oauth2 1.4.11 → 2.0.9
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +150 -3
- data/CONTRIBUTING.md +4 -4
- data/README.md +136 -39
- data/lib/oauth2/access_token.rb +62 -23
- data/lib/oauth2/authenticator.rb +9 -4
- data/lib/oauth2/client.rb +149 -87
- data/lib/oauth2/error.rb +41 -24
- data/lib/oauth2/response.rb +77 -22
- data/lib/oauth2/strategy/assertion.rb +63 -38
- data/lib/oauth2/strategy/auth_code.rb +13 -2
- data/lib/oauth2/strategy/client_credentials.rb +1 -1
- data/lib/oauth2/strategy/implicit.rb +7 -0
- data/lib/oauth2/version.rb +1 -59
- data/lib/oauth2.rb +27 -1
- metadata +54 -35
- data/lib/oauth2/mac_token.rb +0 -130
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: ca10cc72ec9bc6e594334ea57a44fee4cbde470ce93da4148acce84fedcf8cf9
|
|
4
|
+
data.tar.gz: 6fc164a6f1ed3eaabe6e2d9287929be122b1cb2ae0e20a00411abc24158db495
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: cec417d5b26211bc6eda04bdc7595667937a6d1f35f0ca294c7c95487884e428ab9ce0bbedda16d9529367c9e9dbe563c80f858dc69851bf1950b53570eda9a1
|
|
7
|
+
data.tar.gz: 1a9e4f0dd3e2ec837fa8ffb6d5cdeef8b3b58c1ff16f1e5c368f9b41a0e403cd0c467523d58917d739e15cf41d24155005ca40df3df8c82ca7ab45de1bb3cce3
|
data/CHANGELOG.md
CHANGED
|
@@ -1,11 +1,147 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
All notable changes to this project will be documented in this file.
|
|
3
3
|
|
|
4
|
-
|
|
4
|
+
The format (since v2) is based on [Keep a Changelog v1](https://keepachangelog.com/en/1.0.0/),
|
|
5
|
+
and this project adheres to [Semantic Versioning v2](https://semver.org/spec/v2.0.0.html).
|
|
6
|
+
|
|
7
|
+
## [Unreleased]
|
|
8
|
+
### Added
|
|
9
|
+
### Changed
|
|
10
|
+
### Fixed
|
|
11
|
+
### Removed
|
|
12
|
+
|
|
13
|
+
## [2.0.9] - 2022-09-16
|
|
14
|
+
### Added
|
|
15
|
+
- More specs (@pboling)
|
|
16
|
+
### Changed
|
|
17
|
+
- Complete migration to main branch as default (@pboling)
|
|
18
|
+
- Complete migration to Gitlab, updating all links, and references in VCS-managed files (@pboling)
|
|
19
|
+
|
|
20
|
+
## [2.0.8] - 2022-09-01
|
|
21
|
+
### Changed
|
|
22
|
+
- [!630](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/630) - Extract snaky_hash to external dependency (@pboling)
|
|
23
|
+
### Added
|
|
24
|
+
- [!631](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/631) - New global configuration option OAuth2.config.silence_extra_tokens_warning (default: false) fixes [#628](https://gitlab.com/oauth-xx/oauth2/-/issues/628)
|
|
25
|
+
|
|
26
|
+
## [2.0.7] - 2022-08-22
|
|
27
|
+
### Added
|
|
28
|
+
- [#629](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/629) - Allow POST of JSON to get token (@pboling, @terracatta)
|
|
29
|
+
### Fixed
|
|
30
|
+
- [#626](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/626) - Fixes a regression in 2.0.6. Will now prefer the key order from the lookup, not the hash keys (@rickselby)
|
|
31
|
+
- Note: This fixes compatibility with `omniauth-oauth2` and AWS
|
|
32
|
+
- [#625](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/625) - Fixes the printed version in the post install message (@hasghari)
|
|
33
|
+
|
|
34
|
+
## [2.0.6] - 2022-07-13
|
|
35
|
+
### Fixed
|
|
36
|
+
- [#624](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/624) - Fixes a [regression](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/623) in v2.0.5, where an error would be raised in refresh_token flows due to (legitimate) lack of access_token (@pboling)
|
|
37
|
+
|
|
38
|
+
## [2.0.5] - 2022-07-07
|
|
39
|
+
### Fixed
|
|
40
|
+
- [#620](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/620) - Documentation improvements, to help with upgrading (@swanson)
|
|
41
|
+
- [#621](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/621) - Fixed [#528](https://gitlab.com/oauth-xx/oauth2/-/issues/528) and [#619](https://gitlab.com/oauth-xx/oauth2/-/issues/619) (@pboling)
|
|
42
|
+
- All data in responses is now returned, with the access token removed and set as `token`
|
|
43
|
+
- `refresh_token` is no longer dropped
|
|
44
|
+
- **BREAKING**: Microsoft's `id_token` is no longer left as `access_token['id_token']`, but moved to the standard `access_token.token` that all other strategies use
|
|
45
|
+
- Remove `parse` and `snaky` from options so they don't get included in response
|
|
46
|
+
- There is now 100% test coverage, for lines _and_ branches, and it will stay that way.
