oauth2 1.4.4 → 1.4.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (50) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +94 -63
  3. data/CODE_OF_CONDUCT.md +105 -46
  4. data/CONTRIBUTING.md +27 -1
  5. data/LICENSE +1 -1
  6. data/README.md +331 -123
  7. data/SECURITY.md +26 -0
  8. data/lib/oauth2/access_token.rb +11 -8
  9. data/lib/oauth2/authenticator.rb +4 -2
  10. data/lib/oauth2/client.rb +131 -50
  11. data/lib/oauth2/error.rb +3 -1
  12. data/lib/oauth2/mac_token.rb +19 -11
  13. data/lib/oauth2/response.rb +7 -3
  14. data/lib/oauth2/strategy/assertion.rb +6 -4
  15. data/lib/oauth2/strategy/auth_code.rb +3 -1
  16. data/lib/oauth2/strategy/base.rb +2 -0
  17. data/lib/oauth2/strategy/client_credentials.rb +3 -1
  18. data/lib/oauth2/strategy/implicit.rb +3 -1
  19. data/lib/oauth2/strategy/password.rb +5 -3
  20. data/lib/oauth2/version.rb +9 -3
  21. data/lib/oauth2.rb +2 -0
  22. metadata +70 -103
  23. data/.document +0 -5
  24. data/.gitignore +0 -19
  25. data/.jrubyrc +0 -1
  26. data/.rspec +0 -2
  27. data/.rubocop.yml +0 -80
  28. data/.rubocop_rspec.yml +0 -26
  29. data/.rubocop_todo.yml +0 -15
  30. data/.ruby-version +0 -1
  31. data/.travis.yml +0 -87
  32. data/Gemfile +0 -40
  33. data/Rakefile +0 -45
  34. data/gemfiles/jruby_1.7.gemfile +0 -11
  35. data/gemfiles/jruby_9.0.gemfile +0 -7
  36. data/gemfiles/jruby_9.1.gemfile +0 -3
  37. data/gemfiles/jruby_9.2.gemfile +0 -3
  38. data/gemfiles/jruby_head.gemfile +0 -3
  39. data/gemfiles/ruby_1.9.gemfile +0 -11
  40. data/gemfiles/ruby_2.0.gemfile +0 -6
  41. data/gemfiles/ruby_2.1.gemfile +0 -6
  42. data/gemfiles/ruby_2.2.gemfile +0 -3
  43. data/gemfiles/ruby_2.3.gemfile +0 -3
  44. data/gemfiles/ruby_2.4.gemfile +0 -3
  45. data/gemfiles/ruby_2.5.gemfile +0 -3
  46. data/gemfiles/ruby_2.6.gemfile +0 -9
  47. data/gemfiles/ruby_2.7.gemfile +0 -9
  48. data/gemfiles/ruby_head.gemfile +0 -9
  49. data/gemfiles/truffleruby.gemfile +0 -3
  50. data/oauth2.gemspec +0 -52
data/README.md CHANGED
@@ -1,73 +1,295 @@
1
- # OAuth2
1
+ <p align="center">
2
+ <a href="http://oauth.net/2/" target="_blank" rel="noopener">
3
+ <img src="https://github.com/oauth-xx/oauth2/raw/main/docs/images/logo/oauth2-logo-124px.png?raw=true" alt="OAuth 2.0 Logo by Chris Messina, CC BY-SA 3.0">
4
+ </a>
5
+ <a href="https://www.ruby-lang.org/" target="_blank" rel="noopener">
6
+ <img width="124px" src="https://github.com/oauth-xx/oauth2/raw/main/docs/images/logo/ruby-logo-198px.svg?raw=true" alt="Yukihiro Matsumoto, Ruby Visual Identity Team, CC BY-SA 2.5">
7
+ </a>
8
+ </p>
2
9
 
