ask-auth 0.3.2 → 0.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d41ca49d1114503dc3a3830efb730823fd598c1dca1249b2c06bc808be7c4743
-  data.tar.gz: 17b4718e99c515ba26424ce90b104ad4dfc416871e2ee2598ff5f62b67524bd7
+  metadata.gz: 62fd78e86d9cb1014d3c1edc874b037073fc8fda38247c10441401b88c96cb43
+  data.tar.gz: c836b2db286075e95d081aa483762bf17f4332d4c306bb4a58cfd5d1323272ac
 SHA512:
-  metadata.gz: 90118e173e9fa7e9a675dacb331d14fe179f006b72679c2201a3395b121f0637dd91058f99efa098a1aefcf33224f730c40ce5bcbe9a80b37932edcfef73f791
-  data.tar.gz: 73b8d4681b7a3a74a7f92600e26c819e9123b796975d4100e6784fcb948f9412fecef3c7791dd095f41f114a00dadf59ed05c0e4f04eb9dddaee22fd74e5bba9
+  metadata.gz: 9ade8a91063788a2e247c72b189f850debaad6144c5f2270cbf900354aa2d366a127ac1f6d862b3197d944cc201dc582ca7d86fb2f8a6ba7c9e6acc8ccac1775
+  data.tar.gz: c924696e695d30d1d35367ae00e96293add344374e316d7deccca93ad2b5afad85103537c64cac90783f18866ef41c43d5deb5db9ddaf1adf62a1a460d2fd25b

data/CHANGELOG.md

@@ -1,3 +1,19 @@
+## [0.3.3] — 2026-08-18
+
+### Fixed
+
+- **`OAuth#fetch_oauth_state` tolerates string keys.** Cookie session stores
+  serialize to JSON, converting symbol keys to strings. The verifier lookup
+  now falls back to `value[key.to_s]` when the symbol lookup returns nil.
+
+### Added
+
+- **`OAuth` accepts `client_secret:` for token exchange.** Providers that
+  require a client secret (e.g. GitHub OAuth) can now pass it at
+  construction. The secret is included in `token_exchange` and `refresh`
+  requests when present, and omitted when nil — preserving backwards
+  compatibility with PKCE-only flows.
+
 ## [0.3.2] — 2026-08-13
 
 ### Added

data/lib/ask/auth/providers/oauth.rb

@@ -29,12 +29,14 @@ module Ask
       # Subclasses override #parse_token_response to add provider-specific
       # fields (e.g. an account id from the id_token).
       class OAuth
-        attr_reader :client_id, :redirect_uri
+        attr_reader :client_id, :client_secret, :redirect_uri
 
-        def initialize(storage: nil, client_id: nil, authorize_url: nil, token_url: nil,
+        def initialize(storage: nil, client_id: nil, client_secret: nil,
+          authorize_url: nil, token_url: nil,
           redirect_uri: nil, scope: nil, http: Ask::Auth::OAuth::HTTP)
           @storage = storage
           @client_id = client_id
+          @client_secret = client_secret
           @authorize_url = authorize_url
           @token_url = token_url
           @redirect_uri = redirect_uri
@@ -121,6 +123,7 @@ module Ask
         def token_exchange(**params)
           raise OAuthError, "token_url not configured" if @token_url.to_s.empty?
 
+          params[:client_secret] = client_secret if client_secret
           status, body = @http.post_form(@token_url, params)
           raise OAuthError, "token exchange failed (#{status}): #{body.to_s[0, 200]}" unless status == 200
 
@@ -153,7 +156,12 @@ module Ask
           return nil unless @storage.respond_to?(:fetch) && user
 
           value = @storage.fetch(:oauth_state, user: user)
-          value.is_a?(Hash) ? value[key] : nil
+          return nil unless value.is_a?(Hash)
+
+          # Symbol keys survive Ruby→JSON→Ruby round-trips, but cookie
+          # session stores serialize to JSON (converting symbols to strings).
+          # Support both by falling back to the string representation.
+          value[key] || value[key.to_s]
         end
       end
     end

data/lib/ask/auth/version.rb

@@ -2,6 +2,6 @@
 
 module Ask
   module Auth
-    VERSION = "0.3.2"
+    VERSION = "0.3.3"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ask-auth
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.3.3
 platform: ruby
 authors:
 - Kaka Ruto