Redmine

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

require 'net/http'

require 'uri'

require 'json'

class EmailOauthController < ApplicationController

  layout 'admin'

  before_action :require_admin

  def index

    @tokens = EmailOauthToken.order(:email)

  end

  def new

    @token = EmailOauthToken.new

    if Setting.email_oauth_providers.empty?

      flash[:error] = l(:text_email_oauth_providers_not_configured)

      redirect_to email_oauth_index_path

    end

  end

  def initiate

    email = params[:email_oauth_token][:email]

    provider = params[:email_oauth_token][:provider]

    provider_config = get_provider_config(provider)

    if provider_config.blank?

      flash[:error] = l(:error_oauth_authentication_failed, message: "Provider '#{provider}' is not configured in configuration.yml.")

      redirect_to new_email_oauth_path and return

    end

    # Build authorization URL

    auth_uri = build_auth_uri(provider, provider_config, email)

    # Store state in session to prevent CSRF / verify callback

    session[:email_oauth_state] = SecureRandom.hex(16)

    session[:email_oauth_email] = email

    session[:email_oauth_provider] = provider

    redirect_to auth_uri, allow_other_host: true

  end

  def callback

    state = params[:state]

    code = params[:code]

    error = params[:error]

    if error.present?

      flash[:error] = l(:error_oauth_authentication_failed, message: error)

      redirect_to email_oauth_index_path and return

    end

    unless Rails.env.development?

      if state.blank? || state != session[:email_oauth_state]

        flash[:error] = l(:error_oauth_authentication_failed, message: "OAuth verification state mismatch. Potential CSRF request.")

        redirect_to email_oauth_index_path and return

      end

    end

    email = session.delete(:email_oauth_email)

    provider = session.delete(:email_oauth_provider)

    session.delete(:email_oauth_state)

    provider_config = get_provider_config(provider)

    if provider_config.blank? || email.blank?

      flash[:error] = l(:error_oauth_authentication_failed, message: "Invalid session state or missing provider configuration.")

      redirect_to email_oauth_index_path and return

    end

    # Exchange authorization code for tokens

    exchange_and_save_tokens(provider, provider_config, email, code)

  end

  def destroy

    @token = EmailOauthToken.find(params[:id])

    if @token.destroy

      flash[:notice] = l(:notice_successful_delete)

    else

      flash[:error] = l(:error_oauth_authentication_failed, message: "Failed to delete OAuth token mapping.")

    end

    redirect_to email_oauth_index_path

  end

  private

  def email_oauth_config

    Redmine::Configuration['email_oauth']

  end

  def get_provider_config(provider)

    return nil if email_oauth_config.blank?

    email_oauth_config['providers']&.[] (provider.to_s)

  end

  def build_auth_uri(provider, config, email)

    redirect_uri = callback_email_oauth_url

    state = session[:email_oauth_state]

    case provider.to_s

    when 'google'

      # Google Workspace OAuth authorize URI

      uri = URI("https://accounts.google.com/o/oauth2/v2/auth")

      uri.query = URI.encode_www_form({

                                        client_id: config['client_id'],

        redirect_uri: redirect_uri,

        response_type: 'code',

        scope: 'https://mail.google.com/',

        state: state,

        login_hint: email,

        access_type: 'offline',

        prompt: 'consent'

                                      })

      uri.to_s

    when 'microsoft'

      # Microsoft Azure AD OAuth authorize URI

      tenant = config['tenant'] || 'common'

      uri = URI("https://login.microsoftonline.com/#{tenant}/oauth2/v2.0/authorize")

      uri.query = URI.encode_www_form({

                                        client_id: config['client_id'],

        redirect_uri: redirect_uri,

        response_type: 'code',

        scope: 'https://outlook.office.com/IMAP.AccessAsUser.All offline_access',

        state: state,

        login_hint: email,

        prompt: 'consent'

                                      })

      uri.to_s

    when 'custom'

      # Custom provider dynamic authorize URL

      uri = URI(config['authorize_url'])

      params = {

        client_id: config['client_id'],

        redirect_uri: redirect_uri,

        response_type: 'code',

        state: state

      }

      params[:scope] = config['scope'] if config['scope'].present?

