anyoauth-sdk 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 28c09676d41c9d6b86f8599043828ee352ffa54ba48354402f0f63abf65dec1a
+  data.tar.gz: 88a3a0290ec255ebe55aeadee5ed6781238b38a1ac2b907cb95916f7046d5444
+SHA512:
+  metadata.gz: b7d28499e334796ebd40116be9c1c184acf638aaee9b5a75cb57b8342c1fe9feb6db0d43f11aee5dee0ff5ca3d7349ee807fb48d0aeb327d025a952217cc5524
+  data.tar.gz: 20fe8772718f39fce34398c97f8127cea1fe86b9c85f2780de08fba131fc21ee4f21487ad81f70b1a652b3b5dbe80448efacc31f1163df6c40ba17c2e641ac40

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) AnyOAuth contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,51 @@
+# anyoauth-sdk
+
+Generated AnyOAuth ruby confidential-backend SDK, version 0.1.0. MIT licensed. Model descriptors are generated from OpenAPI and embedded in the runtime (also published in schema.json). Objects use JSON field names; optional additive response fields are preserved.
+
+## Install / build
+
+Build with `gem build anyoauth-sdk.gemspec`, then install the resulting gem. Require `anyoauth`.
+
+From this SDK repository root:
+
+```sh
+ruby -c lib/anyoauth.rb
+ruby -c tests/conformance.rb
+python3 tests/selftest.py
+ruby tests/conformance.rb < input.json
+```
+
+The runner reads one JSON object and prints one JSON result. Example input: `{"action":"pkceChallenge","params":{"codeVerifier":"dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"}}`. Tests use a local HTTP server and dummy credentials only.
+
+## Public API
+
+Construct `AnyOAuth::Client.new(client_id, client_secret, base_url)`. The origin defaults to https://api.anyoauth.com. Each operation accepts a parameter hash with string keys.
+
+- `exchange_code`
+- `profile`
+- `revoke`
+- `providers`
+- `pkce_challenge`
+- `authorization_url`
+- `validate_callback`
+- `create_transaction`
+
+Canonical parameters: exchangeCode {code, codeVerifier, redirectUri}; profile/revoke {accessToken}; pkceChallenge {codeVerifier}; authorizationUrl {provider, redirectUri, state, codeChallenge}; validateCallback {callbackUrl, redirectUri, state, expiresAt}; createTransaction {}. Revocation returns null/nil. Errors expose status, code and safe message. Default timeout is 10 seconds with no redirects or retries.
+
+Persist the transaction in the initiating browser's server session, binding it to the exact registered callback. Construct the authorization URL locally, then navigate the browser. Validate the callback and consume the saved transaction atomically (including provider denial). Exchange once with the original verifier, retrieve profile, identify by subject rather than email, and create your application's session. Nullable profile fields are legitimate. Keep secrets on the backend; never put tokens or the verifier in URLs. Helpers do not manage session storage.
+
+Generated reproducibly by `node sdks/generate.mjs --target=ruby`; edit sdks/templates/server-dynamic.mjs rather than generated sources.
+
+## Standalone conformance
+
+Run `node tests/check.mjs` from this package after installing/building dependencies. The shared suite exercises all eight public actions through the native runtime, schema failures, wire formats, redirects, no retries, and deadlines. Node is a test harness dependency only.
+
+## Source and releases
+
+Repository: https://github.com/AnyOAuth/anyoauth-ruby
+
+GitHub prerelease: https://github.com/AnyOAuth/anyoauth-ruby/releases/tag/v0.1.0
+
+Clone this repository, then run `node verify.mjs` with the native toolchain installed to build and execute the package's conformance suite. Source is generated in the AnyOAuth monorepo; propose changes there so every language stays aligned. GitHub hosts source archives and checksums. Package registry publication is separate.
+
+This initial source release has full advertised-method conformance coverage. Runtime line/branch coverage for the whole language matrix remains a separate release gate; see https://anyoauth.com/docs/libraries/.

