From 5d110c6fe0c5e8a840fc3c9a1fe7577bf02eeef0 Mon Sep 17 00:00:00 2001
From: Fernando Valverde <fdov88@gmail.com>
Date: Thu, 24 Sep 2020 11:57:51 -0600
Subject: [PATCH] Fixes Omniauth redirect_uri when SiteConfig.app_domain is
 updated (#10432)

* Makes Omniauth rely on Proc instead of initializer value for redirect uri

* Adds SiteConfig.app_domain test for OAuth providers callback_url generation

* Fixes protocol mismatch in test

* Fixes URL encoding problem with query params in test
---
 config/initializers/omniauth.rb               |  2 +-
 .../omniauth_redirect_uri_spec.rb             | 35 +++++++++++++++++++
 2 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 spec/system/authentication/omniauth_redirect_uri_spec.rb

diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb
index c6d801647..57c4f10fb 100644
--- a/config/initializers/omniauth.rb
+++ b/config/initializers/omniauth.rb
@@ -1,2 +1,2 @@
 OmniAuth.config.logger = Rails.logger
-OmniAuth.config.full_host = URL.url
+OmniAuth.config.full_host = proc { URL.url }
diff --git a/spec/system/authentication/omniauth_redirect_uri_spec.rb b/spec/system/authentication/omniauth_redirect_uri_spec.rb
new file mode 100644
index 000000000..3ab74be25
--- /dev/null
+++ b/spec/system/authentication/omniauth_redirect_uri_spec.rb
@@ -0,0 +1,35 @@
+require "rails_helper"
+
+RSpec.describe "Omniauth redirect_uri", type: :system do
+  let!(:test_app_domain) { SiteConfig.app_domain }
+
+  # Avoid messing with other tests by resetting back SiteConfig.app_domain
+  after { SiteConfig.app_domain = test_app_domain }
+
+  def provider_redirect_regex(provider_name)
+    # URL encoding translates the query params (i.e. colons/slashes/etc)
+    %r{
+      /users/auth/#{provider_name}
+      \?callback_url=#{ERB::Util.url_encode(URL.protocol)}
+      #{ERB::Util.url_encode(SiteConfig.app_domain)}
+      #{ERB::Util.url_encode("/users/auth/#{provider_name}/callback")}
+    }x
+  end
+
+  it "relies on SiteConfig.app_domain to generate correct callbacks_url" do
+    visit sign_up_path
+    Authentication::Providers.available.each do |provider_name|
+      provider_auth_url = find("a.crayons-btn--brand-#{provider_name}")["href"]
+      expect(provider_auth_url).to match(provider_redirect_regex(provider_name))
+    end
+
+    SiteConfig.app_domain = "test.forem.com"
+    visit sign_up_path
+
+    # After an update the callback_url should now match SiteConfig.app_domain
+    Authentication::Providers.available.each do |provider_name|
+      provider_auth_url = find("a.crayons-btn--brand-#{provider_name}")["href"]
+      expect(provider_auth_url).to match(provider_redirect_regex(provider_name))
+    end
+  end
+end