- <%- current_organization.enabled_omniauth_providers.keys.each do |provider| %>
+ <%- current_organization.enabled_omniauth_providers.each do |name, provider| %>
- <% if provider.match?("france") %>
+ <% if name.match?("france") %>
+ <% display_name = provider[:display_name] %>
+ <% provider_name = display_name.present? ? display_name : normalize_provider_name(name).titleize %>
- <%= t("devise.shared.links.sign_in_with_provider", provider: normalize_full_provider_name(provider).titleize) %>
+ <%= t("devise.shared.links.sign_in_with_provider", provider: provider_name) %>
-
-
<%= t("decidim.omniauth.france_connect.explanation") %>
- <%= sso_provider_image(provider, decidim.send("user_#{provider}_omniauth_authorize_path")) %>
-
+
+ <%= t("decidim.omniauth.france_connect.explanation") %>
+
+ <%= link_to decidim.send("user_#{name}_omniauth_authorize_path"), class: "button button--social--custom", method: :post do %>
+ <% if provider[:icon_hover_path].present? %>
+ <%= image_pack_tag provider[:icon_path], class: "button--has-hover", alt: t("devise.shared.links.sign_in_with_provider", provider: provider_name) %>
+ <%= image_pack_tag provider[:icon_hover_path], class: "button--is-hover", alt: t("devise.shared.links.sign_in_with_provider", provider: provider_name) %>
+ <% else %>
+ <%= image_pack_tag provider[:icon_path], alt: t("devise.shared.links.sign_in_with_provider", provider: provider_name) %>
+ <% end %>
+ <% end %>
<% if I18n.exists?("decidim.omniauth.france_connect.external.link") %>
<%= link_to t("link", scope: "decidim.omniauth.france_connect.external"), class: "primary", target: "_blank" do %>
@@ -22,7 +31,7 @@
<% end %>
<% else %>
- <%== sso_provider_button(provider, decidim.send("user_#{provider}_omniauth_authorize_path")).html_safe %>
+ <%== sso_provider_button(name, decidim.send("user_#{name}_omniauth_authorize_path")).html_safe %>
<% end %>
diff --git a/app/views/decidim/unconfirmed_votes_clear_mailer/send_resume.html.erb b/app/views/decidim/unconfirmed_votes_clear_mailer/send_resume.html.erb
index 460d1980..c564bbf5 100644
--- a/app/views/decidim/unconfirmed_votes_clear_mailer/send_resume.html.erb
+++ b/app/views/decidim/unconfirmed_votes_clear_mailer/send_resume.html.erb
@@ -11,12 +11,10 @@
<% end %>
-
<%== t "confirm", scope: "decidim.unconfirmed_votes_clear_mailer.send_resume.body" %>
-
<% content_for :note do %>
<%== t "subject", scope: "decidim.confirmation_reminder_mailer.send_reminder", organization_name: h(@organization.name), link: decidim.notifications_settings_url(host: @organization.host) %>
<% end %>
diff --git a/config/application.rb b/config/application.rb
index 9372e762..2b555810 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -35,6 +35,8 @@ class Application < Rails::Application
"X-Content-Type-Options" => "nosniff"
}
+ require "decidim_app/omniauth/configurator"
+
# Settings in config/environments/* take precedence over those specified here.
# Application configuration can go into files in config/initializers
# -- all .rb files in that directory are automatically loaded after loading
diff --git a/config/initializers/extends.rb b/config/initializers/extends.rb
index b6d49a6e..0e926af0 100644
--- a/config/initializers/extends.rb
+++ b/config/initializers/extends.rb
@@ -14,3 +14,5 @@
require "extends/commands/decidim/admin/update_organization_appearance_extends"
require "extends/cells/decidim/verifications/authorization_metadata_cell_extends"
require "extends/commands/decidim/verifications/authorize_user_extends"
+require "extends/openid_connect/access_token_extends"
+require "extends/omniauth/strategies/openid_connect_extends"
diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb
new file mode 100644
index 00000000..961c98e6
--- /dev/null
+++ b/config/initializers/omniauth.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+ActiveSupport::Notifications.subscribe "decidim.user.omniauth_registration" do |_name, data|
+ Rails.logger.debug "decidim.user.omniauth_registration event in config/initializers/omniauth.rb"
+
+ update_user_profile(data)
+end
+
+def update_user_profile(data)
+ user = Decidim::User.find(data[:user_id])
+
+ user.email = data[:email] if data[:email].present?
