user_id: user.id,
-            scope: "documents,[photos], contacts:rw",
-            redirect_uri: "https://example.com",
-            client_id: "example.com",
-            state: "foobar123",
-            response_type: "code",
-            code_challenge: "challenge123",
-            code_challenge_method: "S256",
-            expire_at: 1.month.from_now
-          }
-          @code = RsAuthorizationCode.last
-        end
-
-        it "creates an authorization code" do
-          expect(@code.permissions).to eq(%w(documents photos contacts:rw))
-          expect(@code.code_challenge).to eq("challenge123")
-          expect(@code.code_challenge_method).to eq("S256")
-        end
-
-        it "does not create a remote storage authorization" do
-          expect(user.reload.remote_storage_authorizations.count).to eq(0)
-        end
-
-        it "redirects with the code in the query string" do
-          location = response.location
-          expect(location).to match(%r{\Ahttps://example\.com\?code=.+&state=foobar123\z})
-
-          raw_code = CGI.parse(URI.parse(location).query)["code"].first
-          expect(RsAuthorizationCode.find_by_code(raw_code)).to eq(@code)
-        end
-      end
-
-      context "with response_type=code but no code_challenge" do
-        before do
-          post :create, params: {
-            user_id: user.id,
-            scope: "documents",
-            redirect_uri: "https://example.com",
-            client_id: "example.com",
-            state: "foobar123",
-            response_type: "code",
-            expire_at: 1.month.from_now
-          }
-        end
-
-        it "redirects with invalid_request using a query param" do
-          expect(response).to redirect_to("https://example.com?error=invalid_request&state=foobar123")
-        end
-
-        it "does not create an authorization code" do
-          expect(RsAuthorizationCode.count).to eq(0)
-        end
-      end
-
       context "when the user_id is different from the signed in user" do
         before do
           post :create, params: {
@@ -539,81 +451,4 @@ RSpec.describe Rs::OauthController, type: :controller do
       end
     end
   end
-
-  describe "POST /rs/oauth/token" do
-    # Example values from RFC 7636, Appendix B
-    let(:code_verifier)  { "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk" }
-    let(:code_challenge) { "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM" }
-
-    def issue_code
-      RsOauthManager::IssueCode.call(
-        user: user,
-        client_id: "example.com",
-        redirect_uri: "https://example.com",
-        permissions: %w(documents:rw),
-        code_challenge: code_challenge,
-        code_challenge_method: "S256"
-      )
-    end
-
-    def token_params(code, **overrides)
-      {
-        grant_type: "authorization_code",
-        code: code.code,
-        client_id: "https://example.com",
-        redirect_uri: "https://example.com",
-        code_verifier: code_verifier
-      }.merge(overrides)
-    end
-
-    after do
-      user.remote_storage_authorizations.destroy_all
-      RsAuthorizationCode.destroy_all
-    end
-
-    context "with a valid code" do
-      before do
-        @code = issue_code
-        post :token, params: token_params(@code)
-      end
-
-      it "returns an access token" do
-        expect(response.response_code).to eq(200)
-
-        json = JSON.parse(response.body)
-        expect(json["access_token"]).to be_present
-        expect(json["token_type"]).to eq("bearer")
-        expect(json["scope"]).to eq("documents:rw")
-      end
-
-      it "does not cache the response" do
-        expect(response.headers["Cache-Control"]).to eq("no-store")
-      end
-
-      it "sets CORS headers" do
-        expect(response.headers["Access-Control-Allow-Origin"]).to eq("*")
-      end
-    end
-
-    context "with a bad code_verifier" do
-      before do
-        @code = issue_code
-        post :token, params: token_params(@code, code_verifier: "wrong-verifier")
-      end
-
-      it "returns invalid_grant" do
-        expect(response.response_code).to eq(400)
-        expect(JSON.parse(response.body)["error"]).to eq("invalid_grant")
-      end
-    end
-
-    context "with an unsupported grant_type" do
-      before { post :token, params: { grant_type: "password" } }
-
-      it "returns unsupported_grant_type" do
-        expect(response.response_code).to eq(400)
-        expect(JSON.parse(response.body)["error"]).to eq("unsupported_grant_type")
-      end
-    end
-  end
 end

