<% if provider[:button_path].present? %>
<%= link_to decidim.send("user_#{name}_omniauth_authorize_path"), class: "button button--social--custom", method: :post do %>
- <%= image_tag provider[:button_path], alt: t("devise.shared.links.sign_in_with_provider", provider: normalize_provider_name(name).titleize) %>
+ <% if provider[:button_hover_path].present? %>
+ <%= image_tag provider[:button_path], class: "button--has-hover", alt: t("devise.shared.links.sign_in_with_provider", provider: normalize_provider_name(name).titleize) %>
+ <%= image_tag provider[:button_hover_path], class: "button--is-hover", alt: t("devise.shared.links.sign_in_with_provider", provider: normalize_provider_name(name).titleize) %>
+ <% else %>
+ <%= image_tag provider[:button_path], alt: t("devise.shared.links.sign_in_with_provider", provider: normalize_provider_name(name).titleize) %>
+ <% end %>
<% end %>
<% if I18n.exists?("decidim.omniauth.france_connect.external.link") %>
<%= link_to t("link", scope: "decidim.omniauth.france_connect.external"), class: "primary", target: "_blank" do %>
diff --git a/config/environments/production.rb b/config/environments/production.rb
index 5744702..e02073d 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -85,16 +85,22 @@
# Use default logging formatter so that PID and timestamp are not suppressed.
config.log_formatter = ::Logger::Formatter.new
- config.action_mailer.smtp_settings = {
- address: Rails.application.secrets.smtp_address,
- port: Rails.application.secrets.smtp_port,
- authentication: Rails.application.secrets.smtp_authentication,
- user_name: Rails.application.secrets.smtp_username,
- password: Rails.application.secrets.smtp_password,
- domain: Rails.application.secrets.smtp_domain,
- enable_starttls_auto: Rails.application.secrets.smtp_starttls_auto,
- openssl_verify_mode: "none"
- }
+ if ENV.fetch("ENABLE_LETTER_OPENER", "0") == "1"
+ config.action_mailer.delivery_method = :letter_opener_web
+ config.action_mailer.default_url_options = { port: 3000 }
+ else
+ config.action_mailer.delivery_method = :smtp
+ config.action_mailer.smtp_settings = {
+ address: Rails.application.secrets.smtp_address,
+ port: Rails.application.secrets.smtp_port,
+ authentication: Rails.application.secrets.smtp_authentication,
+ user_name: Rails.application.secrets.smtp_username,
+ password: Rails.application.secrets.smtp_password,
+ domain: Rails.application.secrets.smtp_domain,
+ enable_starttls_auto: Rails.application.secrets.smtp_starttls_auto,
+ openssl_verify_mode: "none"
+ }
+ end
config.action_mailer.default_options = {
"X-Mailjet-TrackOpen" => 0,
diff --git a/config/initializers/extends.rb b/config/initializers/extends.rb
index ddc9dcd..9491b0b 100644
--- a/config/initializers/extends.rb
+++ b/config/initializers/extends.rb
@@ -10,3 +10,5 @@
require "extends/destroy_account_extend"
require "extends/create_omniauth_registration_extend"
require "extends/update_account_extend"
+require "extends/openid_connect/access_token_extends"
+require "extends/graphql_schema_get_field_extend"
diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb
index ee017bb..8335a63 100644
--- a/config/initializers/omniauth.rb
+++ b/config/initializers/omniauth.rb
@@ -3,6 +3,8 @@
require "omniauth/strategies/france_connect_uid"
require "omniauth/strategies/france_connect_profile"
+OmniAuth.config.logger = Rails.logger
+
Rails.application.config.middleware.use OmniAuth::Builder do
OmniAuth.config.logger = Rails.logger
omniauth_config = Rails.application.secrets.dig(:omniauth)
@@ -11,10 +13,10 @@
provider(
:france_connect_uid,
setup: setup_provider_proc(:france_connect_uid,
- site: :site,
+ issuer: :site,
client_id: :client_id,
client_secret: :client_secret,
- end_session_endpoint: :end_session_endpoint,
+ post_logout_redirect_uri: :post_logout_redirect_uri,
icon_path: :icon_path,
button_path: :button_path,
provider_name: :provider_name,
@@ -26,10 +28,10 @@
provider(
:france_connect_profile,