|
|
47
|
+
|
|
48
|
+
## [2.0.4] - 2022-07-01
|
|
49
|
+
### Fixed
|
|
50
|
+
- [#618](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/618) - In some scenarios the `snaky` option default value was not applied (@pboling)
|
|
51
|
+
|
|
52
|
+
## [2.0.3] - 2022-06-28
|
|
53
|
+
### Added
|
|
54
|
+
- [#611](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/611) - Proper deprecation warnings for `extract_access_token` argument (@pboling)
|
|
55
|
+
- [#612](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/612) - Add `snaky: false` option to skip conversion to `OAuth2::SnakyHash` (default: true) (@pboling)
|
|
56
|
+
### Fixed
|
|
57
|
+
- [#608](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/608) - Wrap `Faraday::TimeoutError` in `OAuth2::TimeoutError` (@nbibler)
|
|
58
|
+
- [#615](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/615) - Fix support for requests with blocks, see `Faraday::Connection#run_request` (@pboling)
|
|
59
|
+
|
|
60
|
+
## [2.0.2] - 2022-06-24
|
|
61
|
+
### Fixed
|
|
62
|
+
- [#604](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/604) - Wrap `Faraday::TimeoutError` in `OAuth2::TimeoutError` (@stanhu)
|
|
63
|
+
- [#606](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/606) - Ruby 2.7 deprecation warning fix: Move `access_token_class` parameter into `Client` constructor (@stanhu)
|
|
64
|
+
- [#607](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/607) - CHANGELOG correction, reference to `OAuth2::ConnectionError` (@zavan)
|
|
65
|
+
|
|
66
|
+
## [2.0.1] - 2022-06-22
|
|
67
|
+
### Added
|
|
68
|
+
- Documentation improvements (@pboling)
|
|
69
|
+
- Increased test coverage to 99% (@pboling)
|
|
70
|
+
|
|
71
|
+
## [2.0.0] - 2022-06-21
|
|
72
|
+
### Added
|
|
73
|
+
- [#158](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/158), [#344](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/344) - Optionally pass raw response to parsers (@niels)
|
|
74
|
+
- [#190](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/190), [#332](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/332), [#334](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/334), [#335](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/335), [#360](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/360), [#426](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/426), [#427](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/427), [#461](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/461) - Documentation (@josephpage, @pboling, @meganemura, @joshRpowell, @elliotcm)
|
|
75
|
+
- [#220](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/220) - Support IETF rfc7523 JWT Bearer Tokens Draft 04+ (@jhmoore)
|
|
76
|
+
- [#298](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/298) - Set the response object on the access token on Client#get_token for debugging (@cpetschnig)
|
|
77
|
+
- [#305](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/305) - Option: `OAuth2::Client#get_token` - `:access_token_class` (`AccessToken`); user specified class to use for all calls to `get_token` (@styd)
|
|
78
|
+
- [#346](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/571) - Modern gem structure (@pboling)
|
|
79
|
+
- [#351](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/351) - Support Jruby 9k (@pboling)
|
|
80
|
+
- [#362](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/362) - Support SemVer release version scheme (@pboling)
|
|
81
|
+
- [#363](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/363) - New method `OAuth2::AccessToken#refresh!` same as old `refresh`, with backwards compatibility alias (@pboling)
|
|
82
|
+
- [#364](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/364) - Support `application/hal+json` format (@pboling)
|
|
83
|
+
- [#365](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/365) - Support `application/vnd.collection+json` format (@pboling)
|
|
84
|
+
- [#376](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/376) - _Documentation_: Example / Test for Google 2-legged JWT (@jhmoore)
|
|
85
|
+
- [#381](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/381) - Spec for extra header params on client credentials (@nikz)
|
|
86
|
+
- [#394](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/394) - Option: `OAuth2::AccessToken#initialize` - `:expires_latency` (`nil`); number of seconds by which AccessToken validity will be reduced to offset latency (@klippx)
|
|
87
|
+
- [#412](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/412) - Support `application/vdn.api+json` format (from jsonapi.org) (@david-christensen)
|
|
88
|
+
- [#413](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/413) - _Documentation_: License scan and report (@meganemura)
|
|
89
|
+
- [#442](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/442) - Option: `OAuth2::Client#initialize` - `:logger` (`::Logger.new($stdout)`) logger to use when OAUTH_DEBUG is enabled (for parity with `1-4-stable` branch) (@rthbound)
|
|
90
|
+
- [#494](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/494) - Support [OIDC 1.0 Private Key JWT](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication); based on the OAuth JWT assertion specification [(RFC 7523)](https://tools.ietf.org/html/rfc7523) (@SteveyblamWork)
|
|
91
|
+
- [#549](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/549) - Wrap `Faraday::ConnectionFailed` in `OAuth2::ConnectionError` (@nikkypx)
|
|
92
|
+
- [#550](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/550) - Raise error if location header not present when redirecting (@stanhu)
|
|
93
|
+
- [#552](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/552) - Add missing `version.rb` require (@ahorek)
|
|
94
|
+
- [#553](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/553) - Support `application/problem+json` format (@janz93)
|
|
95
|
+
