Project

General

Profile

0001-idp_oidc-reduce-users-api-data-to-client-s-authorize.patch

Paul Marillonnet, 09 June 2022 06:12 PM

Download (3.8 KB)

View differences: 

Subject: [PATCH] idp_oidc: reduce users api data to client's authorized claims
 (#65943)


 src/authentic2_idp_oidc/apps.py |  7 +++++++
 tests/idp_oidc/test_api.py      | 26 ++++++++++++++++++++------
 2 files changed, 27 insertions(+), 6 deletions(-)
src/authentic2_idp_oidc/apps.py
146 146 
                    request.unknown_uuids.append(u)
147 147 
            serializer.validated_data['known_uuids'] = new_known_uuids
148 148 
        elif serializer.__class__.__name__ == 'ListSerializer' and 'claim_resolution' in view.request.GET:
149 
            allowed_attrs = ['sub'] + list(
150 
                OIDCClaim.objects.filter(client=client).values_list('name', flat=True)
151 
            )
149 152 
            for user_dict in serializer.data:
150 153 
                context = user_dict.copy()
151 154 
                for claim in OIDCClaim.objects.filter(client=client):
......
154 157 
                        template = Template(claim.value)
155 158 
                        value = template.render(context=context)
156 159 
                    user_dict[claim.name] = value
160 
                copied_dict = user_dict.copy()
161 
                for attr in copied_dict.keys():
162 
                    if attr not in allowed_attrs:
163 
                        user_dict.pop(attr)
157 164 

  		




  158
  165
  
    
    def a2_hook_api_modify_response(self, view, method_name, data):

  		




  159
  166
  
    
        """Reverse mapping applied in a2_hook_api_modify_serializer_after_validation using the

  		












  

    
      tests/idp_oidc/test_api.py
    
  





  75
  75
  
    
        client=oidc_client,

  		




  76
  76
  
    
    )

  		




  77
  77
  
    

  		




  78
  
  
    
    users = [User.objects.create(username=f'user-{i}', last_name=f'Name-{i}') for i in range(10)]

  		




  
  78
  
    
    users = [

  		




  
  79
  
    
        User.objects.create(username=f'user-{i}', last_name=f'Name-{i}', email=f'name-{i}@plain.nowhere.null')

  		




  
  80
  
    
        for i in range(10)

  		




  
  81
  
    
    ]

  		




  79
  82
  
    
    expired = now() + timedelta(hours=1)

  		




  80
  83
  
    
    for user in users:

  		




  81
  84
  
    
        OIDCAuthorization.objects.create(

  		




  ......




  104
  107
  
    
    )

  		




  105
  108
  
    

  		




  106
  109
  
    
    for user_dict in random.choices(response.json['results'], k=3):

  		




  107
  
  
    
        assert user_dict['last_name']

  		




  108
  110
  
    
        assert user_dict['family_name'].startswith('Templated')

  		




  109
  
  
    
        assert user_dict['family_name'].endswith(user_dict['last_name'])

  		




  
  111
  
    
        assert 'Name' in user_dict['family_name']

  		




  110
  112
  
    

  		




  111
  
  
    
        assert user_dict['first_name']

  		




  112
  113
  
    
        assert user_dict['given_name'].startswith('Templated')

  		




  113
  
  
    
        assert user_dict['given_name'].endswith(user_dict['first_name'])

  		




  
  114
  
    
        assert 'User' in user_dict['given_name']

  		




  114
  115
  
    

  		




  115
  116
  
    
        assert user_dict['email']

  		




  116
  
  
    
        assert user_dict['email'].startswith(user_dict['last_name'])

  		




  
  117
  
    
        assert 'Name' in user_dict['email']

  		




  117
  118
  
    
        assert user_dict['email'].endswith('@templated.nowhere.null')

  		




  118
  119
  
    

  		




  
  120
  
    
    response = app.get(

  		




  
  121
  
    
        f'/api/users/?modified__gt={pre_modification}',

  		




  
  122
  
    
        status=200,

  		




  
  123
  
    
    )

  		




  
  124
  
    

  		




  
  125
  
    
    for user_dict in random.choices(response.json['results'], k=3):

  		




  
  126
  
    
        assert user_dict['last_name']

  		




  
  127
  
    
        assert 'family_name' not in user_dict

  		




  
  128
  
    
        assert user_dict['first_name']

  		




  
  129
  
    
        assert 'given_name' not in user_dict

  		




  
  130
  
    
        assert user_dict['email']

  		




  
  131
  
    
        assert not user_dict['email'].endswith('@templated.nowhere.null')

  		




  
  132
  
    

  		




  119
  133
  
    

  		




  120
  134
  
    
def test_api_users_list_queryset_reduction(app, oidc_client):

  		




  121
  135
  
    
    oidc_client.has_api_access = True

  		




  122
  
  
    
-