+ user.skip_reconfirmation! if data[:email].present? && user.email_changed?
+ user.name = data[:name] if data[:name].present?
+
+ user.save!(validate: false, touch: false)
+end
diff --git a/config/initializers/omniauth_france_connect.rb b/config/initializers/omniauth_france_connect.rb
index f450eb37..c31e118a 100644
--- a/config/initializers/omniauth_france_connect.rb
+++ b/config/initializers/omniauth_france_connect.rb
@@ -1,16 +1,16 @@
# frozen_string_literal: true
-Rails.application.config.middleware.use OmniAuth::Builder do
- provider(
- :france_connect,
- setup: lambda { |env|
- request = Rack::Request.new(env)
- organization = env["decidim.current_organization"].presence || Decidim::Organization.find_by(host: request.host)
- provider_config = organization.enabled_omniauth_providers[:france_connect]
- env["omniauth.strategy"].options[:client_id] = provider_config[:client_id]
- env["omniauth.strategy"].options[:client_secret] = provider_config[:client_secret]
- env["omniauth.strategy"].options[:site] = provider_config[:site_url]
- env["omniauth.strategy"].options[:scope] = provider_config[:scope]&.split(" ")
- }
- )
+require "omniauth/strategies/france_connect"
+require "decidim_app/omniauth/openid_connect_utils"
+
+if Rails.application.secrets.dig(:omniauth, :france_connect).present?
+ OmniAuth.config.logger = Rails.logger
+ Rails.application.config.middleware.use OmniAuth::Builder do
+ provider(
+ :france_connect,
+ setup: lambda { |env|
+ DecidimApp::Omniauth::OpenidConnectUtils.setup(:france_connect, env)
+ }
+ )
+ end
end
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 72a5ce56..cab11c4d 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -60,6 +60,8 @@ en:
subject: Please confirm your email address
devise:
omniauth_registrations:
+ create:
+ email_already_exists: Another account is using the same email address
new:
address: Address
birth_date: Date of birth
@@ -212,21 +214,18 @@ en:
organizations:
omniauth_settings:
france_connect:
- client_id: Client ID
- client_secret: Client secret
- site_url: Site URL
- france_connect_profile:
- button_path: Button path
- client_id: Client ID
- client_secret: Client secret
- provider_name: Provider name
- site: Site URL
- france_connect_uid:
- button_path: Button path
- client_id: Client ID
- client_secret: Client secret
- provider_name: Provider name
- site: Site URL
+ acr_values: ACR values
+ client_options_identifier: Client identifier
+ client_options_redirect_uri: Redirect URI (e.g. https://my-decidim.com/users/auth/openid_connect/callback)
+ client_options_secret: Client secret
+ client_signing_alg: Client signing algorithm (e.g. RS256, ES256, PS256 ...)
+ display_name: Display name
+ icon_hover_path: Icon path for hover state (e.g. /media/images/oidc_hover.png)
+ issuer: Issuer URL (e.g. https://identity.com)
+ logout_path: Logout path (path after "/users/auth/openid_connect")
+ logout_policy: Logout policy (none/session.destroy)
+ post_logout_redirect_uri: Post logout redirect URI (e.g. https://my-decidim.com/users/auth/openid_connect/logout)
+ scope: Scope / Claims (e.g. openid email profile)
publik:
client_id: Client ID
client_secret: Client secret
@@ -269,6 +268,8 @@ en:
new:
forgot_your_password: Forgot your password
send_me_reset_password_instructions: Send me reset password instructions
+ registrations:
+ signed_up_but_unconfirmed: A message with a confirmation link has been sent to your email address. Please follow the link to activate your account.
