oauth2 1.4.11 → 2.0.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +150 -3
- data/CONTRIBUTING.md +4 -4
- data/README.md +136 -39
- data/lib/oauth2/access_token.rb +62 -23
- data/lib/oauth2/authenticator.rb +9 -4
- data/lib/oauth2/client.rb +149 -87
- data/lib/oauth2/error.rb +41 -24
- data/lib/oauth2/response.rb +77 -22
- data/lib/oauth2/strategy/assertion.rb +63 -38
- data/lib/oauth2/strategy/auth_code.rb +13 -2
- data/lib/oauth2/strategy/client_credentials.rb +1 -1
- data/lib/oauth2/strategy/implicit.rb +7 -0
- data/lib/oauth2/version.rb +1 -59
- data/lib/oauth2.rb +27 -1
- metadata +54 -35
- data/lib/oauth2/mac_token.rb +0 -130
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: ca10cc72ec9bc6e594334ea57a44fee4cbde470ce93da4148acce84fedcf8cf9
|
|
4
|
+
data.tar.gz: 6fc164a6f1ed3eaabe6e2d9287929be122b1cb2ae0e20a00411abc24158db495
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: cec417d5b26211bc6eda04bdc7595667937a6d1f35f0ca294c7c95487884e428ab9ce0bbedda16d9529367c9e9dbe563c80f858dc69851bf1950b53570eda9a1
|
|
7
|
+
data.tar.gz: 1a9e4f0dd3e2ec837fa8ffb6d5cdeef8b3b58c1ff16f1e5c368f9b41a0e403cd0c467523d58917d739e15cf41d24155005ca40df3df8c82ca7ab45de1bb3cce3
|
data/CHANGELOG.md
CHANGED
|
@@ -1,11 +1,147 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
All notable changes to this project will be documented in this file.
|
|
3
3
|
|
|
4
|
-
|
|
4
|
+
The format (since v2) is based on [Keep a Changelog v1](https://keepachangelog.com/en/1.0.0/),
|
|
5
|
+
and this project adheres to [Semantic Versioning v2](https://semver.org/spec/v2.0.0.html).
|
|
6
|
+
|
|
7
|
+
## [Unreleased]
|
|
8
|
+
### Added
|
|
9
|
+
### Changed
|
|
10
|
+
### Fixed
|
|
11
|
+
### Removed
|
|
12
|
+
|
|
13
|
+
## [2.0.9] - 2022-09-16
|
|
14
|
+
### Added
|
|
15
|
+
- More specs (@pboling)
|
|
16
|
+
### Changed
|
|
17
|
+
- Complete migration to main branch as default (@pboling)
|
|
18
|
+
- Complete migration to Gitlab, updating all links, and references in VCS-managed files (@pboling)
|
|
19
|
+
|
|
20
|
+
## [2.0.8] - 2022-09-01
|
|
21
|
+
### Changed
|
|
22
|
+
- [!630](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/630) - Extract snaky_hash to external dependency (@pboling)
|
|
23
|
+
### Added
|
|
24
|
+
- [!631](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/631) - New global configuration option OAuth2.config.silence_extra_tokens_warning (default: false) fixes [#628](https://gitlab.com/oauth-xx/oauth2/-/issues/628)
|
|
25
|
+
|
|
26
|
+
## [2.0.7] - 2022-08-22
|
|
27
|
+
### Added
|
|
28
|
+
- [#629](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/629) - Allow POST of JSON to get token (@pboling, @terracatta)
|
|
29
|
+
### Fixed
|
|
30
|
+
- [#626](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/626) - Fixes a regression in 2.0.6. Will now prefer the key order from the lookup, not the hash keys (@rickselby)
|
|
31
|
+
- Note: This fixes compatibility with `omniauth-oauth2` and AWS
|
|
32
|
+
- [#625](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/625) - Fixes the printed version in the post install message (@hasghari)
|
|
33
|
+
|
|
34
|
+
## [2.0.6] - 2022-07-13
|
|
35
|
+
### Fixed
|
|
36
|
+
- [#624](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/624) - Fixes a [regression](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/623) in v2.0.5, where an error would be raised in refresh_token flows due to (legitimate) lack of access_token (@pboling)
|
|
37
|
+
|
|
38
|
+
## [2.0.5] - 2022-07-07
|
|
39
|
+
### Fixed
|
|
40
|
+
- [#620](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/620) - Documentation improvements, to help with upgrading (@swanson)
|
|
41
|
+
- [#621](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/621) - Fixed [#528](https://gitlab.com/oauth-xx/oauth2/-/issues/528) and [#619](https://gitlab.com/oauth-xx/oauth2/-/issues/619) (@pboling)
|
|
42
|
+
- All data in responses is now returned, with the access token removed and set as `token`
|
|
43
|
+
- `refresh_token` is no longer dropped
|
|
44
|
+
- **BREAKING**: Microsoft's `id_token` is no longer left as `access_token['id_token']`, but moved to the standard `access_token.token` that all other strategies use
|
|
45
|
+
- Remove `parse` and `snaky` from options so they don't get included in response
|
|
46
|
+
- There is now 100% test coverage, for lines _and_ branches, and it will stay that way.
