feat: 🎸 roll out OIDC to desktop

2021-04-12 18:10:08 -04:00
1 parent 5f342a0ee8
commit 586a4dbe23
@@ -0,0 +1,18 @@
+import Controller from '@ember/controller';
+import { inject as service } from '@ember/service';
+
+export default class ScopesScopeAuthenticateMethodOidcController extends Controller {
+  // =services
+
+  @service session;
+
+  // =attributes
+
+  /**
+   * Authetnication URL for the pending OIDC flow, if any.
+   * @type {?string}
+   */
+  get authURL() {
+    return this.session.data.pending.oidc.attributes.auth_url;
+  }
+}
@@ -10,7 +10,9 @@ Router.map(function () {
  this.route('scopes', function () {
    this.route('scope', { path: ':scope_id' }, function () {
      this.route('authenticate', function () {
-        this.route('method', { path: ':auth_method_id' });
+        this.route('method', { path: ':auth_method_id' }, function () {
+          this.route('oidc');
+        });
      });
      this.route('projects', function () {
        this.route('targets', function () {
@@ -1,5 +1,6 @@
 import Route from '@ember/routing/route';
 import { inject as service } from '@ember/service';
+import { getOwner } from '@ember/application';
 import { action } from '@ember/object';
 import loading from 'ember-loading/decorator';
 import { notifyError } from 'core/decorators/notify';
@@ -9,6 +10,7 @@ export default class ScopesScopeAuthenticateMethodRoute extends Route {

  @service session;
  @service notify;
+  @service ipc;
  @service intl;

  // =methods
@@ -23,6 +25,26 @@ export default class ScopesScopeAuthenticateMethodRoute extends Route {
    return this.store.findRecord('auth-method', id, adapterOptions);
  }

+  /**
+   *
+   */
+  async startOIDCAuthentication(authenticatorName, options) {
+    const oidc = getOwner(this).lookup(authenticatorName);
+    // TODO: delegate this call from the session service so that we don't have
+    // to look up the authenticator directly
+    const json = await oidc.startAuthentication(options);
+    await this.openExternalOIDCFlow(json.attributes.auth_url);
+  }
+
+  /**
+   * Opens the specified URL in a new tab or window.  By default this uses
+   * `window.open`, but may be overriden.
+   * @param {string} url
+   */
+  async openExternalOIDCFlow(url) {
+    await this.ipc.invoke('openExternal', url);
+  }
+
  // =actions

