keycloak_rack

gem "keycloak_rack", "1.0.0"

class ApplicationController < ActionController::API
  before_action :authenticate_user!

  # @return [void]
  def authenticate_user!
    # KeycloakRack::Session#authenticate! implements a Dry::Matcher::ResultMatcher
    request.env["keycloak:session"].authenticate! do |m|
      m.success(:authenticated) do |_, token|
        # this is the case when a user is successfully authenticated

        # token will be a KeycloakRack::DecodedToken instance, a
        # hash-like PORO that maps a number of values from the
        # decoded JWT that can be used to find or upsert a user

        attrs = decoded_token.slice(:keycloak_id, :email, :email_verified, :realm_access, :resource_access)

        result = User.upsert attrs, returning: %i[id], unique_by: %i[keycloak_id]

        @current_user = User.find result.first["id"]
      end

      m.success do
        # When allow_anonymous is true, or
        # a URI is skipped because of skip_paths, this
        # case will be reached. Requests from here on
        # out should be considered anonymous and treated
        # accordingly

        @current_user = AnonymousUser.new
      end

      m.failure do |code, reason|
        # All authentication failures are reached here,
        # assuming halt_on_auth_failure is set to false
        # This allows the application to decide how it
        # wants to respond

        render json: { errors: [{ message: "Auth Failure" }] }, status: :forbidden
      end
    end
  end
end

KeycloakRack.configure do |config|
  config.server_url = ENV["KEYCLOAK_SERVER_URL"]
  config.realm_id   = ENV["KEYCLOAK_REALM_ID"]
  config.skip_paths = {
    get: ["/ping"],
    post: [%r,/api/v1/analytics,]
  }
end

class UploadProcessor
  def initialize(app)
   @app = app
  end

  def call(env)
    env["keycloak.authorize_realm"].call("upload_permission") do |m|
      m.success do
        # allow the upload to proceed
      end

      m.failure do
        # fail the response, return 403, etc
      end
    end
  end
end

app = Rack::Builder.app do
  use KeycloakRack::Middleware

  run UploadProcessor
end

class WidgetCombobulator
  def initialize(app)
    @app = app
  end

  def call(env)
    env["keycloak.authorize_resource"].call("widgets", "recombobulate") do |m|
      m.success do
        # allow the user to recombobulate the widget
      end

      m.failure do
        # return forbidden, log the attempt, etc
      end
    end
  end
end

app = Rack::Builder.app do
  use KeycloakRack::Middleware

  run WidgetCombobulator
end

module Patches
  module OverrideKeycloakFailureBody
    # @param [Hash] env
    # @param [Dry::Monads::Failure] monad
    # @return [String, #to_json]
    def build_failure_body(env, monad)
      # You can use the #failure method on the monad to retrieve a tuple
      reason, message, token, original_error = monad.failure

      # reason is a symbol, like :no_token or :expired
      # message is a human-readable string that explains why it failed
      # token is the original token (if any) that was provided
      # original_error is a possible exception that was raised (not all failures have one)

      # Return any object that will JSONify itself with #to_json

      {
        error: "You can't sign in because: #{message}"
      }
    end
  end
end

KeycloakRack::Middleware.prepend Patches::OverrideKeycloakFailureBody

module Patches
  module OverrideKeycloakFailureHeaders
    # @param [Hash] env
    # @param [Dry::Monads::Failure] monad
    # @return [{ String => String }]
    def build_failure_headers(env, monad)
      {
        "Content-Type" => "application/xml",
        "Special-Header" => "special-value",
      }
    end
  end
end

KeycloakRack::Middleware.prepend Patches::OverrideKeycloakFailureHeaders