sessions:
new:
sign_in: Log in
diff --git a/config/locales/fr.yml b/config/locales/fr.yml
index 97927379..599ba1bf 100644
--- a/config/locales/fr.yml
+++ b/config/locales/fr.yml
@@ -60,6 +60,8 @@ fr:
subject: Veuillez confirmer votre compte
devise:
omniauth_registrations:
+ create:
+ email_already_exists: Un autre compte utilise la même adresse email
new:
address: Adresse
birth_date: Date de naissance
@@ -208,21 +210,18 @@ fr:
organizations:
omniauth_settings:
france_connect:
- client_id: Client ID
- client_secret: Client secret
- site_url: Site URL
- france_connect_profile:
- button_path: Chemin du bouton
- client_id: Client ID
- client_secret: Client secret
- provider_name: Provider name
- site: Site URL
- france_connect_uid:
- button_path: Chemin du bouton
- client_id: Client ID
- client_secret: Client secret
- provider_name: Provider name
- site: Site URL
+ acr_values: ACR values
+ client_options_identifier: Client identifier
+ client_options_redirect_uri: Redirect URI (e.g. https://my-decidim.com/users/auth/openid_connect/callback)
+ client_options_secret: Client secret
+ client_signing_alg: Client signing algorithm (e.g. RS256, ES256, PS256 ...)
+ display_name: Display name
+ icon_hover_path: Icon path for hover state (e.g. /media/images/oidc_hover.png)
+ issuer: Issuer URL (e.g. https://identity.com)
+ logout_path: Logout path (path after "/users/auth/openid_connect")
+ logout_policy: Logout policy (none/session.destroy)
+ post_logout_redirect_uri: Post logout redirect URI (e.g. https://my-decidim.com/users/auth/openid_connect/logout)
+ scope: Scope / Claims (e.g. openid email profile)
publik:
client_id: Client ID
client_secret: Client secret
@@ -265,6 +264,8 @@ fr:
new:
forgot_your_password: Mot de passe oublié ?
send_me_reset_password_instructions: Envoyez-moi les instructions de réinitialisation du mot de passe
+ registrations:
+ signed_up_but_unconfirmed: Un message avec un lien de confirmation a été envoyé à votre adresse e-mail. Veuillez suivre le lien pour activer votre compte.
sessions:
new:
sign_in: S'identifier
diff --git a/config/routes.rb b/config/routes.rb
index a87f61ad..d2cfbc34 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -10,6 +10,11 @@
mount LetterOpenerWeb::Engine, at: "/letter_opener" if Rails.env.development? || ENV.fetch("ENABLE_LETTER_OPENER", "0") == "1"
+ devise_scope :user do
+ get "users/sign_out",
+ to: "decidim/devise/sessions#destroy"
+ end
+
mount Decidim::Core::Engine => "/"
# mount Decidim::Map::Engine => '/map'
# For details on the DSL available within this file, see http://guides.rubyonrails.org/routing.html
diff --git a/config/secrets.yml b/config/secrets.yml
index 72a0542e..ce107795 100644
--- a/config/secrets.yml
+++ b/config/secrets.yml
@@ -64,12 +64,25 @@ default: &default
client_id: <%= ENV["OMNIAUTH_PUBLIK_CLIENT_ID"] %>
client_secret: <%= ENV["OMNIAUTH_PUBLIK_CLIENT_SECRET"] %>
site_url: <%= ENV["OMNIAUTH_PUBLIK_SITE_URL"] %>
- france_connect:
+ france_connect:
enabled: <%= ENV["OMNIAUTH_FC_CLIENT_SECRET"].present? %>
- client_id: <%= ENV["OMNIAUTH_FC_CLIENT_ID"] %>
- client_secret: <%= ENV["OMNIAUTH_FC_CLIENT_SECRET"] %>
- site_url: <%= ENV["OMNIAUTH_FC_SITE_URL"] %>
- scope: <%= ENV["OMNIAUTH_FC_SCOPE"] %>
+ icon_path: <%= ENV["OMNIAUTH_FRANCE_CONNECT_ICON_PATH"] %>
+ icon_hover_path: <%= ENV["OMNIAUTH_FRANCE_CONNECT_ICON_HOVER_PATH"] %>
+ display_name: <%= ENV["OMNIAUTH_FRANCE_CONNECT_DISPLAY_NAME"] %>
+ issuer: <%= ENV["OMNIAUTH_FRANCE_CONNECT_ISSUER"] %>
+ # discovery: <%= ENV["OMNIAUTH_FRANCE_CONNECT_DISCOVERY"] %>
+ client_options_identifier: <%= ENV["OMNIAUTH_FRANCE_CONNECT_CLIENT_OPTIONS_IDENTIFIER"] %>
+ client_options_secret: <%= ENV["OMNIAUTH_FRANCE_CONNECT_CLIENT_OPTIONS_SECRET"] %>