spec/controllers/services/rs_auths_controller_spec.rb

@@ -6,9 +6,7 @@ RSpec.describe Services::RsAuthsController, type: :controller do
   before do
     allow_any_instance_of(AppCatalog::WebApp).to receive(:update_metadata).and_return(true)
     allow_any_instance_of(RemoteStorageAuthorization).to receive(:remove_token_expiry_job).and_return(nil)
-    allow_any_instance_of(LdapService).to receive(:fetch_users).and_return([
-      { services_enabled: ["remotestorage"] }
-    ])
+    allow_any_instance_of(Flipper).to receive(:enabled?).and_return(true)
   end
 
   describe "GET /services/storage/rs_auths/:id/launch_app" do
@@ -37,20 +35,6 @@ RSpec.describe Services::RsAuthsController, type: :controller do
           expect(response).to redirect_to(launch_url)
         end
       end
-
-      context "when remoteStorage is not enabled for the user" do
-        before do
-          allow_any_instance_of(LdapService).to receive(:fetch_users).and_return([
-            { services_enabled: [] }
-          ])
-
-          get :launch_app, params: { id: 1 }
-        end
-
-        it "responds with forbidden" do
-          expect(response).to have_http_status(:forbidden)
-        end
-      end
     end
   end
 end

spec/features/rs/oauth_spec.rb

@@ -49,24 +49,6 @@ RSpec.describe 'remoteStorage OAuth Dialog', type: :feature do
         end
       end
     end
-
-    context "with PKCE parameters" do
-      before do
-        visit new_rs_oauth_path(username: user.cn,
-                                redirect_uri: "http://example.com",
-                                client_id: "http://example.com",
-                                scope: "documents:rw",
-                                response_type: "code",
-                                code_challenge: "challenge123",
-                                code_challenge_method: "S256")
-      end
-
-      it "includes the PKCE parameters in the consent form" do
-        expect(page).to have_selector("input[name='response_type'][value='code']", visible: false)
-        expect(page).to have_selector("input[name='code_challenge'][value='challenge123']", visible: false)
-        expect(page).to have_selector("input[name='code_challenge_method'][value='S256']", visible: false)
-      end
-    end
   end
 
   context "when signed out" do

spec/models/remote_storage_authorization_spec.rb

@@ -12,6 +12,7 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
 
   describe "#create" do
     after(:each) { clear_enqueued_jobs }
+    after(:all)  { redis_rs_delete_keys("authorizations:*") }
 
     let(:auth) do
       user.remote_storage_authorizations.create!(
@@ -26,9 +27,10 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
     end
 
     it "stores a token in redis" do
-      auth
+      user_auth_keys = redis_rs.keys("authorizations:#{user.cn}:*")
+      expect(user_auth_keys.length).to eq(1)
 
-      authorizations = redis_rs.smembers("authorizations:#{user.cn}:#{auth.token}")
+      authorizations = redis_rs.smembers(user_auth_keys.first)
       expect(authorizations.sort).to eq(%w(documents photos contacts:rw videos:r tasks/work:r).sort)
     end
 
@@ -47,6 +49,7 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
 
   describe "#destroy" do
     after(:each) { clear_enqueued_jobs }
+    after(:all)  { redis_rs_delete_keys("authorizations:*") }
 
     it "removes the token from redis" do
       auth = user.remote_storage_authorizations.create!(
@@ -56,7 +59,7 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
              )
       auth.destroy!
 