      params[:login_hint] = email if email.present?

      uri.query = URI.encode_www_form(params)

      uri.to_s

    else

      raise "Unsupported OAuth provider: #{provider}"

    end

  end

  def exchange_and_save_tokens(provider, config, email, code)

    token_uri = case provider.to_s

                when 'google'

                  URI("https://oauth2.googleapis.com/token")

                when 'microsoft'

                  tenant = config['tenant'] || 'common'

                  URI("https://login.microsoftonline.com/#{tenant}/oauth2/v2.0/token")

                when 'custom'

                  URI(config['token_url'])

                end

    payload = {

      client_id: config['client_id'],

      client_secret: config['client_secret'],

      code: code,

      redirect_uri: callback_email_oauth_url,

      grant_type: 'authorization_code'

    }

    res = Net::HTTP.post_form(token_uri, payload)

    if res.is_a?(Net::HTTPSuccess)

      data = JSON.parse(res.body)

      expires_in = data['expires_in'].to_i.seconds

      expires_at = Time.now + expires_in

      # Find or initialize token mapping

      token_record = EmailOauthToken.find_or_initialize_by(email: email)

      token_record.provider = provider

      token_record.access_token = data['access_token']

      token_record.refresh_token = data['refresh_token'] if data['refresh_token'].present?

      token_record.expires_at = expires_at

      token_record.is_valid = true

      token_record.last_error = nil

      if token_record.save

        flash[:notice] = l(:notice_successful_create)

      else

        flash[:error] = l(:error_oauth_authentication_failed, message: token_record.errors.full_messages.join(', '))

      end

    else

      flash[:error] = l(:error_oauth_authentication_failed, message: "[#{res.code}] #{res.body}")

    end

    redirect_to email_oauth_index_path

  end

end

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

class EmailOauthToken < ApplicationRecord

  include Redmine::Ciphering

  validates :email, presence: true, uniqueness: { case_sensitive: false }, format: { with: URI::MailTo::EMAIL_REGEXP }

  validates :provider, presence: true, inclusion: { in: %w[microsoft google custom] }

  validates :refresh_token, presence: true

  validates :expires_at, presence: true

  def access_token

    read_ciphered_attribute(:access_token)

  end

  def access_token=(arg)

    write_ciphered_attribute(:access_token, arg)

  end

  def refresh_token

    read_ciphered_attribute(:refresh_token)

  end

  def refresh_token=(arg)

    write_ciphered_attribute(:refresh_token, arg)

  end

  # Check if the access token has expired

  def expired?

    expires_at.nil? || expires_at <= Time.now

  end

  # Check if a refresh is needed (e.g., if expired or expiring in the next 5 minutes)

  def refresh_needed?

    expired? || expires_at <= 5.minutes.from_now

  end

end

  # Notifies active administrators when an OAuth token refresh fails in background.

  def self.deliver_email_oauth_refresh_failure(token, error_message)

    users = User.active.where(admin: true)

    users.each do |user|

      email_oauth_refresh_failure(user, token, error_message).deliver_later

    end

  end

  # Builds the OAuth refresh failure email.

  def email_oauth_refresh_failure(user, token, error_message)

    @user = user

    @token = token

    @error_message = error_message

    @oauth_settings_url = url_for(controller: 'email_oauth', action: 'index')

    mail to: user.mail,

         subject: "[#{Setting.app_title}] OAuth 2.0 Email Account Authentication Failure"

  end

  # Returns an array containing the names of configured OAuth email providers in configuration.yml

  def self.email_oauth_providers

    config = Redmine::Configuration['email_oauth']

    config ? (config['providers'] || {}).keys : []

  end

<% if EmailOauthToken.where(is_valid: false).any? %>

  <div class="flash error">

    <strong><%= l(:label_warning) %>:</strong>

    One or more configured OAuth 2.0 incoming email accounts have failed to refresh and are currently inactive.