+ client_options_redirect_uri: <%= ENV["OMNIAUTH_FRANCE_CONNECT_CLIENT_OPTIONS_REDIRECT_URI"] %>
+ scope: <%= ENV["OMNIAUTH_FRANCE_CONNECT_SCOPE"] %>
+ # response_type: <%= ENV["OMNIAUTH_FRANCE_CONNECT_RESPONSE_TYPE"] %>
+ acr_values: <%= ENV["OMNIAUTH_FRANCE_CONNECT_ACR_VALUES"] %>
+ # client_auth_method: <%= ENV["OMNIAUTH_FRANCE_CONNECT_CLIENT_AUTH_METHOD"] %>
+ client_signing_alg: <%= ENV["OMNIAUTH_FRANCE_CONNECT_CLIENT_SIGNING_ALG"] %>
+ logout_policy: <%= ENV["OMNIAUTH_FRANCE_CONNECT_LOGOUT_POLICY"] %>
+ logout_path: <%= ENV["OMNIAUTH_FRANCE_CONNECT_LOGOUT_PATH"] %>
+ post_logout_redirect_uri: <%= ENV["OMNIAUTH_FRANCE_CONNECT_POST_LOGOUT_REDIRECT_URI"] %>
+ # uid_field: <%= ENV["OMNIAUTH_FRANCE_CONNECT_UID_FIELD"] %>
maps:
api_key: <%= ENV["GEOCODER_LOOKUP_API_KEY"] %>
sentry:
diff --git a/lib/decidim_app/omniauth/configurator.rb b/lib/decidim_app/omniauth/configurator.rb
new file mode 100644
index 00000000..8ce8e6aa
--- /dev/null
+++ b/lib/decidim_app/omniauth/configurator.rb
@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module DecidimApp
+ module Omniauth
+ class Configurator
+ attr_reader :provider, :database_settings, :strategy_options, :rails_secrets
+
+ def initialize(provider, env)
+ request = Rack::Request.new(env)
+ organization = env["decidim.current_organization"].presence || Decidim::Organization.find_by(host: request.host)
+ @provider = provider
+ @strategy_options = if env["omniauth.strategy"].present?
+ env["omniauth.strategy"].options
+ else
+ OmniAuth::Strategies.const_get(
+ OmniAuth::Utils.camelize(provider).to_s,
+ false
+ ).default_options
+ end
+ @database_settings = organization.enabled_omniauth_providers[provider.to_sym]
+ @rails_secrets = Rails.application.secrets.dig(:omniauth, provider.to_sym)
+
+ # Rails.logger.debug { "Configuring omniauth provider: #{provider} for organization: (#{organization.id}) #{organization.host}" }
+ # Rails.logger.debug { "Strategy default options: #{strategy_options.inspect}" }
+ # Rails.logger.debug { "Database settings: #{database_settings.inspect}" }
+ # Rails.logger.debug { "Rails secrets: #{rails_secrets.inspect}" }
+ end
+
+ def set_value(key, forced_value: nil, path: nil, transform: ->(value) { value })
+ value = if forced_value.nil? # false and "" are valid values
+ transform.call(find_value(key.to_sym))
+ else
+ forced_value
+ end
+ return if value.nil?
+
+ if path.present?
+ path_array = path.split(".").map(&:to_sym)
+ strategy_options.dig(*path_array[0..-2])[path_array.last] = value
+ else
+ strategy_options[key.to_sym] = value
+ end
+ end
+
+ def find_value(key)
+ if database_settings&.dig(key).present?
+ database_settings[key]
+ elsif rails_secrets&.dig(key).present?
+ rails_secrets[key]
+ end
+ end
+
+ def options(key)
+ find_value(key) || strategy_options[key]
+ end
+
+ def manage_boolean(value)
+ [true, "true", "TRUE", 1, "1"].include?(value) if value.present?
+ end
+ end
+ end
+end
diff --git a/lib/decidim_app/omniauth/openid_connect_utils.rb b/lib/decidim_app/omniauth/openid_connect_utils.rb
new file mode 100644
index 00000000..4335af98
--- /dev/null
+++ b/lib/decidim_app/omniauth/openid_connect_utils.rb
@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module DecidimApp
+ module Omniauth
+ class OpenidConnectUtils
+ def self.setup(provider, env)
+ configurator = Configurator.new(provider, env)
+ configurator.set_value(:discovery, transform: ->(value) { configurator.manage_boolean(value) })
+
+ %w(
+ identifier
+ secret
+ redirect_uri
+ ).map(&:to_sym).each do |key|
+ configurator.set_value("client_options_#{key}", path: "client_options.#{key}")
+ end
+
+ if configurator.strategy_options[:client_options][:redirect_uri].blank?
