model_driven_api 3.12.0 → 3.12.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0877810a34bb2f213343f3e5f13bfee52b0cec2d8da29431c64466185078d01b'
-  data.tar.gz: d52e6f70ae1da5655ab7b5ad605c400c88ed659d84425b91e5a239506d2d9d6a
+  metadata.gz: 64d6dc96e02bf63e76a9948d41e1f7203433f9be2f3bb0a2abe16f19179351ad
+  data.tar.gz: 47bf8c07a5e6381bcabb15a150faae8bd08ae02000db9798c091b2a916e628df
 SHA512:
-  metadata.gz: 2a557cb8c023b0e98fc299c3c2334e6720faa58f2383f8f207ad53a5d00f6b66a8b92c9756d467aed8b02a21fc0beb145c5eb92d3fe20ca226de2963fe4ef7ab
-  data.tar.gz: eccaf19b8ecdf2c13283c3918ec4be6d1d8c27d4e52b1e37490ddae532720be75a03a11853f882bb14778c141198cb123f2c610a518d3397b351157e7de523b9
+  metadata.gz: 6d7039ac2e39aa75800db5a1ecdabd121a7465c8ffdc966ab88dac7961e53bd00eff37c0b8794b5d6ecca68f5a8d9eed3e4a3a8dd9d800a084301e12a7e321b0
+  data.tar.gz: 37566ee9050bfe09de0f3d784d0c6b4b6aebb39ec365ceb8c7f59e045b4865d3bf66518ebd1a393c38a8a04db575a2bd3ee2c106df84551f17e79c2b27c33780

data/README.md

@@ -73,7 +73,7 @@ bundle exec rails db:migrate
 POST /api/v2/authenticate
 Content-Type: application/json
 
-{ "auth": { "email": "admin@example.com", "password": "Change#1" } }
+{ "auth": { "email": "admin@example.com", "password": "<password>" } }
 ```
 
 Response body: User JSON. Response header: `Token: <jwt>`.

data/app/controllers/api/v2/auth/oauth_controller.rb

@@ -1,7 +1,15 @@
 module Api::V2::Auth
   class OauthController < ActionController::API
+    # L'identità arriva solo da request.env['omniauth.auth'], che il middleware OmniAuth imposta
+    # dopo aver verificato il login col provider; mai dai parametri della richiesta, che chiunque
+    # può inviare (fino alla 3.12.1 bastava una POST con email= per avere il JWT di quell'utente).
     def callback
-      user = ThecoreAuthCommons.check_user params['email'], params['given_name'], params['family_name'], params['provider']
+      auth = request.env['omniauth.auth']
+      info = auth&.info
+      user = info && ThecoreAuthCommons.check_user(info.email,
+                                                   info.first_name.presence || info.name,
+                                                   info.last_name,
+                                                   auth.provider)
 
       unless user
         render json: { error: "User not registered" }, status: :unauthorized

data/config/routes.rb

@@ -3,8 +3,9 @@
 Rails.application.routes.draw do
   scope ENV.fetch("RAILS_RELATIVE_URL_ROOT", "/") do
     if ThecoreAuthCommons.oauth_vars?
-      # OmniAuth callbacks need these top-level paths:
-      match "/auth/:provider/callback", to: redirect("/api/v2/auth/%{provider}/callback"), via: [:get, :post]
+      # OmniAuth callbacks need these top-level paths. The callback goes straight to the controller:
+      # a redirect would drop the verified request.env['omniauth.auth'] the middleware has just set.
+      match "/auth/:provider/callback", to: "api/v2/auth/oauth#callback", via: [:get, :post], defaults: { format: :json }
       match "/auth/failure", to: redirect("/api/v2/auth/failure"), via: [:get, :post]
     end
     namespace :api, constraints: { format: :json } do

data/lib/api/open_api/v2.rb

@@ -732,7 +732,7 @@ To begin a session, the client must POST user credentials to the authentication
 {
     "auth": {
         "email": "admin@example.com",
-        "password": "Change#1"
+        "password": "<password>"
     }
 }
 

data/lib/model_driven_api/version.rb

@@ -1,3 +1,3 @@
 module ModelDrivenApi
-  VERSION = "3.12.0".freeze
+  VERSION = "3.12.2".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 3.12.0
+  version: 3.12.2
 platform: ruby
 authors:
 - Gabriele Tassoni