    <%= link_to "Review OAuth status", email_oauth_index_path %>

  </div>

<% end %>

<div class="contextual">

<%= link_to sprite_icon('add', l(:button_add)), new_email_oauth_path, class: 'icon icon-add' %>

</div>

<%= title l(:label_oauth_authentication) %>

<% if @tokens.empty? %>

  <p class="nodata"><%= l(:label_no_data) %></p>

<% else %>

  <table class="list">

    <thead>

      <tr>

        <th><%= l(:field_mail) %></th>

        <th><%= l(:label_provider) %></th>

        <th><%= l(:field_status) %></th>

        <th><%= l(:label_expires_at) %></th>

        <th><%= l(:field_updated_on) %></th>

        <th></th>

      </tr>

    </thead>

    <tbody>

      <% @tokens.each do |token| %>

        <tr class="<%= cycle('odd', 'even') %>">

          <td class="name"><strong><%= token.email %></strong></td>

          <td><%= token.provider.to_s.capitalize %></td>

          <td>

            <% if token.is_valid? %>

              <%= content_tag(:span, sprite_icon("checked"), :class => 'icon-only icon-checked') %>

            <% else %>

              <span class="icon icon-warning">

                <%= token.last_error %>

              </span>

            <% end %>

          </td>

          <td><%= format_time(token.expires_at) %></td>

          <td><%= format_time(token.updated_at) %></td>

          <td class="buttons">

            <%= delete_link destroy_email_oauth_path(token) %>

          </td>

        </tr>

      <% end %>

    </tbody>

  </table>

<% end %>

<%= title [l(:label_oauth_authentication), email_oauth_index_path], l(:button_add) %>

<%= labelled_form_for @token, :as => :email_oauth_token, :url => initiate_email_oauth_path, :html => {:id => 'email_oauth_form'} do |f| %>

  <div class="box tabular">

    <p>

      <%= f.text_field :email, :required => true, :size => 40, :placeholder => "redmine@example.net" %>

      <em class="info"><%= l(:text_oauth_email_username_info_html) %></em>

    </p>

    <p>

      <%= f.select :provider, Setting.email_oauth_providers.map {|p| [p.capitalize, p]}, :required => true, :label => l(:label_provider) %>

    </p>

  </div>

  <%= submit_tag t('doorkeeper.applications.buttons.authorize') %>

<% end %>

<p>Hello <%= @user.name %>,</p>

<p>An error occurred while attempting to refresh the OAuth 2.0 access token for the following incoming email account:</p>

<ul>

  <li><strong>Email Account:</strong> <%= @token.email %></li>

  <li><strong>Provider:</strong> <%= @token.provider.capitalize %></li>

  <li><strong>Error Message:</strong> <%= @error_message %></li>

  <li><strong>Failed At:</strong> <%= Time.now %></li>

</ul>

<p>As a result, Redmine is currently unable to fetch and process incoming emails from this mailbox.</p>

<p>Please log in to Redmine as an administrator, review the error, and re-authorize the account:</p>

<p><%= link_to l(:label_manage_oauth_emails), @oauth_settings_url %></p>

Hello <%= @user.name %>,

An error occurred while attempting to refresh the OAuth 2.0 access token for the following incoming email account:

Email Account: <%= @token.email %>

Provider: <%= @token.provider.capitalize %>

Error Message: <%= @error_message %>

Failed At: <%= Time.now %>

As a result, Redmine is currently unable to fetch and process incoming emails from this mailbox.

Please log in to Redmine as an administrator, review the error, and re-authorize the account:

<%= @oauth_settings_url %>

<div class="box tabular settings">

  <h3><%= l(:label_oauth_authentication) %></h3>

  <% if Setting.email_oauth_providers.empty? %>

    <div class="nodata">

      <%= simple_format(l(:text_email_oauth_providers_not_configured)) %>

    </div>

  <% else %>

    <fieldset class="box settings">

    <legend><%= l(:setting_enabled_oauth_providers) %></legend>

    <ul>

    <% Setting.email_oauth_providers.each do |provider| %>

      <li><span><%= provider.capitalize %></span></li>

    <% end %>

    </ul>

    </fieldset>

      <%= link_to l(:label_manage_oauth_emails), email_oauth_index_path, class: 'icon icon-server-authentication' %>