3
- If you need the readme for a released version of the gem please find it below:
10
+ ## What
11
+
12
+ OAuth 2.0 is the industry-standard protocol for authorization.
13
+ OAuth 2.0 focuses on client developer simplicity while providing specific authorization flows for web applications,
14
+ desktop applications, mobile phones, and living room devices.
15
+ This is a RubyGem for implementing OAuth 2.0 clients and servers in Ruby applications.
16
+ See the sibling `oauth` gem for OAuth 1.0 implementations in Ruby.
17
+
18
+ ⚠️⚠️⚠️ **_WARNING_**: You are viewing the `README` of the
19
+ [supported-only-for-critical-enterprise-security-issues](#oauth2-for-enterprise) `1-4-stable`
20
+ branch. Please do not use this, and instead upgrade to version 2! ⚠️⚠️⚠️
21
+
22
+ No further releases of 1.x series are planned! [Version 2](https://gitlab.com/oauth-xx/oauth2/#what-is-new-for-v20) has *tons* of improvements!
23
+
24
+ If you must continue using 1.4.x please consider purchasing an open source security maintenance contract from [Tidelift][tidelift-ref].
25
+
26
+ ---
27
+
28
+ * [OAuth 2.0 Spec][oauth2-spec]
29
+ * [OAuth 1.0 sibling gem][sibling-gem]
30
+
31
+ [oauth2-spec]: https://oauth.net/2/
32
+ [sibling-gem]: https://gitlab.com/oauth-xx/oauth
33
+
34
+ ## Release Documentation
35
+
36
+ <details>
37
+ <summary>1.4.x Readmes</summary>
38
+
39
+ | Version | Release Date | Readme |
40
+ |---------|--------------|-------------------------------------------------------------|
41
+ | 1.4.11 | Sep 16, 2022 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.11/README.md |
42
+ | 1.4.10 | Jul 1, 2022 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.10/README.md |
43
+ | 1.4.9 | Feb 20, 2022 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.9/README.md |
44
+ | 1.4.8 | Feb 18, 2022 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.8/README.md |
45
+ | 1.4.7 | Mar 19, 2021 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.7/README.md |
46
+ | 1.4.6 | Mar 19, 2021 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.6/README.md |
47
+ | 1.4.5 | Mar 18, 2021 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.5/README.md |
48
+ | 1.4.4 | Feb 12, 2020 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.4/README.md |
49
+ | 1.4.3 | Jan 29, 2020 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.3/README.md |
50
+ | 1.4.2 | Oct 1, 2019 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.2/README.md |
51
+ | 1.4.1 | Oct 13, 2018 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.1/README.md |
52
+ | 1.4.0 | Jun 9, 2017 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.0/README.md |
53
+ </details>
54
+
55
+ <details>
56
+ <summary>1.3.x Readmes</summary>
4
57
 
5
58
  | Version | Release Date | Readme |
6
59
  |----------|--------------|----------------------------------------------------------|
7
- | 1.4.4 | Feb 12, 2020 | https://github.com/oauth-xx/oauth2/blob/v1.4.4/README.md |
8
- | 1.4.3 | Jan 29, 2020 | https://github.com/oauth-xx/oauth2/blob/v1.4.3/README.md |
9
- | 1.4.2 | Oct 1, 2019 | https://github.com/oauth-xx/oauth2/blob/v1.4.2/README.md |
10
- | 1.4.1 | Oct 13, 2018 | https://github.com/oauth-xx/oauth2/blob/v1.4.1/README.md |
11
- | 1.4.0 | Jun 9, 2017 | https://github.com/oauth-xx/oauth2/blob/v1.4.0/README.md |
12
- | 1.3.1 | Mar 3, 2017 | https://github.com/oauth-xx/oauth2/blob/v1.3.1/README.md |
13
- | 1.3.0 | Dec 27, 2016 | https://github.com/oauth-xx/oauth2/blob/v1.3.0/README.md |
14
- | 1.2.0 | Jun 30, 2016 | https://github.com/oauth-xx/oauth2/blob/v1.2.0/README.md |
15
- | 1.1.0 | Jan 30, 2016 | https://github.com/oauth-xx/oauth2/blob/v1.1.0/README.md |
16
- | 1.0.0 | May 23, 2014 | https://github.com/oauth-xx/oauth2/blob/v1.0.0/README.md |
17
- | < 1.0.0 | Find here | https://github.com/oauth-xx/oauth2/tags |
18
-
19
- [![Gem Version](http://img.shields.io/gem/v/oauth2.svg)][gem]
20
- [![Total Downloads](https://img.shields.io/gem/dt/oauth2.svg)][gem]
21
- [![Downloads Today](https://img.shields.io/gem/rt/oauth2.svg)][gem]
22
- [![Build Status](https://travis-ci.org/oauth-xx/oauth2.svg?branch=1-4-stable)][travis]
23
- [![Test Coverage](https://api.codeclimate.com/v1/badges/688c612528ff90a46955/test_coverage)][codeclimate-coverage]
24
- [![Maintainability](https://api.codeclimate.com/v1/badges/688c612528ff90a46955/maintainability)][codeclimate-maintainability]
25
- [![Depfu](https://badges.depfu.com/badges/6d34dc1ba682bbdf9ae2a97848241743/count.svg)][depfu]
26
- [![Open Source Helpers](https://www.codetriage.com/oauth-xx/oauth2/badges/users.svg)][code-triage]
27
- [![Chat](https://img.shields.io/gitter/room/oauth-xx/oauth2.svg)](https://gitter.im/oauth-xx/oauth2)
28
- [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)][source-license]
29
- [![Documentation](http://inch-ci.org/github/oauth-xx/oauth2.png)][inch-ci]
30
-
31
- [gem]: https://rubygems.org/gems/oauth2
32
- [travis]: http://travis-ci.org/oauth-xx/oauth2
33
- [coveralls]: https://coveralls.io/r/oauth-xx/oauth2
34
- [codeclimate-maintainability]: https://codeclimate.com/github/oauth-xx/oauth2/maintainability
35
- [codeclimate-coverage]: https://codeclimate.com/github/oauth-xx/oauth2/test_coverage
36
- [depfu]: https://depfu.com/github/oauth-xx/oauth2
37
- [source-license]: https://opensource.org/licenses/MIT
38
- [inch-ci]: http://inch-ci.org/github/oauth-xx/oauth2
39
- [code-triage]: https://www.codetriage.com/oauth-xx/oauth2
40
- [fossa1]: https://app.fossa.io/projects/git%2Bgithub.com%2Foauth-xx%2Foauth2?ref=badge_shield
41
-
42
- A Ruby wrapper for the [OAuth 2.0 specification][oauth2-spec].
60
+ | 1.3.1 | Mar 3, 2017 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.3.1/README.md |
61
+ | 1.3.0 | Dec 27, 2016 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.3.0/README.md |
62
+ </details>
43
63
 