- [#560](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/560) - Support IETF rfc6749, section 2.3.1 - don't set auth params when `nil` (@bouk)
|
|
96
|
+
- [#571](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/571) - Support Ruby 3.1 (@pboling)
|
|
97
|
+
- [#575](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/575) - Support IETF rfc7231, section 7.1.2 - relative location in redirect (@pboling)
|
|
98
|
+
- [#581](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/581) - _Documentation_: of breaking changes (@pboling)
|
|
99
|
+
### Changed
|
|
100
|
+
- [#191](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/191) - **BREAKING**: Token is expired if `expired_at` time is `now` (@davestevens)
|
|
101
|
+
- [#312](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/312) - **BREAKING**: Set `:basic_auth` as default for `:auth_scheme` instead of `:request_body`. This was default behavior before 1.3.0. (@tetsuya, @wy193777)
|
|
102
|
+
- [#317](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/317) - _Dependency_: Upgrade `jwt` to 2.x.x (@travisofthenorth)
|
|
103
|
+
- [#338](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/338) - _Dependency_: Switch from `Rack::Utils.escape` to `CGI.escape` (@josephpage)
|
|
104
|
+
- [#339](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/339), [#368](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/368), [#424](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/424), [#479](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/479), [#493](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/493), [#539](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/539), [#542](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/542), [#553](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/553) - CI Updates, code coverage, linting, spelling, type fixes, New VERSION constant (@pboling, @josephpage, @ahorek)
|
|
105
|
+
- [#410](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/410) - **BREAKING**: Removed the ability to call .error from an OAuth2::Response object (@jhmoore)
|
|
106
|
+
- [#414](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/414) - Use Base64.strict_encode64 instead of custom internal logic (@meganemura)
|
|
107
|
+
- [#489](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/489) - **BREAKING**: Default value for option `OAuth2::Client` - `:authorize_url` removed leading slash to work with relative paths by default (`'oauth/authorize'`) (@ghost)
|
|
108
|
+
- [#489](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/489) - **BREAKING**: Default value for option `OAuth2::Client` - `:token_url` removed leading slash to work with relative paths by default (`'oauth/token'`) (@ghost)
|
|
109
|
+
- [#507](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/507), [#575](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/575) - **BREAKING**: Transform keys to camel case, always, by default (ultimately via `rash_alt` gem)
|
|
110
|
+
- Original keys will still work as previously, in most scenarios, thanks to `rash_alt` gem.
|
|
111
|
+
- However, this is a _breaking_ change if you rely on `response.parsed.to_h`, as the keys in the result will be camel case.
|
|
112
|
+
- As of version 2.0.4 you can turn key transformation off with the `snaky: false` option.
|
|
113
|
+
- [#576](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/576) - **BREAKING**: Stop rescuing parsing errors (@pboling)
|
|
114
|
+
- [#591](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/576) - _DEPRECATION_: `OAuth2::Client` - `:extract_access_token` option is deprecated
|
|
115
|
+
### Fixed
|
|
116
|
+
- [#158](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/158), [#344](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/344) - Handling of errors when using `omniauth-facebook` (@niels)
|
|
117
|
+
- [#294](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/294) - Fix: "Unexpected middleware set" issue with Faraday when `OAUTH_DEBUG=true` (@spectator, @gafrom)
|
|
118
|
+
- [#300](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/300) - _Documentation_: `Oauth2::Error` - Error codes are strings, not symbols (@NobodysNightmare)
|
|
119
|
+
- [#318](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/318), [#326](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/326), [#343](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/343), [#347](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/347), [#397](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/397), [#464](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/464), [#561](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/561), [#565](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/565) - _Dependency_: Support all versions of `faraday` (see [gemfiles/README.md][gemfiles/readme] for compatibility matrix with Ruby engines & versions) (@pboling, @raimondasv, @zacharywelch, @Fudoshiki, @ryogift, @sj26, @jdelStrother)
|
|
120
|
+
- [#322](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/322), [#331](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/331), [#337](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/337), [#361](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/361), [#371](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/371), [#377](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/377), [#383](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/383), [#392](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/392), [#395](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/395), [#400](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/400), [#401](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/401), [#403](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/403), [#415](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/415), [#567](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/567) - Updated Rubocop, Rubocop plugins and improved code style (@pboling, @bquorning, @lautis, @spectator)