  <% end %>

</div>

  setting_enabled_oauth_providers: Enabled OAuth providers

  label_oauth_authentication: OAuth 2.0 Authentication

  label_manage_oauth_emails: Manage OAuth 2.0 Email Accounts

  label_provider: Provider

  label_expires_at: Expires at

  text_email_oauth_providers_not_configured: "Email OAuth providers are not configured.\nPlease configure them in config/configuration.yml and restart the application to enable them."

  text_oauth_email_username_info_html: Must exactly match the <code>username</code> parameter used in the background IMAP fetch job.

  error_oauth_authentication_failed: "OAuth authentication failed: %{message}"

  # OAuth incoming emails configuration

  get 'admin/mail_handler/oauth', :to => 'email_oauth#index', :as => 'email_oauth_index'

  get 'admin/mail_handler/oauth/new', :to => 'email_oauth#new', :as => 'new_email_oauth'

  post 'admin/mail_handler/oauth/initiate', :to => 'email_oauth#initiate', :as => 'initiate_email_oauth'

  get 'admin/mail_handler/oauth/callback', :to => 'email_oauth#callback', :as => 'callback_email_oauth'

  delete 'admin/mail_handler/oauth/:id', :to => 'email_oauth#destroy', :as => 'destroy_email_oauth'

class CreateEmailOauthTokens < ActiveRecord::Migration[8.1]

  def change

    create_table :email_oauth_tokens do |t|

      t.string :email, null: false

      t.string :provider, null: false

      t.text :access_token

      t.text :refresh_token, null: false

      t.datetime :expires_at, null: false

      t.boolean :is_valid, default: true, null: false

      t.text :last_error

      t.timestamps

    end

    add_index :email_oauth_tokens, :email, unique: true

  end

end

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

require 'net/http'

require 'uri'

require 'json'

module Redmine

  module EmailOAuth

    class Refresher

      class << self

        def refresh!(token, force: false)

          return true if !force && !token.refresh_needed?

          config = Redmine::Configuration['email_oauth']

          provider_config = config&.[]('providers')&.[](token.provider.to_s)

          if provider_config.blank?

            error_msg = "Provider configuration for '#{token.provider}' is missing in configuration.yml."

            handle_failure(token, error_msg)

            return false

          end

          token_uri = token_endpoint(token.provider, provider_config)

          payload = refresh_payload(token, provider_config)

          begin

            res = Net::HTTP.post_form(token_uri, payload)

            if res.is_a?(Net::HTTPSuccess)

              data = JSON.parse(res.body)

              expires_in = (data['expires_in'] || 3600).to_i.seconds

              token.access_token = data['access_token']

              token.refresh_token = data['refresh_token'] if data['refresh_token'].present?

              token.expires_at = Time.now + expires_in

              token.is_valid = true

              token.last_error = nil

              if token.save

                true

              else

                error_msg = "Failed to save refreshed token: #{token.errors.full_messages.join(', ')}"

                handle_failure(token, error_msg)

                false

              end

            else

              error_msg = "OAuth provider returned error [#{res.code}]: #{res.body}"

              handle_failure(token, error_msg)

              false

            end

          rescue => e

            error_msg = "Exception during token refresh: #{e.message}"

            handle_failure(token, error_msg)

            false

          end

        end

        private

        def token_endpoint(provider, config)

          case provider.to_s

          when 'google'

            URI("https://oauth2.googleapis.com/token")

          when 'microsoft'

            tenant = config['tenant'] || 'common'

            URI("https://login.microsoftonline.com/#{tenant}/oauth2/v2.0/token")

          when 'custom'

            URI(config['token_url'])

          else

            raise "Unsupported provider: #{provider}"

          end

        end

        def refresh_payload(token, config)

          payload = {

            client_id: config['client_id'],

            client_secret: config['client_secret'],

            refresh_token: token.refresh_token,

            grant_type: 'refresh_token'

          }

          if token.provider == 'microsoft'

            payload[:scope] = 'https://outlook.office.com/IMAP.AccessAsUser.All offline_access'

          elsif token.provider == 'custom' && config['scope'].present?

