Skip to content

Commit 6b04a7b

Browse files
andimovandimov
authored
Merge pull request #456 from magento-performance/CABPI-324
Cabpi 324. Org check with new endpoint
2 parents d2e71d4 + c45c865 commit 6b04a7b

File tree

6 files changed

+76
-31
lines changed

6 files changed

+76
-31
lines changed

‎app/code/Magento/AdminAdobeIms/Controller/Adminhtml/OAuth/ImsCallback.php‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -102,14 +102,15 @@ public function execute(): Redirect
102102
$tokenResponse = $this->adminImsConnection->getTokenResponse($code);
103103
$accessToken = $tokenResponse->getAccessToken();
104104

105-
//check organization assignment
106-
$this->adminOrganizationService->checkOrganizationAllocation($accessToken);
107-
108105
//get profile info to check email
109106
$profile = $this->adminImsConnection->getProfile($accessToken);
110107
if (empty($profile['email'])) {
111108
throw new AuthenticationException(__('An authentication error occurred. Verify and try again.'));
112109
}
110+
111+
//check membership in organization
112+
$this->adminOrganizationService->checkOrganizationMembership($accessToken);
113+
113114
$this->adminLoginProcessService->execute($tokenResponse, $profile);
114115
} catch (AdobeImsAuthorizationException $e) {
115116
$this->logger->error($e->getMessage());

‎app/code/Magento/AdminAdobeIms/Controller/Adminhtml/OAuth/ImsReauthCallback.php‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -118,14 +118,16 @@ public function execute(): ResultInterface
118118
}
119119

120120
$tokenResponse = $this->adminImsConnection->getTokenResponse($code);
121+
$accessToken = $tokenResponse->getAccessToken();
121122

122-
$profile = $this->adminImsConnection->getProfile($tokenResponse->getAccessToken());
123+
$profile = $this->adminImsConnection->getProfile($accessToken);
123124
if (empty($profile['email'])) {
124125
throw new AuthenticationException(__('An authentication error occurred. Verify and try again.'));
125126
}
126127

127-
$accessToken = $tokenResponse->getAccessToken();
128-
$this->adminOrganizationService->checkOrganizationAllocation($accessToken);
128+
//check membership in organization
129+
$this->adminOrganizationService->checkOrganizationMembership($accessToken);
130+
129131
$this->adminReauthProcessService->execute($tokenResponse);
130132

131133
$response = sprintf(

‎app/code/Magento/AdminAdobeIms/Service/ImsConfig.php‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ class ImsConfig extends Config
3434
public const XML_PATH_ADMIN_AUTH_URL_PATTERN = 'adobe_ims/integration/admin/auth_url_pattern';
3535
public const XML_PATH_ADMIN_REAUTH_URL_PATTERN = 'adobe_ims/integration/admin/reauth_url_pattern';
3636
public const XML_PATH_ADMIN_ADOBE_IMS_SCOPES = 'adobe_ims/integration/admin/scopes';
37+
public const XML_PATH_ORGANIZATION_MEMBERSHIP_URL = 'adobe_ims/integration/organization_membership_url';
3738

3839
private const OAUTH_CALLBACK_URL = 'adobe_ims_auth/oauth/';
3940

@@ -376,4 +377,19 @@ public function getCertificateUrl(string $fileName): string
376377
{
377378
return $this->scopeConfig->getValue(self::XML_PATH_CERTIFICATE_PATH) . $fileName;
378379
}
380+
381+
/**
382+
* Get url to check organization membership
383+
*
384+
* @param string $orgId
385+
* @return string
386+
*/
387+
public function getOrganizationMembershipUrl(string $orgId): string
388+
{
389+
return str_replace(
390+
['#{org_id}'],
391+
[$orgId],
392+
$this->scopeConfig->getValue(self::XML_PATH_ORGANIZATION_MEMBERSHIP_URL)
393+
);
394+
}
379395
}

‎app/code/Magento/AdminAdobeIms/Service/ImsOrganizationService.php‎

Lines changed: 46 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
namespace Magento\AdminAdobeIms\Service;
1010

1111
use Magento\AdminAdobeIms\Exception\AdobeImsOrganizationAuthorizationException;
12+
use Magento\Framework\HTTP\Client\CurlFactory;
1213

1314
class ImsOrganizationService
1415
{
@@ -17,33 +18,68 @@ class ImsOrganizationService
1718
*/
1819
private ImsConfig $adminImsConfig;
1920

21+
/**
22+
* @var CurlFactory
23+
*/
24+
private CurlFactory $curlFactory;
25+
2026
/**
2127
* @param ImsConfig $adminImsConfig
28+
* @param CurlFactory $curlFactory
2229
*/
2330
public function __construct(
24-
ImsConfig $adminImsConfig
31+
ImsConfig $adminImsConfig,
32+
CurlFactory $curlFactory
2533
) {
2634
$this->adminImsConfig = $adminImsConfig;
35+
$this->curlFactory = $curlFactory;
2736
}
2837