|
|
121
|
+
- [#328](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/328) - _Documentation_: Homepage URL is SSL (@amatsuda)
|
|
122
|
+
- [#339](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/339), [#479](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/479) - Update testing infrastructure for all supported Rubies (@pboling and @josephpage)
|
|
123
|
+
- [#366](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/366) - **Security**: Fix logging to `$stdout` of request and response bodies via Faraday's logger and `ENV["OAUTH_DEBUG"] == 'true'` (@pboling)
|
|
124
|
+
- [#380](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/380) - Fix: Stop attempting to encode non-encodable objects in `Oauth2::Error` (@jhmoore)
|
|
125
|
+
- [#399](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/399) - Fix: Stop duplicating `redirect_uri` in `get_token` (@markus)
|
|
126
|
+
- [#410](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/410) - Fix: `SystemStackError` caused by circular reference between Error and Response classes (@jhmoore)
|
|
127
|
+
- [#460](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/460) - Fix: Stop throwing errors when `raise_errors` is set to `false`; analog of [#524](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/524) for `1-4-stable` branch (@joaolrpaulo)
|
|
128
|
+
- [#472](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/472) - **Security**: Add checks to enforce `client_secret` is *never* passed in authorize_url query params for `implicit` and `auth_code` grant types (@dfockler)
|
|
129
|
+
- [#482](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/482) - _Documentation_: Update last of `intridea` links to `oauth-xx` (@pboling)
|
|
130
|
+
- [#536](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/536) - **Security**: Compatibility with more (and recent) Ruby OpenSSL versions, Github Actions, Rubocop updated, analogous to [#535](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/535) on `1-4-stable` branch (@pboling)
|
|
131
|
+
- [#595](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/595) - Graceful handling of empty responses from `Client#get_token`, respecting `:raise_errors` config (@stanhu)
|
|
132
|
+
- [#596](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/596) - Consistency between `AccessToken#refresh` and `Client#get_token` named arguments (@stanhu)
|
|
133
|
+
- [#598](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/598) - Fix unparseable data not raised as error in `Client#get_token`, respecting `:raise_errors` config (@stanhu)
|
|
134
|
+
### Removed
|
|
135
|
+
- [#341](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/341) - Remove Rdoc & Jeweler related files (@josephpage)
|
|
136
|
+
- [#342](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/342) - **BREAKING**: Dropped support for Ruby 1.8 (@josephpage)
|
|
137
|
+
- [#539](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/539) - Remove reliance on globally included OAuth2 in tests, analog of [#538](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/538) for 1-4-stable (@anderscarling)
|
|
138
|
+
- [#566](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/566) - _Dependency_: Removed `wwtd` (@bquorning)
|
|
139
|
+
- [#589](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/589), [#593](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/593) - Remove support for expired MAC token draft spec (@stanhu)
|
|
140
|
+
- [#590](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/590) - _Dependency_: Removed `multi_json` (@stanhu)
|
|
5
141
|
|
|
6
142
|
## [1.4.11] - 2022-09-16
|
|
7
143
|
- Complete migration to main branch as default (@pboling)
|
|
8
|
-
- Complete migration to Gitlab, updating all links, and references in VCS-managed files (@pboling)
|
|
144
|
+
- Complete migration to Gitlab, updating all links, and references in VCS-managed files (@pboling)
|
|
9
145
|
|
|
10
146
|
## [1.4.10] - 2022-07-01
|
|
11
147
|
- FIPS Compatibility [#587](https://gitlab.com/oauth-xx/oauth2/-/merge_requests/587) (@akostadinov)
|
|
@@ -185,4 +321,15 @@ All notable changes to this project will be documented in this file.
|
|
|
185
321
|
[1.4.9]: https://gitlab.com/oauth-xx/oauth2/-/compare/v1.4.8...v1.4.9
|
|
186
322
|
[1.4.10]: https://gitlab.com/oauth-xx/oauth2/-/compare/v1.4.9...v1.4.10
|
|
187
323
|
[1.4.11]: https://gitlab.com/oauth-xx/oauth2/-/compare/v1.4.10...v1.4.11
|
|
188
|
-
[
|
|
324
|
+
[2.0.0]: https://gitlab.com/oauth-xx/oauth2/-/compare/v1.4.11...v2.0.0
|
|
325
|
+
[2.0.1]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.0...v2.0.1
|
|
326
|
+
[2.0.2]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.1...v2.0.2
|
|
327
|
+
[2.0.3]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.2...v2.0.3
|
|
328
|
+
[2.0.4]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.3...v2.0.4
|
|
329
|
+
[2.0.5]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.4...v2.0.5
|
|
330
|
+
[2.0.6]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.5...v2.0.6
|
|
331
|
+
[2.0.7]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.6...v2.0.7
|
|
332
|
+
[2.0.8]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.7...v2.0.8
|
|
333
|
+
[2.0.9]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.8...v2.0.9
|
|
334
|
+
[Unreleased]: https://gitlab.com/oauth-xx/oauth2/-/compare/v2.0.9...HEAD
|
|
335
|
+
[gemfiles/readme]: gemfiles/README.md
|
data/CONTRIBUTING.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
## Contributing
|
|
2
2
|
|
|
3
|
-
Bug reports and pull requests are welcome on
|
|
3
|
+
Bug reports and pull requests are welcome on GitLab at [https://gitlab.com/oauth-xx/oauth2][source]
|
|
4
4
|
. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to
|
|
5
5
|
the [code of conduct][conduct].