data/lib/anyoauth.rb

@@ -0,0 +1,156 @@
+require 'json'
+require 'uri'
+require 'net/http'
+require 'openssl'
+require 'securerandom'
+require 'base64'
+require 'digest'
+
+module AnyOAuth
+  DESCRIPTORS = JSON.parse('{"schemas":{"Provider":{"type":"string","enum":["google","github"]},"RedirectUri":{"type":"string","format":"uri","maxLength":2048,"x-validation":"redirect","description":"Exact registered HTTPS URL or HTTP loopback; no credentials, query or fragment."},"TokenRequest":{"type":"object","additionalProperties":false,"required":["grant_type","client_id","client_secret","code","redirect_uri","code_verifier"],"properties":{"grant_type":{"type":"string","const":"authorization_code"},"client_id":{"type":"string","maxLength":100},"client_secret":{"type":"string","minLength":1,"maxLength":200},"code":{"type":"string","minLength":1,"maxLength":200},"redirect_uri":{"$ref":"#/components/schemas/RedirectUri"},"code_verifier":{"type":"string","pattern":"^[A-Za-z0-9._~-]{43,128}$"}}},"TokenResponse":{"type":"object","required":["access_token","token_type","expires_in","scope"],"properties":{"access_token":{"type":"string","pattern":"^aop_[A-Za-z0-9_-]{43}$"},"token_type":{"type":"string","const":"Bearer"},"expires_in":{"type":"integer","const":900},"scope":{"type":"string","const":"profile"}}},"Profile":{"type":"object","required":["subject","provider","providerSubject","name","username","email","emailVerified","avatarUrl"],"properties":{"subject":{"type":"string"},"provider":{"$ref":"#/components/schemas/Provider"},"providerSubject":{"type":"string"},"name":{"type":["string","null"]},"username":{"type":["string","null"]},"email":{"type":["string","null"]},"emailVerified":{"type":"boolean"},"avatarUrl":{"type":["string","null"]}}},"ProviderStatus":{"type":"object","required":["id","configured","enabled","available"],"properties":{"id":{"$ref":"#/components/schemas/Provider"},"configured":{"type":"boolean"},"enabled":{"type":"boolean"},"available":{"type":"boolean"}}},"ProviderStatuses":{"type":"array","items":{"$ref":"#/components/schemas/ProviderStatus"}},"ApiError":{"type":"object","required":["error"],"properties":{"error":{"type":"string"},"message":{"type":"string"}}},"Transaction":{"type":"object","required":["state","codeVerifier","codeChallenge","createdAt","expiresAt"],"properties":{"state":{"type":"string","pattern":"^[A-Za-z0-9_-]{43}$"},"codeVerifier":{"type":"string","pattern":"^[A-Za-z0-9._~-]{43,128}$"},"codeChallenge":{"type":"string","pattern":"^[A-Za-z0-9_-]{43}$"},"createdAt":{"type":"integer"},"expiresAt":{"type":"integer"}}}},"operations":{"exchangeCode":{"id":"exchangeCode","path":"/v1/token","method":"POST","auth":"client","requestSchema":"TokenRequest","responseSchema":"TokenResponse","successStatus":200,"inputs":{"grant_type":{"constant":"authorization_code"},"client_id":{"param":"clientId"},"client_secret":{"param":"clientSecret"},"code":{"param":"code"},"redirect_uri":{"param":"redirectUri"},"code_verifier":{"param":"codeVerifier"}}},"profile":{"id":"profile","path":"/v1/profile","method":"GET","auth":"bearer","requestSchema":null,"responseSchema":"Profile","successStatus":200,"inputs":{}},"revoke":{"id":"revoke","path":"/v1/revoke","method":"POST","auth":"bearer","requestSchema":null,"responseSchema":null,"successStatus":204,"inputs":{}},"providers":{"id":"providers","path":"/api/providers","method":"GET","auth":"none","requestSchema":null,"responseSchema":"ProviderStatuses","successStatus":200,"inputs":{}}},"authorization":{"path":"/authorize","parameters":[{"name":"client_id","in":"query","required":true,"schema":{"type":"string","minLength":1}},{"name":"provider","in":"query","required":true,"schema":{"$ref":"#/components/schemas/Provider"}},{"name":"redirect_uri","in":"query","required":true,"schema":{"$ref":"#/components/schemas/RedirectUri"}},{"name":"state","in":"query","required":true,"schema":{"type":"string","minLength":16,"maxLength":512}},{"name":"code_challenge","in":"query","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_-]{43}$"}},{"name":"code_challenge_method","in":"query","required":true,"schema":{"type":"string","const":"S256"}},{"name":"response_type","in":"query","required":true,"schema":{"type":"string","const":"code"}}]},"transaction":{"lifetimeSeconds":600,"entropyBytes":32,"description":"Create random state and a PKCE verifier/challenge. Persist this transaction in the initiating browser or app session.","input":{"type":"object","properties":{},"additionalProperties":false}},"defaultOrigin":"https://api.anyoauth.com"}')
+  SCHEMAS = DESCRIPTORS.fetch('schemas')
+  class Error < StandardError
+    attr_reader :status, :code
+    def initialize(status = 0, code = 'invalid_argument', message = 'Invalid input')
+      @status, @code = status, code
+      super(message)
+    end
+  end
+  class Client
+    def initialize(client_id = '', client_secret = '', base_url = DESCRIPTORS['defaultOrigin'])
+      @client_id, @client_secret, @base_url = client_id, client_secret, url(base_url, true)
+    end
+    def url(value, origin = false)
+      raise Error.new unless value.is_a?(String) && !value.match?(/[\s\\]/)
+      u = URI.parse(value)
+      raise Error.new unless u.host && !u.userinfo && !value.include?('?') && !value.include?('#') && !value.split('://',2).last.split(/[\/?#]/).first.include?('@')
+      raise Error.new unless u.scheme == 'https' || (u.scheme == 'http' && ['localhost','127.0.0.1','[::1]'].include?(u.host))
+      raise Error.new if origin && !['','/'].include?(u.path)
+      origin ? value.sub(%r{/+$}, '') : value
+    rescue URI::InvalidURIError, URI::InvalidComponentError
+      raise Error.new
+    end
+    def validate(value, schema)
+      return validate(value, SCHEMAS.fetch(schema['$ref'].split('/').last)) if schema['$ref']
+      types = Array(schema['type'])
+      matches = {'null'=>value.nil?, 'string'=>value.is_a?(String), 'integer'=>value.is_a?(Integer) || (value.is_a?(Float) && value.finite? && value == value.to_i), 'boolean'=>[true,false].include?(value), 'object'=>value.is_a?(Hash), 'array'=>value.is_a?(Array)}
+      raise Error.new if !types.empty? && !types.any? { |t| matches[t] }
+      raise Error.new if schema.key?('const') && value != schema['const']
+      raise Error.new if schema['enum'] && !schema['enum'].include?(value)
+      if value.is_a?(String)
+        raise Error.new if value.length < schema.fetch('minLength',0) || value.length > schema.fetch('maxLength',Float::INFINITY)
+        raise Error.new if schema['pattern'] && !Regexp.new(schema['pattern'].sub(/\$$/, '\\z')).match?(value)
+        url(value) if schema['x-validation'] == 'redirect'
+      end
+      if value.is_a?(Hash)
+        raise Error.new unless Array(schema['required']).all? { |k| value.key?(k) }
+        props = schema.fetch('properties', {})
+        raise Error.new if schema['additionalProperties'] == false && (value.keys-props.keys).any?