2938
/**
30-
* Check if user is assigned to organization
39+
* Check if user is a member of Adobe Organization
3140
*
32-
* @param string $token
33-
* @return bool
41+
* @param string $access_token
42+
* @return void
3443
* @throws AdobeImsOrganizationAuthorizationException
3544
*/
36-
public function checkOrganizationAllocation(string $token): bool
45+
public function checkOrganizationMembership(string $access_token): void
3746
{
38-
$configuredOrganization = $this->adminImsConfig->getOrganizationId();
47+
$configuredOrganizationId = $this->adminImsConfig->getOrganizationId();
3948

40-
//@TODO CABPI-324: Change Org check to use new endpoint
41-
if ($configuredOrganization === '' || !$token) {
49+
if ($configuredOrganizationId === '' || !$access_token) {
4250
throw new AdobeImsOrganizationAuthorizationException(
43-
__('User is not assigned to defined organization.')
51+
__('Can\'t check user membership in organization.')
4452
);
4553
}
4654

47-
return true;
55+
try {
56+
$curl = $this->curlFactory->create();
57+
58+
$curl->addHeader('Content-Type', 'application/x-www-form-urlencoded');
59+
$curl->addHeader('cache-control', 'no-cache');
60+
$curl->addHeader('Authorization', 'Bearer ' . $access_token);
61+
62+
$orgCheckUrl = $this->adminImsConfig->getOrganizationMembershipUrl($configuredOrganizationId);
63+
$curl->get($orgCheckUrl);
64+
65+
if ($curl->getBody() === '') {
66+
throw new AdobeImsOrganizationAuthorizationException(
67+
__('Could not check Organization Membership. Response is empty.')
68+
);
69+
}
70+
71+
$response = $curl->getBody();
72+
73+
if ($response !== 'true') {
74+
throw new AdobeImsOrganizationAuthorizationException(
75+
__('User is not a member of configured Adobe Organization.')
76+
);
77+
}
78+
79+
} catch (\Exception $exception) {
80+
throw new AdobeImsOrganizationAuthorizationException(
81+
__('Organization Membership check can\'t be performed')
82+
);
83+
}
4884
}
4985
}

‎app/code/Magento/AdminAdobeIms/Test/Unit/Service/ImsOrganizationServiceTest.php‎

Lines changed: 3 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -43,27 +43,15 @@ protected function setUp(): void
4343
);
4444
}
4545

46-
public function testCheckOrganizationAllocationReturnsTrueWhenProfileAssignedToOrg()
47-
{
48-
$this->adminImsConfigMock
49-
->method('getOrganizationId')
50-
->willReturn(self::VALID_ORGANIZATION_ID);
51-
52-
$this->assertEquals(
53-
true,
54-
$this->imsOrganizationService->checkOrganizationAllocation('my_token')
55-
);
56-
}
57-
58-
public function testCheckOrganizationAllocationThrowsExceptionWhenProfileNotAssignedToOrg()
46+
public function testCheckOrganizationMembershipThrowsExceptionWhenProfileNotAssignedToOrg()
5947
{
6048
$this->adminImsConfigMock
6149
->method('getOrganizationId')
6250
->willReturn('');
6351

6452
$this->expectException(AdobeImsOrganizationAuthorizationException::class);
65-
$this->expectExceptionMessage('User is not assigned to defined organization.');
53+
$this->expectExceptionMessage('Can\'t check user membership in organization.');
6654

67-
$this->imsOrganizationService->checkOrganizationAllocation('my_token');
55+
$this->imsOrganizationService->checkOrganizationMembership('my_token');
6856
}
6957
}

‎app/code/Magento/AdminAdobeIms/etc/config.xml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,15 @@
1818
<openid>openid</openid>
1919
<email>email</email>
2020
<profile>profile</profile>
21+
<org.read>org.read</org.read>
2122
</scopes>
2223
</admin>
2324
<logging_enabled>0</logging_enabled>
2425
<organization_id backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>
2526
<auth_url_pattern><![CDATA[https://ims-na1.adobelogin.com/ims/authorize/v2?client_id=#{client_id}&amp;redirect_uri=#{redirect_uri}&amp;locale=#{locale}&amp;scope=openid,creative_sdk,email,profile&amp;response_type=code]]></auth_url_pattern>
2627
<token_url>https://ims-na1.adobelogin.com/ims/token</token_url>
2728
<profile_url><![CDATA[https://ims-na1.adobelogin.com/ims/profile/v1?client_id=#{client_id}]]></profile_url>
29+
<organization_membership_url><![CDATA[https://graph.identity.adobe.com/#{org_id}@AdobeOrg/membership]]></organization_membership_url>
2830
<logout_url><![CDATA[https://ims-na1.adobelogin.com/ims/logout/v1?access_token=#{access_token}&amp;client_id=#{client_id}&amp;client_secret=#{client_secret}]]></logout_url>
2931
<certificate_path><![CDATA[https://static.adobelogin.com/keys/prod/]]></certificate_path>
3032
<validate_token_url><![CDATA[https://ims-na1.adobelogin.com/ims/validate_token/v1?token=#{token}&client_id=#{client_id}&type=#{token_type}]]></validate_token_url>

0 commit comments

Comments
 (0)