|
|
47
|
+
|
|
48
|
+
## [2.0.4] - 2022-07-01
|
|
49
|
+
### Fixed
|
|
50
|
+
- [#618](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/618) - In some scenarios the `snaky` option default value was not applied (@pboling)
|
|
51
|
+
|
|
52
|
+
## [2.0.3] - 2022-06-28
|
|
53
|
+
### Added
|
|
54
|
+
- [#611](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/611) - Proper deprecation warnings for `extract_access_token` argument (@pboling)
|
|
55
|
+
- [#612](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/612) - Add `snaky: false` option to skip conversion to `OAuth2::SnakyHash` (default: true) (@pboling)
|
|
56
|
+
### Fixed
|
|
57
|
+
- [#608](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/608) - Wrap `Faraday::TimeoutError` in `OAuth2::TimeoutError` (@nbibler)
|
|
58
|
+
- [#615](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/615) - Fix support for requests with blocks, see `Faraday::Connection#run_request` (@pboling)
|
|
59
|
+
|
|
60
|
+
## [2.0.2] - 2022-06-24
|
|
61
|
+
### Fixed
|
|
62
|
+
- [#604](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/604) - Wrap `Faraday::TimeoutError` in `OAuth2::TimeoutError` (@stanhu)
|
|
63
|
+
- [#606](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/606) - Ruby 2.7 deprecation warning fix: Move `access_token_class` parameter into `Client` constructor (@stanhu)
|
|
64
|
+
- [#607](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/607) - CHANGELOG correction, reference to `OAuth2::ConnectionError` (@zavan)
|
|
65
|
+
|
|
66
|
+
## [2.0.1] - 2022-06-22
|
|
67
|
+
### Added
|
|
68
|
+
- Documentation improvements (@pboling)
|
|
69
|
+
- Increased test coverage to 99% (@pboling)
|
|
70
|
+
|
|
71
|
+
## [2.0.0] - 2022-06-21
|
|
72
|
+
### Added
|
|
73
|
+
- [#158](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/158), [#344](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/344) - Optionally pass raw response to parsers (@niels)
|
|
74
|
+
- [#190](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/190), [#332](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/332), [#334](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/334), [#335](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/335), [#360](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/360), [#426](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/426), [#427](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/427), [#461](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/461) - Documentation (@josephpage, @pboling, @meganemura, @joshRpowell, @elliotcm)
|
|
75
|
+
- [#220](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/220) - Support IETF rfc7523 JWT Bearer Tokens Draft 04+ (@jhmoore)
|
|
76
|
+
- [#298](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/298) - Set the response object on the access token on Client#get_token for debugging (@cpetschnig)
|
|
77
|
+
- [#305](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/305) - Option: `OAuth2::Client#get_token` - `:access_token_class` (`AccessToken`); user specified class to use for all calls to `get_token` (@styd)
|
|
78
|
+
- [#346](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/571) - Modern gem structure (@pboling)
|
|
79
|
+
- [#351](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/351) - Support Jruby 9k (@pboling)
|
|
80
|
+
- [#362](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/362) - Support SemVer release version scheme (@pboling)
|
|
81
|
+
- [#363](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/363) - New method `OAuth2::AccessToken#refresh!` same as old `refresh`, with backwards compatibility alias (@pboling)
|
|
82
|
+
- [#364](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/364) - Support `application/hal+json` format (@pboling)
|
|
83
|
+
- [#365](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/365) - Support `application/vnd.collection+json` format (@pboling)
|
|
84
|
+
- [#376](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/376) - _Documentation_: Example / Test for Google 2-legged JWT (@jhmoore)
|
|
85
|
+
- [#381](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/381) - Spec for extra header params on client credentials (@nikz)
|
|
86
|
+
- [#394](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/394) - Option: `OAuth2::AccessToken#initialize` - `:expires_latency` (`nil`); number of seconds by which AccessToken validity will be reduced to offset latency (@klippx)
|
|
87
|
+
- [#412](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/412) - Support `application/vdn.api+json` format (from jsonapi.org) (@david-christensen)
|
|
88
|
+
- [#413](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/413) - _Documentation_: License scan and report (@meganemura)
|
|
89
|
+
- [#442](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/442) - Option: `OAuth2::Client#initialize` - `:logger` (`::Logger.new($stdout)`) logger to use when OAUTH_DEBUG is enabled (for parity with `1-4-stable` branch) (@rthbound)
|
|
90
|
+
- [#494](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/494) - Support [OIDC 1.0 Private Key JWT](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication); based on the OAuth JWT assertion specification [(RFC 7523)](https://tools.ietf.org/html/rfc7523) (@SteveyblamWork)
|
|
91
|
+
- [#549](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/549) - Wrap `Faraday::ConnectionFailed` in `OAuth2::ConnectionError` (@nikkypx)
|
|
92
|
+
- [#550](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/550) - Raise error if location header not present when redirecting (@stanhu)
|
|
93
|
+
- [#552](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/552) - Add missing `version.rb` require (@ahorek)
|
|
94
|
+
- [#553](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/553) - Support `application/problem+json` format (@janz93)
|
|
95
|
+
