CC refactors

Author: jvanderhoof

app/domain/authentication/authn_jwt/v2/data_objects/authenticator_contract.rb

@@ -77,7 +77,7 @@ class AuthenticatorContract < Dry::Validation::Contract
 
           # Verify that a variable has been created for one of: `jwks-uri`, `public-keys`, or `provider-uri`
           rule(:jwks_uri, :public_keys, :provider_uri) do
-            if %i[jwks_uri provider_uri public_keys].all? { |item| values[item].nil? }
+            if all_are?(array: %i[jwks_uri provider_uri public_keys], values: values, check: :nil?)
               utils.failed_response(
                 key: key,
                 error: Errors::Authentication::AuthnJwt::InvalidSigningKeySettings.new(
@@ -89,7 +89,8 @@ class AuthenticatorContract < Dry::Validation::Contract
 
           # Verify that a variable has been set for one of: `jwks-uri`, `public-keys`, or `provider-uri`
           rule(:jwks_uri, :public_keys, :provider_uri) do
-            if %i[jwks_uri provider_uri public_keys].all? { |item| values[item].blank? }
+            if all_are?(array: %i[jwks_uri provider_uri public_keys], values: values, check: :blank?)
+            # if %i[jwks_uri provider_uri public_keys].all? { |item| values[item].blank? }
               utils.failed_response(
                 key: key,
                 error: Errors::Authentication::AuthnJwt::InvalidSigningKeySettings.new(
@@ -328,6 +329,12 @@ def variable_empty?(key:, values:, variable:)
               )
             )
           end
+
+          def all_are?(array:, values:, check:)
+            array.all? { |item| values[item].send(check) }
+          end
+
+
         end
       end
     end

app/domain/authentication/authn_oidc/v2/strategy.rb

@@ -4,6 +4,8 @@ module Authentication
   module AuthnOidc
     module V2
       class Strategy
+        REQUIRED_PARAMS = %i[code nonce].freeze
+
         def initialize(
           authenticator:,
           client: Authentication::AuthnOidc::V2::Client,
@@ -16,7 +18,7 @@ def initialize(
 
         def callback(parameters:, request_body: nil)
           # NOTE: `code_verifier` param is optional
-          %i[code nonce].each do |param|
+          REQUIRED_PARAMS.each do |param|
             unless parameters[param].present?
               raise Errors::Authentication::RequestBody::MissingRequestParam, param.to_s
             end

dev/start

@@ -433,7 +433,9 @@ init_jwt() {
 
   # OIDC is a special case on JWT, JWT automation tests contain scenarios with
   # OIDC providers.
-  configure_oidc_providers
+  # configure_oidc_providers
+  configure_oidc_authenticators
+  enable_oidc_authenticators
 
   echo "Configure jwks provider"
   docker-compose exec jwks "/tmp/create_nginx_certificate.sh"

spec/app/db/repository/authenticator_repository_spec.rb

@@ -66,7 +66,7 @@
               arguments.each do |variable|
                 ::Secret.create(
                   resource_id: "rspec:variable:conjur/authn-oidc/#{service}/#{variable}",
-                  value: "#{variable}"
+                  value: variable.to_s
                 )
               end
             end

spec/app/domain/authentication/authn-jwt/v2/data_objects/authenticator_contract_spec.rb

@@ -3,7 +3,7 @@
 require 'spec_helper'
 
 RSpec.describe(Authentication::AuthnOidc::V2::DataObjects::AuthenticatorContract) do
-  subject { Authentication::AuthnJwt::V2::DataObjects::AuthenticatorContract.new.call(**params) }
+  subject { Authentication::AuthnJwt::V2::DataObjects::AuthenticatorContract.new(utils: ::Util::ContractUtils).call(**params) }
   let(:default_args) { { account: 'foo', service_id: 'bar' } }
   let(:public_keys) { '{"type":"jwks","value":{"keys":[{}]}}' }
 
@@ -238,7 +238,7 @@
       end
     end
     context 'with claims in reserved claim list' do
-      let(:contract) { Authentication::AuthnJwt::V2::DataObjects::AuthenticatorContract.new }
+      let(:contract) { Authentication::AuthnJwt::V2::DataObjects::AuthenticatorContract.new(utils: ::Util::ContractUtils) }
       %w[iss exp nbf iat jti aud].each do |reserved_claim|
         enforced_claims = "foo-bar/b, #{reserved_claim}"
         it 'is unsuccessful' do
@@ -312,7 +312,7 @@
       end
     end
     context 'with claim alias in reserved claim list' do
-      let(:contract) { Authentication::AuthnJwt::V2::DataObjects::AuthenticatorContract.new }
+      let(:contract) { Authentication::AuthnJwt::V2::DataObjects::AuthenticatorContract.new(utils: ::Util::ContractUtils) }
       %w[iss exp nbf iat jti aud].each do |reserved_claim|
         enforced_claims = "foo:bar/b, #{reserved_claim}:bing/baz"
         it 'is unsuccessful' do
@@ -325,7 +325,7 @@
       end
     end
     context 'with claim target in reserved claim list' do
-      let(:contract) { Authentication::AuthnJwt::V2::DataObjects::AuthenticatorContract.new }
+      let(:contract) { Authentication::AuthnJwt::V2::DataObjects::AuthenticatorContract.new(utils: ::Util::ContractUtils) }
       %w[iss exp nbf iat jti aud].each do |reserved_claim|
         enforced_claims = "foo:bar/b, bing:#{reserved_claim}"
         it 'is unsuccessful' do

spec/app/domain/authentication/authn-jwt/v2/resolve_identity_spec.rb

@@ -275,7 +275,7 @@
         let(:allowed_roles) do
           [
             { role_id: 'rspec:host:bill', annotations: {} },
-            { role_id: 'rspec:host:bob',
+            { role_id: 'rspec:user:bob',
               annotations: {
                 'authn-jwt/bar/project_id' => 'test-1',
                 'authn-jwt/bar/iss' => 'test-2'