-      expect(redis_rs.exists?("authorizations:#{user.cn}:#{auth.token}")).to be(false)
+      expect(redis_rs.keys("authorizations:#{user.address}:*")).to be_empty
     end
 
     context "with expiry set" do
@@ -76,6 +79,8 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
 
   describe "#find_or_create_web_app" do
     context "with origin that looks hosted" do
+      after(:all)  { redis_rs_delete_keys("authorizations:*") }
+
       let(:auth) do
         user.remote_storage_authorizations.create!(
           permissions: %w(documents:rw),
@@ -168,6 +173,8 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
   end
 
   describe "#launch_url" do
+    after(:all) { redis_rs_delete_keys("authorizations:*") }
+
     context "without start URL" do
       before do
         AppCatalog::WebApp.create!(
@@ -243,6 +250,7 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
     include ActiveJob::TestHelper
 
     after(:each) { clear_enqueued_jobs }
+    after(:all)  { redis_rs_delete_keys("authorizations:*") }
 
     before { allow(user).to receive(:display_name).and_return("Jimmy") }
 

spec/models/rs_authorization_code_spec.rb

@@ -1,65 +0,0 @@
-require 'rails_helper'
-
-RSpec.describe RsAuthorizationCode, type: :model do
-  let(:user) { create :user }
-
-  def build_code(**attrs)
-    RsAuthorizationCode.create!(
-      user: user,
-      client_id: "example.com",
-      redirect_uri: "https://example.com",
-      permissions: %w(documents:rw),
-      code_challenge: "challenge",
-      **attrs
-    )
-  end
-
-  describe "#create" do
-    it "generates a raw code and stores only its digest" do
-      code = build_code
-
-      expect(code.code).to be_present
-      expect(code.code_digest).to eq(Digest::SHA256.hexdigest(code.code))
-    end
-
-    it "sets a short expiry" do
-      code = build_code
-
-      expect(code.expires_at).to be_within(5.seconds).of(60.seconds.from_now)
-    end
-  end
-
-  describe ".find_by_code" do
-    it "finds a code by its raw value" do
-      code = build_code
-
-      expect(RsAuthorizationCode.find_by_code(code.code)).to eq(code)
-    end
-
-    it "returns nil for an unknown code" do
-      expect(RsAuthorizationCode.find_by_code("does-not-exist")).to be_nil
-    end
-
-    it "returns nil for a blank code" do
-      expect(RsAuthorizationCode.find_by_code(nil)).to be_nil
-    end
-  end
-
-  describe "#expired?" do
-    it "is false before the expiry" do
-      expect(build_code).not_to be_expired
-    end
-
-    it "is true after the expiry" do
-      expect(build_code(expires_at: 1.minute.ago)).to be_expired
-    end
-  end
-
-  describe "#consume!" do
-    it "destroys the record" do
-      code = build_code
-
-      expect { code.consume! }.to change(RsAuthorizationCode, :count).by(-1)
-    end
-  end
-end

spec/requests/rs/oauth_spec.rb

@@ -1,57 +0,0 @@
-require 'rails_helper'
-
-RSpec.describe "remoteStorage OAuth token endpoint", type: :request do
-  let(:user) { create :user }
-
-  # Example values from RFC 7636, Appendix B
-  let(:code_verifier)  { "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk" }
-  let(:code_challenge) { "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM" }
-
-  before do
-    allow_any_instance_of(AppCatalog::WebApp).to receive(:update_metadata).and_return(true)
-    allow_any_instance_of(RemoteStorageAuthorization).to receive(:remove_token_expiry_job).and_return(nil)
-  end
-
-  after do
-    user.remote_storage_authorizations.destroy_all
-    RsAuthorizationCode.destroy_all
-  end
-
-  def issue_code
-    RsOauthManager::IssueCode.call(
-      user: user,
-      client_id: "example.com",
-      redirect_uri: "https://example.com",
-      permissions: %w(documents:rw),
-      code_challenge: code_challenge,
-      code_challenge_method: "S256"
-    )
-  end
-
-  it "exchanges a code for an access token without a session" do
-    code = issue_code
-
-    post "/rs/oauth/token", params: {
-      grant_type: "authorization_code",
-      code: code.code,
-      client_id: "https://example.com",
-      redirect_uri: "https://example.com",
-      code_verifier: code_verifier
-    }
-
-    expect(response).to have_http_status(:ok)
-    expect(response.media_type).to eq("application/json")
-
-    json = JSON.parse(response.body)
-    expect(json["access_token"]).to be_present
-    expect(json["token_type"]).to eq("bearer")
-    expect(response.headers["Access-Control-Allow-Origin"]).to eq("*")
-  end
-
-  it "answers CORS preflight requests" do
-    options "/rs/oauth/token"
-
-    expect(response).to have_http_status(:ok)
-    expect(response.headers["Access-Control-Allow-Methods"]).to include("POST")
-  end
-end

