azure_oauth2_spec.rb

require 'spec_helper'
require 'omniauth-azure-oauth2'

module OmniAuth
  module Strategies
    module JWT; end
  end
end

describe OmniAuth::Strategies::AzureOauth2 do
  let(:request) { double('Request', :params => {}, :cookies => {}, :env => {}) }
  let(:app) {
    lambda do
      [200, {}, ["Hello."]]
    end
  }

  before do
    OmniAuth.config.test_mode = true
  end

  after do
    OmniAuth.config.test_mode = false
  end

  describe 'static configuration' do
    let(:options) { @options || {} }
    subject do
      OmniAuth::Strategies::AzureOauth2.new(app, {client_id: 'id', client_secret: 'secret', tenant_id: 'tenant'}.merge(options))
    end

    describe '#client' do
      it 'has correct authorize url' do
        allow(subject).to receive(:request) { request }
        expect(subject.client.options[:authorize_url]).to eql('https://login.microsoftonline.com/tenant/oauth2/authorize')
      end

      it 'has correct authorize params' do
        allow(subject).to receive(:request) { request }
        subject.client
        expect(subject.authorize_params[:domain_hint]).to be_nil
      end

      it 'has correct token url' do
        allow(subject).to receive(:request) { request }
        expect(subject.client.options[:token_url]).to eql('https://login.microsoftonline.com/tenant/oauth2/token')
      end

      describe "overrides" do
        it 'should override domain_hint' do
          @options = {domain_hint: 'hint'}
          allow(subject).to receive(:request) { request }
          subject.client
          expect(subject.authorize_params[:domain_hint]).to eql('hint')
        end
      end
    end

  end

  describe 'static configuration - german' do
    let(:options) { @options || {} }
    subject do
      OmniAuth::Strategies::AzureOauth2.new(app, {client_id: 'id', client_secret: 'secret', tenant_id: 'tenant', base_azure_url: 'https://login.microsoftonline.de'}.merge(options))
    end

    describe '#client' do
      it 'has correct authorize url' do
        allow(subject).to receive(:request) { request }
        expect(subject.client.options[:authorize_url]).to eql('https://login.microsoftonline.de/tenant/oauth2/authorize')
      end

      it 'has correct authorize params' do
        allow(subject).to receive(:request) { request }
        subject.client
        expect(subject.authorize_params[:domain_hint]).to be_nil
      end

      it 'has correct token url' do
        allow(subject).to receive(:request) { request }
        expect(subject.client.options[:token_url]).to eql('https://login.microsoftonline.de/tenant/oauth2/token')
      end

      it 'has correct token params' do
        allow(subject).to receive(:request) { request }
        subject.client
        expect(subject.token_params[:resource]).to eql('00000002-0000-0000-c000-000000000000')
      end

      describe "overrides" do
        it 'should override domain_hint' do
          @options = {domain_hint: 'hint'}
          allow(subject).to receive(:request) { request }
          subject.client
          expect(subject.authorize_params[:domain_hint]).to eql('hint')
        end
      end
    end
  end

  describe 'static common configuration' do
    let(:options) { @options || {} }
    subject do
      OmniAuth::Strategies::AzureOauth2.new(app, {client_id: 'id', client_secret: 'secret'}.merge(options))
    end

    before do
      allow(subject).to receive(:request) { request }
    end

    describe '#client' do
      it 'has correct authorize url' do
        expect(subject.client.options[:authorize_url]).to eql('https://login.microsoftonline.com/common/oauth2/authorize')
      end

      it 'has correct token url' do
        expect(subject.client.options[:token_url]).to eql('https://login.microsoftonline.com/common/oauth2/token')
      end
    end
  end

  describe 'static common configuration v2' do
    let(:options) { @options || {} }
    subject do
      OmniAuth::Strategies::AzureOauth2.new(app, {client_id: 'id', client_secret: 'secret', v2: true}.merge(options))
    end

    before do
      allow(subject).to receive(:request) { request }
    end

    describe '#client' do
      it 'has correct authorize url' do
        expect(subject.client.options[:authorize_url]).to eql('https://login.microsoftonline.com/common/oauth2/v2.0/authorize')
      end

      it 'has correct token url' do
        expect(subject.client.options[:token_url]).to eql('https://login.microsoftonline.com/common/oauth2/v2.0/token')
      end

      it 'has correct authorize params' do
        subject.client
        expect(subject.authorize_params[:scope]).to eql('User.Read')
        expect(subject.authorize_params[:resource]).to be_nil
      end