setup: setup_provider_proc(:france_connect_profile,
- site: :site,
+ issuer: :site,
client_id: :client_id,
client_secret: :client_secret,
- end_session_endpoint: :end_session_endpoint,
+ post_logout_redirect_uri: :post_logout_redirect_uri,
icon_path: :icon_path,
button_path: :button_path,
provider_name: :provider_name,
@@ -37,56 +39,3 @@
)
end
end
-
-# if Rails.application.secrets.dig(:omniauth, :france_connect_uid).present? && Rails.application.secrets.dig(:omniauth, :france_connect_uid, :enabled)
-# ::Devise.setup do |config|
-# config.omniauth :france_connect_uid, {
-# name: "france_connect_uid",
-# issuer: "https://" + Rails.application.secrets.dig(:omniauth, :france_connect_uid, :host),
-# scope: [:openid],
-# client_signing_alg: :HS256,
-# client_auth_method: :body,
-# acr_values: "eidas1" ,
-# client_options: {
-# host: Rails.application.secrets.dig(:omniauth, :france_connect_uid, :host),
-# authorization_endpoint: '/api/v1/authorize',
-# token_endpoint: '/api/v1/token',
-# userinfo_endpoint: '/api/v1/userinfo',
-# jwks_uri: '/api/v1/jwk',
-# end_session_endpoint: '/api/v1/logout',
-# identifier: Rails.application.secrets.dig(:omniauth, :france_connect_uid, :identifier),
-# secret: Rails.application.secrets.dig(:omniauth, :france_connect_uid, :secret),
-# redirect_uri: Rails.application.secrets.dig(:omniauth, :france_connect_uid, :redirect_uri)
-# }
-# }
-# end
-#
-# Decidim::User.omniauth_providers << :france_connect_uid
-# end
-#
-# if Rails.application.secrets.dig(:omniauth, :france_connect_profile).present? && Rails.application.secrets.dig(:omniauth, :france_connect_profile, :enabled)
-# ::Devise.setup do |config|
-# config.omniauth :france_connect_profile, {
-# name: "france_connect_profile",
-# issuer: "https://" + Rails.application.secrets.dig(:omniauth, :france_connect_profile, :host),
-# # scope: [:openid, :email, :given_name, :family_name, :preferred_username, :birthdate],
-# scope: [:openid, :email, :given_name, :family_name, :birthdate],
-# client_signing_alg: :HS256,
-# client_auth_method: :body,
-# acr_values: "eidas1" ,
-# client_options: {
-# host: Rails.application.secrets.dig(:omniauth, :france_connect_profile, :host),
-# authorization_endpoint: '/api/v1/authorize',
-# token_endpoint: '/api/v1/token',
-# userinfo_endpoint: '/api/v1/userinfo',
-# jwks_uri: '/api/v1/jwk',
-# end_session_endpoint: '/api/v1/logout',
-# identifier: Rails.application.secrets.dig(:omniauth, :france_connect_profile, :identifier),
-# secret: Rails.application.secrets.dig(:omniauth, :france_connect_profile, :secret),
-# redirect_uri: Rails.application.secrets.dig(:omniauth, :france_connect_profile, :redirect_uri)
-# }
-# }
-# end
-#
-# Decidim::User.omniauth_providers << :france_connect_profile
-# end
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 7abfd01..a3b3af4 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -283,19 +283,23 @@ en:
organizations:
omniauth_settings:
france_connect_profile:
+ button_hover_path: Chemin de l'image du bouton de survol
button_path: Chemin de l'image du bouton
client_id: ID client
client_secret: Clé secrète
end_session_endpoint: Endpoint de déconnexion
minimum_age: Age minimum
+ post_logout_redirect_uri: Endpoint de retour de déconnexion (Decidim)
provider_name: Nom du service
site: URL principale du service
france_connect_uid:
+ button_hover_path: Chemin de l'image du bouton de survol
button_path: Chemin de l'image du bouton
client_id: ID client
client_secret: Clé secrète
end_session_endpoint: Endpoint de déconnexion
minimum_age: Age minimum
+ post_logout_redirect_uri: Endpoint de retour de déconnexion (Decidim)
provider_name: Nom du service
site: URL principale du service
verifications:
diff --git a/config/locales/fr.yml b/config/locales/fr.yml
index 9cfcd16..0a46987 100644
--- a/config/locales/fr.yml
+++ b/config/locales/fr.yml
@@ -230,10 +230,10 @@ fr:
link: https://franceconnect.gouv.fr/
text: Qu'est-ce-que FranceConnect ?