- [#560](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/560) - Support IETF rfc6749, section 2.3.1 - don't set auth params when `nil` (@bouk)
|
|
96
|
+
- [#571](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/571) - Support Ruby 3.1 (@pboling)
|
|
97
|
+
- [#575](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/575) - Support IETF rfc7231, section 7.1.2 - relative location in redirect (@pboling)
|
|
98
|
+
- [#581](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/581) - _Documentation_: of breaking changes (@pboling)
|
|
99
|
+
### Changed
|
|
100
|
+
- [#191](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/191) - **BREAKING**: Token is expired if `expired_at` time is `now` (@davestevens)
|
|
101
|
+
- [#312](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/312) - **BREAKING**: Set `:basic_auth` as default for `:auth_scheme` instead of `:request_body`. This was default behavior before 1.3.0. (@tetsuya, @wy193777)
|
|
102
|
+
- [#317](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/317) - _Dependency_: Upgrade `jwt` to 2.x.x (@travisofthenorth)
|
|
103
|
+
- [#338](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/338) - _Dependency_: Switch from `Rack::Utils.escape` to `CGI.escape` (@josephpage)
|
|
104
|
+
- [#339](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/339), [#368](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/368), [#424](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/424), [#479](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/479), [#493](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/493), [#539](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/539), [#542](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/542), [#553](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/553) - CI Updates, code coverage, linting, spelling, type fixes, New VERSION constant (@pboling, @josephpage, @ahorek)
|
|
105
|
+
- [#410](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/410) - **BREAKING**: Removed the ability to call .error from an OAuth2::Response object (@jhmoore)
|
|
106
|
+
- [#414](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/414) - Use Base64.strict_encode64 instead of custom internal logic (@meganemura)
|
|
107
|
+
- [#489](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/489) - **BREAKING**: Default value for option `OAuth2::Client` - `:authorize_url` removed leading slash to work with relative paths by default (`'oauth/authorize'`) (@ghost)
|
|
108
|
+
- [#489](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/489) - **BREAKING**: Default value for option `OAuth2::Client` - `:token_url` removed leading slash to work with relative paths by default (`'oauth/token'`) (@ghost)
|
|
109
|
+
- [#507](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/507), [#575](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/575) - **BREAKING**: Transform keys to camel case, always, by default (ultimately via `rash_alt` gem)
|
|
110
|
+
- Original keys will still work as previously, in most scenarios, thanks to `rash_alt` gem.
|
|
111
|
+
- However, this is a _breaking_ change if you rely on `response.parsed.to_h`, as the keys in the result will be camel case.
|
|
112
|
+
- As of version 2.0.4 you can turn key transformation off with the `snaky: false` option.
|
|
113
|
+
- [#576](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/576) - **BREAKING**: Stop rescuing parsing errors (@pboling)
|
|
114
|
+
- [#591](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/576) - _DEPRECATION_: `OAuth2::Client` - `:extract_access_token` option is deprecated
|
|
115
|
+
### Fixed
|
|
116
|
+
- [#158](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/158), [#344](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/344) - Handling of errors when using `omniauth-facebook` (@niels)
|
|
117
|
+
- [#294](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/294) - Fix: "Unexpected middleware set" issue with Faraday when `OAUTH_DEBUG=true` (@spectator, @gafrom)
|
|
118
|
+
- [#300](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/300) - _Documentation_: `Oauth2::Error` - Error codes are strings, not symbols (@NobodysNightmare)
|
|
119
|
+
- [#318](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/318), [#326](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/326), [#343](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/343), [#347](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/347), [#397](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/397), [#464](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/464), [#561](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/561), [#565](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/565) - _Dependency_: Support all versions of `faraday` (see [gemfiles/README.md][gemfiles/readme] for compatibility matrix with Ruby engines & versions) (@pboling, @raimondasv, @zacharywelch, @Fudoshiki, @ryogift, @sj26, @jdelStrother)
|
|
120
|
+
- [#322](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/322), [#331](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/331), [#337](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/337), [#361](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/361), [#371](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/371), [#377](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/377), [#383](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/383), [#392](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/392), [#395](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/395), [#400](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/400), [#401](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/401), [#403](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/403), [#415](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/415), [#567](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/567) - Updated Rubocop, Rubocop plugins and improved code style (@pboling, @bquorning, @lautis, @spectator)