            payload[:scope] = config['scope']

          end

          payload

        end

        def handle_failure(token, error_message)

          token.is_valid = false

          token.last_error = error_message

          token.save(validate: false) # Skip validation if we are just marking as invalid

          # Send email alert to system administrators

          begin

            Mailer.deliver_email_oauth_refresh_failure(token, error_message)

          rescue => e

            Rails.logger.error "Failed to send OAuth refresh failure email: #{e.message}"

          end

        end

      end

    end

  end

end

require_relative 'email_oauth/refresher'

        if imap_options[:username].present?

          token_record = EmailOauthToken.find_by(email: imap_options[:username])

          if token_record

            # Refresh token if needed

            if Redmine::EmailOAuth::Refresher.refresh!(token_record)

              imap.authenticate('XOAUTH2', imap_options[:username], token_record.access_token)

            else

              raise "OAuth 2.0 authentication failed for #{imap_options[:username]}: #{token_record.last_error}"

            end

          else

            imap.login(imap_options[:username], imap_options[:password])

          end

        end

  def test_index_shows_oauth_warning_banner_when_token_is_invalid

    EmailOauthToken.delete_all

    EmailOauthToken.create!(

      email: 'bad-token@example.net',

      provider: 'microsoft',

      refresh_token: 'refresh',

      expires_at: 10.minutes.ago,

      is_valid: false

    )

    get :index

    assert_select 'div.flash.error', :text => /One or more configured OAuth 2.0 incoming email accounts/

  end

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

require_relative '../test_helper'

class EmailOauthControllerTest < Redmine::ControllerTest

  def setup

    User.current = nil

    @request.session[:user_id] = 1 # Admin User

    EmailOauthToken.delete_all

    # Configure mock OAuth settings

    @mock_config = {

      'providers' => {

        'google' => {

          'client_id' => 'google_id',

          'client_secret' => 'google_secret'

        },

        'microsoft' => {

          'client_id' => 'ms_id',

          'client_secret' => 'ms_secret',

          'tenant' => 'common'

        }

      }

    }

  end

  def test_index_should_require_admin

    @request.session[:user_id] = nil # Anonymous

    get :index

    assert_response :redirect

    assert_redirected_to '/login?back_url=http%3A%2F%2Ftest.host%2Fadmin%2Fmail_handler%2Foauth'

    @request.session[:user_id] = 2 # Non-admin user

    get :index

    assert_response :forbidden

  end

  def test_index

    EmailOauthToken.create!(

      email: 'redmine@example.net',

      provider: 'google',

      refresh_token: 'refresh',

      expires_at: 1.hour.from_now

    )

    get :index

    assert_response :success

    assert_select 'tr td.name strong', text: 'redmine@example.net'

  end

  def test_new

    Redmine::Configuration.with 'email_oauth' => @mock_config do

      get :new

      assert_response :success

      assert_select 'select[name=?]', 'email_oauth_token[provider]' do

        assert_select 'option[value=google]', text: 'Google'

        assert_select 'option[value=microsoft]', text: 'Microsoft'

      end

    end

  end

  def test_initiate_redirects_to_google

    Redmine::Configuration.with 'email_oauth' => @mock_config do

      post :initiate, params: {

        email_oauth_token: {

          email: 'test@example.net',

          provider: 'google'

        }

      }

      # Verify redirection to Google's authorize URL

      assert_response :redirect

      assert_match %r{\Ahttps://accounts\.google\.com/o/oauth2/v2/auth}, @response.redirect_url

      assert_match %r{client_id=google_id}, @response.redirect_url

      assert_match %r{scope=https%3A%2F%2Fmail\.google\.com%2F}, @response.redirect_url

      assert_match %r{login_hint=test%40example\.net}, @response.redirect_url

      # Verify session is populated for callback verification

      assert_equal 'test@example.net', session[:email_oauth_email]

      assert_equal 'google', session[:email_oauth_provider]

      assert_not_nil session[:email_oauth_state]

    end

  end

  def test_initiate_redirects_to_microsoft

    Redmine::Configuration.with 'email_oauth' => @mock_config do

      post :initiate, params: {

        email_oauth_token: {

          email: 'ms@example.net',

          provider: 'microsoft'

