raucao
8dd0bf10ce
Implements the optional OAuth 2.0 Authorization Code grant with PKCE (RFC 7636) for remoteStorage, as described in the remoteStorage spec (section 10.1). - Advertise the authorization and token endpoints plus the supported code_challenge method (S256) in WebFinger, and bump the advertised spec version to draft-dejong-remotestorage-27 - Add RsAuthorizationCode: a short-lived (5 min), single-use authorization code stored only as a SHA256 digest - Add RsOauthManager services for issuing and exchanging codes, including S256 verification - Add a cross-origin POST /rs/oauth/token endpoint that exchanges a code (and code_verifier) for an access token, with CORS and no CSRF token - Consent dialog now carries response_type / code_challenge through the form and redirects with the code in the query string for the code flow - Remove the existing-token reuse shortcut so every authorization results in a distinct authorization (and token) Part of #254
30 lines
853 B
Ruby
30 lines
853 B
Ruby
require 'rails_helper'
|
|
|
|
RSpec.describe RsOauthManager::IssueCode do
|
|
let(:user) { create :user }
|
|
|
|
subject do
|
|
described_class.call(
|
|
user: user,
|
|
client_id: "example.com",
|
|
redirect_uri: "https://example.com",
|
|
permissions: %w(documents:rw),
|
|
code_challenge: "challenge",
|
|
code_challenge_method: "S256",
|
|
expire_at: 1.month.from_now
|
|
)
|
|
end
|
|
|
|
it "creates a short-lived authorization code" do
|
|
expect { subject }.to change(RsAuthorizationCode, :count).by(1)
|
|
expect(subject.code).to be_present
|
|
expect(subject.client_id).to eq("example.com")
|
|
expect(subject.permissions).to eq(%w(documents:rw))
|
|
expect(subject.code_challenge).to eq("challenge")
|
|
end
|
|
|
|
it "does not create a remote storage authorization" do
|
|
expect { subject }.not_to change(RemoteStorageAuthorization, :count)
|
|
end
|
|
end
|