|
|
6
6
|
|
|
@@ -27,7 +27,7 @@ To submit a patch, please fork the project and create a patch with tests. Once y
|
|
|
27
27
|
|
|
28
28
|
## Contributors
|
|
29
29
|
|
|
30
|
-
[][contributors]
|
|
30
|
+
[][🚎contributors]
|
|
31
31
|
|
|
32
32
|
Made with [contributors-img][contrib-rocks].
|
|
33
33
|
|
|
@@ -37,8 +37,8 @@ Made with [contributors-img][contrib-rocks].
|
|
|
37
37
|
|
|
38
38
|
[contrib-rocks]: https://contrib.rocks
|
|
39
39
|
|
|
40
|
-
[contributors]: https://gitlab.com/oauth-xx/oauth2/-/graphs/main
|
|
40
|
+
[🚎contributors]: https://gitlab.com/oauth-xx/oauth2/-/graphs/main
|
|
41
41
|
|
|
42
42
|
[comment]: <> (Following links are used by README, CONTRIBUTING, Homepage)
|
|
43
43
|
|
|
44
|
-
[source]: https://gitlab.com/oauth-xx/oauth2
|
|
44
|
+
[source]: https://gitlab.com/oauth-xx/oauth2/
|
data/README.md
CHANGED
|
@@ -15,24 +15,37 @@ OAuth 2.0 focuses on client developer simplicity while providing specific author
|
|
|
15
15
|
This is a RubyGem for implementing OAuth 2.0 clients and servers in Ruby applications.
|
|
16
16
|
See the sibling `oauth` gem for OAuth 1.0 implementations in Ruby.
|
|
17
17
|
|
|
18
|
-
⚠️⚠️⚠️ **_WARNING_**: You are viewing the `README` of the
|
|
19
|
-
[supported-only-for-critical-enterprise-security-issues](#oauth2-for-enterprise) `1-4-stable`
|
|
20
|
-
branch. Please do not use this, and instead upgrade to version 2! ⚠️⚠️⚠️
|
|
21
|
-
|
|
22
|
-
No further releases of 1.x series are planned! [Version 2](https://gitlab.com/oauth-xx/oauth2/#what-is-new-for-v20) has *tons* of improvements!
|
|
23
|
-
|
|
24
|
-
If you must continue using 1.4.x please consider purchasing an open source security maintenance contract from [Tidelift][tidelift-ref].
|
|
25
|
-
|
|
26
18
|
---
|
|
27
19
|
|
|
28
20
|
* [OAuth 2.0 Spec][oauth2-spec]
|
|
29
|
-
* [
|
|
21
|
+
* [oauth sibling gem][sibling-gem] for OAuth 1.0 implementations in Ruby.
|
|
30
22
|
|
|
31
23
|
[oauth2-spec]: https://oauth.net/2/
|
|
32
24
|
[sibling-gem]: https://gitlab.com/oauth-xx/oauth
|
|
33
25
|
|
|
34
26
|
## Release Documentation
|
|
35
27
|
|
|
28
|
+
### Version 2.0.x
|
|
29
|
+
|
|
30
|
+
<details>
|
|
31
|
+
<summary>2.0.x Readmes</summary>
|
|
32
|
+
|
|
33
|
+
| Version | Release Date | Readme |
|
|
34
|
+
|---------|--------------|----------------------------------------------------------|
|
|
35
|
+
| 2.0.9 | 2022-09-16 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.9/README.md |
|
|
36
|
+
| 2.0.8 | 2022-09-01 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.8/README.md |
|
|
37
|
+
| 2.0.7 | 2022-08-22 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.7/README.md |
|
|
38
|
+
| 2.0.6 | 2022-07-13 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.6/README.md |
|
|
39
|
+
| 2.0.5 | 2022-07-07 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.5/README.md |
|
|
40
|
+
| 2.0.4 | 2022-07-01 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.4/README.md |
|
|
41
|
+
| 2.0.3 | 2022-06-28 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.3/README.md |
|
|
42
|
+
| 2.0.2 | 2022-06-24 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.2/README.md |
|
|
43
|
+
| 2.0.1 | 2022-06-22 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.1/README.md |
|
|
44
|
+
| 2.0.0 | 2022-06-21 | https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.0/README.md |
|
|
45
|
+
</details>
|
|
46
|
+
|
|
47
|
+
### Older Releases
|
|
48
|
+
|
|
36
49
|
<details>
|
|
37
50
|
<summary>1.4.x Readmes</summary>
|
|
38
51
|
|
|
@@ -162,10 +175,10 @@ The link tokens in the following sections should be kept ordered by the row and
|
|
|
162
175
|
<!-- 5️⃣ coverage & security -->
|
|
163
176
|
[⛳cclim-cov]: https://codeclimate.com/github/oauth-xx/oauth2/test_coverage
|
|
164
177
|
[⛳cclim-cov-img♻️]: https://api.codeclimate.com/v1/badges/688c612528ff90a46955/test_coverage
|
|
165
|
-
[🖇codecov-img♻️]: https://codecov.io/gh/oauth-xx/oauth2/branch/
|
|
178
|
+
[🖇codecov-img♻️]: https://codecov.io/gh/oauth-xx/oauth2/branch/main/graph/badge.svg?token=bNqSzNiuo2
|
|
166
179
|
[🖇codecov]: https://codecov.io/gh/oauth-xx/oauth2
|
|
167
|
-
[🏘coveralls]: https://coveralls.io/github/oauth-xx/oauth2?branch=
|
|
168
|
-
[🏘coveralls-img]: https://coveralls.io/repos/github/oauth-xx/oauth2/badge.svg?branch=
|
|
180
|
+
[🏘coveralls]: https://coveralls.io/github/oauth-xx/oauth2?branch=main
|
|
181
|
+
[🏘coveralls-img]: https://coveralls.io/repos/github/oauth-xx/oauth2/badge.svg?branch=main
|
|
169
182
|
[🚎sec-pol]: https://gitlab.com/oauth-xx/oauth2/-/blob/main/SECURITY.md
|
|
170
183
|
[🚎sec-pol-img]: https://img.shields.io/badge/security-policy-brightgreen.svg?style=flat
|
|
171
184
|
[🖐codeQL]: https://github.com/oauth-xx/oauth2/security/code-scanning
|
|
@@ -225,7 +238,7 @@ Tidelift will coordinate the fix and disclosure.
