Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added authentication method selection in integration setup #737

Open
wants to merge 24 commits into
base: master
Choose a base branch
from
Open

Added authentication method selection in integration setup #737

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
e9cf280
Added OIDC based authorization feature
SagarGi Dec 12, 2024
1fc2759
Review address
SagarGi Dec 12, 2024
cd4a717
Fix php unit test after changes
SagarGi Dec 12, 2024
0be3763
Fix failing vue unit tests due to changes
SagarGi Dec 16, 2024
a9f6b5a
Fix UI for reset values
SagarGi Dec 17, 2024
c6bd475
Fix unit php tests
SagarGi Dec 17, 2024
6446a80
changes from nabin
nabim777 Dec 17, 2024
809feeb
Added single new test after refactor
SagarGi Dec 17, 2024
04d4bfd
Fix from ui endpint
SagarGi Dec 17, 2024
afb0653
Fix from unit
SagarGi Dec 17, 2024
5e4ecca
Fix backend and tests
SagarGi Dec 18, 2024
ce60575
changes from nabin 2
nabim777 Dec 18, 2024
1f95606
Fix backend 1
SagarGi Dec 18, 2024
e6f64e5
temp test
SagarGi Dec 18, 2024
d231ef5
Added new php tests
SagarGi Dec 18, 2024
426fb50
added new php tests for OP API controller
SagarGi Dec 19, 2024
54f44da
added new php tests for OP API service
SagarGi Dec 19, 2024
5222e18
Added pre test for mock service
SagarGi Dec 19, 2024
b962d15
Added final php test
SagarGi Dec 23, 2024
e842164
Fix dynamix load
SagarGi Dec 23, 2024
39c9ef4
final test
SagarGi Dec 24, 2024
6a1a046
Added vue unit tests
SagarGi Dec 24, 2024
ba4ee29
pre unit tests admin
SagarGi Dec 27, 2024
4c4823d
Added new vue unit tests
SagarGi Dec 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
140 changes: 108 additions & 32 deletions lib/Controller/ConfigController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,6 +141,30 @@ public function clearUserInfo(string $userId = null) {
$this->config->deleteUserValue($userId, Application::APP_ID, 'refresh_token');
}

/**
* @return void
*/
public function resetConfigValuesForOauth2Reset(): void {
// for oauth2 reset we reset openproject client credential as well as nextcloud client credential
$this->config->setAppValue(Application::APP_ID, 'openproject_client_id', "");
$this->config->setAppValue(Application::APP_ID, 'openproject_client_secret', "");
$this->deleteOauthClient();
}

/**
* @return void
*/
public function resetConfigValuesForOIDCReset(string $userId = null): void {
if ($userId === null) {
$userId = $this->userId;
}
$this->config->setAppValue(Application::APP_ID, 'oidc_provider', "");
$this->config->setAppValue(Application::APP_ID, 'targeted_audience_client_id', "");
$this->config->deleteUserValue($userId, Application::APP_ID, 'user_id');
$this->config->deleteUserValue($userId, Application::APP_ID, 'user_name');
}


/**
* set config values
* @NoAdminRequired
Expand Down Expand Up @@ -183,6 +207,9 @@ public function setConfig(array $values): DataResponse {
private function setIntegrationConfig(array $values): array {
$allowedKeys = [
'openproject_instance_url',
'authorization_method',
'oidc_provider',
'targeted_audience_client_id',
'openproject_client_id',
'openproject_client_secret',
'default_enable_navigation',
Expand All @@ -199,7 +226,7 @@ private function setIntegrationConfig(array $values): array {
}
$appPassword = null;

if (key_exists('setup_project_folder', $values) && $values['setup_project_folder'] === true) {
if (array_key_exists('setup_project_folder', $values) && $values['setup_project_folder'] === true) {
$isSystemReady = $this->openprojectAPIService->isSystemReadyForProjectFolderSetUp();
if ($isSystemReady) {
$password = $this->secureRandom->generate($this->openprojectAPIService->getPasswordLength(), ISecureRandom::CHAR_ALPHANUMERIC.ISecureRandom::CHAR_SYMBOLS);
Expand All @@ -215,7 +242,7 @@ private function setIntegrationConfig(array $values): array {
}

