iorwerth-hub 0.2.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d030b6a6a8d09a19eabfaa5d4de8f27682e144dfb968d3c05cbcb36359a334b8
-  data.tar.gz: 5f296810092251cb6de7e11b6edf527ba3069ffe649dd4a28d2b796d8f475641
+  metadata.gz: ccb7cd07fb35bb31f30c9e1cf6745d85af73e2191f24afcbe6fd31a4a06acea4
+  data.tar.gz: 1251c0a59f7f236a19fabd563dc5ff25f2634a13c51df04bffd99bb5c0fcf00b
 SHA512:
-  metadata.gz: 48155d512256d8a5147036ad71acb9142d78111df2a48e46a6866d588e128d274bf02be8e3bde04f9758d05d52bdd9b28fa396c32b07ba84cfce4b72d9fddfc1
-  data.tar.gz: 6fea37e940129be2dbc5a1907b109693dad63b867da00ebffb6fca2297502c8d882a60af19818de5d063cdd991ad804d3a321daf99c7f06e3af84d3211c9d63f
+  metadata.gz: c8b17b28b437e5e126fa3c37af38381fc735eff5a60446cdbd1e37da4a92f08ca5af8f6f8439e6a424acf53e33705fc4aeb7c784e26a71fa7c2144ca1bb29e21
+  data.tar.gz: 12fbc699b292ba772bcbb32eddca0c7c9e690758f2a60e3c99cce42600d4a90a569f9562363d69afbf726d596cf9c987280327e9d3bda2620e507b6a927d4b58

data/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.4.0
+
+- Sign-in strategy forwards `organization` as an authorization parameter, so a product
+  that signs up organizations passes the name on its "Start free trial" link
+  (`/auth/hub?prompt=create&plan=…&organization=…`). The Hub creates that organization
+  and no longer renders a field of its own for it (platform ADR-0014).
+
+## 0.3.0
+
+- `Iorwerth::Hub.end_session`: RP-initiated logout. Builds the request to the Hub's
+  end-session endpoint (discovered, not hard-coded) so a product's "Log out" ends the
+  Hub session too; POST `endpoint` + `params` to keep the ID token out of URLs, and the
+  Hub returns the browser to `redirect_uri` with `state` unchanged.
+
 ## 0.2.0
 
 - `checkout` and `portal`: Stripe Checkout and Customer Portal URLs for an organization.

data/README.md

@@ -2,7 +2,7 @@
 
 Connects a Ruby product to the Iorwerth Customer Hub. It provides four pieces:
 
-- **Sign-in:** the `:iorwerth_hub` OmniAuth strategy. OpenID Connect, code flow with PKCE.
+- **Sign-in:** the OmniAuth strategy, mounted as `:hub`. OpenID Connect, code flow with PKCE.
 - **API client:** `Iorwerth::Hub::Client`, one method per `/api/v1` operation.
 - **Entitlement checks:** `Iorwerth::Hub.entitled?`, cached, and still answering while the Hub is down.
 - **Webhooks:** `Iorwerth::Hub::Webhook::Receiver`, a Rack endpoint that verifies each signature.
@@ -60,13 +60,20 @@ end
 require "iorwerth/hub/omniauth"
 
 Rails.application.config.middleware.use OmniAuth::Builder do
-  provider :iorwerth_hub, redirect_uri: "https://podium.app/auth/iorwerth_hub/callback"
+  provider :iorwerth_hub, name: :hub, redirect_uri: "https://podium.app/auth/hub/callback"
 end
 ```
 
-- **Signing in:** send people to `/auth/iorwerth_hub`. The callback receives the usual OmniAuth hash.
-- **Starting a trial:** send people to `/auth/iorwerth_hub?prompt=create&plan=<plan key>`. The Hub
+`name: :hub` mounts the strategy at `/auth/hub`, so the callback is `/auth/hub/callback`. Register
+that exact URL as the product's redirect URI with the Hub.
+
+- **Signing in:** send people to `/auth/hub`. The callback receives the usual OmniAuth hash.
+- **Starting a trial:** send people to `/auth/hub?prompt=create&plan=<plan key>`. The Hub
   shows its signup page and records the requested plan.
+- **Naming the organization:** if your customers are organizations (leagues, teams,
+  companies), collect the name in your own signup step and add `&organization=<name>` to
+  that trial link. The Hub creates that organization and attaches the plan to it; it never
+  asks for the name itself. Leave it off for individual customers.
 
 The callback's `uid` is the Hub's `usr_` id. `info` holds the person's name and email.
 `Iorwerth::Hub.organizations(auth)` returns the organizations they belong to, as this
@@ -86,6 +93,46 @@ def callback
 end
 ```
 