44
- [oauth2-spec]: https://oauth.net/2/
64
+ <details>
65
+ <summary>&le;= 1.2.x Readmes (2016 and before)</summary>
66
+
67
+ | Version | Release Date | Readme |
68
+ |----------|--------------|----------------------------------------------------------|
69
+ | 1.2.0 | Jun 30, 2016 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.2.0/README.md |
70
+ | 1.1.0 | Jan 30, 2016 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.1.0/README.md |
71
+ | 1.0.0 | May 23, 2014 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.0.0/README.md |
72
+ | < 1.0.0 | Find here | https://gitlab.com/oauth-xx/oauth2/-/tags |
73
+ </details>
74
+
75
+ ## Status
76
+
77
+ <!--
78
+ Numbering rows and badges in each row as a visual "database" lookup,
79
+ as the table is extremely dense, and it can be very difficult to find anything
80
+ Putting one on each row here, to document the emoji that should be used, and for ease of copy/paste.
81
+
82
+ row #s:
83
+ 1️⃣
84
+ 2️⃣
85
+ 3️⃣
86
+ 4️⃣
87
+ 5️⃣
88
+ 6️⃣
89
+ 7️⃣
90
+
91
+ badge #s:
92
+ ⛳️
93
+ 🖇
94
+ 🏘
95
+ 🚎
96
+ 🖐
97
+ 🧮
98
+ 📗
99
+
100
+ appended indicators:
101
+ ♻️ - URL needs to be updated from SASS integration. Find / Replace is insufficient.
102
+ -->
103
+
104
+ | | Project | bundle add oauth2 |
105
+ |:----|-----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
106
+ | 1️⃣ | name, license, docs | [![RubyGems.org][⛳️name-img]][⛳️gem] [![License: MIT][🖇src-license-img]][🖇src-license] [![FOSSA][🏘fossa-img]][🏘fossa] [![RubyDoc.info][🚎yard-img]][🚎yard] [![InchCI][🖐inch-ci-img]][🚎yard] |
107
+ | 2️⃣ | version & activity | [![Gem Version][⛳️version-img]][⛳️gem] [![Total Downloads][🖇DL-total-img]][⛳️gem] [![Download Rank][🏘DL-rank-img]][⛳️gem] [![Source Code][🚎src-home-img]][🚎src-home] |
108
+ | 3️⃣ | maintanence & linting | [![Maintainability][⛳cclim-maint-img♻️]][⛳cclim-maint] [![Helpers][🖇triage-help-img]][🖇triage-help] [![Depfu][🏘depfu-img♻️]][🏘depfu♻️] [![Contributors][🚎contributors-img]][🚎contributors] [![Style][🖐style-wf-img]][🖐style-wf] [![Kloc Roll][🧮kloc-img]][🧮kloc] |
109
+ | 4️⃣ | testing | [![Supported][🏘sup-wf-img]][🏘sup-wf] [![Heads][🚎heads-wf-img]][🚎heads-wf] [![Unofficial Support][🖐uns-wf-img]][🖐uns-wf] [![MacOS][🧮mac-wf-img]][🧮mac-wf] [![Windows][📗win-wf-img]][📗win-wf] |
110
+ | 5️⃣ | coverage & security | [![CodeClimate][⛳cclim-cov-img♻️]][⛳cclim-cov] [![CodeCov][🖇codecov-img♻️]][🖇codecov] [![Coveralls][🏘coveralls-img]][🏘coveralls] [![Security Policy][🚎sec-pol-img]][🚎sec-pol] [![CodeQL][🖐codeQL-img]][🖐codeQL] [![Code Coverage][🧮cov-wf-img]][🧮cov-wf] |
111
+ | 6️⃣ | resources | [![Discussion][⛳gg-discussions-img]][⛳gg-discussions] [![Get help on Codementor][🖇codementor-img]][🖇codementor] [![Chat][🏘chat-img]][🏘chat] [![Blog][🚎blog-img]][🚎blog] [![Blog][🖐wiki-img]][🖐wiki] |
112
+ | 7️⃣ | spread 💖 | [![Liberapay Patrons][⛳liberapay-img]][⛳liberapay] [![Sponsor Me][🖇sponsor-img]][🖇sponsor] [![Tweet @ Peter][🏘tweet-img]][🏘tweet] [🌏][aboutme] [👼][angelme] [💻][coderme] |