+ configurator.set_value(
+ :redirect_uri,
+ forced_value: env["omniauth.strategy"].callback_url.split("?")[0],
+ path: "client_options.redirect_uri"
+ )
+ end
+
+ %w(
+ issuer
+ response_type
+ acr_values
+ client_auth_method
+ client_signing_alg
+ logout_policy
+ logout_path
+ post_logout_redirect_uri
+ uid_field
+ ).map(&:to_sym).each do |key|
+ configurator.set_value(key)
+ end
+
+ configurator.set_value(:scope, transform: ->(value) { value&.split(",")&.map(&:strip) })
+ end
+ end
+ end
+end
diff --git a/lib/decidim_app/omniauth/utils.rb b/lib/decidim_app/omniauth/utils.rb
new file mode 100644
index 00000000..3636a9ac
--- /dev/null
+++ b/lib/decidim_app/omniauth/utils.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module DecidimApp
+ module Omniauth
+ class Utils
+ def self.find_value(key, settings, secrets)
+ if settings&.dig(key).present?
+ settings[key]
+ elsif secrets&.dig(key).present?
+ secrets[key]
+ end
+ end
+
+ def self.provider_settings(env, provider)
+ request = Rack::Request.new(env)
+ organization = env["decidim.current_organization"].presence || Decidim::Organization.find_by(host: request.host)
+ organization.enabled_omniauth_providers[provider.to_sym]
+ end
+ end
+ end
+end
diff --git a/lib/extends/controllers/decidim/devise/account_controller_extends.rb b/lib/extends/controllers/decidim/devise/account_controller_extends.rb
index de4a8d98..0666eaeb 100644
--- a/lib/extends/controllers/decidim/devise/account_controller_extends.rb
+++ b/lib/extends/controllers/decidim/devise/account_controller_extends.rb
@@ -1,41 +1,63 @@
# frozen_string_literal: true
-module AccountControllerExtends
- def destroy
- enforce_permission_to :delete, :user, current_user: current_user
- @form = form(Decidim::DeleteAccountForm).from_params(params)
-
- Decidim::DestroyAccount.call(current_user, @form) do
- on(:ok) do
- sign_out(current_user)
- if active_france_connect_session?
- destroy_france_connect_session(session["omniauth.france_connect.end_session_uri"])
- else
- redirect_to decidim.root_path
+module Decidim
+ module AccountControllerExtends
+ def destroy
+ enforce_permission_to :delete, :user, current_user: current_user
+ @form = form(Decidim::DeleteAccountForm).from_params(params)
+ Decidim::DestroyAccount.call(current_user, @form) do
+ on(:ok) do
+ handle_successful_destruction
+ end
+ on(:invalid) do
+ handle_invalid_destruction
end
- flash[:notice] = t("account.destroy.success", scope: "decidim")
end
+ end
+
+ private
- on(:invalid) do
- flash[:alert] = t("account.destroy.error", scope: "decidim")
+ def handle_successful_destruction
+ sign_out(current_user)
+ flash[:notice] = t("account.destroy.success", scope: "decidim")
+ if active_omniauth_session?
+ handle_omniauth_logout
+ else
redirect_to decidim.root_path
end
end
- end
- private
+ def handle_omniauth_logout
+ provider = session.delete("omniauth.provider")
+ omniauth_config = DecidimApp::Omniauth::Configurator.new(provider, request.env)
+ logout_policy = omniauth_config.options(:logout_policy)
+ logout_path = omniauth_config.options(:logout_path)
+
+ if provider.present? && logout_policy == "session.destroy" && logout_path.present?
+ redirect_to omniauth_logout_path(provider, logout_path)
+ else
+ redirect_to decidim.root_path
+ end
+ end
- def destroy_france_connect_session(fc_logout_path)
- session.delete("omniauth.france_connect.end_session_uri")
+ def handle_invalid_destruction
+ flash[:alert] = t("account.destroy.error", scope: "decidim")
+ redirect_to decidim.root_path
+ end
- redirect_to fc_logout_path
- end
+ def active_omniauth_session?
