diff --git a/lib/PiTube.pm b/lib/PiTube.pm index 112864a444f37fa3049e48bd51a9e09bf4f98ce5..8160bcbd3edec89145aef777051b2c8e848194cc 100644 --- a/lib/PiTube.pm +++ b/lib/PiTube.pm @@ -55,8 +55,6 @@ sub startup { return 0 if ! $c->session->{user}; my %user_roles = map { $_ => 1 } @{ $c->session->{user}{roles} }; - $role .= '@' . $cfg->{oauth2}{client_id} if $role !~ /\@/; - return exists $user_roles{$role} ? 1 : 0; }, user_privs => sub {}, diff --git a/lib/PiTube/Controller/OAuth2.pm b/lib/PiTube/Controller/OAuth2.pm index c680a82c5ad2ef8bd48264d010817a9aef14de3b..70d4db0a422eec22d2ae1aeea94eefb76a1f3fd6 100644 --- a/lib/PiTube/Controller/OAuth2.pm +++ b/lib/PiTube/Controller/OAuth2.pm @@ -9,9 +9,10 @@ sub callback { # TODO: ERROR HANDLING - $c->session->{refresh_token} = $token->refresh_token; my $claims = $c->oauth_claims( $token->access_token ); + $c->session->{refresh_token} = $token->refresh_token; + $c->session->{user} = { uuid => $claims->{sub}, name => $claims->{name}, @@ -24,10 +25,11 @@ sub callback { ); $user->set_token(); - $c->session->{user}{id} = $user->id; - $c->session->{user}{token} = $user->token; - $c->session->{user}{roles} = $c->oauth_roles($claims); - $c->session->{user}{acl} = $c->schema->resultset('ACL')->user_acl( + $c->session->{user}{id} = $user->id; + $c->session->{user}{token} = $user->token; + $c->session->{user}{roles} = $c->oauth_roles($claims); + $c->session->{user}{groups} = $c->oauth_groups($claims); + $c->session->{user}{acl} = $c->schema->resultset('ACL')->user_acl( $c->session->{user} ); diff --git a/lib/PiTube/Helpers/OAuth2.pm b/lib/PiTube/Helpers/OAuth2.pm index cca75a61fa3d0ac9d20dade9bcc28d601719aa55..6d385abcf67d579274ed69d461a9c83ee5a04c5c 100644 --- a/lib/PiTube/Helpers/OAuth2.pm +++ b/lib/PiTube/Helpers/OAuth2.pm @@ -8,6 +8,7 @@ use constant KEY_FORMAT => "-----BEGIN PUBLIC KEY-----\n%s\n-----END PUBLIC KEY- use base 'Mojolicious::Plugin'; use Mojo::JWT; use Mojo::UserAgent; +use YAML; sub register { my ($class, $self) = @_; @@ -70,20 +71,29 @@ sub register { my $c = shift; my $claims = shift; - my @roles = (); + return $claims->{resource_access}{$self->cfg->{oauth2}{client_id}}{roles}; + }); - CLIENT: - foreach my $client ( keys %{ $claims->{resource_access} } ) { - ROLE: - foreach my $role ( @{ $claims->{resource_access}{$client}{roles} } ) { - push @roles, $role . '@' . $client; - } - } + $self->helper( oauth_groups => sub { + my $c = shift; + my $claims = shift; - return \@roles; + return $claims->{groups} // [] ; - }); + # JEN Z DUVODU KOMPATIBLITY SE STARYM KEYCLOAK +# my @groups = (); + +# CLIENT: +# foreach my $client ( keys %{ $claims->{resource_access} } ) { +# ROLE: +# foreach my $role ( @{ $claims->{resource_access}{$client}{roles} } ) { +# push @groups, $role . '@' . $client; +# } +# } +# return \@groups; + + }); } 1;