|
|
121
|
+
- [#328](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/328) - _Documentation_: Homepage URL is SSL (@amatsuda)
|
|
122
|
+
- [#339](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/339), [#479](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/479) - Update testing infrastructure for all supported Rubies (@pboling and @josephpage)
|
|
123
|
+
- [#366](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/366) - **Security**: Fix logging to `$stdout` of request and response bodies via Faraday's logger and `ENV["OAUTH_DEBUG"] == 'true'` (@pboling)
|
|
124
|
+
- [#380](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/380) - Fix: Stop attempting to encode non-encodable objects in `Oauth2::Error` (@jhmoore)
|
|
125
|
+
- [#399](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/399) - Fix: Stop duplicating `redirect_uri` in `get_token` (@markus)
|
|
126
|
+
- [#410](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/410) - Fix: `SystemStackError` caused by circular reference between Error and Response classes (@jhmoore)
|
|
127
|
+
- [#460](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/460) - Fix: Stop throwing errors when `raise_errors` is set to `false`; analog of [#524](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/524) for `1-4-stable` branch (@joaolrpaulo)
|
|
128
|
+
- [#472](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/472) - **Security**: Add checks to enforce `client_secret` is *never* passed in authorize_url query params for `implicit` and `auth_code` grant types (@dfockler)
|
|
129
|
+
- [#482](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/482) - _Documentation_: Update last of `intridea` links to `oauth-xx` (@pboling)
|
|
130
|
+
- [#536](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/536) - **Security**: Compatibility with more (and recent) Ruby OpenSSL versions, Github Actions, Rubocop updated, analogous to [#535](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/535) on `1-4-stable` branch (@pboling)
|
|
131
|
+
- [#595](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/595) - Graceful handling of empty responses from `Client#get_token`, respecting `:raise_errors` config (@stanhu)
|
|
132
|
+
- [#596](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/596) - Consistency between `AccessToken#refresh` and `Client#get_token` named arguments (@stanhu)
|
|
133
|
+
- [#598](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/598) - Fix unparseable data not raised as error in `Client#get_token`, respecting `:raise_errors` config (@stanhu)
|
|
134
|
+
### Removed
|
|
135
|
+
- [#341](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/341) - Remove Rdoc & Jeweler related files (@josephpage)
|
|
136
|
+
- [#342](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/342) - **BREAKING**: Dropped support for Ruby 1.8 (@josephpage)
|
|
137
|
+
- [#539](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/539) - Remove reliance on globally included OAuth2 in tests, analog of [#538](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/538) for 1-4-stable (@anderscarling)
|
|
138
|
+
- [#566](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/566) - _Dependency_: Removed `wwtd` (@bquorning)
|
|
139
|
+
- [#589](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/589), [#593](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/593) - Remove support for expired MAC token draft spec (@stanhu)
|
|
140
|
+
- [#590](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/590) - _Dependency_: Removed `multi_json` (@stanhu)
|
|
5
141
|
|
|
6
142
|
## [1.4.11] - 2022-09-16
|
|
7
143
|
- Complete migration to main branch as default (@pboling)
|
|
8
|
-
- Complete migration to Gitlab, updating all links, and references in VCS-managed files (@pboling)
|
|
144
|
+
- Complete migration to Gitlab, updating all links, and references in VCS-managed files (@pboling)
|
|
9
145
|
|
|
10
146
|
## [1.4.10] - 2022-07-01
|
|
11
147
|
- FIPS Compatibility [#587](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/587) (@akostadinov)
|
|
@@ -185,4 +321,15 @@ All notable changes to this project will be documented in this file.
|
|
|
185
321
|
[1.4.9]: https://gitlab.com/oauth-xx/oauth2/-/compare/v1.4.8...v1.4.9
|
|
186
322
|
[1.4.10]: https://gitlab.com/oauth-xx/oauth2/-/compare/v1.4.9...v1.4.10
|
|
187
323
|
[1.4.11]: https://gitlab.com/oauth-xx/oauth2/-/compare/v1.4.10...v1.4.11
|
|
188
|
-
[
|
|
324
|
+
[2.0.0]: https://gitlab.com/oauth-xx/oauth2/-/compare/v1.4.11...v2.0.0
|
|
325
|
+
[2.0.1]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.0...v2.0.1
|
|
326
|
+
[2.0.2]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.1...v2.0.2
|
|
327
|
+
[2.0.3]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.2...v2.0.3
|
|
328
|
+
[2.0.4]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.3...v2.0.4
|
|
329
|
+
[2.0.5]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.4...v2.0.5
|
|
330
|
+
[2.0.6]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.5...v2.0.6
|
|
331
|
+
[2.0.7]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.6...v2.0.7
|
|
332
|
+
[2.0.8]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.7...v2.0.8
|
|
333
|
+
[2.0.9]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.8...v2.0.9
|
|
334
|
+
[Unreleased]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.9...HEAD
|
|
335
|
+
[gemfiles/readme]: gemfiles/README.md
|
data/CONTRIBUTING.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
## Contributing
|
|
2
2
|
|
|
3
|
-
Bug reports and pull requests are welcome on
|
|
3
|
+
Bug reports and pull requests are welcome on GitLab at [https://gitlab.com/oauth-xx/oauth2][source]
|
|
4
4
|
. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to
|
|
5
5
|
the [code of conduct][conduct].