+ session["omniauth.provider"].present?
+ end
- def active_france_connect_session?
- current_organization.enabled_omniauth_providers.include?(:france_connect) && session["omniauth.france_connect.end_session_uri"].present?
+ def omniauth_logout_path(provider, logout_path)
+ uri = URI.parse(decidim.send("user_#{provider}_omniauth_authorize_path"))
+ uri.path += logout_path
+ uri.to_s
+ end
end
end
Decidim::AccountController.class_eval do
- prepend(AccountControllerExtends)
+ prepend(Decidim::AccountControllerExtends)
+ include ApplicationHelper
end
diff --git a/lib/extends/controllers/decidim/devise/sessions_controller_extends.rb b/lib/extends/controllers/decidim/devise/sessions_controller_extends.rb
index ec6cc048..a8db96c9 100644
--- a/lib/extends/controllers/decidim/devise/sessions_controller_extends.rb
+++ b/lib/extends/controllers/decidim/devise/sessions_controller_extends.rb
@@ -7,14 +7,26 @@ module SessionControllerExtends
include Decidim::AfterSignInActionHelper
def destroy
- after_sign_out_url = after_sign_out_path_for(current_user)
- current_user.invalidate_all_sessions!
- if active_france_connect_session?
- destroy_france_connect_session(session["omniauth.france_connect.end_session_uri"], after_sign_out_url)
- elsif params[:translation_suffix].present?
- super { set_flash_message! :notice, params[:translation_suffix], { scope: "decidim.devise.sessions" } }
+ if active_omniauth_session?
+ provider = session.delete("omniauth.provider")
+ omniauth_config = DecidimApp::Omniauth::Configurator.new(provider, request.env)
+ logout_policy = omniauth_config.options(:logout_policy)
+ logout_path = omniauth_config.options(:logout_path)
+ end
+
+ if provider.present? && logout_policy == "session.destroy" && logout_path.present?
+ redirect_to omniauth_logout_path(provider, logout_path)
else
- super
+ if current_user
+ current_user.invalidate_all_sessions!
+ request.params[stored_location_key_for(current_user)] = stored_location_for(current_user) if pending_redirect?(current_user)
+ end
+
+ if params[:translation_suffix].present?
+ super { set_flash_message! :notice, params[:translation_suffix], { scope: "decidim.devise.sessions" } }
+ else
+ super
+ end
end
end
@@ -30,6 +42,10 @@ def after_sign_in_path_for(user)
end
end
+ def after_sign_out_path_for(user)
+ request.params[stored_location_key_for(user)] || request.referer || super
+ end
+
private
# Skip authorization handler by default
@@ -38,18 +54,14 @@ def skip_first_login_authorization?
end
end
- def destroy_france_connect_session(fc_logout_path, post_logout_redirect_uri)
- signed_out = (::Devise.sign_out_all_scopes ? sign_out : sign_out(resource_name))
- if signed_out
- set_flash_message! :notice, :signed_out
- session.delete("omniauth.france_connect.end_session_uri")
- end
- session["omniauth.france_connect.post_logout_redirect_uri"] = post_logout_redirect_uri
- redirect_to fc_logout_path
+ def active_omniauth_session?
+ session["omniauth.provider"].present?
end
- def active_france_connect_session?
- current_organization.enabled_omniauth_providers.include?(:france_connect) && session["omniauth.france_connect.end_session_uri"].present?
+ def omniauth_logout_path(provider, logout_path)
+ uri = URI.parse(decidim.send("user_#{provider}_omniauth_authorize_path"))
+ uri.path += logout_path
+ uri.to_s
end
end
diff --git a/lib/extends/forms/decidim/omniauth_registration_form_extend.rb b/lib/extends/forms/decidim/omniauth_registration_form_extend.rb
index 7d7084d1..09a36cf7 100644
--- a/lib/extends/forms/decidim/omniauth_registration_form_extend.rb
+++ b/lib/extends/forms/decidim/omniauth_registration_form_extend.rb
@@ -13,7 +13,7 @@ module OmniauthRegistrationFormExtend
attribute :city, String
attribute :tos_agreement, ::ActiveModel::Type::Boolean
- validates :email, "valid_email_2/email": { mx: true }
+ # validates :email, "valid_email_2/email": { mx: true }
validates :postal_code,
:birth_date,
:city,
diff --git a/lib/extends/omniauth/strategies/france_connect_extends.rb b/lib/extends/omniauth/strategies/france_connect_extends.rb
index dadc7b6a..fff33ad1 100644
--- a/lib/extends/omniauth/strategies/france_connect_extends.rb
+++ b/lib/extends/omniauth/strategies/france_connect_extends.rb
@@ -7,7 +7,9 @@ module FranceConnectExtends
private
def redirect_uri
- "#{omniauth_callback_url}?#{params.slice("redirect_uri", "after_action").to_query}"
+ uri = URI.parse(super)
+ uri.query = [uri.query, "after_action=#{params["after_action"]}"].compact.join("&") if params["after_action"].present?
