fulfil_api 0.8.0 → 0.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6f433cc5985d728b55fbc2d60bfc4b953c816ec0ca75dc46d33a30999571cef9
-  data.tar.gz: f66f3c19a009cd3592cbe73a97c04fea29654c6147c90c8000c2361cb5326309
+  metadata.gz: b1e3793aadb8a9615fdddb8970acbc23564eec7965e8655558cc9062bdb43c00
+  data.tar.gz: fbae55d2bec65240dbbb44370411b452bb2461a8021668f70be3af67ee1decfe
 SHA512:
-  metadata.gz: 6a4af75edfecaf1c3b9c64efa2be766b044153298da60af42df2c7e9bb3d8f5fdf43b9951ab62ad30868424b2eeaa5915c2add9059fedc48458cb99f3371eed9
-  data.tar.gz: 00b77b892735a6f29a569785c0795b4dd64c13e91091bbb840689a8fe689d76730dc4408041c6e3a0bef08b4fe02d77020cd9d25d66bfd40c170644fe277017a
+  metadata.gz: 4cd81653bfe993a17a6552adfaceef0c0ea22f351ae900cc63dd436eb8461767c9d494d372cdc9458f44b5e5af0f6e4860aad49eabdca079ce5e59a32df15c53
+  data.tar.gz: cbf055f30acca04e2eeaf6aa510d90345ca603e50e016154626e363adca1e92f9a8f4e01f98bb238e32bb656a9d39b597071fb94f20d62cf1f98e09974e523ff

data/CHANGELOG.md

@@ -1,10 +1,17 @@
 ## [Unreleased]
 
+- Send the `grant_type` and `redirect_uri` in the form body when exchanging an authorization code, the way OAuth 2.0 defines the token request. The grant type used to travel in the query string and the redirect URI was left out, which Fulfil accepts today but isn't required to.
+
+- Separate the requested OAuth scopes with spaces instead of commas. Fulfil didn't recognize the comma separated list, and a workspace granted every scope the approving user had rather than the ones that were asked for.
+
 - Require Rails 8.0 and Ruby 3.2 or newer. Every application using the gem is on Rails 8 already, so carrying support for older versions bought nothing.
 
 - Add support for Fulfil's OAuth 2.0 authorization flow, so applications no longer depend on personal access tokens now that Fulfil caps their lifetime. `FulfilApi::OAuth::Authorization` builds the consent screen URL and exchanges the authorization code for a token, and `config.oauth` holds the OAuth app's credentials.
+
 - Ship the flow as a Rails engine that is only loaded inside a Rails application. `bin/rails generate fulfil_api:install` writes the initializer, adds the migration for `FulfilApi::Installation`, and mounts the engine. Installing changes nothing about how an application behaves until `config.oauth.parent_controller` names the controller the flow runs under, so an application still on personal access tokens can move to OAuth in its own time. There is no default: the engine's controllers inherit from it, and guessing wrong leaves an endpoint a stranger can use to record their own Fulfil workspace over the application's.
+
 - Add the `FulfilApi::Authenticated` controller concern, which runs every action with a client authenticated as the current installation and sends a user without a usable token through the OAuth flow.
+
 - Add the `FulfilApi::Installable` model concern, so an application serving many merchants can keep one installation per record instead of one for the whole application. A record is connected to a single Fulfil workspace.
 
 - Add an optional circuit breaker, backed by [Faulty](https://github.com/ParentSquare/faulty), that stops sending requests to a Fulfil instance that keeps failing, so a struggling instance can't tie up every thread of an application that talks to several of them. Pass a `Faulty` instance as `circuit_breaker`; each Fulfil instance gets its own circuit, and while it's open requests raise a `FulfilApi::CircuitOpen` without touching the network.

data/lib/fulfil_api/oauth/authorization.rb

@@ -96,8 +96,7 @@ module FulfilApi
       def exchange(code)
         raise TokenExchangeFailed, "No authorization code was provided" if code.blank?
 
-        response = connection.post(TOKEN_PATH, { code: code }) do |request|
-          request.params["grant_type"] = "authorization_code"
+        response = connection.post(TOKEN_PATH, token_parameters(code)) do |request|
           request.headers["Authorization"] = "Basic #{basic_credentials}"
         end
 
@@ -154,6 +153,16 @@ module FulfilApi
         }
       end
 
+      # @param code [String] The authorization code Fulfil sent to the callback.
+      # @return [Hash]
+      def token_parameters(code)
+        {
+          code: code,
+          grant_type: "authorization_code",
+          redirect_uri: redirect_uri
+        }.compact
+      end
+
       # @param state [String] The nonce to verify the callback with.
       # @return [Hash]
       def url_parameters(state)
@@ -164,7 +173,7 @@ module FulfilApi
           response_type: "code",
           state: state
         }.tap do |parameters|
-          parameters[:scope] = scopes.join(",") if scopes.any?
+          parameters[:scope] = scopes.join(" ") if scopes.any?
         end.compact
       end
     end

data/lib/fulfil_api/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module FulfilApi
-  VERSION = "0.8.0"
+  VERSION = "0.8.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fulfil_api
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.8.1
 platform: ruby
 authors:
 - Stefan Vermaas