spec/requests/webfinger_spec.rb

@@ -133,15 +133,6 @@ RSpec.describe "WebFinger", type: :request do
 
           oauth_url = rs_link["properties"]["http://tools.ietf.org/html/rfc6749#section-4.2"]
           expect(oauth_url).to eql("http://localhost/rs/oauth/tony")
-
-          authorization_url = rs_link["properties"]["http://tools.ietf.org/html/rfc6749#section-3.1"]
-          expect(authorization_url).to eql("http://localhost/rs/oauth/tony")
-
-          token_url = rs_link["properties"]["http://tools.ietf.org/html/rfc6749#section-3.2"]
-          expect(token_url).to eql("http://localhost/rs/oauth/token")
-
-          expect(rs_link["properties"]["http://tools.ietf.org/html/rfc7636"]).to eql("S256")
-          expect(rs_link["properties"]["http://remotestorage.io/spec/version"]).to eql("draft-dejong-remotestorage-27")
         end
 
         it "returns CORS headers" do

spec/services/rs_oauth_manager/exchange_code_spec.rb

@@ -1,103 +0,0 @@
-require 'rails_helper'
-
-RSpec.describe RsOauthManager::ExchangeCode do
-  let(:user) { create :user }
-
-  # Example values from RFC 7636, Appendix B
-  let(:code_verifier)  { "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk" }
-  let(:code_challenge) { "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM" }
-
-  before do
-    allow_any_instance_of(AppCatalog::WebApp).to receive(:update_metadata).and_return(true)
-    allow_any_instance_of(RemoteStorageAuthorization).to receive(:remove_token_expiry_job).and_return(nil)
-  end
-
-  def issue_code(**overrides)
-    RsOauthManager::IssueCode.call(
-      user: user,
-      client_id: "example.com",
-      redirect_uri: "https://example.com",
-      permissions: %w(documents:rw),
-      code_challenge: code_challenge,
-      code_challenge_method: "S256",
-      **overrides
-    )
-  end
-
-  def exchange(code, **overrides)
-    described_class.call(
-      code: code.code,
-      client_id: "https://example.com",
-      redirect_uri: "https://example.com",
-      code_verifier: code_verifier,
-      **overrides
-    )
-  end
-
-  it "creates an authorization and consumes the code" do
-    code = issue_code
-    auth = nil
-
-    expect { auth = exchange(code) }.to change(RemoteStorageAuthorization, :count).by(1)
-
-    expect(auth.permissions).to eq(%w(documents:rw))
-    expect(auth.client_id).to eq("example.com")
-    expect(auth.token).to be_present
-    expect(RsAuthorizationCode.exists?(code.id)).to be(false)
-  end
-
-  it "carries over the permission expiry" do
-    expire_at = 1.month.from_now
-    code = issue_code(expire_at: expire_at)
-
-    auth = exchange(code)
-
-    expect(auth.expire_at).to be_within(1.second).of(expire_at)
-  end
-
-  it "rejects an unknown code" do
-    expect do
-      described_class.call(
-        code: "unknown",
-        client_id: "https://example.com",
-        redirect_uri: "https://example.com",
-        code_verifier: code_verifier
-      )
-    end.to raise_error(RsOauthManagerService::InvalidGrant)
-  end
-
-  it "rejects a reused code" do
-    code = issue_code
-    exchange(code)
-
-    expect { exchange(code) }.to raise_error(RsOauthManagerService::InvalidGrant)
-  end
-
-  it "rejects an expired code" do
-    code = issue_code
-    code.update_columns(expires_at: 1.minute.ago)
-
-    expect { exchange(code) }.to raise_error(RsOauthManagerService::InvalidGrant)
-  end
-
-  it "rejects a mismatching redirect_uri" do
-    code = issue_code
-
-    expect { exchange(code, redirect_uri: "https://example.com/other") }
-      .to raise_error(RsOauthManagerService::InvalidGrant)
-  end
-
-  it "rejects a mismatching client_id host" do
-    code = issue_code
-
-    expect { exchange(code, client_id: "https://evil.example.org") }
-      .to raise_error(RsOauthManagerService::InvalidGrant)
-  end
-
-  it "rejects a bad code_verifier" do
-    code = issue_code
-
-    expect { exchange(code, code_verifier: "wrong-verifier") }
-      .to raise_error(RsOauthManagerService::InvalidGrant)
-  end
-end