+ uri.to_s
end
end
end
diff --git a/lib/extends/omniauth/strategies/openid_connect_extends.rb b/lib/extends/omniauth/strategies/openid_connect_extends.rb
new file mode 100644
index 00000000..bbfbe4ef
--- /dev/null
+++ b/lib/extends/omniauth/strategies/openid_connect_extends.rb
@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+module OpenIDConnectExtends
+ extend ActiveSupport::Concern
+
+ included do
+ include Rails.application.routes.mounted_helpers
+
+ option :logout_policy, "none"
+
+ info do
+ base_info
+ end
+
+ def base_info
+ {
+ name: user_info_name,
+ email: user_info.email,
+ email_verified: user_info.email_verified,
+ nickname: user_info.preferred_username,
+ first_name: user_info.given_name,
+ last_name: user_info.family_name,
+ gender: user_info.gender,
+ image: user_info.picture,
+ phone: user_info.phone_number,
+ urls: { website: user_info.website }
+ }
+ end
+
+ def user_info_name
+ user_info.name || [user_info.given_name, user_info.family_name].join(" ")
+ end
+
+ def other_phase
+ log :debug, "logout_path_pattern #{logout_path_pattern}"
+ log :debug, "current_path #{current_path}"
+ log :debug, "logout_path_pattern match #{logout_path_pattern.match?(current_path)}"
+ if logout_path_pattern.match?(current_path)
+ if end_session_callback?
+ log :debug, "Logout phase callback."
+ session.delete("omniauth.logout.callback")
+ return redirect(decidim.destroy_user_session_path)
+ else
+ log :debug, "Logout phase initiated."
+ @env["omniauth.strategy"] ||= self
+ setup_phase
+ options.issuer = issuer if options.issuer.to_s.empty?
+ discover!
+ session["omniauth.logout.callback"] = end_session_callback_value
+ end_session_redirect_uri = end_session_uri
+ log :debug, "End session redirect URI: #{end_session_redirect_uri}"
+ return redirect(end_session_redirect_uri) if end_session_redirect_uri.present?
+ end
+ end
+ call_app!
+ end
+
+ def end_session_uri
+ return unless end_session_endpoint_is_valid?
+
+ end_session_uri = URI(client_options.end_session_endpoint)
+ end_session_uri.query = URI.encode_www_form(
+ id_token_hint: credentials[:id_token],
+ post_logout_redirect_uri: options.post_logout_redirect_uri
+ )
+ end_session_uri.to_s
+ end
+
+ def end_session_callback?
+ session["omniauth.logout.callback"] == end_session_callback_value
+ end
+
+ def end_session_callback_value
+ "#{name}--#{session["session_id"]}"
+ end
+
+ def user_info
+ return @user_info if @user_info
+
+ if access_token.id_token
+ decoded = decode_id_token(access_token.id_token).raw_attributes
+
+ response = access_token.userinfo!
+ response = decode_id_token(response) if response.is_a?(String)
+
+ log :debug, "Userinfo response: #{response.raw_attributes.to_h}"
+
+ @user_info = ::OpenIDConnect::ResponseObject::UserInfo.new response.raw_attributes.merge(decoded).deep_symbolize_keys
+ else
+ @user_info = access_token.userinfo!