113
+
114
+ <!--
115
+ The link tokens in the following sections should be kept ordered by the row and badge numbering scheme
116
+ -->
117
+
118
+ <!-- 1️⃣ name, license, docs -->
119
+ [⛳️gem]: https://rubygems.org/gems/oauth2
120
+ [⛳️name-img]: https://img.shields.io/badge/name-oauth2-brightgreen.svg?style=flat
121
+ [🖇src-license]: https://opensource.org/licenses/MIT
122
+ [🖇src-license-img]: https://img.shields.io/badge/License-MIT-green.svg
123
+ [🏘fossa]: https://app.fossa.io/projects/git%2Bgithub.com%2Foauth-xx%2Foauth2?ref=badge_shield
124
+ [🏘fossa-img]: https://app.fossa.io/api/projects/git%2Bgithub.com%2Foauth-xx%2Foauth2.svg?type=shield
125
+ [🚎yard]: https://www.rubydoc.info/github/oauth-xx/oauth2
126
+ [🚎yard-img]: https://img.shields.io/badge/documentation-rubydoc-brightgreen.svg?style=flat
127
+ [🖐inch-ci-img]: http://inch-ci.org/github/oauth-xx/oauth2.png
128
+
129
+ <!-- 2️⃣ version & activity -->
130
+ [⛳️version-img]: http://img.shields.io/gem/v/oauth2.svg
131
+ [🖇DL-total-img]: https://img.shields.io/gem/dt/oauth2.svg
132
+ [🏘DL-rank-img]: https://img.shields.io/gem/rt/oauth2.svg
133
+ [🚎src-home]: https://gitlab.com/oauth-xx/oauth2/
134
+ [🚎src-home-img]: https://img.shields.io/badge/source-gitlab-blue.svg?style=flat
135
+
136
+ <!-- 3️⃣ maintenance & linting -->
137
+ [⛳cclim-maint]: https://codeclimate.com/github/oauth-xx/oauth2/maintainability
138
+ [⛳cclim-maint-img♻️]: https://api.codeclimate.com/v1/badges/688c612528ff90a46955/maintainability
139
+ [🖇triage-help]: https://www.codetriage.com/oauth-xx/oauth2
140
+ [🖇triage-help-img]: https://www.codetriage.com/oauth-xx/oauth2/badges/users.svg
141
+ [🏘depfu♻️]: https://depfu.com/github/oauth-xx/oauth2?project_id=4445
142
+ [🏘depfu-img♻️]: https://badges.depfu.com/badges/6d34dc1ba682bbdf9ae2a97848241743/count.svg
143
+ [🚎contributors]: https://gitlab.com/oauth-xx/oauth2/-/graphs/main
144
+ [🚎contributors-img]: https://img.shields.io/github/contributors-anon/oauth-xx/oauth2
145
+ [🖐style-wf]: https://github.com/oauth-xx/oauth2/actions/workflows/style.yml
146
+ [🖐style-wf-img]: https://github.com/oauth-xx/oauth2/actions/workflows/style.yml/badge.svg
147
+ [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
148
+ [🧮kloc-img]: https://img.shields.io/tokei/lines/github.com/oauth-xx/oauth2
149
+
150
+ <!-- 4️⃣ testing -->
151
+ [🏘sup-wf]: https://github.com/oauth-xx/oauth2/actions/workflows/supported.yml
152
+ [🏘sup-wf-img]: https://github.com/oauth-xx/oauth2/actions/workflows/supported.yml/badge.svg
153
+ [🚎heads-wf]: https://github.com/oauth-xx/oauth2/actions/workflows/heads.yml
154
+ [🚎heads-wf-img]: https://github.com/oauth-xx/oauth2/actions/workflows/heads.yml/badge.svg
155
+ [🖐uns-wf]: https://github.com/oauth-xx/oauth2/actions/workflows/unsupported.yml
156
+ [🖐uns-wf-img]: https://github.com/oauth-xx/oauth2/actions/workflows/unsupported.yml/badge.svg
157
+ [🧮mac-wf]: https://github.com/oauth-xx/oauth2/actions/workflows/macos.yml