|
|
|
225
238
|
|
|
226
239
|
For more see [SECURITY.md][🚎sec-pol].
|
|
227
240
|
|
|
228
|
-
##
|
|
241
|
+
## What is new for v2.0?
|
|
229
242
|
|
|
230
243
|
- Officially support Ruby versions >= 2.7
|
|
231
244
|
- Unofficially support Ruby versions >= 2.5
|
|
@@ -250,10 +263,9 @@ For more see [SECURITY.md][🚎sec-pol].
|
|
|
250
263
|
|
|
251
264
|
## Compatibility
|
|
252
265
|
|
|
253
|
-
Targeted ruby compatibility is 2.7, 3.0 and
|
|
254
|
-
supported and unsupported versions of Ruby.
|
|
255
|
-
|
|
256
|
-
Ruby is limited to 1.9+ in the gemspec for the 1.4.x series and is be 2.2+ for next major version releases (see `master` branch).
|
|
266
|
+
Targeted ruby compatibility is non-EOL versions of Ruby, currently 2.7, 3.0 and
|
|
267
|
+
3.1. Compatibility is further distinguished by supported and unsupported versions of Ruby.
|
|
268
|
+
Ruby is limited to 2.2+ for 2.x releases. See `1-4-stable` branch for older rubies.
|
|
257
269
|
|
|
258
270
|
<details>
|
|
259
271
|
<summary>Ruby Engine Compatibility Policy</summary>
|
|
@@ -293,19 +305,86 @@ See [SECURITY.md][🚎sec-pol]
|
|
|
293
305
|
|
|
294
306
|
## Usage Examples
|
|
295
307
|
|
|
308
|
+
### Global Configuration
|
|
309
|
+
|
|
310
|
+
If you started seeing this warning, but everything it working fine, you can now silence it.
|
|
311
|
+
```log
|
|
312
|
+
OAuth2::AccessToken.from_hash: `hash` contained more than one 'token' key
|
|
313
|
+
```
|
|
314
|
+
|
|
296
315
|
```ruby
|
|
297
|
-
|
|
298
|
-
|
|
316
|
+
OAuth2.configure do |config|
|
|
317
|
+
config.silence_extra_tokens_warning = true # default: false
|
|
318
|
+
end
|
|
319
|
+
```
|
|
299
320
|
|
|
300
|
-
|
|
301
|
-
# => "https://example.org/oauth/authorization?response_type=code&client_id=client_id&redirect_uri=http://localhost:8080/oauth2/callback"
|
|
321
|
+
### `authorize_url` and `token_url` are on site root (Just Works!)
|
|
302
322
|
|
|
303
|
-
|
|
304
|
-
|
|
323
|
+
```ruby
|
|
324
|
+
require 'oauth2'
|
|
325
|
+
client = OAuth2::Client.new('client_id', 'client_secret', site: 'https://example.org')
|
|
326
|
+
# => #<OAuth2::Client:0x00000001204c8288 @id="client_id", @secret="client_sec...
|
|
327
|
+
client.auth_code.authorize_url(redirect_uri: 'http://localhost:8080/oauth2/callback')
|
|
328
|
+
# => "https://example.org/oauth/authorize?client_id=client_id&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth2%2Fcallback&response_type=code"
|
|
329
|
+
|
|
330
|
+
access = client.auth_code.get_token('authorization_code_value', redirect_uri: 'http://localhost:8080/oauth2/callback', headers: {'Authorization' => 'Basic some_password'})
|
|
331
|
+
response = access.get('/api/resource', params: {'query_foo' => 'bar'})
|
|
305
332
|
response.class.name
|
|
306
333
|
# => OAuth2::Response
|
|
307
334
|
```
|
|
308
335
|
|
|
336
|
+
### Relative `authorize_url` and `token_url` (Not on site root, Just Works!)
|
|
337
|
+
|
|
338
|
+
In above example, the default Authorization URL is `oauth/authorize` and default Access Token URL is `oauth/token`, and, as they are missing a leading `/`, both are relative.
