From a6fcaa1640e88bf8c303185b9875a6440b06bc86 Mon Sep 17 00:00:00 2001 From: carla Date: Wed, 18 Jun 2025 09:31:47 +0200 Subject: [PATCH] feaut(oicd_provider): added oicd provider rauthy and strategy for authentication --- config/dev.exs | 2 + docker-compose.yml | 40 ++- lib/accounts/user.ex | 33 ++- lib/accounts/user_identity.exs | 15 + lib/mv_web/controllers/auth_controller.ex | 2 + .../controllers/page_html/home.html.heex | 262 +++--------------- lib/mv_web/member_live/index.ex | 2 - lib/mv_web/router.ex | 32 ++- 8 files changed, 147 insertions(+), 241 deletions(-) create mode 100644 lib/accounts/user_identity.exs diff --git a/config/dev.exs b/config/dev.exs index 9ef39db..cf6694d 100644 --- a/config/dev.exs +++ b/config/dev.exs @@ -89,3 +89,5 @@ config :mv, :secret_key_base, "ryn7D6ssmIHQFWIks2sFiTGATgwwAR1+3bN8p7fy6qVtB8qnx # Signing Secret for Authentication config :mv, :token_signing_secret, "IwUwi65TrEeExwBXXFPGm2I7889NsL" + +config :mv, :oicd_client_secret , "krkpCYuLtaXUdQDcStaOQRBcfDSRvPdvpmllkraNRStBYMLXgXRlcTxoRkVDrLYv" diff --git a/docker-compose.yml b/docker-compose.yml index 3b4e8ec..03f0366 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,3 +1,10 @@ +version: "3.5" + +networks: + local: + rauthy-test: + driver: bridge + services: db: image: postgres:17.5-alpine @@ -16,8 +23,37 @@ services: networks: - local -networks: - local: + mailcrab: + image: marlonb/mailcrab:latest + ports: + - "1080:1080" + networks: + - rauthy-test + + + rauthy: + container_name: rauthy-test + image: ghcr.io/sebadob/rauthy:latest + environment: + - LOCAL_TEST=true + - SMTP_URL=mailcrab + - SMTP_PORT=1025 + - SMTP_DANGER_INSECURE=true + - BOOTSTRAP_ADMIN_PASSWORD_PLAIN="RAUTHY" + #- HIQLITE=false + #- PG_HOST=db + #- PG_PORT=5432 + #- PG_USER=postgres + #- PG_PASSWORD=postgres + #- PG_DB_NAME=mv_dev + ports: + - "8080:8080" + depends_on: + - mailcrab + - db + networks: + - rauthy-test + - local volumes: postgres-data: diff --git a/lib/accounts/user.ex b/lib/accounts/user.ex index f07a57f..930bc0d 100644 --- a/lib/accounts/user.ex +++ b/lib/accounts/user.ex @@ -21,6 +21,22 @@ defmodule Mv.Accounts.User do end strategies do + oidc :rauthy do + client_id "mv" + base_url "http://localhost:8080/auth/v1" + redirect_uri "http://localhost:4000/auth/user/rauthy/callback" + auth_method :client_secret_jwt + #id_token_signed_response_alg "EdDSA" + #user_url "http://localhost:8080/auth/v1/oidc/userinfo" + #token_url "http://localhost:8080/auth/v1/oidc/token" + #authorize_url "http://localhost:8080/auth/v1/oidc/authorize" + registration_enabled? false + code_verifier true + client_secret fn _, _ -> + Application.fetch_env(:mv, :oicd_client_secret) + end + end + password :password do identity_field :email hash_provider AshAuthentication.BcryptProvider @@ -39,21 +55,23 @@ defmodule Mv.Accounts.User do prepare AshAuthentication.Preparations.FilterBySubject end - # read :sign_in_with_example do - # argument :user_info, :map, allow_nil?: false - # argument :oauth_tokens, :map, allow_nil?: false - # prepare AshAuthentication.Strategy.OAuth2.SignInPreparation + read :sign_in_with_rauthy do + argument :user_info, :map, allow_nil?: false + argument :oauth_tokens, :map, allow_nil?: false + prepare AshAuthentication.Strategy.OAuth2.SignInPreparation - # filter expr(email == get_path(^arg(:user_info), [:email])) - # end + filter expr(email == get_path(^arg(:user_info), [:email])) + end end + ## TODO: registration ergänzen, seed rausnehmen, oidc_id aus user_info map holen + attributes do uuid_primary_key :id attribute :email, :ci_string, allow_nil?: false, public?: true attribute :hashed_password, :string, sensitive?: true, allow_nil?: true - attribute :oicd_id, :string, allow_nil?: true + attribute :oidc_id, :string, allow_nil?: true end relationships do @@ -62,6 +80,7 @@ defmodule Mv.Accounts.User do identities do identity :unique_email, [:email] + identity :unique_oidc_id, [:oidc_id] end # You can customize this if you wish, but this is a safe default that diff --git a/lib/accounts/user_identity.exs b/lib/accounts/user_identity.exs new file mode 100644 index 0000000..1fe54f8 --- /dev/null +++ b/lib/accounts/user_identity.exs @@ -0,0 +1,15 @@ +defmodule Mv.Accounts.UserIdentity do + use Ash.Resource, + data_layer: AshPostgres.DataLayer, + extensions: [AshAuthentication.UserIdentity], + domain: Mv.Accounts + + user_identity do + user_resource Mv.Accounts.User + end + + postgres do + table "user_identities" + repo Mv.Repo + end +end diff --git a/lib/mv_web/controllers/auth_controller.ex b/lib/mv_web/controllers/auth_controller.ex index 913bc4b..f3dd287 100644 --- a/lib/mv_web/controllers/auth_controller.ex +++ b/lib/mv_web/controllers/auth_controller.ex @@ -22,6 +22,8 @@ defmodule MvWeb.AuthController do end def failure(conn, activity, reason) do + IO.puts(inspect(reason)) + message = case {activity, reason} do {_, diff --git a/lib/mv_web/controllers/page_html/home.html.heex b/lib/mv_web/controllers/page_html/home.html.heex index d72b03c..8cf0506 100644 --- a/lib/mv_web/controllers/page_html/home.html.heex +++ b/lib/mv_web/controllers/page_html/home.html.heex @@ -1,222 +1,52 @@ -<.flash_group flash={@flash} /> - -
-
- -