158
+ [🧮mac-wf-img]: https://github.com/oauth-xx/oauth2/actions/workflows/macos.yml/badge.svg
159
+ [📗win-wf]: https://github.com/oauth-xx/oauth2/actions/workflows/windows.yml
160
+ [📗win-wf-img]: https://github.com/oauth-xx/oauth2/actions/workflows/windows.yml/badge.svg
161
+
162
+ <!-- 5️⃣ coverage & security -->
163
+ [⛳cclim-cov]: https://codeclimate.com/github/oauth-xx/oauth2/test_coverage
164
+ [⛳cclim-cov-img♻️]: https://api.codeclimate.com/v1/badges/688c612528ff90a46955/test_coverage
165
+ [🖇codecov-img♻️]: https://codecov.io/gh/oauth-xx/oauth2/branch/1-4-stable/graph/badge.svg?token=bNqSzNiuo2
166
+ [🖇codecov]: https://codecov.io/gh/oauth-xx/oauth2
167
+ [🏘coveralls]: https://coveralls.io/github/oauth-xx/oauth2?branch=1-4-stable
168
+ [🏘coveralls-img]: https://coveralls.io/repos/github/oauth-xx/oauth2/badge.svg?branch=1-4-stable
169
+ [🚎sec-pol]: https://gitlab.com/oauth-xx/oauth2/-/blob/main/SECURITY.md
170
+ [🚎sec-pol-img]: https://img.shields.io/badge/security-policy-brightgreen.svg?style=flat
171
+ [🖐codeQL]: https://github.com/oauth-xx/oauth2/security/code-scanning
172
+ [🖐codeQL-img]: https://github.com/oauth-xx/oauth2/actions/workflows/codeql-analysis.yml/badge.svg
173
+ [🧮cov-wf]: https://github.com/oauth-xx/oauth2/actions/workflows/coverage.yml
174
+ [🧮cov-wf-img]: https://github.com/oauth-xx/oauth2/actions/workflows/coverage.yml/badge.svg
175
+
176
+ <!-- 6️⃣ resources -->
177
+ [⛳gg-discussions]: https://groups.google.com/g/oauth-ruby
178
+ [⛳gg-discussions-img]: https://img.shields.io/badge/google-group-purple.svg?style=flat
179
+ [🖇codementor]: https://www.codementor.io/peterboling?utm_source=github&utm_medium=button&utm_term=peterboling&utm_campaign=github
180
+ [🖇codementor-img]: https://cdn.codementor.io/badges/get_help_github.svg
181
+ [🏘chat]: https://gitter.im/oauth-xx/oauth2
182
+ [🏘chat-img]: https://img.shields.io/gitter/room/oauth-xx/oauth2.svg
183
+ [🚎blog]: http://www.railsbling.com/tags/oauth2/
184
+ [🚎blog-img]: https://img.shields.io/badge/blog-railsbling-brightgreen.svg?style=flat
185
+ [🖐wiki]: https://gitlab.com/oauth-xx/oauth2/-/wikis/home
186
+ [🖐wiki-img]: https://img.shields.io/badge/wiki-examples-brightgreen.svg?style=flat
187
+
188
+ <!-- 7️⃣ spread 💖 -->
189
+ [⛳liberapay-img]: https://img.shields.io/liberapay/patrons/pboling.svg?logo=liberapay
190
+ [⛳liberapay]: https://liberapay.com/pboling/donate
191
+ [🖇sponsor-img]: https://img.shields.io/badge/sponsor-pboling.svg?style=social&logo=github
192
+ [🖇sponsor]: https://github.com/sponsors/pboling
193
+ [🏘tweet-img]: https://img.shields.io/twitter/follow/galtzo.svg?style=social&label=Follow
194
+ [🏘tweet]: http://twitter.com/galtzo
195
+
196
+ <!-- Maintainer Contact Links -->
197
+ [railsbling]: http://www.railsbling.com
198
+ [peterboling]: http://www.peterboling.com
199
+ [aboutme]: https://about.me/peter.boling
200
+ [angelme]: https://angel.co/peter-boling
201
+ [coderme]:http://coderwall.com/pboling
45
202
 