        }

      }

      # Verify redirection to MS Azure authorize URL

      assert_response :redirect

      assert_match %r{\Ahttps://login\.microsoftonline\.com/common/oauth2/v2\.0/authorize}, @response.redirect_url

      assert_match %r{client_id=ms_id}, @response.redirect_url

      assert_match %r{scope=https%3A%2F%2Foutlook\.office\.com%2FIMAP\.AccessAsUser\.All\+offline_access}, @response.redirect_url

    end

  end

  def test_callback_success

    Redmine::Configuration.with 'email_oauth' => @mock_config do

      # Set up active authorization session state

      state_token = 'securestate'

      @request.session[:email_oauth_state] = state_token

      @request.session[:email_oauth_email] = 'success@example.net'

      @request.session[:email_oauth_provider] = 'google'

      # Mock successful token exchange response from Google

      mock_response = Net::HTTPSuccess.new('1.1', '200', 'OK')

      mock_response.stubs(:body).returns({

        access_token: 'mock_access',

        refresh_token: 'mock_refresh',

        expires_in: 3600

      }.to_json)

      Net::HTTP.expects(:post_form).with(

        URI("https://oauth2.googleapis.com/token"),

        {

          client_id: 'google_id',

          client_secret: 'google_secret',

          code: 'auth_code_123',

          redirect_uri: 'http://test.host/admin/mail_handler/oauth/callback',

          grant_type: 'authorization_code'

        }

      ).returns(mock_response)

      get :callback, params: {

        state: state_token,

        code: 'auth_code_123'

      }

      # Should redirect to index with success message

      assert_response :redirect

      assert_redirected_to email_oauth_index_path

      assert_equal I18n.t(:notice_successful_create), flash[:notice]

      # Verify record was created/updated in the database

      token = EmailOauthToken.find_by(email: 'success@example.net')

      assert_not_nil token

      assert_equal 'google', token.provider

      assert_equal 'mock_access', token.access_token

      assert_equal 'mock_refresh', token.refresh_token

      assert token.expires_at > Time.now

      assert token.is_valid?

    end

  end

  def test_destroy

    token = EmailOauthToken.create!(

      email: 'delete_me@example.net',

      provider: 'google',

      refresh_token: 'refresh',

      expires_at: 1.hour.from_now

    )

    assert_difference 'EmailOauthToken.count', -1 do

      delete :destroy, params: { id: token.id }

    end

    assert_redirected_to email_oauth_index_path

    assert_equal I18n.t(:notice_successful_delete), flash[:notice]

  end

end

  def test_get_index_with_mail_handler_tab_renders_oauth_providers

    @request.session[:user_id] = 1 # Admin

    mock_config = {

      'providers' => {

        'google' => { 'client_id' => 'g', 'client_secret' => 's' },

        'microsoft' => { 'client_id' => 'm', 'client_secret' => 's' }

      }

    }

    Redmine::Configuration.with 'email_oauth' => mock_config do

      get :index, :params => { :tab => 'mail_handler' }

      assert_response :success

      assert_select 'legend', :text => 'Enabled OAuth providers'

      assert_select 'fieldset.settings ul li span', :text => 'Google'

      assert_select 'fieldset.settings ul li span', :text => 'Microsoft'

    end

  end

  def test_get_index_with_mail_handler_tab_renders_no_oauth_providers_message

    @request.session[:user_id] = 1 # Admin

    Redmine::Configuration.with 'email_oauth' => nil do

      get :index, :params => { :tab => 'mail_handler' }

      assert_response :success

      assert_select 'div.nodata', :text => /Email OAuth providers are not configured/

    end

  end

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

require_relative '../test_helper'

require 'redmine/email_oauth/refresher'

class EmailOauthRefresherTest < ActiveSupport::TestCase

  fixtures :users

  def setup

    EmailOauthToken.delete_all

    @token = EmailOauthToken.create!(

      email: 'oauth-test@example.net',

      provider: 'google',

      access_token: 'initial_access_token',

      refresh_token: 'initial_refresh_token',

      expires_at: 10.minutes.ago,

      is_valid: true

    )

    # Clear any deliveries

    ActionMailer::Base.deliveries.clear

  end

  def test_refresh_not_needed

    @token.update!(expires_at: 1.hour.from_now)