+## Signing out
+
+"Log out" must end the Hub session too, or the next sign-in is silent. Clear your own
+session first, then send the browser to the Hub's end-session endpoint. POST it so the ID
+token stays out of URLs; the Hub returns to `post_logout_redirect_uri` with `state`
+unchanged, which you can use to pick where to land.
+
+The POST is cross-site, so the browser does not send the Hub's session cookie with it. The
+Hub handles that for you: it bounces the browser through a same-site redirect of its own that
+does carry the cookie, then on to `post_logout_redirect_uri`. Your side is unchanged — submit
+the form and let the browser follow the redirects.
+
+```ruby
+# config/initializers/omniauth.rb — register the return URL with the Hub, per product:
+#   post_logout_redirect_uris = https://podium.app/auth/hub/signed_out
+
+def destroy            # DELETE /logout
+  id_token = session[:hub_id_token]   # saved from auth.credentials.id_token at sign-in
+  reset_session                       # end the product's own session first
+  @logout = Iorwerth::Hub.end_session(
+    id_token: id_token,
+    redirect_uri: signed_out_url,     # must be one of the registered post-logout URIs
+    state: SecureRandom.hex(8)
+  )
+  render :signing_out                 # a view with an auto-submitting POST form
+end
+```
+
+```erb
+<%# app/views/sessions/signing_out.html.erb %>
+<%= form_tag @logout.endpoint, method: :post, id: "hub-logout" do %>
+  <% @logout.params.each do |name, value| %><%= hidden_field_tag name, value %><% end %>
+<% end %>
+<script>document.getElementById("hub-logout").submit()</script>
+```
+
+`end_session` discovers the endpoint from the Hub (it does not hard-code it). When a plain
+redirect is acceptable and the ID token in the URL is not a concern, `@logout.redirect_url`
+is the endpoint with the fields in the query string instead.
+
 ## API
 
 ```ruby

data/lib/iorwerth/hub/logout.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require "json"
+require "net/http"
+require "openssl"
+require "uri"
+
+module Iorwerth
+  module Hub
+    # RP-initiated logout (OpenID Connect RP-Initiated Logout 1.0): end the Hub session when a
+    # product signs someone out. Clear the product's own session first, then send the browser
+    # to the Hub's end-session endpoint. POST it (`endpoint` + `params`) so the ID token stays
+    # out of URLs and server logs; the Hub returns the browser to `redirect_uri` with `state`
+    # unchanged, so a product can carry its own return target through the round trip.
+    #
+    #   logout = Iorwerth::Hub.end_session(id_token: session[:hub_id_token],
+    #                                      redirect_uri: signed_out_url, state: SecureRandom.hex)
+    #   # an auto-submitting POST form in the view:
+    #   form_tag logout.endpoint, method: :post do
+    #     safe_join(logout.params.map { |name, value| hidden_field_tag(name, value) })
+    #   end
+    class EndSession
+      attr_reader :id_token, :redirect_uri, :state, :client_id
+
+      def initialize(id_token:, redirect_uri: nil, state: nil,
+                     client_id: Hub.config.oidc_client_id, url: Hub.config.url)
+        @id_token = id_token
+        @redirect_uri = redirect_uri
+        @state = state
+        @client_id = client_id
+        @url = url
+      end
+
+      # The Hub's end-session endpoint, from its discovery document.
+      def endpoint
+        Hub.discovery(@url).fetch("end_session_endpoint")
+      end
+
+      # The logout request's fields, for a POST form. Absent ones are dropped.
+      def params
+        {
+          "id_token_hint" => id_token,
+          "client_id" => client_id,
+          "post_logout_redirect_uri" => redirect_uri,
+          "state" => state
+        }.compact
+      end
+
+      # The endpoint with the fields in the query string, for a plain redirect. Prefer a POST
+      # of `endpoint` + `params` when the ID token should not appear in a URL.
+      def redirect_url
+        uri = URI(endpoint)
+        uri.query = URI.encode_www_form(params)
+        uri.to_s
+      end
+    end
+  end
+end

data/lib/iorwerth/hub/omniauth.rb

@@ -11,11 +11,14 @@ module OmniAuth
     #   # config/initializers/omniauth.rb
     #   require "iorwerth/hub/omniauth"