france_connect_profile:
- explanation: '
Pour déposer une pétition L''auteur d''une pétition ne peut être anonyme. Toutefois, le Sénat ne récupère, via l''authentification FranceConnect, que les informations suivantes :
nom, prénom(s), date de naissance, adresse électronique et identifiant technique.
Les noms et prénoms des auteurs de pétition sont publiés avec la pétition.
Les autres éléments ne sont pas rendus publics.
'
+ explanation:
Pour déposer une pétition
FranceConnect est la solution proposée par l'État pour sécuriser et simplifier la connexion à vos services en ligne.
france_connect_uid:
anonymous_user: Authentifié(e) avec
FranceConnect
- explanation: "
Pour signer une pétition La connexion via FranceConnect permet de conserver votre anonymat (aucune donnée personnelle n'est récupérée), tout en garantissant qu'une pétition n'est signée qu'une seule fois par une même personne physique."
+ explanation:
Pour signer une pétition
FranceConnect est la solution proposée par l'État pour sécuriser et simplifier la connexion à vos services en ligne.
pages:
index:
title: Pages d'aide
@@ -276,19 +276,23 @@ fr:
organizations:
omniauth_settings:
france_connect_profile:
+ button_hover_path: Chemin de l'image du bouton de survol
button_path: Chemin de l'image du bouton
client_id: ID client
client_secret: Clé secrète
- end_session_endpoint: Endpoint de déconnexion
+ end_session_endpoint: Endpoint de retour de déconnexion (Decidim)
minimum_age: Age minimum
+ post_logout_redirect_uri: Endpoint de retour de déconnexion (Decidim)
provider_name: Nom du service
site: URL principale du service
france_connect_uid:
+ button_hover_path: Chemin de l'image du bouton de survol
button_path: Chemin de l'image du bouton
client_id: ID client
client_secret: Clé secrète
- end_session_endpoint: Endpoint de déconnexion
+ end_session_endpoint: Endpoint de retour de déconnexion (Decidim)
minimum_age: Age minimum
+ post_logout_redirect_uri: Endpoint de retour de déconnexion (Decidim)
provider_name: Nom du service
site: URL principale du service
verifications:
diff --git a/config/routes.rb b/config/routes.rb
index ce4681c..e2470cd 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -4,7 +4,7 @@
require "sidekiq-scheduler/web"
Rails.application.routes.draw do
- mount LetterOpenerWeb::Engine, at: "/letter_opener" if Rails.env.development?