// creates or replace the app password
if (key_exists('setup_app_password', $values) && $values['setup_app_password'] === true) {
if (array_key_exists('setup_app_password', $values) && $values['setup_app_password'] === true) {
$isAppPasswordBeingReplaced = $this->openprojectAPIService->hasAppPassword();
$this->openprojectAPIService->deleteAppPassword();
if (!$this->userManager->userExists(Application::OPEN_PROJECT_ENTITIES_NAME)) {
Expand All @@ -232,17 +259,68 @@ private function setIntegrationConfig(array $values): array {
);
}
}

$oldClientId = $oldClientSecret = '';
$oldOpenProjectOauthUrl = $this->config->getAppValue(
Application::APP_ID, 'openproject_instance_url', ''
);
$oldClientId = $this->config->getAppValue(
Application::APP_ID, 'openproject_client_id', ''
$oldAuthMethod = $this->config->getAppValue(
Application::APP_ID, 'authorization_method', ''
);
$oldClientSecret = $this->config->getAppValue(
Application::APP_ID, 'openproject_client_secret', ''
// when openproject_instance_url && authorization_method does not have a value at the same time,
// it means a full reset is done
$runningFullReset = array_key_exists('openproject_instance_url', $values) &&
array_key_exists('authorization_method', $values) &&
!$values['openproject_instance_url'] &&
!$values['authorization_method'];

$runningFullResetWithOAuth2Auth = (
$runningFullReset &&
$oldAuthMethod === OpenProjectAPIService::AUTH_METHOD_OAUTH
);

$runningFullResetWithOIDCAuth = (
$runningFullReset &&
$oldAuthMethod === OpenProjectAPIService::AUTH_METHOD_OIDC
);
if (
(array_key_exists('openproject_client_id', $values) && array_key_exists('openproject_client_secret', $values))
) {
$oldClientId = $this->config->getAppValue(
Application::APP_ID, 'openproject_client_id', ''
);
$oldClientSecret = $this->config->getAppValue(
Application::APP_ID, 'openproject_client_secret', ''
);
}
// since we can now switch between both authorization method we need to know what we are resetting
$runningOauth2Reset = (
array_key_exists('openproject_client_id', $values) &&
!$values['openproject_client_id'] &&
array_key_exists('openproject_client_secret', $values) &&
!$values['openproject_client_secret'] &&
$oldOpenProjectOauthUrl &&
$oldClientId &&
$oldClientSecret
);

$runningOIDCReset = false;
if (
array_key_exists('oidc_provider', $values) &&
array_key_exists('targeted_audience_client_id', $values)
) {
$oldOidcProvider = $this->config->getAppValue(
Application::APP_ID, 'oidc_provider', ''
);
$oldTargetedAudienceClient = $this->config->getAppValue(
Application::APP_ID, 'targeted_audience_client_id', ''
);
$runningOIDCReset = (
$oldOidcProvider &&
$oldTargetedAudienceClient &&
!$values['oidc_provider'] &&
!$values['targeted_audience_client_id']);
}

foreach ($values as $key => $value) {
if ($key === 'setup_project_folder' || $key === 'setup_app_password') {
continue;
Expand All @@ -251,8 +329,8 @@ private function setIntegrationConfig(array $values): array {
}

// if the OpenProject OAuth URL has changed
if (key_exists('openproject_instance_url', $values)
&& $oldOpenProjectOauthUrl !== $values['openproject_instance_url']
if (array_key_exists('openproject_instance_url', $values)
&& $oldOpenProjectOauthUrl !== $values['openproject_instance_url'] && (!$runningOIDCReset || !$runningFullResetWithOIDCAuth)
) {
// delete the existing OAuth client if new OAuth URL is passed empty
if (
Expand All @@ -271,24 +349,8 @@ private function setIntegrationConfig(array $values): array {
}
}