     #   Rails.application.config.middleware.use OmniAuth::Builder do
-    #     provider :iorwerth_hub, redirect_uri: "https://podium.app/auth/iorwerth_hub/callback"
+    #     provider :iorwerth_hub, name: :hub, redirect_uri: "https://podium.app/auth/hub/callback"
     #   end
     #
-    # Link to /auth/iorwerth_hub to sign in, or /auth/iorwerth_hub?prompt=create&plan=<key>
-    # for "Start free trial": the Hub shows signup and records the plan. The auth hash's
+    # `name: :hub` mounts it at /auth/hub. Link to /auth/hub to sign in, or
+    # /auth/hub?prompt=create&plan=<key> for "Start free trial": the Hub shows signup and
+    # records the plan. When your customers are organizations, collect the organization's
+    # name in your own signup wizard and pass it as &organization=<name>; the Hub creates
+    # that organization and never shows a field of its own for it. The auth hash's
     # extra.raw_info carries the `organizations` claim (Iorwerth::Hub.organizations(auth)).
     class IorwerthHub < OpenIDConnect
       option :name, "iorwerth_hub"
@@ -23,7 +26,7 @@ module OmniAuth
       option :pkce, true
       option :response_type, "code"
       option :scope, %i[openid email profile]
-      option :allow_authorize_params, %i[plan]
+      option :allow_authorize_params, %i[plan organization]
 
       def initialize(app, *args, &block)
         super

data/lib/iorwerth/hub/version.rb

@@ -2,6 +2,6 @@
 
 module Iorwerth
   module Hub
-    VERSION = "0.2.0"
+    VERSION = "0.4.0"
   end
 end

data/lib/iorwerth/hub.rb

@@ -1,10 +1,16 @@
 # frozen_string_literal: true
 
+require "json"
+require "net/http"
+require "openssl"
+require "uri"
+
 require "iorwerth/hub/version"
 require "iorwerth/hub/errors"
 require "iorwerth/hub/configuration"
 require "iorwerth/hub/client"
 require "iorwerth/hub/entitlements"
+require "iorwerth/hub/logout"
 require "iorwerth/hub/webhook"
 
 module Iorwerth
@@ -48,9 +54,38 @@ module Iorwerth
         info.fetch("organizations", info.fetch(:organizations, []))
       end
 
+      # Build an RP-initiated logout for one person's session. See EndSession.
+      def end_session(id_token:, redirect_uri: nil, state: nil)
+        EndSession.new(id_token: id_token, redirect_uri: redirect_uri, state: state)
+      end
+
+      # The Hub's OpenID Connect discovery document, fetched once per URL and cached.
+      def discovery(url = config.url)
+        raise ConfigurationError, "Set HUB_URL." if url.nil? || url.empty?
+
+        (@discovery ||= {})[url] ||= fetch_discovery(url)
+      end
+
       # Forget settings and cached state; for tests.
       def reset!
-        @config = @client = @entitlements = nil
+        @config = @client = @entitlements = @discovery = nil
+      end
+
+      private
+
+      def fetch_discovery(url)
+        uri = URI("#{url.chomp('/')}/.well-known/openid-configuration")
+        response = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https",
+                                                       open_timeout: config.open_timeout,
+                                                       read_timeout: config.timeout) do |http|
+          request = Net::HTTP::Get.new(uri)
+          request["Accept"] = "application/json"
+          request["User-Agent"] = "iorwerth-hub-ruby/#{VERSION}"
+          http.request(request)
+        end
+        JSON.parse(response.body)
+      rescue SocketError, SystemCallError, Timeout::Error, IOError, OpenSSL::SSL::SSLError => e
+        raise ConnectionError, "#{uri.host}: #{e.class}: #{e.message}"
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: iorwerth-hub
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Iorwerth Technologies
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-08 00:00:00.000000000 Z
+date: 2026-10-17 00:00:00.000000000 Z
 dependencies: []
 description: Sign-in through the Hub (OmniAuth), its /api/v1 client, cached entitlement
   checks, and a Rack endpoint that verifies the Hub's webhooks.
@@ -25,6 +25,7 @@ files:
 - lib/iorwerth/hub/configuration.rb
 - lib/iorwerth/hub/entitlements.rb
 - lib/iorwerth/hub/errors.rb
+- lib/iorwerth/hub/logout.rb
 - lib/iorwerth/hub/omniauth.rb
 - lib/iorwerth/hub/version.rb
 - lib/iorwerth/hub/webhook.rb