  /**
@@ -37,10 +59,23 @@ export default class ScopesScopeAuthenticateMethodRoute extends Route {
    const authMethod = this.modelFor('scopes.scope.authenticate.method');
    const authenticatorName = `authenticator:${authMethod.type}`;
    const requestCookies = false;
-    await this.session.authenticate(authenticatorName, creds, requestCookies, {
-      scope,
-      authMethod,
-    });
-    this.replaceWith('index');
+    switch (authMethod.type) {
+      case 'password':
+        await this.session.authenticate(
+          authenticatorName,
+          creds,
+          requestCookies,
+          { scope, authMethod }
+        );
+        this.transitionTo('index');
+        break;
+      case 'oidc':
+        await this.startOIDCAuthentication(authenticatorName, {
+          scope,
+          authMethod,
+        });
+        this.transitionTo('scopes.scope.authenticate.method.oidc');
+        break;
+    }
  }
 }
@@ -0,0 +1,3 @@
+import Route from '@ember/routing/route';
+
+export default class ScopesScopeAuthenticateMethodIndexRoute extends Route {}
@@ -0,0 +1,82 @@
+import Route from '@ember/routing/route';
+import { getOwner } from '@ember/application';
+import { inject as service } from '@ember/service';
+import { task, timeout } from 'ember-concurrency';
+import { action } from '@ember/object';
+import { notifyError } from 'core/decorators/notify';
+import config from '../../../../../config/environment';
+
+const POLL_TIMEOUT_SECONDS = config.oidcPollingTimeoutSeconds;
+
+export default class ScopesScopeAuthenticateMethodOidcRoute extends Route {
+
+  // =services
+
+  @service session;
+
+  // =attributes
+
+  /**
+   * A simple Ember Concurrency-based polling task that refreshes the route
+   * every POLL_TIMEOUT_SECONDS seconds.  This is necessary to display changes
+   * to session `status` that may occur.
+   *
+   * NOTE:  tasks are sort of attributes and sort of methods, but they are not
+   * language-level constructs.  Thus we annotate this task as if it
+   * is an attribute.
+   * @type {Task}
+   */
+  @task(function * () {
+    while(!this.session.isAuthenticated) {
+      yield timeout(POLL_TIMEOUT_SECONDS * 1000);
+      yield this.refresh();
+    }
+  /* eslint-disable-next-line prettier/prettier */
+  }).drop() poller;
+
+  // =methods
+
+  model() {
+    const scope = this.modelFor('scopes.scope');
+    const authMethod = this.modelFor('scopes.scope.authenticate.method');
+    const authenticatorName = `authenticator:${authMethod.type}`;
+    const oidc = getOwner(this).lookup(authenticatorName);
+    // TODO: delegate this call from the session service so that we don't have
+    // to look up the authenticator directly
+    return oidc.attemptFetchToken({ scope, authMethod });
+  }
+
+  /**
+   * If authenticated, redirects to index for further processing.
+   */
+  redirect() {
+    if (this.session.isAuthenticated) this.replaceWith('index');
+  }
+
+  /**
+   * When this route is activated (entered), begin polling for changes.
+   */
+  activate() {
+    this.poller.perform();
+  }
+
+  /**
+   * When this route is deactivated (exited), stop polling for changes.
+   */
+  deactivate() {
+    this.poller.cancelAll();
+  }
+
+  /**
+   * An error in this route indicates authentication failed.  The user is
+   * notified and returned to the index.
+   */
+  @action
+  @notifyError(() => 'errors.authentication-failed.title', { catch: true })
+  error(e) {
+    this.transitionTo('scopes.scope.authenticate.method.index');
+    // rethrow the error to activate the notifyError decorator
+    throw e;
+  }
+
+}
@@ -1,17 +1 @@
-{{#if (feature-flag 'oidc')}}
-  {{! OIDC enabled:  show form for any auth method}}
-  <Form::Authenticate
-    @model={{@model}}
-    @submit={{route-action "authenticate"}}
-    @disabled={{is-loading}}
-  />
-{{else}}
-  {{! OIDC disabled:  hide OIDC auth form}}
-  {{#unless @model.isOIDC}}
-    <Form::Authenticate
-      @model={{@model}}
-      @submit={{route-action "authenticate"}}
-      @disabled={{is-loading}}
-    />
-  {{/unless}}
-{{/if}}
+{{outlet}}
@@ -0,0 +1,17 @@
+{{#if (feature-flag 'oidc')}}
+  {{! OIDC enabled:  show form for any auth method}}
+  <Form::Authenticate
+    @model={{@model}}
+    @submit={{route-action "authenticate"}}
+    @disabled={{is-loading}}
+  />
+{{else}}
+  {{! OIDC disabled:  hide OIDC auth form}}
+  {{#unless @model.isOIDC}}
+    <Form::Authenticate
+      @model={{@model}}
+      @submit={{route-action "authenticate"}}
+      @disabled={{is-loading}}
+    />
+  {{/unless}}
+{{/if}}
@@ -0,0 +1,23 @@
+<Rose::Dialog::Cover>
+  <:header>
+    <h1>{{t 'resources.auth-method.messages.pending.title'}}</h1>
+  </:header>
+  <:body>
+    <p>{{t 'resources.auth-method.messages.pending.description'}}</p>
+    <p>
+      {{t 'resources.auth-method.questions.no-see-window'}}
+      <a
+        href="{{this.authURL}}"
+        target="_blank"
+        rel="noreferrer noopener"
+      >
+        {{t 'actions.retry'}}
+      </a>
+    </p>
+    <p>
+      <LinkTo @route="scopes.scope.authenticate.method">
+        {{t 'actions.cancel'}}
+      </LinkTo>
+    </p>
+  </:body>
+</Rose::Dialog::Cover>
@@ -44,6 +44,7 @@ module.exports = function (environment) {

    notifyTimeout: 4000,
    sessionPollingTimeoutSeconds: 2.5,
+    oidcPollingTimeoutSeconds: 1,

    documentation: {
      baseURL: 'https://boundaryproject.io/help/desktop',
@@ -1,4 +1,5 @@
 const { shell } = require('electron');
+const isDev = require('electron-is-dev');
 const handle = require('./ipc-handler');
 const boundaryCli = require('./boundary-cli');
 const origin = require('./origin.js');
@@ -26,10 +27,11 @@ handle('resetOrigin', async (requestOrigin) => {
 });