$runningFullReset = (

key_exists('openproject_instance_url', $values) &&

key_exists('openproject_client_id', $values) &&

key_exists('openproject_client_secret', $values) &&

$values['openproject_instance_url'] === null &&

$values['openproject_client_id'] === null &&

$values['openproject_client_secret'] === null

);

// resetting and keeping the project folder setup should delete the user app password
if (key_exists('setup_app_password', $values) && $values['setup_app_password'] === false) {
if (array_key_exists('setup_app_password', $values) && $values['setup_app_password'] === false) {
$this->openprojectAPIService->deleteAppPassword();
if (!$runningFullReset) {
$this->openprojectAPIService->logToAuditFile(
Expand All @@ -300,10 +362,11 @@ private function setIntegrationConfig(array $values): array {
$this->config->deleteAppValue(Application::APP_ID, 'oPOAuthTokenRevokeStatus');
if (
// when the OP client information has changed
((key_exists('openproject_client_id', $values) && $values['openproject_client_id'] !== $oldClientId) ||
(key_exists('openproject_client_secret', $values) && $values['openproject_client_secret'] !== $oldClientSecret)) ||
// when the OP client information is for reset
$runningFullReset
(!$runningFullResetWithOIDCAuth && ((array_key_exists('openproject_client_id', $values) && $values['openproject_client_id'] !== $oldClientId) ||
(array_key_exists('openproject_client_secret', $values) && $values['openproject_client_secret'] !== $oldClientSecret))) ||
// when the OP client information is for reset
$runningFullResetWithOAuth2Auth ||
$runningOauth2Reset
) {
$this->userManager->callForAllUsers(function (IUser $user) use (
$oldOpenProjectOauthUrl, $oldClientId, $oldClientSecret
Expand Down Expand Up @@ -345,6 +408,8 @@ private function setIntegrationConfig(array $values): array {
}
$this->clearUserInfo($userUID);
});
} elseif ($runningFullResetWithOIDCAuth) {
$this->resetConfigValuesForOIDCReset();
}


Expand All @@ -361,6 +426,18 @@ private function setIntegrationConfig(array $values): array {
$this->config->setAppValue(Application::APP_ID, 'fresh_project_folder_setup', "0");
}

// admin can now switch between authorization method 'oidc' and 'oauth2'
// when switching between two method (back and forth) should delete configuration
if (array_key_exists('authorization_method', $values) &&
$values['authorization_method'] === OpenProjectAPIService::AUTH_METHOD_OIDC && $runningOauth2Reset) {
$this->resetConfigValuesForOauth2Reset();
}

if (array_key_exists('authorization_method', $values) &&
$values['authorization_method'] === OpenProjectAPIService::AUTH_METHOD_OAUTH && $runningOIDCReset) {
$this->resetConfigValuesForOIDCReset();
}

// if the revoke has failed at least once, the last status is stored in the database
// this is not a neat way to give proper information about the revoke status
// TODO: find way to report every user's revoke status
Expand Down Expand Up @@ -603,13 +680,12 @@ public function checkConfig(): DataResponse {
* @return DataResponse
*/
public function checkAdminConfigOk(): DataResponse {
$adminConfigStatusWithoutGroupFolderSetupStatus = OpenProjectAPIService::isAdminConfigOk($this->config);
$appPasswordSetStatus = $this->openprojectAPIService->hasAppPassword();
// Admin config can be set in two parts
// 1. config without project folder set up (which is compulsory for integration)
// 2. config with project folder set up (which is optional for admin)
return new DataResponse([
'config_status_without_project_folder' => $adminConfigStatusWithoutGroupFolderSetupStatus,
'config_status_without_project_folder' => OpenProjectAPIService::isAdminConfigOk($this->config),
'project_folder_setup_status' => $appPasswordSetStatus
]);
}
Expand Down
Loading
Loading