|
|
339
|
+
|
|
340
|
+
```ruby
|
|
341
|
+
client = OAuth2::Client.new('client_id', 'client_secret', site: 'https://example.org/nested/directory/on/your/server')
|
|
342
|
+
# => #<OAuth2::Client:0x00000001204c8288 @id="client_id", @secret="client_sec...
|
|
343
|
+
client.auth_code.authorize_url(redirect_uri: 'http://localhost:8080/oauth2/callback')
|
|
344
|
+
# => "https://example.org/nested/directory/on/your/server/oauth/authorize?client_id=client_id&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth2%2Fcallback&response_type=code"
|
|
345
|
+
```
|
|
346
|
+
|
|
347
|
+
### Customize `authorize_url` and `token_url`
|
|
348
|
+
|
|
349
|
+
You can specify custom URLs for authorization and access token, and when using a leading `/` they will _not be relative_, as shown below:
|
|
350
|
+
|
|
351
|
+
```ruby
|
|
352
|
+
client = OAuth2::Client.new('client_id', 'client_secret',
|
|
353
|
+
site: 'https://example.org/nested/directory/on/your/server',
|
|
354
|
+
authorize_url: '/jaunty/authorize/',
|
|
355
|
+
token_url: '/stirrups/access_token')
|
|
356
|
+
# => #<OAuth2::Client:0x00000001204c8288 @id="client_id", @secret="client_sec...
|
|
357
|
+
client.auth_code.authorize_url(redirect_uri: 'http://localhost:8080/oauth2/callback')
|
|
358
|
+
# => "https://example.org/jaunty/authorize/?client_id=client_id&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth2%2Fcallback&response_type=code"
|
|
359
|
+
client.class.name
|
|
360
|
+
# => OAuth2::Client
|
|
361
|
+
```
|
|
362
|
+
|
|
363
|
+
### snake_case and indifferent access in Response#parsed
|
|
364
|
+
|
|
365
|
+
```ruby
|
|
366
|
+
response = access.get('/api/resource', params: {'query_foo' => 'bar'})
|
|
367
|
+
# Even if the actual response is CamelCase. it will be made available as snaky:
|
|
368
|
+
JSON.parse(response.body) # => {"accessToken"=>"aaaaaaaa", "additionalData"=>"additional"}
|
|
369
|
+
response.parsed # => {"access_token"=>"aaaaaaaa", "additional_data"=>"additional"}
|
|
370
|
+
response.parsed.access_token # => "aaaaaaaa"
|
|
371
|
+
response.parsed[:access_token] # => "aaaaaaaa"
|
|
372
|
+
response.parsed.additional_data # => "additional"
|
|
373
|
+
response.parsed[:additional_data] # => "additional"
|
|
374
|
+
response.parsed.class.name # => OAuth2::SnakyHash (subclass of Hashie::Mash::Rash, from `rash_alt` gem)
|
|
375
|
+
```
|
|
376
|
+
|
|
377
|
+
#### What if I hate snakes and/or indifference?
|
|
378
|
+
|
|
379
|
+
```ruby
|
|
380
|
+
response = access.get('/api/resource', params: {'query_foo' => 'bar'}, snaky: false)
|
|
381
|
+
JSON.parse(response.body) # => {"accessToken"=>"aaaaaaaa", "additionalData"=>"additional"}
|
|
382
|
+
response.parsed # => {"accessToken"=>"aaaaaaaa", "additionalData"=>"additional"}
|
|
383
|
+
response.parsed['accessToken'] # => "aaaaaaaa"
|
|
384
|
+
response.parsed['additionalData'] # => "additional"
|
|
385
|
+
response.parsed.class.name # => Hash (just, regular old Hash)
|
|
386
|
+
```
|
|
387
|
+
|
|
309
388
|
<details>
|
|
310
389
|
<summary>Debugging</summary>
|
|
311
390
|
|
|
@@ -324,8 +403,8 @@ require 'oauth2'
|
|
|
324
403
|
client = OAuth2::Client.new(
|
|
325
404
|
'client_id',
|
|
326
405
|
'client_secret',
|
|
327
|
-
:
|
|
328
|
-
:
|
|
406
|
+
site: 'https://example.org',
|
|
407
|
+
logger: Logger.new('example.log', 'weekly')
|
|
329
408
|
)
|
|
330
409
|
```
|
|
331
410
|
</details>
|
|
@@ -336,7 +415,7 @@ The `AccessToken` methods `#get`, `#post`, `#put` and `#delete` and the generic
|
|
|
336
415
|
will return an instance of the #OAuth2::Response class.