+        props.each { |k,s| validate(value[k], s) if value.key?(k) }
+      end
+      value.each { |item| validate(item, schema['items']) } if value.is_a?(Array) && schema['items']
+      value
+    end
+    def request(action, params)
+      op = DESCRIPTORS['operations'].fetch(action)
+      headers = {'Accept'=>'application/json', 'User-Agent'=>'AnyOAuth-ruby/0.1.0'}
+      if op['auth'] == 'bearer'
+        token = params['accessToken']
+        raise Error.new unless token.is_a?(String) && token.match?(%r{\A[A-Za-z0-9._~+/-]+=*\z})
+        headers['Authorization'] = 'Bearer '+token
+      end
+      body = nil
+      if op['requestSchema']
+        values = params.merge('clientId'=>@client_id, 'clientSecret'=>@client_secret)
+        data = op['inputs'].to_h { |k,v| [k, v.key?('constant') ? v['constant'] : values[v['param']]] }
+        validate(data, SCHEMAS[op['requestSchema']])
+        body = JSON.generate(data)
+        headers['Content-Type'] = 'application/json'
+      end
+      begin
+        uri = URI.parse(@base_url + op['path'])
+        http = Net::HTTP.new(uri.host, uri.port, nil)
+        http.use_ssl = uri.scheme == 'https'
+        http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+        http.open_timeout = http.read_timeout = http.write_timeout = 10
+        http.max_retries = 0
+        req = Net::HTTPGenericRequest.new(op['method'], !body.nil?, true, uri.request_uri, headers)
+        req.body = body unless body.nil?
+        response = http.request(req)
+      rescue StandardError
+        raise Error.new(0, 'transport_error', 'HTTP request failed')
+      end
+      status = response.code.to_i
+      if status != op['successStatus']
+        raise Error.new(status, 'protocol_error', 'Unexpected response status') if status >= 200 && status < 300
+        code, message = 'protocol_error', 'Invalid error response'
+        begin
+          error = validate(JSON.parse(response.body), SCHEMAS['ApiError'])
+          code, message = error['error'], error.fetch('message', 'HTTP request failed')
+        rescue StandardError
+          # Infrastructure errors may be non-JSON; never expose raw response bytes.
+        end
+        raise Error.new(status, code, message)
+      end
+      return nil unless op['responseSchema']
+      begin
+        validate(JSON.parse(response.body), SCHEMAS[op['responseSchema']])
+      rescue StandardError
+        raise Error.new(status, 'protocol_error', 'Invalid API response')
+      end
+    end
+    def exchange_code(params = {})
+      request('exchangeCode', params)
+    end
+    def profile(params = {})
+      request('profile', params)
+    end
+    def revoke(params = {})
+      request('revoke', params)
+    end
+    def providers(params = {})
+      request('providers', params)
+    end
+    def pkce_challenge(params)
+      v = params['codeVerifier']
+      raise Error.new unless v.is_a?(String) && v.match?(/\A[A-Za-z0-9._~-]{43,128}\z/)
+      Base64.urlsafe_encode64(Digest::SHA256.digest(v), padding: false)
+    end
+    def create_transaction(_params = {})
+      settings = DESCRIPTORS['transaction']
+      state, verifier = 2.times.map { SecureRandom.urlsafe_base64(settings['entropyBytes'], false) }
+      now = Time.now.to_i
+      validate({'state'=>state,'codeVerifier'=>verifier,'codeChallenge'=>pkce_challenge('codeVerifier'=>verifier),'createdAt'=>now,'expiresAt'=>now+settings['lifetimeSeconds']}, SCHEMAS['Transaction'])
+    end
+    def authorization_url(params)
+      values = params.merge('clientId'=>@client_id)
+      query = DESCRIPTORS['authorization']['parameters'].to_h do |p|
+        s = p['schema']; key = p['name'].gsub(/_([a-z])/) { $1.upcase }
+        [p['name'], validate(s.key?('const') ? s['const'] : values[key], s)]
+      end
+      @base_url + DESCRIPTORS['authorization']['path'] + '?' + URI.encode_www_form(query)
+    end
+    def validate_callback(params)
+      redirect = url(params['redirectUri'])
+      callback, state, expiry = params.values_at('callbackUrl','state','expiresAt')
+      raise Error.new unless state.is_a?(String) && !state.empty? && expiry.is_a?(Integer) && expiry > Time.now.to_i
+      raise Error.new unless callback.is_a?(String) && !callback.match?(/[\s\\#]/) && callback.split('?',2)[0] == redirect
+      query = callback.split('?',2)[1] || ''
+      raise Error.new if query.match?(/%(?![0-9a-fA-F]{2})/)
+      pairs = URI.decode_www_form(query).group_by(&:first).transform_values { |p| p.map(&:last) }
+      raise Error.new if ['state','code','error'].any? { |k| pairs.fetch(k,[]).length > 1 }
+      actual = pairs.fetch('state',[''])[0]
+      # Compare fixed-size digests without an early exit, including on older OpenSSL gems.
