144 lines
4.1 KiB
Ruby
144 lines
4.1 KiB
Ruby
class Application < ApplicationRecord
|
|
has_secure_password :client_secret
|
|
|
|
has_many :application_groups, dependent: :destroy
|
|
has_many :allowed_groups, through: :application_groups, source: :group
|
|
has_many :oidc_authorization_codes, dependent: :destroy
|
|
has_many :oidc_access_tokens, dependent: :destroy
|
|
has_many :oidc_user_consents, dependent: :destroy
|
|
has_many :application_roles, dependent: :destroy
|
|
has_many :user_role_assignments, through: :application_roles
|
|
|
|
validates :name, presence: true
|
|
validates :slug, presence: true, uniqueness: { case_sensitive: false },
|
|
format: { with: /\A[a-z0-9\-]+\z/, message: "only lowercase letters, numbers, and hyphens" }
|
|
validates :app_type, presence: true,
|
|
inclusion: { in: %w[oidc saml] }
|
|
validates :client_id, uniqueness: { allow_nil: true }
|
|
validates :role_mapping_mode, inclusion: { in: %w[disabled oidc_managed hybrid] }, allow_blank: true
|
|
|
|
normalizes :slug, with: ->(slug) { slug.strip.downcase }
|
|
|
|
before_validation :generate_client_credentials, on: :create, if: :oidc?
|
|
|
|
# Scopes
|
|
scope :active, -> { where(active: true) }
|
|
scope :oidc, -> { where(app_type: "oidc") }
|
|
scope :saml, -> { where(app_type: "saml") }
|
|
scope :oidc_managed_roles, -> { where(role_mapping_mode: "oidc_managed") }
|
|
scope :hybrid_roles, -> { where(role_mapping_mode: "hybrid") }
|
|
|
|
# Type checks
|
|
def oidc?
|
|
app_type == "oidc"
|
|
end
|
|
|
|
def saml?
|
|
app_type == "saml"
|
|
end
|
|
|
|
# Role mapping checks
|
|
def role_mapping_enabled?
|
|
role_mapping_mode.in?(['oidc_managed', 'hybrid'])
|
|
end
|
|
|
|
def oidc_managed_roles?
|
|
role_mapping_mode == 'oidc_managed'
|
|
end
|
|
|
|
def hybrid_roles?
|
|
role_mapping_mode == 'hybrid'
|
|
end
|
|
|
|
# Access control
|
|
def user_allowed?(user)
|
|
return false unless active?
|
|
return false unless user.active?
|
|
|
|
# If no groups are specified, allow all active users
|
|
return true if allowed_groups.empty?
|
|
|
|
# Otherwise, user must be in at least one of the allowed groups
|
|
(user.groups & allowed_groups).any?
|
|
end
|
|
|
|
# OIDC helpers
|
|
def parsed_redirect_uris
|
|
return [] unless redirect_uris.present?
|
|
JSON.parse(redirect_uris)
|
|
rescue JSON::ParserError
|
|
redirect_uris.split("\n").map(&:strip).reject(&:blank?)
|
|
end
|
|
|
|
def parsed_metadata
|
|
return {} unless metadata.present?
|
|
JSON.parse(metadata)
|
|
rescue JSON::ParserError
|
|
{}
|
|
end
|
|
|
|
def parsed_managed_permissions
|
|
return {} unless managed_permissions.present?
|
|
managed_permissions.is_a?(Hash) ? managed_permissions : JSON.parse(managed_permissions)
|
|
rescue JSON::ParserError
|
|
{}
|
|
end
|
|
|
|
# Role management methods
|
|
def user_roles(user)
|
|
application_roles.joins(:user_role_assignments)
|
|
.where(user_role_assignments: { user: user })
|
|
.active
|
|
end
|
|
|
|
def user_has_role?(user, role_name)
|
|
user_roles(user).exists?(name: role_name)
|
|
end
|
|
|
|
def assign_role_to_user!(user, role_name, source: 'manual', metadata: {})
|
|
role = application_roles.active.find_by!(name: role_name)
|
|
role.assign_to_user!(user, source: source, metadata: metadata)
|
|
end
|
|
|
|
def remove_role_from_user!(user, role_name)
|
|
role = application_roles.find_by!(name: role_name)
|
|
role.remove_from_user!(user)
|
|
end
|
|
|
|
# Enhanced access control with roles
|
|
def user_allowed_with_roles?(user)
|
|
return user_allowed?(user) unless role_mapping_enabled?
|
|
|
|
# For OIDC managed roles, check if user has any roles assigned
|
|
if oidc_managed_roles?
|
|
return user_roles(user).exists?
|
|
end
|
|
|
|
# For hybrid mode, either group-based access or role-based access works
|
|
if hybrid_roles?
|
|
return user_allowed?(user) || user_roles(user).exists?
|
|
end
|
|
|
|
user_allowed?(user)
|
|
end
|
|
|
|
# Generate and return a new client secret
|
|
def generate_new_client_secret!
|
|
secret = SecureRandom.urlsafe_base64(48)
|
|
self.client_secret = secret
|
|
self.save!
|
|
secret
|
|
end
|
|
|
|
private
|
|
|
|
def generate_client_credentials
|
|
self.client_id ||= SecureRandom.urlsafe_base64(32)
|
|
# Generate and hash the client secret
|
|
if new_record? && client_secret.blank?
|
|
secret = SecureRandom.urlsafe_base64(48)
|
|
self.client_secret = secret
|
|
end
|
|
end
|
|
end
|