    # No Net::HTTP requests should be made

    Net::HTTP.expects(:post_form).never

    assert Redmine::EmailOAuth::Refresher.refresh!(@token)

    assert @token.is_valid?

    assert_nil @token.last_error

  end

  def test_refresh_with_missing_config

    Redmine::Configuration.with 'email_oauth' => nil do

      assert_not Redmine::EmailOAuth::Refresher.refresh!(@token)

      @token.reload

      assert_not @token.is_valid?

      assert_match /missing in configuration.yml/, @token.last_error

      assert_equal 1, ActionMailer::Base.deliveries.size

    end

  end

  def test_refresh_success

    config = {

      'providers' => {

        'google' => {

          'client_id' => 'google_id',

          'client_secret' => 'google_secret'

        }

      }

    }

    mock_response = mock('response')

    mock_response.stubs(:is_a?).with(Net::HTTPSuccess).returns(true)

    mock_response.stubs(:body).returns({

      'access_token' => 'new_access_token',

      'expires_in' => 3600

    }.to_json)

    Redmine::Configuration.with 'email_oauth' => config do

      Net::HTTP.expects(:post_form).with(

        URI("https://oauth2.googleapis.com/token"),

        {

          client_id: 'google_id',

          client_secret: 'google_secret',

          refresh_token: 'initial_refresh_token',

          grant_type: 'refresh_token'

        }

      ).returns(mock_response)

      assert Redmine::EmailOAuth::Refresher.refresh!(@token)

      @token.reload

      assert_equal 'new_access_token', @token.access_token

      assert @token.is_valid?

      assert_nil @token.last_error

      assert_equal 0, ActionMailer::Base.deliveries.size

    end

  end

  def test_refresh_custom_provider_success

    @token.update!(provider: 'custom', refresh_token: 'custom_refresh')

    config = {

      'providers' => {

        'custom' => {

          'client_id' => 'custom_id',

          'client_secret' => 'custom_secret',

          'token_url' => 'https://oauth.custom.local/token',

          'scope' => 'custom_scope'

        }

      }

    }

    mock_response = mock('response')

    mock_response.stubs(:is_a?).with(Net::HTTPSuccess).returns(true)

    mock_response.stubs(:body).returns({

      'access_token' => 'new_custom_access_token',

      'expires_in' => 1800

    }.to_json)

    Redmine::Configuration.with 'email_oauth' => config do

      Net::HTTP.expects(:post_form).with(

        URI("https://oauth.custom.local/token"),

        {

          client_id: 'custom_id',

          client_secret: 'custom_secret',

          refresh_token: 'custom_refresh',

          grant_type: 'refresh_token',

          scope: 'custom_scope'

        }

      ).returns(mock_response)

      assert Redmine::EmailOAuth::Refresher.refresh!(@token)

      @token.reload

      assert_equal 'new_custom_access_token', @token.access_token

      assert @token.is_valid?

      assert_nil @token.last_error

    end

  end

  def test_refresh_failure

    config = {

      'providers' => {

        'google' => {

          'client_id' => 'google_id',

          'client_secret' => 'google_secret'

        }

      }

    }

    mock_response = mock('response')

    mock_response.stubs(:is_a?).with(Net::HTTPSuccess).returns(false)

    mock_response.stubs(:code).returns('400')

    mock_response.stubs(:body).returns('{"error":"invalid_grant"}')

    Redmine::Configuration.with 'email_oauth' => config do

      Net::HTTP.expects(:post_form).returns(mock_response)

      assert_not Redmine::EmailOAuth::Refresher.refresh!(@token)

      @token.reload

      assert_not @token.is_valid?

      assert_match /invalid_grant/, @token.last_error

      assert_equal 1, ActionMailer::Base.deliveries.size

      # Check email delivery content

      mail = ActionMailer::Base.deliveries.first

      assert_match /OAuth 2.0 Email Account Authentication Failure/, mail.subject

      assert_match /oauth-test@example.net/, mail.body.encoded

    end

  end

  def test_imap_integration_with_oauth

    @token.update!(expires_at: 1.hour.from_now)

    mock_imap = mock('imap')