|
|
6
6
|
|
|
@@ -27,7 +27,7 @@ To submit a patch, please fork the project and create a patch with tests. Once y
|
|
|
27
27
|
|
|
28
28
|
## Contributors
|
|
29
29
|
|
|
30
|
-
[][contributors]
|
|
30
|
+
[][🚎contributors]
|
|
31
31
|
|
|
32
32
|
Made with [contributors-img][contrib-rocks].
|
|
33
33
|
|
|
@@ -37,8 +37,8 @@ Made with [contributors-img][contrib-rocks].
|
|
|
37
37
|
|
|
38
38
|
[contrib-rocks]: https://contrib.rocks
|
|
39
39
|
|
|
40
|
-
[contributors]: https://gitlab.com/oauth-xx/oauth2/-/graphs/main
|
|
40
|
+
[🚎contributors]: https://gitlab.com/oauth-xx/oauth2/-/graphs/main
|
|
41
41
|
|
|
42
42
|
[comment]: <> (Following links are used by README, CONTRIBUTING, Homepage)
|
|
43
43
|
|
|
44
|
-
[source]: https://gitlab.com/oauth-xx/oauth2
|
|
44
|
+
[source]: https://gitlab.com/oauth-xx/oauth2/
|
data/README.md
CHANGED
|
@@ -15,24 +15,37 @@ OAuth 2.0 focuses on client developer simplicity while providing specific author
|
|
|
15
15
|
This is a RubyGem for implementing OAuth 2.0 clients and servers in Ruby applications.
|
|
16
16
|
See the sibling `oauth` gem for OAuth 1.0 implementations in Ruby.
|
|
17
17
|
|
|
18
|
-
⚠️⚠️⚠️ **_WARNING_**: You are viewing the `README` of the
|
|
19
|
-
[supported-only-for-critical-enterprise-security-issues](#oauth2-for-enterprise) `1-4-stable`
|
|
20
|
-
branch. Please do not use this, and instead upgrade to version 2! ⚠️⚠️⚠️
|
|
21
|
-
|
|
22
|
-
No further releases of 1.x series are planned! [Version 2](https://gitlab.com/oauth-xx/oauth2/#what-is-new-for-v20) has *tons* of improvements!
|
|
23
|
-
|
|
24
|
-
If you must continue using 1.4.x please consider purchasing an open source security maintenance contract from [Tidelift][tidelift-ref].
|
|
25
|
-
|
|
26
18
|
---
|
|
27
19
|
|
|
28
20
|
* [OAuth 2.0 Spec][oauth2-spec]
|
|
29
|
-
* [
|
|
21
|
+
* [oauth sibling gem][sibling-gem] for OAuth 1.0 implementations in Ruby.
|
|
30
22
|
|
|
31
23
|
[oauth2-spec]: https://oauth.net/2/
|
|
32
24
|
[sibling-gem]: https://gitlab.com/oauth-xx/oauth
|
|
33
25
|
|
|
34
26
|
## Release Documentation
|
|
35
27
|
|
|
28
|
+
### Version 2.0.x
|
|
29
|
+
|
|
30
|
+
<details>
|
|
31
|
+
<summary>2.0.x Readmes</summary>
|
|
32
|
+
|
|
33
|
+
| Version | Release Date | Readme |
|
|
34
|
+
|---------|--------------|----------------------------------------------------------|
|
|
35
|
+
| 2.0.9 | 2022-09-16 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.9/README.md |
|
|
36
|
+
| 2.0.8 | 2022-09-01 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.8/README.md |
|
|
37
|
+
| 2.0.7 | 2022-08-22 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.7/README.md |
|
|
38
|
+
| 2.0.6 | 2022-07-13 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.6/README.md |
|
|
39
|
+
| 2.0.5 | 2022-07-07 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.5/README.md |
|
|
40
|
+
| 2.0.4 | 2022-07-01 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.4/README.md |
|
|
41
|
+
| 2.0.3 | 2022-06-28 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.3/README.md |
|
|
42
|
+
| 2.0.2 | 2022-06-24 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.2/README.md |
|
|
43
|
+
| 2.0.1 | 2022-06-22 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.1/README.md |
|
|
44
|
+
| 2.0.0 | 2022-06-21 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.0/README.md |
|
|
45
|
+
</details>
|
|
46
|
+
|
|
47
|
+
### Older Releases
|
|
48
|
+
|
|
36
49
|
<details>
|
|
37
50
|
<summary>1.4.x Readmes</summary>
|
|
38
51
|
|
|
@@ -162,10 +175,10 @@ The link tokens in the following sections should be kept ordered by the row and
|
|
|
162
175
|
<!-- 5️⃣ coverage & security -->
|
|
163
176
|
[⛳cclim-cov]: https://codeclimate.com/github/oauth-xx/oauth2/test_coverage
|
|
164
177
|
[⛳cclim-cov-img♻️]: https://api.codeclimate.com/v1/badges/688c612528ff90a46955/test_coverage
|
|
165
|
-
[🖇codecov-img♻️]: https://codecov.io/gh/oauth-xx/oauth2/branch/
|
|
178
|
+
[🖇codecov-img♻️]: https://codecov.io/gh/oauth-xx/oauth2/branch/main/graph/badge.svg?token=bNqSzNiuo2
|
|
166
179
|
[🖇codecov]: https://codecov.io/gh/oauth-xx/oauth2
|
|
167
|
-
[🏘coveralls]: https://coveralls.io/github/oauth-xx/oauth2?branch=
|
|
168
|
-
[🏘coveralls-img]: https://coveralls.io/repos/github/oauth-xx/oauth2/badge.svg?branch=
|
|
180
|
+
[🏘coveralls]: https://coveralls.io/github/oauth-xx/oauth2?branch=main
|
|
181
|
+
[🏘coveralls-img]: https://coveralls.io/repos/github/oauth-xx/oauth2/badge.svg?branch=main
|
|
169
182
|
[🚎sec-pol]: https://gitlab.com/oauth-xx/oauth2/-/blob/main/SECURITY.md
|
|
170
183
|
[🚎sec-pol-img]: https://img.shields.io/badge/security-policy-brightgreen.svg?style=flat
|
|
171
184
|
[🖐codeQL]: https://github.com/oauth-xx/oauth2/security/code-scanning
|
|
@@ -225,7 +238,7 @@ Tidelift will coordinate the fix and disclosure.
