Merge pull request #11 from qld-gov-au/develop

Merge Development, QOLDEV-1017, QOLSVC-9904, cache fix

Author: duttonw

.github/workflows/test.yml

@@ -1,3 +1,4 @@
+---
 name: Tests
 on:
   push:
@@ -6,21 +7,37 @@ on:
       - master
 
 jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.10'
+      - name: Install requirements
+        run: pip install flake8 pycodestyle
+      - name: Check syntax
+        run: flake8
+
   test:
+    needs: lint
     strategy:
-      matrix:
-        ckan-version: ["2.10", 2.9]
       fail-fast: false
+      matrix:
+        ckan-version: ["2.11", "2.10", 2.9]
+        experimental: [false]
+        include:
+          - ckan-version: 'master'
+            experimental: true  #master is unstable, good to know if we are compatible or not
 
+    name: Test on CKAN ${{ matrix.ckan-version }}
     runs-on: ubuntu-latest
     container:
-      # The CKAN version tag of the Solr and Postgres containers should match
-      # the one of the container the tests run on.
-      # You can switch this base image with a custom image tailored to your project
-      image: openknowledge/ckan-dev:${{ matrix.ckan-version }}
+      image: ckan/ckan-dev:${{ matrix.ckan-version }}
+      options: --user root
     services:
       solr:
-        image: ckan/ckan-solr:${{ matrix.ckan-version }}
+        image: ckan/ckan-solr:${{ matrix.ckan-version }}-solr9
       postgres:
         image: ckan/ckan-postgres-dev:${{ matrix.ckan-version }}
         env:
@@ -30,7 +47,6 @@ jobs:
         options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
       redis:
           image: redis:3
-
     env:
       CKAN_SQLALCHEMY_URL: postgresql://ckan_default:pass@postgres/ckan_test
       CKAN_DATASTORE_WRITE_URL: postgresql://datastore_write:pass@postgres/datastore_test
@@ -39,25 +55,35 @@ jobs:
       CKAN_REDIS_URL: redis://redis:6379/1
 
     steps:
-    - uses: actions/checkout@v4
-
-    - name: Install lint requirements
-      run: pip install flake8 pycodestyle
-    - name: Check syntax
-      run: flake8
-
-    - name: Install requirements
-      # Install any extra requirements your extension has here (dev requirements, other extensions etc)
-      run: |
-        pip install -r requirements.txt
-        pip install -r dev-requirements.txt
-        pip install -e .
-    - name: Setup extension
-      # Extra initialization steps
-      run: |
-        # Replace default path to CKAN core config file with the one on the container
-        sed -i -e 's/use = config:.*/use = config:\/srv\/app\/src\/ckan\/test-core.ini/' test.ini
-
-        ckan -c test.ini db init
-    - name: Run tests
-      run: pytest --ckan-ini=test.ini --cov=ckanext.oidc_pkce --disable-warnings ckanext/oidc_pkce
+      - uses: actions/checkout@v4
+        continue-on-error: ${{ matrix.experimental }}
+
+      - if: ${{ matrix.ckan-version == 2.9 }}
+        continue-on-error: ${{ matrix.experimental }}
+        run: pip install "setuptools>=44.1.0,<71"
+      - name: Install requirements
+        continue-on-error: ${{ matrix.experimental }}
+        # Install any extra requirements your extension has here (dev requirements, other extensions etc)
+        run: |
+          pip install -r requirements.txt
+          pip install -r dev-requirements.txt
+          pip install -e .
+
+      - name: Setup extension
+        continue-on-error: ${{ matrix.experimental }}
+        # Extra initialization steps
+        run: |
+          # Replace default path to CKAN core config file with the one on the container
+          sed -i -e 's/use = config:.*/use = config:\/srv\/app\/src\/ckan\/test-core.ini/' test.ini
+          ckan -c test.ini db init
+
+      - name: Run tests
+        continue-on-error: ${{ matrix.experimental }}
+        run: pytest --ckan-ini=test.ini --cov=ckanext.oidc_pkce --disable-warnings ckanext/oidc_pkce --junit-xml=/tmp/artifacts/junit/results.xml
+
+      - name: Test Summary
+        uses: test-summary/action@v2
+        continue-on-error: ${{ matrix.experimental }}
+        with:
+          paths: "/tmp/artifacts/junit/*.xml"
+        if: always()

ckanext/oidc_pkce/templates/user/login.html

@@ -4,11 +4,15 @@
 #}
 
 {% block form %}
+    {% block sso_form %}
     <p><a href="{{ h.url_for('user.login') }}/oidc-pkce" class="btn btn-primary"><i class="fa fa-sign-in"></i> Log in via single sign-on</a></p>
+    {% endblock %}
     {{ super() }}
 {% endblock %}
 
 {% block help_register_button %}
     {{ super() }}
+    {% block sso_help_register %}
     <a href="{{ h.url_for('user.login') }}/oidc-pkce" class="btn btn-secondary">Register via single sign-on</a>
+    {% endblock %}
 {% endblock %}

ckanext/oidc_pkce/views.py

@@ -8,7 +8,8 @@
 from flask import Blueprint
 
 import ckan.plugins.toolkit as tk
-from ckan.common import session
+from ckan.plugins.toolkit import request
+from ckan.common import session  # flask.session
 from ckan.plugins import PluginImplementations
 
 from . import config, utils
@@ -29,8 +30,17 @@ def get_blueprints():
     return [bp]
 
 
+def _no_cache():
+    # Ensure auth pages are not public cached
+    # Alternative way, generate anon user from ckan.common import current_user
+    request.environ[u'__no_cache__'] = True
+    # Flag that should soon be in ckan to disable cache-control: private
+    request.environ[u'__no_private_cache__'] = True
+
+
 @bp.route("/user/login/oidc-pkce")
 def login():
+    _no_cache()
     verifier = utils.code_verifier()
     state = utils.app_state()
     session[SESSION_VERIFIER] = verifier
@@ -61,6 +71,7 @@ def login():
 
 
 def callback():
+    _no_cache()
     # TODO: check state
     error = tk.request.args.get("error")
     state = tk.request.args.get("state")
@@ -82,7 +93,7 @@ def callback():
             error = "The app state does not match"
 
     if error:
-        log.error(f"Error: {error}")
+        log.error("Error: %s", error)
         session[SESSION_ERROR] = error
         return tk.redirect_to(came_from)
 

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ckanext-oidc-pkce"
-version = "0.3.1.post1"
+version = "0.4.0"
 description = "CKAN OIDC authenticator with PKCE flow"
 classifiers = [ "Development Status :: 4 - Beta", "License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)", "Programming Language :: Python :: 3.7", "Programming Language :: Python :: 3.8", "Programming Language :: Python :: 3.9", "Programming Language :: Python :: 3.10",]
 keywords = [ "CKAN", "Okta", "oidc", "pkce", "authentication",]

setup.cfg

@@ -1,3 +1,6 @@
+[options]
+namespace_packages = ckanext
+
 [extract_messages]
 keywords = translate isPlural
 add_comments = TRANSLATORS:

test.ini

@@ -10,6 +10,8 @@ use = config:../ckan/test-core.ini
 # tests here. These will override the one defined in CKAN core's test-core.ini
 ckan.plugins = oidc_pkce
 
+ckanext.oidc_pkce.base_url = http://unit-test
+ckanext.oidc_pkce.client_id = unit-test
 
 # Logging configuration
 [loggers]