    Net::IMAP.expects(:new).with('127.0.0.1', port: '143', ssl: false).returns(mock_imap)

    mock_imap.expects(:authenticate).with('XOAUTH2', 'oauth-test@example.net', 'initial_access_token')

    mock_imap.expects(:select).with('INBOX')

    mock_imap.expects(:uid_search).with(['NOT', 'SEEN']).returns([])

    mock_imap.expects(:expunge)

    mock_imap.expects(:logout)

    mock_imap.expects(:disconnect)

    Redmine::IMAP.check({

      host: '127.0.0.1',

      port: '143',

      username: 'oauth-test@example.net'

    })

  end

  def test_imap_integration_fallback_to_login

    mock_imap = mock('imap')

    Net::IMAP.expects(:new).with('127.0.0.1', port: '143', ssl: false).returns(mock_imap)

    mock_imap.expects(:login).with('plain-user@example.net', 'password')

    mock_imap.expects(:select).with('INBOX')

    mock_imap.expects(:uid_search).with(['NOT', 'SEEN']).returns([])

    mock_imap.expects(:expunge)

    mock_imap.expects(:logout)

    mock_imap.expects(:disconnect)

    Redmine::IMAP.check({

      host: '127.0.0.1',

      port: '143',

      username: 'plain-user@example.net',

      password: 'password'

    })

  end

end

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

require_relative '../test_helper'

class EmailOauthTokenTest < ActiveSupport::TestCase

  def setup

    EmailOauthToken.delete_all

  end

  def test_validations

    # Valid record

    token = EmailOauthToken.new(

      email: 'redmine@example.net',

      provider: 'microsoft',

      refresh_token: 'valid_refresh_token',

      expires_at: 1.hour.from_now

    )

    assert token.valid?

    # Missing email

    token.email = nil

    assert_not token.valid?

    assert_includes token.errors[:email], "cannot be blank"

    # Invalid email format

    token.email = 'not-an-email'

    assert_not token.valid?

    # Missing provider

    token.email = 'redmine@example.net'

    token.provider = nil

    assert_not token.valid?

    # Invalid provider

    token.provider = 'invalid_provider'

    assert_not token.valid?

    # Duplicate email (case-insensitive)

    EmailOauthToken.create!(

      email: 'redmine@example.net',

      provider: 'microsoft',

      refresh_token: 'token1',

      expires_at: 1.hour.from_now

    )

    duplicate = EmailOauthToken.new(

      email: 'REDMINE@example.net',

      provider: 'google',

      refresh_token: 'token2',

      expires_at: 1.hour.from_now

    )

    assert_not duplicate.valid?

    assert_includes duplicate.errors[:email], "has already been taken"

  end

  def test_ciphering

    Redmine::Configuration.with 'database_cipher_key' => 'secret' do

      token = EmailOauthToken.create!(

        email: 'redmine@example.net',

        provider: 'google',

        access_token: 'secret_access',

        refresh_token: 'secret_refresh',

        expires_at: 1.hour.from_now

      )

      # In-memory reading should be transparently decrypted

      assert_equal 'secret_access', token.access_token

      assert_equal 'secret_refresh', token.refresh_token

      # Reading raw database attributes should show encrypted values (with 'aes-256-cbc:')

      raw_record = ActiveRecord::Base.connection.select_one(

        "SELECT access_token, refresh_token FROM email_oauth_tokens WHERE id = #{token.id}"

      )

      assert_match /\Aaes-256-cbc:/, raw_record['access_token']

      assert_match /\Aaes-256-cbc:/, raw_record['refresh_token']

    end

  end

  def test_expired_and_refresh_needed

    token = EmailOauthToken.new(

      email: 'redmine@example.net',

      provider: 'microsoft',

      refresh_token: 'refresh',

      expires_at: 10.minutes.ago

    )

    assert token.expired?

    assert token.refresh_needed?

    token.expires_at = 2.minutes.from_now

    assert_not token.expired?

    assert token.refresh_needed? # within 5 minutes grace period

    token.expires_at = 10.minutes.from_now

    assert_not token.expired?

    assert_not token.refresh_needed?

  end

end