+ mount LetterOpenerWeb::Engine, at: "/letter_opener" if Rails.env.development? || ENV.fetch("ENABLE_LETTER_OPENER", "0") == "1"
authenticate :admin do
mount Sidekiq::Web => "/sidekiq"
diff --git a/config/secrets.yml b/config/secrets.yml
index 887e2a7..9d7f646 100644
--- a/config/secrets.yml
+++ b/config/secrets.yml
@@ -26,27 +26,28 @@ default: &default
bucket_name: <%= ENV["SCALEWAY_BUCKET_NAME"] %>
omniauth:
france_connect_uid:
- enabled: true
- icon_path: "france-connect-logo.svg"
- button_path: "FCboutons-10@2x.png"
- provider_name: "FranceConnect \"Signataire\""
- site: <%= ENV["FRANCE_CONNECT_UID_SITE"] %>
- client_id: <%= ENV["FRANCE_CONNECT_UID_CLIENT_ID"] %>
- client_secret: <%= ENV["FRANCE_CONNECT_UID_CLIENT_SECRET"] %>
+ enabled: <%= ENV["OMNIAUTH_FRANCE_CONNECT_UID_ENABLED"]&.to_i || 0 %>
+ icon_path: <%= ENV["OMNIAUTH_FRANCE_CONNECT_UID_ICON_PATH"] %>
+ button_path: <%= ENV["OMNIAUTH_FRANCE_CONNECT_UID_BUTTON_PATH"] %>
+ button_hover_path: <%= ENV["OMNIAUTH_FRANCE_CONNECT_UID_BUTTON_HOVER_PATH"] %>
+ provider_name: <%= ENV["OMNIAUTH_FRANCE_CONNECT_UID_PROVIDER_NAME"] %>
+ site: <%= ENV["OMNIAUTH_FRANCE_CONNECT_UID_SITE"] %>
+ client_id: <%= ENV["OMNIAUTH_FRANCE_CONNECT_UID_CLIENT_ID"] %>
+ client_secret: <%= ENV["OMNIAUTH_FRANCE_CONNECT_UID_CLIENT_SECRET"] %>
end_session_endpoint: <%= ENV["OMNIAUTH_FRANCE_CONNECT_UID_END_SESSION_ENDPOINT"] %>
+ post_logout_redirect_uri: <%= ENV["OMNIAUTH_FRANCE_CONNECT_UID_POST_LOGOUT_REDIRECT_URI"] %>
minimum_age: <%= ENV["OMNIAUTH_FRANCE_CONNECT_UID_MINIMUM_AGE"] %>
- # redirect_uri: "https://decidim.local.osp.cat/users/auth/france_connect_uid/callback"
france_connect_profile:
- enabled: true
- icon_path: "france-connect-logo.svg"
- button_path: "FCboutons-10@2x.png"
- provider_name: "FranceConnect \"Auteur\""
- site: <%= ENV["FRANCE_CONNECT_PROFILE_SITE"] %>
- client_id: <%= ENV["FRANCE_CONNECT_PROFILE_CLIENT_ID"] %>
- client_secret: <%= ENV["FRANCE_CONNECT_PROFILE_CLIENT_SECRET"] %>
- end_session_endpoint: <%= ENV["OMNIAUTH_FRANCE_CONNECT_PROFILE_END_SESSION_ENDPOINT"] %>
+ enabled: <%= ENV["OMNIAUTH_FRANCE_CONNECT_PROFILE_ENABLED"]&.to_i || 0 %>
+ icon_path: <%= ENV["OMNIAUTH_FRANCE_CONNECT_PROFILE_ICON_PATH"] %>
+ button_path: <%= ENV["OMNIAUTH_FRANCE_CONNECT_PROFILE_BUTTON_PATH"] %>
+ button_hover_path: <%= ENV["OMNIAUTH_FRANCE_CONNECT_PROFILE_BUTTON_HOVER_PATH"] %>
+ provider_name: <%= ENV["OMNIAUTH_FRANCE_CONNECT_PROFILE_PROVIDER_NAME"] %>
+ site: <%= ENV["OMNIAUTH_FRANCE_CONNECT_PROFILE_SITE"] %>
+ client_id: <%= ENV["OMNIAUTH_FRANCE_CONNECT_PROFILE_CLIENT_ID"] %>
+ client_secret: <%= ENV["OMNIAUTH_FRANCE_CONNECT_PROFILE_CLIENT_SECRET"] %>
+ post_logout_redirect_uri: <%= ENV["OMNIAUTH_FRANCE_CONNECT_PROFILE_POST_LOGOUT_REDIRECT_URI"] %>
minimum_age: <%= ENV["OMNIAUTH_FRANCE_CONNECT_PROFILE_MINIMUM_AGE"] %>
- # redirect_uri: "https://decidim.local.osp.cat/users/auth/france_connect_profile/callback"
geocoder:
here_app_id: <%= ENV["HERE_APP_ID"] %>
here_app_code: <%= ENV["HERE_APP_CODE"] %>
diff --git a/k8s/decidim/staging/ingress.yml b/k8s/decidim/staging/ingress.yml
deleted file mode 100644
index 8a6e5d9..0000000
--- a/k8s/decidim/staging/ingress.yml
+++ /dev/null
@@ -1,24 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
