ask-auth 0.3.1 → 0.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d8434cd70339a093050b7c19364a628d9b8e56048f41c1bb492f6268ed672b39
-  data.tar.gz: d5c377bb5480fb7e19d1dca9a0ca46bc1a29d09ef4dc7d3fc3f216fa38342552
+  metadata.gz: 62fd78e86d9cb1014d3c1edc874b037073fc8fda38247c10441401b88c96cb43
+  data.tar.gz: c836b2db286075e95d081aa483762bf17f4332d4c306bb4a58cfd5d1323272ac
 SHA512:
-  metadata.gz: 7676f10e858addff8c2ab69db3223aea179e11016ce8faa44422432dfcc2e567ff772c9d04e037b8370d4a32b894c0094a5e3a23debfdd43d02bb877283c775f
-  data.tar.gz: cacdcf31dbe213784f73c9ca0a70b8b17e280cd13697fb07e4cbcf5ac99261c340ed24f0591b637584dcc6d32be10bf83eac713b89751511a82ff2e2e6ecdfd1
+  metadata.gz: 9ade8a91063788a2e247c72b189f850debaad6144c5f2270cbf900354aa2d366a127ac1f6d862b3197d944cc201dc582ca7d86fb2f8a6ba7c9e6acc8ccac1775
+  data.tar.gz: c924696e695d30d1d35367ae00e96293add344374e316d7deccca93ad2b5afad85103537c64cac90783f18866ef41c43d5deb5db9ddaf1adf62a1a460d2fd25b

data/CHANGELOG.md

@@ -1,3 +1,30 @@
+## [0.3.3] — 2026-08-18
+
+### Fixed
+
+- **`OAuth#fetch_oauth_state` tolerates string keys.** Cookie session stores
+  serialize to JSON, converting symbol keys to strings. The verifier lookup
+  now falls back to `value[key.to_s]` when the symbol lookup returns nil.
+
+### Added
+
+- **`OAuth` accepts `client_secret:` for token exchange.** Providers that
+  require a client secret (e.g. GitHub OAuth) can now pass it at
+  construction. The secret is included in `token_exchange` and `refresh`
+  requests when present, and omitted when nil — preserving backwards
+  compatibility with PKCE-only flows.
+
+## [0.3.2] — 2026-08-13
+
+### Added
+
+- **`Ask::Auth.lookup` — non-raising credential resolution.** Same chain and
+  fallback semantics as `resolve`, but returns `nil` when nothing matches
+  instead of raising `MissingCredential`. For config-time resolution (e.g.
+  ERB in `database.yml`) where a missing credential should degrade to
+  nil/defaults rather than crash the boot. `resolve` is now implemented on
+  top of `lookup` and keeps its raising behavior.
+
 ## [0.3.1] — 2026-08-07
 
 ### Added

data/lib/ask/auth/providers/oauth.rb

@@ -29,12 +29,14 @@ module Ask
       # Subclasses override #parse_token_response to add provider-specific
       # fields (e.g. an account id from the id_token).
       class OAuth
-        attr_reader :client_id, :redirect_uri
+        attr_reader :client_id, :client_secret, :redirect_uri
 
-        def initialize(storage: nil, client_id: nil, authorize_url: nil, token_url: nil,
+        def initialize(storage: nil, client_id: nil, client_secret: nil,
+          authorize_url: nil, token_url: nil,
           redirect_uri: nil, scope: nil, http: Ask::Auth::OAuth::HTTP)
           @storage = storage
           @client_id = client_id
+          @client_secret = client_secret
           @authorize_url = authorize_url
           @token_url = token_url
           @redirect_uri = redirect_uri
@@ -121,6 +123,7 @@ module Ask
         def token_exchange(**params)
           raise OAuthError, "token_url not configured" if @token_url.to_s.empty?
 
+          params[:client_secret] = client_secret if client_secret
           status, body = @http.post_form(@token_url, params)
           raise OAuthError, "token exchange failed (#{status}): #{body.to_s[0, 200]}" unless status == 200
 
@@ -153,7 +156,12 @@ module Ask
           return nil unless @storage.respond_to?(:fetch) && user
 
           value = @storage.fetch(:oauth_state, user: user)
-          value.is_a?(Hash) ? value[key] : nil
+          return nil unless value.is_a?(Hash)
+
+          # Symbol keys survive Ruby→JSON→Ruby round-trips, but cookie
+          # session stores serialize to JSON (converting symbols to strings).
+          # Support both by falling back to the string representation.
+          value[key] || value[key.to_s]
         end
       end
     end

data/lib/ask/auth/version.rb

@@ -2,6 +2,6 @@
 
 module Ask
   module Auth
-    VERSION = "0.3.1"
+    VERSION = "0.3.3"
   end
 end

data/lib/ask/auth.rb

@@ -74,7 +74,21 @@ module Ask
       #
       # +names+:: One or more Symbols, Strings, or Arrays identifying the credential
       # +user+:: Optional user record for per-user providers (Database, OAuth)
+      #
+      # Raises MissingCredential when nothing matches. Use +lookup+ for a
+      # non-raising variant.
       def resolve(*names, user: nil)
+        value = lookup(*names, user: user)
+        return value unless value.nil?
+
+        raise MissingCredential, names
+      end
+
+      # Non-raising variant of +resolve+: returns nil when no provider
+      # matches, instead of raising MissingCredential. For config-time
+      # resolution (e.g. ERB in database.yml) where a missing credential
+      # should degrade to nil/defaults rather than crash the boot.
+      def lookup(*names, user: nil)
         return nil if names.empty?
 
         names.each do |name|
@@ -92,7 +106,7 @@ module Ask
           end
         end
 
-        raise MissingCredential, names
+        nil
       end
 
       private

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ask-auth
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.3.3
 platform: ruby
 authors:
 - Kaka Ruto
@@ -110,7 +110,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.18
 specification_version: 4
 summary: Credential resolution for the ask-rb ecosystem
 test_files: []