- Phoenix Framework - - v{Application.spec(:phoenix, :vsn)} - -

-

- Peace of mind from prototype to production. -

-

- Build rich, interactive web applications quickly, with less code and fewer moving parts. Join our growing community of developers using Phoenix to craft APIs, HTML5 apps and more, for fun or at scale. -

-
-
-
- - - - - - Guides & Docs - - - - - - - - Source Code - - - - - - - - Changelog - - -
-
- - - - -
- - - Deploy your application - + + +
+
+
+

+ Demo +

+
+
+
+
+
+
+
+
+
diff --git a/lib/mv_web/member_live/index.ex b/lib/mv_web/member_live/index.ex index 5bd82b5..452ebab 100644 --- a/lib/mv_web/member_live/index.ex +++ b/lib/mv_web/member_live/index.ex @@ -1,8 +1,6 @@ defmodule MvWeb.MemberLive.Index do use MvWeb, :live_view - on_mount {MvWeb.LiveUserAuth, :live_user_required} - @impl true def render(assigns) do ~H""" diff --git a/lib/mv_web/router.ex b/lib/mv_web/router.ex index 2c82607..e4be8e1 100644 --- a/lib/mv_web/router.ex +++ b/lib/mv_web/router.ex @@ -42,30 +42,34 @@ defmodule MvWeb.Router do scope "/", MvWeb do pipe_through :browser - get "/", PageController, :home + ash_authentication_live_session :authentication_required, + on_mount: {MvWeb.LiveUserAuth, :live_user_required} do + + get "/", PageController, :home - ash_authentication_live_session :session_name do live "/members", MemberLive.Index, :index live "/members/new", MemberLive.Index, :new live "/members/:id/edit", MemberLive.Index, :edit live "/members/:id", MemberLive.Show, :show live "/members/:id/show/edit", MemberLive.Show, :edit - end + live "/property_types", PropertyTypeLive.Index, :index + live "/property_types/new", PropertyTypeLive.Index, :new + live "/property_types/:id/edit", PropertyTypeLive.Index, :edit + live "/property_types/:id", PropertyTypeLive.Show, :show + live "/property_types/:id/show/edit", PropertyTypeLive.Show, :edit - live "/property_types", PropertyTypeLive.Index, :index - live "/property_types/new", PropertyTypeLive.Index, :new - live "/property_types/:id/edit", PropertyTypeLive.Index, :edit - live "/property_types/:id", PropertyTypeLive.Show, :show - live "/property_types/:id/show/edit", PropertyTypeLive.Show, :edit - - live "/properties", PropertyLive.Index, :index - live "/properties/new", PropertyLive.Index, :new - live "/properties/:id/edit", PropertyLive.Index, :edit - live "/properties/:id", PropertyLive.Show, :show - live "/properties/:id/show/edit", PropertyLive.Show, :edit + live "/properties", PropertyLive.Index, :index + live "/properties/new", PropertyLive.Index, :new + live "/properties/:id/edit", PropertyLive.Index, :edit + live "/properties/:id", PropertyLive.Show, :show + live "/properties/:id/show/edit", PropertyLive.Show, :edit post "/set_locale", LocaleController, :set_locale + + end + + # ASHAUTHENTICATION GENERATED AUTH ROUTES auth_routes AuthController, Mv.Accounts.User, path: "/auth" sign_out_route AuthController