iorwerth-hub 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb15506bb31b75a41adcff9d816410edfbb6386f73046d972ad2588b0974a500
-  data.tar.gz: ef02264de56eb7fa73b6210b4a2f017ab83b94ba114c58ba35355d84ce9e60d2
+  metadata.gz: ccb7cd07fb35bb31f30c9e1cf6745d85af73e2191f24afcbe6fd31a4a06acea4
+  data.tar.gz: 1251c0a59f7f236a19fabd563dc5ff25f2634a13c51df04bffd99bb5c0fcf00b
 SHA512:
-  metadata.gz: 65995baaa899db6097a4997a86acad674b3d3272166fa8055ac558c69738eb171a99edb99cace0fa93496b99b05a6af252ebe6f1c1d3c5b90f5e9a7c0be64d66
-  data.tar.gz: 72f260c64686c7c0e92edfc16d704b1060106f4c467a5dd771adccbc8c08f1677d17a14ad61d792869d37af1d8ce22dee00a25185390200b6d66ef804479e405
+  metadata.gz: c8b17b28b437e5e126fa3c37af38381fc735eff5a60446cdbd1e37da4a92f08ca5af8f6f8439e6a424acf53e33705fc4aeb7c784e26a71fa7c2144ca1bb29e21
+  data.tar.gz: 12fbc699b292ba772bcbb32eddca0c7c9e690758f2a60e3c99cce42600d4a90a569f9562363d69afbf726d596cf9c987280327e9d3bda2620e507b6a927d4b58

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.4.0
+
+- Sign-in strategy forwards `organization` as an authorization parameter, so a product
+  that signs up organizations passes the name on its "Start free trial" link
+  (`/auth/hub?prompt=create&plan=…&organization=…`). The Hub creates that organization
+  and no longer renders a field of its own for it (platform ADR-0014).
+
 ## 0.3.0
 
 - `Iorwerth::Hub.end_session`: RP-initiated logout. Builds the request to the Hub's

data/README.md

@@ -2,7 +2,7 @@
 
 Connects a Ruby product to the Iorwerth Customer Hub. It provides four pieces:
 
-- **Sign-in:** the `:iorwerth_hub` OmniAuth strategy. OpenID Connect, code flow with PKCE.
+- **Sign-in:** the OmniAuth strategy, mounted as `:hub`. OpenID Connect, code flow with PKCE.
 - **API client:** `Iorwerth::Hub::Client`, one method per `/api/v1` operation.
 - **Entitlement checks:** `Iorwerth::Hub.entitled?`, cached, and still answering while the Hub is down.
 - **Webhooks:** `Iorwerth::Hub::Webhook::Receiver`, a Rack endpoint that verifies each signature.
@@ -60,13 +60,20 @@ end
 require "iorwerth/hub/omniauth"
 
 Rails.application.config.middleware.use OmniAuth::Builder do
-  provider :iorwerth_hub, redirect_uri: "https://podium.app/auth/iorwerth_hub/callback"
+  provider :iorwerth_hub, name: :hub, redirect_uri: "https://podium.app/auth/hub/callback"
 end
 ```
 
-- **Signing in:** send people to `/auth/iorwerth_hub`. The callback receives the usual OmniAuth hash.
-- **Starting a trial:** send people to `/auth/iorwerth_hub?prompt=create&plan=<plan key>`. The Hub
+`name: :hub` mounts the strategy at `/auth/hub`, so the callback is `/auth/hub/callback`. Register
+that exact URL as the product's redirect URI with the Hub.
+
+- **Signing in:** send people to `/auth/hub`. The callback receives the usual OmniAuth hash.
+- **Starting a trial:** send people to `/auth/hub?prompt=create&plan=<plan key>`. The Hub
   shows its signup page and records the requested plan.
+- **Naming the organization:** if your customers are organizations (leagues, teams,
+  companies), collect the name in your own signup step and add `&organization=<name>` to
+  that trial link. The Hub creates that organization and attaches the plan to it; it never
+  asks for the name itself. Leave it off for individual customers.
 
 The callback's `uid` is the Hub's `usr_` id. `info` holds the person's name and email.
 `Iorwerth::Hub.organizations(auth)` returns the organizations they belong to, as this
@@ -93,6 +100,11 @@ session first, then send the browser to the Hub's end-session endpoint. POST it
 token stays out of URLs; the Hub returns to `post_logout_redirect_uri` with `state`
 unchanged, which you can use to pick where to land.
 
+The POST is cross-site, so the browser does not send the Hub's session cookie with it. The
+Hub handles that for you: it bounces the browser through a same-site redirect of its own that
+does carry the cookie, then on to `post_logout_redirect_uri`. Your side is unchanged — submit
+the form and let the browser follow the redirects.
+
 ```ruby
 # config/initializers/omniauth.rb — register the return URL with the Hub, per product:
 #   post_logout_redirect_uris = https://podium.app/auth/hub/signed_out

data/lib/iorwerth/hub/omniauth.rb

@@ -11,11 +11,14 @@ module OmniAuth
     #   # config/initializers/omniauth.rb
     #   require "iorwerth/hub/omniauth"
     #   Rails.application.config.middleware.use OmniAuth::Builder do
-    #     provider :iorwerth_hub, redirect_uri: "https://podium.app/auth/iorwerth_hub/callback"
+    #     provider :iorwerth_hub, name: :hub, redirect_uri: "https://podium.app/auth/hub/callback"
     #   end
     #
-    # Link to /auth/iorwerth_hub to sign in, or /auth/iorwerth_hub?prompt=create&plan=<key>
-    # for "Start free trial": the Hub shows signup and records the plan. The auth hash's
+    # `name: :hub` mounts it at /auth/hub. Link to /auth/hub to sign in, or
+    # /auth/hub?prompt=create&plan=<key> for "Start free trial": the Hub shows signup and
+    # records the plan. When your customers are organizations, collect the organization's
+    # name in your own signup wizard and pass it as &organization=<name>; the Hub creates
+    # that organization and never shows a field of its own for it. The auth hash's
     # extra.raw_info carries the `organizations` claim (Iorwerth::Hub.organizations(auth)).
     class IorwerthHub < OpenIDConnect
       option :name, "iorwerth_hub"
@@ -23,7 +26,7 @@ module OmniAuth
       option :pkce, true
       option :response_type, "code"
       option :scope, %i[openid email profile]
-      option :allow_authorize_params, %i[plan]
+      option :allow_authorize_params, %i[plan organization]
 
       def initialize(app, *args, &block)
         super

data/lib/iorwerth/hub/version.rb

@@ -2,6 +2,6 @@
 
 module Iorwerth
   module Hub
-    VERSION = "0.3.0"
+    VERSION = "0.4.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: iorwerth-hub
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Iorwerth Technologies
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-10 00:00:00.000000000 Z
+date: 2026-10-17 00:00:00.000000000 Z
 dependencies: []
 description: Sign-in through the Hub (OmniAuth), its /api/v1 client, cached entitlement
   checks, and a Rack endpoint that verifies the Hub's webhooks.