raucao
44e4488a4f
CI / Test (pull_request) Successful in 41s
A new consent for the same app on the same device now replaces the previous authorization, so a device keeps a single active token per app instead of accumulating duplicates. Destroying the superseded record revokes its token in Redis and removes its expiry job. Matching is on (user, client_id, user_agent); a different device or app is left untouched. Also documents the storage-first launch (remoteStorage spec section 11) with an explicit spec proving only the user address is handed over, never an access token. Part of #254
61 lines
1.8 KiB
Ruby
61 lines
1.8 KiB
Ruby
require 'rails_helper'
|
|
|
|
RSpec.describe Services::RsAuthsController, type: :controller do
|
|
let(:user) { create :user }
|
|
|
|
before do
|
|
allow_any_instance_of(AppCatalog::WebApp).to receive(:update_metadata).and_return(true)
|
|
allow_any_instance_of(RemoteStorageAuthorization).to receive(:remove_token_expiry_job).and_return(nil)
|
|
allow_any_instance_of(LdapService).to receive(:fetch_users).and_return([
|
|
{ services_enabled: ["remotestorage"] }
|
|
])
|
|
end
|
|
|
|
describe "GET /services/storage/rs_auths/:id/launch_app (storage-first)" do
|
|
context "when user is signed in" do
|
|
before do
|
|
sign_in user
|
|
end
|
|
|
|
context "token exists" do
|
|
before do
|
|
@auth = user.remote_storage_authorizations.create!(
|
|
permissions: %w(documents), client_id: "app.example.com",
|
|
redirect_uri: "https://app.example.com",
|
|
expire_at: 2.days.from_now
|
|
)
|
|
|
|
get :launch_app, params: { id: @auth.id }
|
|
end
|
|
|
|
after do
|
|
@auth.destroy
|
|
end
|
|
|
|
it "hands the app the user address in the URL fragment" do
|
|
launch_url = "https://app.example.com#remotestorage=#{user.address}"
|
|
expect(response).to redirect_to(launch_url)
|
|
end
|
|
|
|
it "does not hand over an access token" do
|
|
expect(response.location).not_to include("access_token")
|
|
end
|
|
end
|
|
|
|
context "when remoteStorage is not enabled for the user" do
|
|
before do
|
|
allow_any_instance_of(LdapService).to receive(:fetch_users).and_return([
|
|
{ services_enabled: [] }
|
|
])
|
|
|
|
get :launch_app, params: { id: 1 }
|
|
end
|
|
|
|
it "responds with forbidden" do
|
|
expect(response).to have_http_status(:forbidden)
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|