46
203
  ## Installation
47
204
 
48
- Add this line to your application's Gemfile:
205
+ Install the gem and add to the application's Gemfile by executing:
49
206
 
50
- ```ruby
51
- gem 'oauth2'
52
- ```
207
+ $ bundle add oauth2
53
208
 
54
- And then execute:
209
+ If bundler is not being used to manage dependencies, install the gem by executing:
55
210
 
56
- $ bundle
211
+ $ gem install oauth2
57
212
 
58
- Or install it yourself as:
213
+ ## OAuth2 for Enterprise
59
214
 
60
- $ gem install oauth2
215
+ Available as part of the Tidelift Subscription.
216
+
217
+ The maintainers of OAuth2 and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use. [Learn more.][tidelift-ref]
218
+
219
+ [tidelift-ref]: https://tidelift.com/subscription/pkg/rubygems-oauth2?utm_source=rubygems-oauth2&utm_medium=referral&utm_campaign=enterprise
220
+
221
+ ## Security contact information
61
222
 
62
- ## Resources
223
+ To report a security vulnerability, please use the [Tidelift security contact](https://tidelift.com/security).
224
+ Tidelift will coordinate the fix and disclosure.
63
225
 
64
- * [View Source on GitHub][code]
65
- * [Report Issues on GitHub][issues]
66
- * [Read More at the Wiki][wiki]
226
+ For more see [SECURITY.md][🚎sec-pol].
227
+
228
+ ## Why should you upgrade to version v2.0?
229
+
230
+ - Officially support Ruby versions >= 2.7
231
+ - Unofficially support Ruby versions >= 2.5
232
+ - Incidentally support Ruby versions >= 2.2
233
+ - Drop support for the expired MAC Draft (all versions)
234
+ - Support IETF rfc7523 JWT Bearer Tokens
235
+ - Support IETF rfc7231 Relative Location in Redirect
236
+ - Support IETF rfc6749 Don't set oauth params when nil
237
+ - Support [OIDC 1.0 Private Key JWT](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication); based on the OAuth JWT assertion specification [(RFC 7523)](https://tools.ietf.org/html/rfc7523)
238
+ - Support new formats, including from [jsonapi.org](http://jsonapi.org/format/): `application/vdn.api+json`, `application/vnd.collection+json`, `application/hal+json`, `application/problem+json`
239
+ - Adds new option to `OAuth2::Client#get_token`:
240
+ - `:access_token_class` (`AccessToken`); user specified class to use for all calls to `get_token`
241
+ - Adds new option to `OAuth2::AccessToken#initialize`:
242
+ - `:expires_latency` (`nil`); number of seconds by which AccessToken validity will be reduced to offset latency
243
+ - By default, keys are transformed to camel case.
244
+ - Original keys will still work as previously, in most scenarios, thanks to `rash_alt` gem.
245
+ - However, this is a _breaking_ change if you rely on `response.parsed.to_h`, as the keys in the result will be camel case.
246
+ - As of version 2.0.4 you can turn key transformation off with the `snaky: false` option.
247
+ - By default, the `:auth_scheme` is now `:basic_auth` (instead of `:request_body`)
248
+ - Third-party strategies and gems may need to be updated if a provider was requiring client id/secret in the request body
249
+ - [... A lot more](https://gitlab.com/oauth-xx/oauth2/-/blob/main/CHANGELOG.md#2.0.0)
250
+
251
+ ## Compatibility
252
+
253
+ Targeted ruby compatibility is 2.7, 3.0 and 3.1. Compatibility is further distinguished by
254
+ supported and unsupported versions of Ruby.
255
+ This gem will work with Ruby versions back to 1.9, though it remains unsupported.
256