spec/services/rs_oauth_manager/issue_code_spec.rb

@@ -1,29 +0,0 @@
-require 'rails_helper'
-
-RSpec.describe RsOauthManager::IssueCode do
-  let(:user) { create :user }
-
-  subject do
-    described_class.call(
-      user: user,
-      client_id: "example.com",
-      redirect_uri: "https://example.com",
-      permissions: %w(documents:rw),
-      code_challenge: "challenge",
-      code_challenge_method: "S256",
-      expire_at: 1.month.from_now
-    )
-  end
-
-  it "creates a short-lived authorization code" do
-    expect { subject }.to change(RsAuthorizationCode, :count).by(1)
-    expect(subject.code).to be_present
-    expect(subject.client_id).to eq("example.com")
-    expect(subject.permissions).to eq(%w(documents:rw))
-    expect(subject.code_challenge).to eq("challenge")
-  end
-
-  it "does not create a remote storage authorization" do
-    expect { subject }.not_to change(RemoteStorageAuthorization, :count)
-  end
-end

spec/services/rs_oauth_manager/verify_pkce_spec.rb

@@ -1,41 +0,0 @@
-require 'rails_helper'
-
-RSpec.describe RsOauthManager::VerifyPkce do
-  # Example values from RFC 7636, Appendix B
-  let(:code_verifier)  { "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk" }
-  let(:code_challenge) { "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM" }
-
-  subject do
-    described_class.call(
-      code_challenge: code_challenge,
-      code_challenge_method: code_challenge_method,
-      code_verifier: code_verifier
-    )
-  end
-
-  context "with the S256 method" do
-    let(:code_challenge_method) { "S256" }
-
-    it "accepts a matching verifier" do
-      expect(subject).to be(true)
-    end
-
-    it "rejects a non-matching verifier" do
-      expect(
-        described_class.call(
-          code_challenge: code_challenge,
-          code_challenge_method: "S256",
-          code_verifier: "wrong-verifier"
-        )
-      ).to be(false)
-    end
-  end
-
-  context "with an unsupported method" do
-    let(:code_challenge_method) { "plain" }
-
-    it "rejects the verifier" do
-      expect(subject).to be(false)
-    end
-  end
-end

spec/support/helpers/redis_helper.rb

@@ -1,3 +1,8 @@
 def redis_rs
   @redis_rs ||= Redis.new(url: Setting.rs_redis_url)
 end
+
+def redis_rs_delete_keys(pattern)
+  keys = redis_rs.keys(pattern)
+  redis_rs.del(*keys)
+end