      it 'has correct token params' do
        subject.client
        expect(subject.token_params[:scope]).to eql('User.Read')
        expect(subject.token_params[:resource]).to be_nil
      end

      it 'has correct uid claim' do
        subject.client
        expect(subject.options[:uid_claim]).to eql('sub')
      end
    end
  end

  describe 'static custom configuration v2' do
    let(:options) { @options || {} }
    subject do
      OmniAuth::Strategies::AzureOauth2.new(app, {client_id: 'id', client_secret: 'secret', v2: true, uid_claim: 'oid'}.merge(options))
    end

    before do
      allow(subject).to receive(:request) { request }
    end

    describe '#client' do
      it 'has correct authorize url' do
        expect(subject.client.options[:authorize_url]).to eql('https://login.microsoftonline.com/common/oauth2/v2.0/authorize')
      end

      it 'has correct token url' do
        expect(subject.client.options[:token_url]).to eql('https://login.microsoftonline.com/common/oauth2/v2.0/token')
      end

      it 'has correct authorize params' do
        subject.client
        puts subject.authorize_params
        expect(subject.authorize_params[:scope]).to eql('User.Read')
        expect(subject.authorize_params[:resource]).to be_nil
      end

      it 'has correct token params' do
        subject.client
        expect(subject.token_params[:scope]).to eql('User.Read')
        expect(subject.token_params[:resource]).to be_nil
      end

      it 'has correct uid claim' do
        subject.client
        expect(subject.options[:uid_claim]).to eql('oid')
      end
    end
  end

  describe 'dynamic configuration' do
    let(:provider_klass) {
      Class.new {
        def initialize(strategy)
        end

        def client_id
          'id'
        end

        def client_secret
          'secret'
        end

        def tenant_id
          'tenant'
        end

        def authorize_params
          { custom_option: 'value' }
        end
      }
    }

    subject do
      OmniAuth::Strategies::AzureOauth2.new(app, provider_klass)
    end

    before do
      allow(subject).to receive(:request) { request }
    end

    describe '#client' do
      it 'has correct authorize url' do
        expect(subject.client.options[:authorize_url]).to eql('https://login.microsoftonline.com/tenant/oauth2/authorize')
      end

      it 'has correct authorize params' do
        subject.client
        expect(subject.authorize_params[:domain_hint]).to be_nil
        expect(subject.authorize_params[:custom_option]).to eql('value')
      end

      it 'has correct token url' do
        expect(subject.client.options[:token_url]).to eql('https://login.microsoftonline.com/tenant/oauth2/token')
      end

      it 'has correct token params' do
        subject.client
        expect(subject.token_params[:resource]).to eql('00000002-0000-0000-c000-000000000000')
      end

      # todo: how to get this working?
      # describe "overrides" do
      #   it 'should override domain_hint' do
      #     provider_klass.domain_hint = 'hint'
      #     subject.client
      #     expect(subject.authorize_params[:domain_hint]).to eql('hint')
      #   end
      # end
    end

  end

  describe 'dynamic configuration - german' do
    let(:provider_klass) {
      Class.new {
        def initialize(strategy)
        end

        def client_id
          'id'
        end

        def client_secret
          'secret'
        end

        def tenant_id
          'tenant'
        end

        def base_azure_url
          'https://login.microsoftonline.de'
        end
      }
    }

    subject do
      OmniAuth::Strategies::AzureOauth2.new(app, provider_klass)
    end

    before do
      allow(subject).to receive(:request) { request }
    end

    describe '#client' do
      it 'has correct authorize url' do
        expect(subject.client.options[:authorize_url]).to eql('https://login.microsoftonline.de/tenant/oauth2/authorize')
      end

      it 'has correct authorize params' do
        subject.client
        expect(subject.authorize_params[:domain_hint]).to be_nil
      end

      it 'has correct token url' do
        expect(subject.client.options[:token_url]).to eql('https://login.microsoftonline.de/tenant/oauth2/token')
      end

      it 'has correct token params' do
        subject.client
        expect(subject.token_params[:resource]).to eql('00000002-0000-0000-c000-000000000000')
      end

