Feature/oauth integration #1095
Conversation
use BetterTogether controller
Prevent visibility of the feature before it's ready
Allows for linking OAuth authorizations to Person and Platform records
- Introduced new spec for Simple OAuth Flow in `oauth_simple_spec.rb` to validate user creation and integration handling. - Enhanced `person_platform_integration_spec.rb` with tests for attributes extraction, token management, and integration updates. - Created `devise_user_spec.rb` to test user creation from OAuth and attribute setting from auth hash. - Added support helpers in `oauth_test_helpers.rb` for generating mock OAuth auth hashes for various providers. - Implemented shared examples in `oauth_examples.rb` for consistent testing of OAuth authentication flows and token management.
Signed-off-by: Robert Smith <[email protected]>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -0,0 +1,59 @@ | |||
| class BetterTogether::OmniauthCallbacksController < Devise::OmniauthCallbacksController | |||
| # See https://github.com/omniauth/omniauth/wiki/FAQ#rails-session-is-clobbered-after-callback-on-developer-strategy | |||
| skip_before_action :verify_authenticity_token, only: %i[github] | |||
Check failure
Code scanning / CodeQL
CSRF protection weakened or disabled High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 27 days ago
To fix this issue, re-enable CSRF protection for the github callback by removing or altering the line that skips CSRF verification for it. The best, most minimal fix is to delete or comment out the skip_before_action :verify_authenticity_token, only: %i[github] line (line 3 in the given code). This restores Rails' default (and secure) behaviour: requests made to the github callback will require the authenticity token, mitigating CSRF risk. No additional code or imports are needed—just remove that single line.
| @@ -1,6 +1,5 @@ | ||
| class BetterTogether::OmniauthCallbacksController < Devise::OmniauthCallbacksController | ||
| # See https://github.com/omniauth/omniauth/wiki/FAQ#rails-session-is-clobbered-after-callback-on-developer-strategy | ||
| skip_before_action :verify_authenticity_token, only: %i[github] | ||
|
|
||
| before_action :set_person_platform_integration, except: [:failure] | ||
| before_action :set_user, except: [:failure] |
| @@ -0,0 +1,10 @@ | |||
| <p style="color: green"><%= notice %></p> | |||
|
|
|||
| <%= render @person_platform_integration %> | |||
Check notice
Code scanning / Brakeman
Render path contains parameter value. Note
1 participant
Summary
Describe the change and the motivation.
Checklist
bin/ci).rubocop,brakeman,bundler-audit).docs/describing new/changed functionality.docs/*.mmd) updated to reflect changes.bin/render_diagramsand committed.Screenshots / Diagrams
If applicable, include screenshots or link to updated diagrams.
Notes
Anything reviewers should be aware of (migration order, flags, feature toggles).