|
|
|
225
238
|
|
|
226
239
|
For more see [SECURITY.md][🚎sec-pol].
|
|
227
240
|
|
|
228
|
-
##
|
|
241
|
+
## What is new for v2.0?
|
|
229
242
|
|
|
230
243
|
- Officially support Ruby versions >= 2.7
|
|
231
244
|
- Unofficially support Ruby versions >= 2.5
|
|
@@ -250,10 +263,9 @@ For more see [SECURITY.md][🚎sec-pol].
|
|
|
250
263
|
|
|
251
264
|
## Compatibility
|
|
252
265
|
|
|
253
|
-
Targeted ruby compatibility is 2.7, 3.0 and
|
|
254
|
-
supported and unsupported versions of Ruby.
|
|
255
|
-
|
|
256
|
-
Ruby is limited to 1.9+ in the gemspec for the 1.4.x series and is be 2.2+ for next major version releases (see `master` branch).
|
|
266
|
+
Targeted ruby compatibility is non-EOL versions of Ruby, currently 2.7, 3.0 and
|
|
267
|
+
3.1. Compatibility is further distinguished by supported and unsupported versions of Ruby.
|
|
268
|
+
Ruby is limited to 2.2+ for 2.x releases. See `1-4-stable` branch for older rubies.
|
|
257
269
|
|
|
258
270
|
<details>
|
|
259
271
|
<summary>Ruby Engine Compatibility Policy</summary>
|
|
@@ -293,19 +305,86 @@ See [SECURITY.md][🚎sec-pol]
|
|
|
293
305
|
|
|
294
306
|
## Usage Examples
|
|
295
307
|
|
|
308
|
+
### Global Configuration
|
|
309
|
+
|
|
310
|
+
If you started seeing this warning, but everything it working fine, you can now silence it.
|
|
311
|
+
```log
|
|
312
|
+
OAuth2::AccessToken.from_hash: `hash` contained more than one 'token' key
|
|
313
|
+
```
|
|
314
|
+
|
|
296
315
|
```ruby
|
|
297
|
-
|
|
298
|
-
|
|
316
|
+
OAuth2.configure do |config|
|
|
317
|
+
config.silence_extra_tokens_warning = true # default: false
|
|
318
|
+
end
|
|
319
|
+
```
|
|
299
320
|
|
|
300
|
-
|
|
301
|
-
# => "https://example.org/oauth/authorization?response_type=code&client_id=client_id&redirect_uri=http://localhost:8080/oauth2/callback"
|
|
321
|
+
### `authorize_url` and `token_url` are on site root (Just Works!)
|
|
302
322
|
|
|
303
|
-
|
|
304
|
-
|
|
323
|
+
```ruby
|
|
324
|
+
require 'oauth2'
|
|
325
|
+
client = OAuth2::Client.new('client_id', 'client_secret', site: 'https://example.org')
|
|
326
|
+
# => #<OAuth2::Client:0x00000001204c8288 @id="client_id", @secret="client_sec...
|
|
327
|
+
client.auth_code.authorize_url(redirect_uri: 'http://localhost:8080/oauth2/callback')
|
|
328
|
+
# => "https://example.org/oauth/authorize?client_id=client_id&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth2%2Fcallback&response_type=code"
|
|
329
|
+
|
|
330
|
+
access = client.auth_code.get_token('authorization_code_value', redirect_uri: 'http://localhost:8080/oauth2/callback', headers: {'Authorization' => 'Basic some_password'})
|
|
331
|
+
response = access.get('/api/resource', params: {'query_foo' => 'bar'})
|
|
305
332
|
response.class.name
|
|
306
333
|
# => OAuth2::Response
|
|
307
334
|
```
|
|
308
335
|
|
|
336
|
+
### Relative `authorize_url` and `token_url` (Not on site root, Just Works!)
|
|
337
|
+
|
|
338
|
+
In above example, the default Authorization URL is `oauth/authorize` and default Access Token URL is `oauth/token`, and, as they are missing a leading `/`, both are relative.