      # todo: how to get this working?
      # describe "overrides" do
      #   it 'should override domain_hint' do
      #     provider_klass.domain_hint = 'hint'
      #     subject.client
      #     expect(subject.authorize_params[:domain_hint]).to eql('hint')
      #   end
      # end
    end

  end

  describe 'dynamic common configuration' do
    let(:provider_klass) {
      Class.new {
        def initialize(strategy)
        end

        def client_id
          'id'
        end

        def client_secret
          'secret'
        end
      }
    }

    subject do
      OmniAuth::Strategies::AzureOauth2.new(app, provider_klass)
    end

    before do
      allow(subject).to receive(:request) { request }
    end

    describe '#client' do
      it 'has correct authorize url' do
        expect(subject.client.options[:authorize_url]).to eql('https://login.microsoftonline.com/common/oauth2/authorize')
      end

      it 'has correct token url' do
        expect(subject.client.options[:token_url]).to eql('https://login.microsoftonline.com/common/oauth2/token')
      end
    end
  end

  describe 'dynamic common configuration v2' do
    let(:provider_klass) {
      Class.new {
        def initialize(strategy)
        end

        def client_id
          'id'
        end

        def client_secret
          'secret'
        end

        def v2
          true
        end
      }
    }

    subject do
      OmniAuth::Strategies::AzureOauth2.new(app, provider_klass)
    end

    before do
      allow(subject).to receive(:request) { request }
    end

    describe '#client' do
      it 'has correct authorize url' do
        expect(subject.client.options[:authorize_url]).to eql('https://login.microsoftonline.com/common/oauth2/v2.0/authorize')
      end

      it 'has correct token url' do
        expect(subject.client.options[:token_url]).to eql('https://login.microsoftonline.com/common/oauth2/v2.0/token')
      end

      it 'has correct authorize params' do
        subject.client
        expect(subject.authorize_params[:scope]).to eql('User.Read')
        expect(subject.authorize_params[:resource]).to be_nil
      end

      it 'has correct token params' do
        subject.client
        expect(subject.token_params[:scope]).to eql('User.Read')
        expect(subject.token_params[:resource]).to be_nil
      end

      it 'has correct uid claim' do
        subject.client
        expect(subject.options[:uid_claim]).to eql('sub')
      end
    end
  end

  describe 'dynamic custom configuration v2' do
    let(:provider_klass) {
      Class.new {
        def initialize(strategy)
        end

        def client_id
          'id'
        end

        def client_secret
          'secret'
        end

        def v2
          true
        end

        def uid_claim
          'oid'
        end
      }
    }

    subject do
      OmniAuth::Strategies::AzureOauth2.new(app, provider_klass)
    end

    before do
      allow(subject).to receive(:request) { request }
    end

    describe '#client' do
      it 'has correct authorize url' do
        expect(subject.client.options[:authorize_url]).to eql('https://login.microsoftonline.com/common/oauth2/v2.0/authorize')
      end

      it 'has correct token url' do
        expect(subject.client.options[:token_url]).to eql('https://login.microsoftonline.com/common/oauth2/v2.0/token')
      end

      it 'has correct authorize params' do
        subject.client
        puts subject.authorize_params
        expect(subject.authorize_params[:scope]).to eql('User.Read')
        expect(subject.authorize_params[:resource]).to be_nil
      end

      it 'has correct token params' do
        subject.client
        expect(subject.token_params[:scope]).to eql('User.Read')
        expect(subject.token_params[:resource]).to be_nil
      end

      it 'has correct uid claim' do
        subject.client
        expect(subject.options[:uid_claim]).to eql('oid')
      end
    end
  end

  describe "raw_info" do
    subject do
      OmniAuth::Strategies::AzureOauth2.new(app, {client_id: 'id', client_secret: 'secret'})
    end

    let(:token) do
      JWT.encode({"some" => "payload"}, "secret")
    end

    let(:access_token) do
      double(:token => token)
    end

    before do
      allow(subject).to receive(:access_token) { access_token }
      allow(subject).to receive(:request) { request }
    end

    it "does not clash if JWT strategy is used" do
      expect do
        subject.info
      end.to_not raise_error
    end
  end

  describe 'token_params' do
    let(:strategy) { OmniAuth::Strategies::AzureOauth2.new(app, client_id: 'id', client_secret: 'secret') }
    let(:request)  { double('Request', env: env) }
    let(:env)      { {} }

    subject { strategy.token_params }

    before { allow(strategy).to receive(:request).and_return request }

    it { is_expected.to be_a OmniAuth::Strategy::Options }
    it 'has default resource' do
      expect(subject.resource).to eq '00000002-0000-0000-c000-000000000000'
    end

    context 'when custom crm url' do
      let(:crm_url) { 'https://mydomain.crm.dynamics.com/' }
      let(:env)     { { 'omniauth.params' => { 'azure_resource' => crm_url } } }

      it 'has resource from url params' do
        expect(subject.resource).to eq crm_url
      end
    end
  end
end