Merge pull request #12954 from edx/renzo/extract-token-generation

Unify JWT generation code

cms/djangoapps/contentstore/views/program.py

@@ -1,14 +1,16 @@
 """Programs views for use with Studio."""
 from django.conf import settings
 from django.contrib.auth.decorators import login_required
+from django.core.exceptions import ImproperlyConfigured
 from django.core.urlresolvers import reverse
 from django.http import Http404, JsonResponse
 from django.utils.decorators import method_decorator
 from django.views.generic import View
+from provider.oauth2.models import Client
 
 from edxmako.shortcuts import render_to_response
 from openedx.core.djangoapps.programs.models import ProgramsApiConfig
-from openedx.core.lib.token_utils import get_id_token
+from openedx.core.lib.token_utils import JwtBuilder
 
 
 class ProgramAuthoringView(View):
@@ -44,7 +46,24 @@ class ProgramsIdTokenView(View):
     def get(self, request, *args, **kwargs):
         """Generate and return a token, if the integration is enabled."""
         if ProgramsApiConfig.current().is_studio_tab_enabled:
-            id_token = get_id_token(request.user, 'programs')
-            return JsonResponse({'id_token': id_token})
+            # TODO: Use the system's JWT_AUDIENCE and JWT_SECRET_KEY instead of client ID and name.
+            client_name = 'programs'
+
+            try:
+                client = Client.objects.get(name=client_name)
+            except Client.DoesNotExist:
+                raise ImproperlyConfigured(
+                    'OAuth2 Client with name [{}] does not exist.'.format(client_name)
+                )
+
+            scopes = ['email', 'profile']
+            expires_in = settings.OAUTH_ID_TOKEN_EXPIRATION
+            jwt = JwtBuilder(request.user, secret=client.client_secret).build_token(
+                scopes,
+                expires_in,
+                aud=client.client_id
+            )
+
+            return JsonResponse({'id_token': jwt})
         else:
             raise Http404

cms/djangoapps/contentstore/views/tests/test_programs.py

@@ -147,18 +147,17 @@ class TestProgramsIdTokenView(ProgramsApiConfigMixin, SharedModuleStoreTestCase)
         self.assertEqual(response.status_code, 302)
         self.assertIn(settings.LOGIN_URL, response['Location'])
 
-    @mock.patch('cms.djangoapps.contentstore.views.program.get_id_token', return_value='test-id-token')
-    def test_config_enabled(self, mock_get_id_token):
+    @mock.patch('cms.djangoapps.contentstore.views.program.JwtBuilder.build_token')
+    def test_config_enabled(self, mock_build_token):
         """
         Ensure the endpoint responds with a valid JSON payload when authoring
         is enabled.
         """
+        mock_build_token.return_value = 'test-id-token'
+        ClientFactory(name=ProgramsApiConfig.OAUTH2_CLIENT_NAME, client_type=CONFIDENTIAL)
+
         self.create_programs_config()
         response = self.client.get(self.path)
         self.assertEqual(response.status_code, 200)
         payload = json.loads(response.content)
-        self.assertEqual(payload, {"id_token": "test-id-token"})
-        # this comparison is a little long-handed because we need to compare user instances directly
-        user, client_name = mock_get_id_token.call_args[0]
-        self.assertEqual(user, self.user)
-        self.assertEqual(client_name, "programs")
+        self.assertEqual(payload, {'id_token': 'test-id-token'})

cms/envs/aws.py

@@ -448,6 +448,9 @@ MICROSITE_DATABASE_TEMPLATE_CACHE_TTL = ENV_TOKENS.get(
 # OpenID Connect issuer ID. Normally the URL of the authentication endpoint.
 OAUTH_OIDC_ISSUER = ENV_TOKENS['OAUTH_OIDC_ISSUER']
 
+#### JWT configuration ####
+JWT_AUTH.update(ENV_TOKENS.get('JWT_AUTH', {}))
+
 ######################## CUSTOM COURSES for EDX CONNECTOR ######################
 if FEATURES.get('CUSTOM_COURSES_EDX'):
     INSTALLED_APPS += ('openedx.core.djangoapps.ccxcon',)

cms/envs/common.py

@@ -75,6 +75,8 @@ from lms.envs.common import (
     # constants for redirects app
     REDIRECT_CACHE_TIMEOUT,
     REDIRECT_CACHE_KEY_PREFIX,
+
+    JWT_AUTH,
 )
 from path import Path as path
 from warnings import simplefilter

cms/envs/test.py

@@ -35,6 +35,7 @@ from lms.envs.test import (
     MEDIA_ROOT,
     MEDIA_URL,
     COMPREHENSIVE_THEME_DIRS,
+    JWT_AUTH,
 )
 
 # mongo connection settings