+      left, right = [actual,state].map { |s| Digest::SHA256.digest(s).bytes }
+      difference = left.zip(right).reduce(0) { |bits,(a,b)| bits | (a ^ b) }
+      raise Error.new unless difference == 0
+      raise Error.new if pairs.key?('code') == pairs.key?('error')
+      key = pairs.key?('code') ? 'code' : 'error'
+      raise Error.new if pairs[key][0].empty?
+      {key=>pairs[key][0], 'state'=>actual}
+    rescue ArgumentError
+      raise Error.new
+    end
+    private :url, :request
+  end
+end

data/schema.json

@@ -0,0 +1,347 @@
+{
+  "schemas": {
+    "Provider": {
+      "type": "string",
+      "enum": [
+        "google",
+        "github"
+      ]
+    },
+    "RedirectUri": {
+      "type": "string",
+      "format": "uri",
+      "maxLength": 2048,
+      "x-validation": "redirect",
+      "description": "Exact registered HTTPS URL or HTTP loopback; no credentials, query or fragment."
+    },
+    "TokenRequest": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "grant_type",
+        "client_id",
+        "client_secret",
+        "code",
+        "redirect_uri",
+        "code_verifier"
+      ],
+      "properties": {
+        "grant_type": {
+          "type": "string",
+          "const": "authorization_code"
+        },
+        "client_id": {
+          "type": "string",
+          "maxLength": 100
+        },
+        "client_secret": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 200
+        },
+        "code": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 200
+        },
+        "redirect_uri": {
+          "$ref": "#/components/schemas/RedirectUri"
+        },
+        "code_verifier": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9._~-]{43,128}$"
+        }
+      }
+    },
+    "TokenResponse": {
+      "type": "object",
+      "required": [
+        "access_token",
+        "token_type",
+        "expires_in",
+        "scope"
+      ],
+      "properties": {
+        "access_token": {
+          "type": "string",
+          "pattern": "^aop_[A-Za-z0-9_-]{43}$"
+        },
+        "token_type": {
+          "type": "string",
+          "const": "Bearer"
+        },
+        "expires_in": {
+          "type": "integer",
+          "const": 900
+        },
+        "scope": {
+          "type": "string",
+          "const": "profile"
+        }
+      }
+    },
+    "Profile": {
+      "type": "object",
+      "required": [
+        "subject",
+        "provider",
+        "providerSubject",
+        "name",
+        "username",
+        "email",
+        "emailVerified",
+        "avatarUrl"
+      ],
+      "properties": {
+        "subject": {
+          "type": "string"
+        },
+        "provider": {
+          "$ref": "#/components/schemas/Provider"
+        },
+        "providerSubject": {
+          "type": "string"
+        },
+        "name": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "username": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "email": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "emailVerified": {
+          "type": "boolean"
+        },
+        "avatarUrl": {
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      }
+    },
+    "ProviderStatus": {
+      "type": "object",
+      "required": [
+        "id",
+        "configured",
+        "enabled",
+        "available"
+      ],
+      "properties": {
+        "id": {
+          "$ref": "#/components/schemas/Provider"
+        },
+        "configured": {
+          "type": "boolean"
+        },
+        "enabled": {
+          "type": "boolean"
+        },
+        "available": {
+          "type": "boolean"
+        }
+      }
+    },
+    "ProviderStatuses": {
+      "type": "array",
+      "items": {
+        "$ref": "#/components/schemas/ProviderStatus"
+      }
+    },
+    "ApiError": {
+      "type": "object",
+      "required": [
+        "error"
+      ],
+      "properties": {
+        "error": {
+          "type": "string"
+        },
+        "message": {
+          "type": "string"
+        }
+      }
+    },
+    "Transaction": {
+      "type": "object",
+      "required": [
+        "state",
+        "codeVerifier",
+        "codeChallenge",
+        "createdAt",
+        "expiresAt"
+      ],
+      "properties": {