 /**
- * Opens the specified URL in an external browser.  Only HTTPS URLs are allowed.
+ * Opens the specified URL in an external browser.  Only HTTPS URLs are allowed,
+ * except in development where all protocols are allowed.
 */
 handle('openExternal', async (href) => {
-  if (href.startsWith('https://')) {
+  if (href.startsWith('https://') || isDev) {
    // openExternal is necessary in order to display documentation and to
    // support arbitrary OIDC flows.  The protocol is validated.
    shell.openExternal(href); /* eng-disable OPEN_EXTERNAL_JS_CHECK */
@@ -36,6 +36,9 @@
    "postinstall": "cd electron-app && yarn install",
    "posttest": "ember coverage-merge && yarn clean:coverage"
  },
+  "dependencies": {
+    "ember-named-blocks-polyfill": "^0.2.4"
+  },
  "devDependencies": {
    "@doyensec/electronegativity": "^1.8.1",
    "@ember/jquery": "^1.1.0",
@@ -87,9 +87,11 @@ module('Acceptance | authentication', function (hooks) {
    // create other resources
    instances.authMethods.global = this.server.create('auth-method', {
      scope: instances.scopes.global,
+      type: 'password',
    });
    instances.authMethods.org = this.server.create('auth-method', {
      scope: instances.scopes.org,
+      type: 'password',
    });

    urls.scopes.global = `/scopes/${instances.scopes.global.id}`;
@@ -0,0 +1,17 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+
+module(
+  'Unit | Controller | scopes/scope/authenticate/method/oidc',
+  function (hooks) {
+    setupTest(hooks);
+
+    // TODO: Replace this with your real tests.
+    test('it exists', function (assert) {
+      let controller = this.owner.lookup(
+        'controller:scopes/scope/authenticate/method/oidc'
+      );
+      assert.ok(controller);
+    });
+  }
+);
@@ -0,0 +1,16 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+
+module(
+  'Unit | Route | scopes/scope/authenticate/method/index',
+  function (hooks) {
+    setupTest(hooks);
+
+    test('it exists', function (assert) {
+      let route = this.owner.lookup(
+        'route:scopes/scope/authenticate/method/index'
+      );
+      assert.ok(route);
+    });
+  }
+);
@@ -0,0 +1,16 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+
+module(
+  'Unit | Route | scopes/scope/authenticate/method/oidc',
+  function (hooks) {
+    setupTest(hooks);
+
+    test('it exists', function (assert) {
+      let route = this.owner.lookup(
+        'route:scopes/scope/authenticate/method/oidc'
+      );
+      assert.ok(route);
+    });
+  }
+);
@@ -7571,7 +7571,7 @@ debug@~4.1.0:
  dependencies:
    ms "^2.1.1"

-debuglog@*, debuglog@^1.0.1:
+debuglog@^1.0.1:
  version "1.0.1"
  resolved "https://registry.yarnpkg.com/debuglog/-/debuglog-1.0.1.tgz#aa24ffb9ac3df9a2351837cfb2d279360cd78492"
  integrity sha1-qiT/uaw9+aI1GDfPstJ5NgzXhJI=
@@ -12336,7 +12336,7 @@ import-lazy@^4.0.0:
  resolved "https://registry.yarnpkg.com/import-lazy/-/import-lazy-4.0.0.tgz#e8eb627483a0a43da3c03f3e35548be5cb0cc153"
  integrity sha512-rKtvo6a868b5Hu3heneU+L4yEQ4jYKLtjpnPeUdK7h0yzXGmyBTypknlkCvHFBqfX9YlorEiMM6Dnq/5atfHkw==

-imurmurhash@*, imurmurhash@^0.1.4:
+imurmurhash@^0.1.4:
  version "0.1.4"
  resolved "https://registry.yarnpkg.com/imurmurhash/-/imurmurhash-0.1.4.tgz#9218b9b2b928a238b13dc4fb6b6d576f231453ea"
  integrity sha1-khi5srkoojixPcT7a21XbyMUU+o=
@@ -14034,11 +14034,6 @@ lodash._baseflatten@^3.0.0:
    lodash.isarguments "^3.0.0"
    lodash.isarray "^3.0.0"