|
|
337
416
|
|
|
338
417
|
This instance contains a `#parsed` method that will parse the response body and
|
|
339
|
-
return a Hash if the `Content-Type` is `application/x-www-form-urlencoded` or if
|
|
418
|
+
return a Hash-like [`OAuth2::SnakyHash`](https://gitlab.com/oauth-xx/oauth2/-/blob/main/lib/oauth2/snaky_hash.rb) if the `Content-Type` is `application/x-www-form-urlencoded` or if
|
|
340
419
|
the body is a JSON object. It will return an Array if the body is a JSON
|
|
341
420
|
array. Otherwise, it will return the original body string.
|
|
342
421
|
|
|
@@ -366,28 +445,46 @@ Response instance will contain the `OAuth2::Error` instance.
|
|
|
366
445
|
|
|
367
446
|
Currently the Authorization Code, Implicit, Resource Owner Password Credentials, Client Credentials, and Assertion
|
|
368
447
|
authentication grant types have helper strategy classes that simplify client
|
|
369
|
-
use. They are available via the `#auth_code
|
|
448
|
+
use. They are available via the [`#auth_code`](https://gitlab.com/oauth-xx/oauth2/-/blob/main/lib/oauth2/strategy/auth_code.rb),
|
|
449
|
+
[`#implicit`](https://gitlab.com/oauth-xx/oauth2/-/blob/main/lib/oauth2/strategy/implicit.rb),
|
|
450
|
+
[`#password`](https://gitlab.com/oauth-xx/oauth2/-/blob/main/lib/oauth2/strategy/password.rb),
|
|
451
|
+
[`#client_credentials`](https://gitlab.com/oauth-xx/oauth2/-/blob/main/lib/oauth2/strategy/client_credentials.rb), and
|
|
452
|
+
[`#assertion`](https://gitlab.com/oauth-xx/oauth2/-/blob/main/lib/oauth2/strategy/assertion.rb) methods respectively.
|
|
370
453
|
|
|
454
|
+
These aren't full examples, but demonstrative of the differences between usage for each strategy.
|
|
371
455
|
```ruby
|
|
372
|
-
auth_url = client.auth_code.authorize_url(:
|
|
373
|
-
|
|
456
|
+
auth_url = client.auth_code.authorize_url(redirect_uri: 'http://localhost:8080/oauth/callback')
|
|
457
|
+
access = client.auth_code.get_token('code_value', redirect_uri: 'http://localhost:8080/oauth/callback')
|
|
374
458
|
|
|
375
|
-
auth_url = client.implicit.authorize_url(:
|
|
459
|
+
auth_url = client.implicit.authorize_url(redirect_uri: 'http://localhost:8080/oauth/callback')
|
|
376
460
|
# get the token params in the callback and
|
|
377
|
-
|
|
378
|
-
|
|
379
|
-
|
|
380
|
-
|
|
381
|
-
|
|
382
|
-
|
|
383
|
-
|
|
461
|
+
access = OAuth2::AccessToken.from_kvform(client, query_string)
|
|
462
|
+
|
|
463
|
+
access = client.password.get_token('username', 'password')
|
|
464
|
+
|
|
465
|
+
access = client.client_credentials.get_token
|
|
466
|
+
|
|
467
|
+
# Client Assertion Strategy
|
|
468
|
+
# see: https://tools.ietf.org/html/rfc7523
|
|
469
|
+
claimset = {
|
|
470
|
+
iss: 'http://localhost:3001',
|
|
471
|
+
aud: 'http://localhost:8080/oauth2/token',
|
|
472
|
+
sub: 'me@example.com',
|
|
473
|
+
exp: Time.now.utc.to_i + 3600,
|
|
474
|
+
}
|
|
475
|
+
assertion_params = [claimset, 'HS256', 'secret_key']
|
|
476
|
+
access = client.assertion.get_token(assertion_params)
|
|
477
|
+
|
|
478
|
+
# The `access` (i.e. access token) is then used like so:
|
|
479
|
+
access.token # actual access_token string, if you need it somewhere
|
|
480
|
+
access.get('/api/stuff') # making api calls with access token
|
|
384
481
|
```
|
|
385
482
|
|
|
386
483
|
If you want to specify additional headers to be sent out with the
|
|
387
484
|
request, add a 'headers' hash under 'params':
|
|
388
485
|
|
|
389
486
|
```ruby
|
|
390
|
-
|
|
487
|
+
access = client.auth_code.get_token('code_value', redirect_uri: 'http://localhost:8080/oauth/callback', headers: {'Some' => 'Header'})
|
|
391
488
|
```
|
|
392
489
|
|
|
393
490
|
You can always use the `#request` method on the `OAuth2::Client` instance to make
|
|
@@ -408,7 +505,7 @@ dependency on this gem using the [Pessimistic Version Constraint][pvc] with two
|
|
|
408
505
|
For example:
|
|
409
506
|
|
|
410
507
|
```ruby
|
|
411
|
-
spec.add_dependency 'oauth2', '~>
|
|
508
|
+
spec.add_dependency 'oauth2', '~> 2.0'
|
|
412
509
|
```
|
|
413
510
|
|
|
414
511
|
[semver]: http://semver.org/
|