+        "state": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9_-]{43}$"
+        },
+        "codeVerifier": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9._~-]{43,128}$"
+        },
+        "codeChallenge": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9_-]{43}$"
+        },
+        "createdAt": {
+          "type": "integer"
+        },
+        "expiresAt": {
+          "type": "integer"
+        }
+      }
+    }
+  },
+  "operations": {
+    "exchangeCode": {
+      "id": "exchangeCode",
+      "path": "/v1/token",
+      "method": "POST",
+      "auth": "client",
+      "requestSchema": "TokenRequest",
+      "responseSchema": "TokenResponse",
+      "successStatus": 200,
+      "inputs": {
+        "grant_type": {
+          "constant": "authorization_code"
+        },
+        "client_id": {
+          "param": "clientId"
+        },
+        "client_secret": {
+          "param": "clientSecret"
+        },
+        "code": {
+          "param": "code"
+        },
+        "redirect_uri": {
+          "param": "redirectUri"
+        },
+        "code_verifier": {
+          "param": "codeVerifier"
+        }
+      }
+    },
+    "profile": {
+      "id": "profile",
+      "path": "/v1/profile",
+      "method": "GET",
+      "auth": "bearer",
+      "requestSchema": null,
+      "responseSchema": "Profile",
+      "successStatus": 200,
+      "inputs": {}
+    },
+    "revoke": {
+      "id": "revoke",
+      "path": "/v1/revoke",
+      "method": "POST",
+      "auth": "bearer",
+      "requestSchema": null,
+      "responseSchema": null,
+      "successStatus": 204,
+      "inputs": {}
+    },
+    "providers": {
+      "id": "providers",
+      "path": "/api/providers",
+      "method": "GET",
+      "auth": "none",
+      "requestSchema": null,
+      "responseSchema": "ProviderStatuses",
+      "successStatus": 200,
+      "inputs": {}
+    }
+  },
+  "authorization": {
+    "path": "/authorize",
+    "parameters": [
+      {
+        "name": "client_id",
+        "in": "query",
+        "required": true,
+        "schema": {
+          "type": "string",
+          "minLength": 1
+        }
+      },
+      {
+        "name": "provider",
+        "in": "query",
+        "required": true,
+        "schema": {
+          "$ref": "#/components/schemas/Provider"
+        }
+      },
+      {
+        "name": "redirect_uri",
+        "in": "query",
+        "required": true,
+        "schema": {
+          "$ref": "#/components/schemas/RedirectUri"
+        }
+      },
+      {
+        "name": "state",
+        "in": "query",
+        "required": true,
+        "schema": {
+          "type": "string",
+          "minLength": 16,
+          "maxLength": 512
+        }
+      },
+      {
+        "name": "code_challenge",
+        "in": "query",
+        "required": true,
+        "schema": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9_-]{43}$"
+        }
+      },
+      {
+        "name": "code_challenge_method",
+        "in": "query",
+        "required": true,
+        "schema": {
+          "type": "string",
+          "const": "S256"
+        }
+      },
+      {
+        "name": "response_type",
+        "in": "query",
+        "required": true,
+        "schema": {
+          "type": "string",
+          "const": "code"
+        }
+      }
+    ]
+  },
+  "transaction": {
+    "lifetimeSeconds": 600,
+    "entropyBytes": 32,
+    "description": "Create random state and a PKCE verifier/challenge. Persist this transaction in the initiating browser or app session.",
+    "input": {
+      "type": "object",
+      "properties": {},
+      "additionalProperties": false
+    }
+  },
+  "defaultOrigin": "https://api.anyoauth.com"
+}

metadata

@@ -0,0 +1,46 @@
+--- !ruby/object:Gem::Specification
+name: anyoauth-sdk
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- AnyOAuth contributors
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2026-10-07 00:00:00.000000000 Z
+dependencies: []
+description: 
+email: 
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- lib/anyoauth.rb
+- schema.json
+homepage: 
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '2.6'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.0.3.1
+signing_key: 
+specification_version: 4
+summary: AnyOAuth confidential backend SDK
+test_files: []