- name: decidim-sen-ingress
- annotations:
- kubernetes.io/ingress.class: "nginx"
- kubernetes.io/tls-acme: "true"
- cert-manager.io/issuer: letsencrypt-prod
-spec:
- rules:
- - host: pps-int.opensourcepolitics.net
- http:
- paths:
- - path: /
- pathType: Prefix
- backend:
- service:
- name: decidim-sen-svc
- port:
- number: 80
- tls:
- - hosts:
- - pps-int.opensourcepolitics.net
- secretName: decidim-sen-ingress-secret-2
diff --git a/lib/extends/graphql_schema_get_field_extend.rb b/lib/extends/graphql_schema_get_field_extend.rb
new file mode 100644
index 0000000..e19fe30
--- /dev/null
+++ b/lib/extends/graphql_schema_get_field_extend.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+if GraphQL::Schema.instance_method(:get_field).arity == 2
+ module GraphqlSchemaGetFieldExtend
+ def get_field(parent_type, field_name, _context = GraphQL::Query::NullContext)
+ super(parent_type, field_name)
+ end
+ end
+
+ GraphQL::Schema.prepend(GraphqlSchemaGetFieldExtend)
+end
diff --git a/lib/extends/openid_connect/access_token_extends.rb b/lib/extends/openid_connect/access_token_extends.rb
new file mode 100644
index 0000000..3f92709
--- /dev/null
+++ b/lib/extends/openid_connect/access_token_extends.rb
@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module AccessTokenExtends
+ extend ActiveSupport::Concern
+
+ included do
+ def userinfo!(params = {})
+ response = resource_request do
+ get client.userinfo_uri, params
+ end
+
+ if response.is_a?(Hash)
+ ::OpenIDConnect::ResponseObject::UserInfo.new response.with_indifferent_access
+ else
+ response
+ end
+ end
+
+ private
+
+ def resource_request
+ res = yield
+ case res.status
+ when 200
+ res.body
+ when 400
+ raise BadRequest.new("API Access Failed", res)
+ when 401
+ raise Unauthorized.new("Access Token Invalid or Expired", res)
+ when 403
+ raise Forbidden.new("Insufficient Scope", res)
+ else
+ raise HttpError.new(res.status, "Unknown HttpError", res)
+ end
+ end
+ end
+end
+
+OpenIDConnect::AccessToken.class_eval do
+ include(AccessTokenExtends)
+end
diff --git a/lib/omniauth/strategies/france_connect.rb b/lib/omniauth/strategies/france_connect.rb
index fb03a05..6c551f8 100644
--- a/lib/omniauth/strategies/france_connect.rb
+++ b/lib/omniauth/strategies/france_connect.rb
@@ -11,11 +11,14 @@ class FranceConnect < OmniAuth::Strategies::OpenIDConnect
option :site
option :client_id
option :client_secret
- option :end_session_endpoint
-
- option :scope, [:openid, :email, :preferred_username]
- option :client_signing_alg, :HS256
- option :client_auth_method, :body
+ # option :end_session_endpoint
+
+ option :scope, %w(openid email preferred_username)
+ option :client_signing_alg, :ES256
+ option :discovery, true
+ option :response_type, "code"
+ option :client_auth_method, "basic"
+ option :uid_field, "sub"
option :acr_values, "eidas1"
info do
@@ -32,10 +35,6 @@ def find_name
user_info.preferred_username.presence || user_info.family_name
end
- def authorize_uri
- super + (options.acr_values.present? ? "&acr_values=#{options.acr_values}" : "")
- end
-
def auth_hash
hash = super
hash.logout = end_session_uri
@@ -43,40 +42,50 @@ def auth_hash
end
def end_session_uri
- return if client_options.end_session_endpoint.blank?