|
|
339
|
+
|
|
340
|
+
```ruby
|
|
341
|
+
client = OAuth2::Client.new('client_id', 'client_secret', site: 'https://example.org/nested/directory/on/your/server')
|
|
342
|
+
# => #<OAuth2::Client:0x00000001204c8288 @id="client_id", @secret="client_sec...
|
|
343
|
+
client.auth_code.authorize_url(redirect_uri: 'http://localhost:8080/oauth2/callback')
|
|
344
|
+
# => "https://example.org/nested/directory/on/your/server/oauth/authorize?client_id=client_id&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth2%2Fcallback&response_type=code"
|
|
345
|
+
```
|
|
346
|
+
|
|
347
|
+
### Customize `authorize_url` and `token_url`
|
|
348
|
+
|
|
349
|
+
You can specify custom URLs for authorization and access token, and when using a leading `/` they will _not be relative_, as shown below:
|
|
350
|
+
|
|
351
|
+
```ruby
|
|
352
|
+
client = OAuth2::Client.new('client_id', 'client_secret',
|
|
353
|
+
site: 'https://example.org/nested/directory/on/your/server',
|
|
354
|
+
authorize_url: '/jaunty/authorize/',
|
|
355
|
+
token_url: '/stirrups/access_token')
|
|
356
|
+
# => #<OAuth2::Client:0x00000001204c8288 @id="client_id", @secret="client_sec...
|
|
357
|
+
client.auth_code.authorize_url(redirect_uri: 'http://localhost:8080/oauth2/callback')
|
|
358
|
+
# => "https://example.org/jaunty/authorize/?client_id=client_id&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth2%2Fcallback&response_type=code"
|
|
359
|
+
client.class.name
|
|
360
|
+
# => OAuth2::Client
|
|
361
|
+
```
|
|
362
|
+
|
|
363
|
+
### snake_case and indifferent access in Response#parsed
|
|
364
|
+
|
|
365
|
+
```ruby
|
|
366
|
+
response = access.get('/api/resource', params: {'query_foo' => 'bar'})
|
|
367
|
+
# Even if the actual response is CamelCase. it will be made available as snaky:
|
|
368
|
+
JSON.parse(response.body) # => {"accessToken"=>"aaaaaaaa", "additionalData"=>"additional"}
|
|
369
|
+
response.parsed # => {"access_token"=>"aaaaaaaa", "additional_data"=>"additional"}
|
|
370
|
+
response.parsed.access_token # => "aaaaaaaa"
|
|
371
|
+
response.parsed[:access_token] # => "aaaaaaaa"
|
|
372
|
+
response.parsed.additional_data # => "additional"
|
|
373
|
+
response.parsed[:additional_data] # => "additional"
|
|
374
|
+
response.parsed.class.name # => OAuth2::SnakyHash (subclass of Hashie::Mash::Rash, from `rash_alt` gem)
|
|
375
|
+
```
|
|
376
|
+
|
|
377
|
+
#### What if I hate snakes and/or indifference?
|
|
378
|
+
|
|
379
|
+
```ruby
|
|
380
|
+
response = access.get('/api/resource', params: {'query_foo' => 'bar'}, snaky: false)
|
|
381
|
+
JSON.parse(response.body) # => {"accessToken"=>"aaaaaaaa", "additionalData"=>"additional"}
|
|
382
|
+
response.parsed # => {"accessToken"=>"aaaaaaaa", "additionalData"=>"additional"}
|
|
383
|
+
response.parsed['accessToken'] # => "aaaaaaaa"
|
|
384
|
+
response.parsed['additionalData'] # => "additional"
|
|
385
|
+
response.parsed.class.name # => Hash (just, regular old Hash)
|
|
386
|
+
```
|
|
387
|
+
|
|
309
388
|
<details>
|
|
310
389
|
<summary>Debugging</summary>
|
|
311
390
|
|
|
@@ -324,8 +403,8 @@ require 'oauth2'
|
|
|
324
403
|
client = OAuth2::Client.new(
|
|
325
404
|
'client_id',
|
|
326
405
|
'client_secret',
|
|
327
|
-
:
|
|
328
|
-
:
|
|
406
|
+
site: 'https://example.org',
|
|
407
|
+
logger: Logger.new('example.log', 'weekly')
|
|
329
408
|
)
|
|
330
409
|
```
|
|
331
410
|
</details>
|
|
@@ -336,7 +415,7 @@ The `AccessToken` methods `#get`, `#post`, `#put` and `#delete` and the generic
|
|
|
336
415
|
will return an instance of the #OAuth2::Response class.
