heroku-bouncer 0.6.0 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 665c9d7aafb5ad2f6d67e2b2c6534afe7114a310
-  data.tar.gz: 740248c7d7ff94e833d11c3072b4d605e545d540
+  metadata.gz: 4b619fbf7d6217756617859a7fa5f965c8ed1a01
+  data.tar.gz: 90beec382fbef5aaea8f8f2b907cdf6e4d18bf8e
 SHA512:
-  metadata.gz: 98037d0ba899477a43af554df33b0edeaad5b4381e761a8b44d4f91025bd036d92b5cb5c82b83edca30f3edb52a0caf3772b0d7ad327d02834cf8d180299bdde
-  data.tar.gz: 229ef416b7d70912a4d38cbb8b76feed9013b6d4a8b5a350b07590a26bc78735116dbd46f34eff5ec38a547c8aa39a0ae2cb155b7710e3a941a628289a22733e
+  metadata.gz: 766781d8a9a9cca09a58f9c64c247cda6890a3b0c85239744f9630c3a7183162c5657e8ddd9a60b66f0fdc5975213c3a601d65d1a4ff03b8e058b690b7c2dcc6
+  data.tar.gz: 79d6db6a927996bee71f1c17f8b3cb6c3c490c4a160351b4e6c95e82646964e4c509da4b8959993e415af60074c05a222eb465776dfafe25db49778610e9a53c

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+# 0.7.0
+
+* #46: expose refresh token when exposing access token
+* #44: use v3 API for /account call
+
 # 0.6.0
 
 * #42: add `allow_if_user` which takes the user object, instead of just

data/README.md

@@ -142,6 +142,7 @@ Based on your choice of the expose options above, the middleware adds
 the following keys to your request environment:
 
 * `bouncer.token`
+* `bouncer.refresh_token`
 * `bouncer.email`
 * `bouncer.user`
 
@@ -162,6 +163,12 @@ apps = heroku.get_apps.body
 Keep in mind that this adds substantial security risk to your
 application.
 
+The API token is short-lived, and expires 8 hours after issue. Heroku provides
+a separate `refresh_token` (available as `bouncer.refresh_token`) that can be
+used to fetch fresh API tokens if necessary. See the
+[token refresh documentation](https://devcenter.heroku.com/articles/oauth#token-refresh)
+for details.
+
 ## Logging out
 
 Send users to `/auth/sso-logout` if logging out of Heroku is

data/lib/heroku/bouncer/middleware.rb

@@ -37,7 +37,7 @@ class Heroku::Bouncer::Middleware < Sinatra::Base
       # backwards-compatibility for allow_if
       allow_if = extract_option(options, :allow_if, false)
       if allow_if
-        @allow_if_user ||= lambda { |user| allow_if.call(user['email']) }  
+        @allow_if_user ||= lambda { |user| allow_if.call(user['email']) }
       end
 
       @expose_token = extract_option(options, :expose_token, false)
@@ -82,7 +82,8 @@ class Heroku::Bouncer::Middleware < Sinatra::Base
 
   # callback when successful, time to save data
   get '/auth/heroku/callback' do
-    token = request.env['omniauth.auth']['credentials']['token']
+    token         = request.env['omniauth.auth']['credentials']['token']
+    refresh_token = request.env['omniauth.auth']['credentials']['refresh_token']
     if @expose_email || @expose_user || !@allow_if_user.nil?
       user = fetch_user(token)
       # Wrapping lambda to prevent short-circut proc return
@@ -97,7 +98,10 @@ class Heroku::Bouncer::Middleware < Sinatra::Base
       store_write(:user, true)
     end
     store_write(@session_sync_nonce.to_sym, session_nonce_cookie) if @session_sync_nonce
-    store_write(:token, token) if @expose_token
+    if @expose_token
+      store_write(:token, token)
+      store_write(:refresh_token, refresh_token)
+    end
     store_write(:expires_at, Time.now.to_i + 3600 * 8)
 
     return_to = store_delete(:return_to) || '/'
@@ -187,7 +191,7 @@ private
   def fetch_user(token)
     ::Heroku::Bouncer::JsonParser.call(
       Faraday.new(ENV["HEROKU_API_URL"] || "https://api.heroku.com/").get('/account') do |r|
-        r.headers['Accept'] = 'application/json'
+        r.headers['Accept'] = 'application/vnd.heroku+json; version=3'
         r.headers['Authorization'] = "Bearer #{token}"
       end.body)
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: heroku-bouncer
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.7.0
 platform: ruby
 authors:
 - Jonathan Dance
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-03-04 00:00:00.000000000 Z
+date: 2015-12-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-heroku
@@ -191,7 +191,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.4.5.1
 signing_key: 
 specification_version: 4
 summary: Rapidly add Heroku OAuth to your Ruby app.