+ return unless end_session_endpoint_is_valid?
- end_session_uri = URI(options.issuer + client_options.end_session_endpoint)
+ end_session_uri = URI(client_options.end_session_endpoint)
end_session_uri.query = URI.encode_www_form(
id_token_hint: credentials[:id_token],
- state: session_state,
- post_logout_redirect_uri: "#{full_host}/users/auth/#{options.name}/logout"
+ state: new_state,
+ post_logout_redirect_uri: options.post_logout_redirect_uri
)
end_session_uri.to_s
end
- private
+ def user_info
+ return @user_info if @user_info
+
+ if access_token.id_token
+ decoded = decode_id_token(access_token.id_token).raw_attributes
+
+ response = access_token.userinfo!
+ response = decode_id_token(response) if response.is_a?(String)
+
+ log :debug, "Userinfo response: #{response.raw_attributes.to_h}"
- def issuer
- options.site
+ @user_info = ::OpenIDConnect::ResponseObject::UserInfo.new response.raw_attributes.merge(decoded).deep_symbolize_keys
+ else
+ @user_info = access_token.userinfo!
+ end
end
+ private
+
def client_options
- site_url = URI(options.site)
+ site_url = URI(options.issuer)
- client_options = {
+ options.client_options.merge(
host: site_url.host,
port: site_url.port,
identifier: options.client_id,
secret: options.client_secret,
- authorization_endpoint: "/api/v1/authorize",
- token_endpoint: "/api/v1/token",
- userinfo_endpoint: "/api/v1/userinfo",
- jwks_uri: "/api/v1/jwk"
- }
-
- client_options[:end_session_endpoint] = options.end_session_endpoint if options.end_session_endpoint.present?
-
- options.client_options.merge client_options
+ authorization_endpoint: "/api/v2/authorize",
+ token_endpoint: "/api/v2/token",
+ userinfo_endpoint: "/api/v2/userinfo",
+ jwks_uri: "/api/v2/jwks",
+ end_session_endpoint: "#{options.issuer}/session/end"
+ )
end
def redirect_uri
diff --git a/lib/omniauth/strategies/france_connect_profile.rb b/lib/omniauth/strategies/france_connect_profile.rb
index 814c921..83c5aa1 100644
--- a/lib/omniauth/strategies/france_connect_profile.rb
+++ b/lib/omniauth/strategies/france_connect_profile.rb
@@ -6,7 +6,7 @@ module OmniAuth
module Strategies
class FranceConnectProfile < OmniAuth::Strategies::FranceConnect
option :name, :france_connect_profile
- option :scope, [:email, :openid, :birthdate, :given_name, :family_name]
+ option :scope, %w(openid email given_name family_name birthdate)
info do
{
diff --git a/lib/omniauth/strategies/france_connect_uid.rb b/lib/omniauth/strategies/france_connect_uid.rb
index 8948331..6d41274 100644
--- a/lib/omniauth/strategies/france_connect_uid.rb
+++ b/lib/omniauth/strategies/france_connect_uid.rb
@@ -7,7 +7,7 @@ module OmniAuth
module Strategies
class FranceConnectUid < OmniAuth::Strategies::FranceConnect
option :name, :france_connect_uid
- option :scope, [:openid]
+ option :scope, %w(openid)
info do
{