|
|
337
416
|
|
|
338
417
|
This instance contains a `#parsed` method that will parse the response body and
|
|
339
|
-
return a Hash if the `Content-Type` is `application/x-www-form-urlencoded` or if
|
|
418
|
+
return a Hash-like [`OAuth2::SnakyHash`](https://gitlab.com/oauth-xx/oauth2/-/blob/main/lib/oauth2/snaky_hash.rb) if the `Content-Type` is `application/x-www-form-urlencoded` or if
|
|
340
419
|
the body is a JSON object. It will return an Array if the body is a JSON
|
|
341
420
|
array. Otherwise, it will return the original body string.
|
|
342
421
|
|
|
@@ -366,28 +445,46 @@ Response instance will contain the `OAuth2::Error` instance.
|
|
|
366
445
|
|
|
367
446
|
Currently the Authorization Code, Implicit, Resource Owner Password Credentials, Client Credentials, and Assertion
|
|
368
447
|
authentication grant types have helper strategy classes that simplify client
|
|
369
|
-
use. They are available via the `#auth_code
|
|
448
|
+
use. They are available via the [`#auth_code`](https://gitlab.com/oauth-xx/oauth2/-/blob/main/lib/oauth2/strategy/auth_code.rb),
|
|
449
|
+
[`#implicit`](https://gitlab.com/oauth-xx/oauth2/-/blob/main/lib/oauth2/strategy/implicit.rb),
|
|
450
|
+
[`#password`](https://gitlab.com/oauth-xx/oauth2/-/blob/main/lib/oauth2/strategy/password.rb),
|
|
451
|
+
[`#client_credentials`](https://gitlab.com/oauth-xx/oauth2/-/blob/main/lib/oauth2/strategy/client_credentials.rb), and
|
|
452
|
+
[`#assertion`](https://gitlab.com/oauth-xx/oauth2/-/blob/main/lib/oauth2/strategy/assertion.rb) methods respectively.
|
|
370
453
|
|
|
454
|
+
These aren't full examples, but demonstrative of the differences between usage for each strategy.
|
|
371
455
|
```ruby
|
|
372
|
-
auth_url = client.auth_code.authorize_url(:
|
|
373
|
-
|
|
456
|
+
auth_url = client.auth_code.authorize_url(redirect_uri: 'http://localhost:8080/oauth/callback')
|
|
457
|
+
access = client.auth_code.get_token('code_value', redirect_uri: 'http://localhost:8080/oauth/callback')
|
|
374
458
|
|
|
375
|
-
auth_url = client.implicit.authorize_url(:
|
|
459
|
+
auth_url = client.implicit.authorize_url(redirect_uri: 'http://localhost:8080/oauth/callback')
|
|
376
460
|
# get the token params in the callback and
|
|
377
|
-
|
|
378
|
-
|
|
379
|
-
|
|
380
|
-
|
|
381
|
-
|
|
382
|
-
|
|
383
|
-
|
|
461
|
+
access = OAuth2::AccessToken.from_kvform(client, query_string)
|
|
462
|
+
|
|
463
|
+
access = client.password.get_token('username', 'password')
|
|
464
|
+
|
|
465
|
+
access = client.client_credentials.get_token
|
|
466
|
+
|
|
467
|
+
# Client Assertion Strategy
|
|
468
|
+
# see: https://tools.ietf.org/html/rfc7523
|
|
469
|
+
claimset = {
|
|
470
|
+
iss: 'http://localhost:3001',
|
|
471
|
+
aud: 'http://localhost:8080/oauth2/token',
|
|
472
|
+
sub: 'me@example.com',
|
|
473
|
+
exp: Time.now.utc.to_i + 3600,
|
|
474
|
+
}
|
|
475
|
+
assertion_params = [claimset, 'HS256', 'secret_key']
|
|
476
|
+
access = client.assertion.get_token(assertion_params)
|
|
477
|
+
|
|
478
|
+
# The `access` (i.e. access token) is then used like so:
|
|
479
|
+
access.token # actual access_token string, if you need it somewhere
|
|
480
|
+
access.get('/api/stuff') # making api calls with access token
|
|
384
481
|
```
|
|
385
482
|
|
|
386
483
|
If you want to specify additional headers to be sent out with the
|
|
387
484
|
request, add a 'headers' hash under 'params':
|
|
388
485
|
|
|
389
486
|
```ruby
|
|
390
|
-
|
|
487
|
+
access = client.auth_code.get_token('code_value', redirect_uri: 'http://localhost:8080/oauth/callback', headers: {'Some' => 'Header'})
|
|
391
488
|
```
|
|
392
489
|
|
|
393
490
|
You can always use the `#request` method on the `OAuth2::Client` instance to make
|
|
@@ -408,7 +505,7 @@ dependency on this gem using the [Pessimistic Version Constraint][pvc] with two
|
|
|
408
505
|
For example:
|
|
409
506
|
|
|
410
507
|
```ruby
|
|
411
|
-
spec.add_dependency 'oauth2', '~>
|
|
508
|
+
spec.add_dependency 'oauth2', '~> 2.0'
|
|
412
509
|
```
|
|
413
510
|
|
|
414
511
|
[semver]: http://semver.org/
|