+ end
+ end
+ end
+end
+
+OmniAuth::Strategies::OpenIDConnect.class_eval do
+ include(OpenIDConnectExtends)
+end
diff --git a/lib/extends/openid_connect/access_token_extends.rb b/lib/extends/openid_connect/access_token_extends.rb
new file mode 100644
index 00000000..3f92709d
--- /dev/null
+++ b/lib/extends/openid_connect/access_token_extends.rb
@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module AccessTokenExtends
+ extend ActiveSupport::Concern
+
+ included do
+ def userinfo!(params = {})
+ response = resource_request do
+ get client.userinfo_uri, params
+ end
+
+ if response.is_a?(Hash)
+ ::OpenIDConnect::ResponseObject::UserInfo.new response.with_indifferent_access
+ else
+ response
+ end
+ end
+
+ private
+
+ def resource_request
+ res = yield
+ case res.status
+ when 200
+ res.body
+ when 400
+ raise BadRequest.new("API Access Failed", res)
+ when 401
+ raise Unauthorized.new("Access Token Invalid or Expired", res)
+ when 403
+ raise Forbidden.new("Insufficient Scope", res)
+ else
+ raise HttpError.new(res.status, "Unknown HttpError", res)
+ end
+ end
+ end
+end
+
+OpenIDConnect::AccessToken.class_eval do
+ include(AccessTokenExtends)
+end
diff --git a/lib/omniauth/strategies/france_connect.rb b/lib/omniauth/strategies/france_connect.rb
new file mode 100644
index 00000000..1490a303
--- /dev/null
+++ b/lib/omniauth/strategies/france_connect.rb
@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module OmniAuth
+ module Strategies
+ class FranceConnect < OpenIDConnect
+ option :name, :france_connect
+ option :discovery, true
+ option :response_type, "code"
+ option :client_auth_method, "basic"
+ option :uid_field, "sub"
+
+ info do
+ base_info.merge(
+ {
+ birthdate: extra.dig(:raw_info, :birthdate),
+ birthplace: extra.dig(:raw_info, :birthplace),
+ birthcountry: extra.dig(:raw_info, :birthcountry)
+ }
+ )
+ end
+
+ def user_info_name
+ [user_info.given_name, user_info.preferred_username || user_info.family_name].join(" ")
+ end
+
+ def auth_hash
+ session["omniauth.id_token_hint"] = credentials[:id_token]
+ super
+ end
+
+ def end_session_uri
+ return unless end_session_endpoint_is_valid?
+
+ if session["omniauth.id_token_hint"].present?
+ Rails.logger.debug do
+ "Omniauth session id_token_hint: #{session["omniauth.id_token_hint"]}"
+ end
+ end
+
+ end_session_uri = URI(client_options.end_session_endpoint)
+ end_session_uri.query = URI.encode_www_form(
+ id_token_hint: session.delete("omniauth.id_token_hint") || credentials[:id_token],
+ state: new_state,
+ post_logout_redirect_uri: options.post_logout_redirect_uri
+ )
+ end_session_uri.to_s
+ end
+
+ private
+
+ def redirect_uri
+ uri = URI.parse(super)
+ uri.query = [uri.query, "after_action=#{params["after_action"]}"].compact.join("&") if params["after_action"].present?
+ uri.to_s
+ end
+ end
+ end
+end
diff --git a/spec/controllers/account_controller_spec.rb b/spec/controllers/account_controller_spec.rb
index 3758ce51..93a887fa 100644
--- a/spec/controllers/account_controller_spec.rb
+++ b/spec/controllers/account_controller_spec.rb
@@ -36,7 +36,7 @@ module Decidim
delete :destroy, session: { "omniauth.france_connect.end_session_uri" => "http://test-france-connect.fr/" }
expect(controller.current_user).to be_nil
- expect(controller).to redirect_to("http://test-france-connect.fr/")
+ expect(controller).to redirect_to("http://test.host/")
expect(session["flash"]["flashes"]["notice"]).to eq("Your account was successfully deleted.")
end
diff --git a/spec/controllers/sessions_controller_spec.rb b/spec/controllers/sessions_controller_spec.rb
index 4bf8d5f0..a0f374cd 100644
--- a/spec/controllers/sessions_controller_spec.rb
+++ b/spec/controllers/sessions_controller_spec.rb
@@ -134,7 +134,7 @@ module Devise
delete :destroy, session: { "omniauth.france_connect.end_session_uri" => "http://test-france-connect.fr/" }
expect(controller.current_user).to be_nil
- expect(controller).to redirect_to("http://test-france-connect.fr/")
+ expect(controller).to redirect_to("http://test.host/")
expect(session["flash"]["flashes"]["notice"]).to eq("Signed out successfully.")
end