-lodash._baseindexof@*:
-  version "3.1.0"
-  resolved "https://registry.yarnpkg.com/lodash._baseindexof/-/lodash._baseindexof-3.1.0.tgz#fe52b53a1c6761e42618d654e4a25789ed61822c"
-  integrity sha1-/lK1OhxnYeQmGNZU5KJXie1hgiw=
-
 lodash._baseuniq@~4.6.0:
  version "4.6.0"
  resolved "https://registry.yarnpkg.com/lodash._baseuniq/-/lodash._baseuniq-4.6.0.tgz#0ebb44e456814af7905c6212fa2c9b2d51b841e8"
@@ -14047,16 +14042,11 @@ lodash._baseuniq@~4.6.0:
    lodash._createset "~4.0.0"
    lodash._root "~3.0.0"

-lodash._bindcallback@*, lodash._bindcallback@^3.0.0:
+lodash._bindcallback@^3.0.0:
  version "3.0.1"
  resolved "https://registry.yarnpkg.com/lodash._bindcallback/-/lodash._bindcallback-3.0.1.tgz#e531c27644cf8b57a99e17ed95b35c748789392e"
  integrity sha1-5THCdkTPi1epnhftlbNcdIeJOS4=

-lodash._cacheindexof@*:
-  version "3.0.2"
-  resolved "https://registry.yarnpkg.com/lodash._cacheindexof/-/lodash._cacheindexof-3.0.2.tgz#3dc69ac82498d2ee5e3ce56091bafd2adc7bde92"
-  integrity sha1-PcaayCSY0u5ePOVgkbr9Ktx73pI=
-
 lodash._createassigner@^3.0.0:
  version "3.1.1"
  resolved "https://registry.yarnpkg.com/lodash._createassigner/-/lodash._createassigner-3.1.1.tgz#838a5bae2fdaca63ac22dee8e19fa4e6d6970b11"
@@ -14066,19 +14056,12 @@ lodash._createassigner@^3.0.0:
    lodash._isiterateecall "^3.0.0"
    lodash.restparam "^3.0.0"

-lodash._createcache@*:
-  version "3.1.2"
-  resolved "https://registry.yarnpkg.com/lodash._createcache/-/lodash._createcache-3.1.2.tgz#56d6a064017625e79ebca6b8018e17440bdcf093"
-  integrity sha1-VtagZAF2JeeevKa4AY4XRAvc8JM=
-  dependencies:
-    lodash._getnative "^3.0.0"
-
 lodash._createset@~4.0.0:
  version "4.0.3"
  resolved "https://registry.yarnpkg.com/lodash._createset/-/lodash._createset-4.0.3.tgz#0f4659fbb09d75194fa9e2b88a6644d363c9fe26"
  integrity sha1-D0ZZ+7CddRlPqeK4imZE02PJ/iY=

-lodash._getnative@*, lodash._getnative@^3.0.0:
+lodash._getnative@^3.0.0:
  version "3.9.1"
  resolved "https://registry.yarnpkg.com/lodash._getnative/-/lodash._getnative-3.9.1.tgz#570bc7dede46d61cdcde687d65d3eecbaa3aaff5"
  integrity sha1-VwvH3t5G1hzc3mh9ZdPuy6o6r/U=
@@ -14296,7 +14279,7 @@ lodash.pick@^4.4.0:
  resolved "https://registry.yarnpkg.com/lodash.pick/-/lodash.pick-4.4.0.tgz#52f05610fff9ded422611441ed1fc123a03001b3"
  integrity sha1-UvBWEP/53tQiYRRB7R/BI6AwAbM=

-lodash.restparam@*, lodash.restparam@^3.0.0:
+lodash.restparam@^3.0.0:
  version "3.6.1"
  resolved "https://registry.yarnpkg.com/lodash.restparam/-/lodash.restparam-3.6.1.tgz#936a4e309ef330a7645ed4145986c85ae5b20805"
  integrity sha1-k2pOMJ7zMKdkXtQUWYbIWuWyCAU=