+ Ruby is limited to 1.9+ in the gemspec for the 1.4.x series and is be 2.2+ for next major version releases (see `master` branch).
257
+
258
+ <details>
259
+ <summary>Ruby Engine Compatibility Policy</summary>
260
+
261
+ This gem is tested against MRI, JRuby, and Truffleruby.
262
+ Each of those has varying versions that target a specific version of MRI Ruby.
263
+ This gem should work in the just-listed Ruby engines according to the targeted MRI compatibility in the table below.
264
+ If you would like to add support for additional engines,
265
+ see `gemfiles/README.md`, then submit a PR to the correct maintenance branch as according to the table below.
266
+ </details>
267
+
268
+ <details>
269
+ <summary>Ruby Version Compatibility Policy</summary>
270
+
271
+ If something doesn't work on one of these interpreters, it's a bug.
272
+
273
+ This library may inadvertently work (or seem to work) on other Ruby
274
+ implementations, however support will only be provided for the versions listed
275
+ above.
276
+
277
+ If you would like this library to support another Ruby version, you may
278
+ volunteer to be a maintainer. Being a maintainer entails making sure all tests
279
+ run and pass on that implementation. When something breaks on your
280
+ implementation, you will be responsible for providing patches in a timely
281
+ fashion. If critical issues for a particular implementation exist at the time
282
+ of a major release, support for that Ruby version may be dropped.
283
+ </details>
67
284
 
68
- [code]: https://github.com/oauth-xx/oauth2
69
- [issues]: https://github.com/oauth-xx/oauth2/issues
70
- [wiki]: https://wiki.github.com/oauth-xx/oauth2
285
+ | | Ruby OAuth2 Version | Maintenance Branch | Supported Officially | Supported Unofficially | Supported Incidentally |
286
+ |:----|---------------------|--------------------|-------------------------|------------------------|------------------------|
287
+ | 1️⃣ | 2.0.x | `main` | 2.7, 3.0, 3.1 | 2.5, 2.6 | 2.2, 2.3, 2.4 |
288
+ | 2️⃣ | 1.4.x | `1-4-stable` | 2.5, 2.6, 2.7, 3.0, 3.1 | 2.1, 2.2, 2.3, 2.4 | 1.9, 2.0 |
289
+ | 3️⃣ | older | N/A | Best of luck to you! | Please upgrade! | |
290
+
291
+ NOTE: The 1.4 series will only receive critical security updates.
292
+ See [SECURITY.md][🚎sec-pol]
71
293
 
72
294
  ## Usage Examples
73
295
 
@@ -79,17 +301,42 @@ client.auth_code.authorize_url(:redirect_uri => 'http://localhost:8080/oauth2/ca
79
301
  # => "https://example.org/oauth/authorization?response_type=code&client_id=client_id&redirect_uri=http://localhost:8080/oauth2/callback"
80
302
 
81
303
  token = client.auth_code.get_token('authorization_code_value', :redirect_uri => 'http://localhost:8080/oauth2/callback', :headers => {'Authorization' => 'Basic some_password'})
82
- response = token.get('/api/resource', :params => { 'query_foo' => 'bar' })
304
+ response = token.get('/api/resource', :params => {'query_foo' => 'bar'})
83
305
  response.class.name
84
306
  # => OAuth2::Response
85
307
  ```
308
+
309
+ <details>
310
+ <summary>Debugging</summary>
311
+
312
+ Set an environment variable, however you would [normally do that](https://github.com/bkeepers/dotenv).
313
+
314
+ ```ruby
315
+ # will log both request and response, including bodies
316
+ ENV['OAUTH_DEBUG'] = 'true'
317
+ ```
318
+
319
+ By default, debug output will go to `$stdout`. This can be overridden when
320
+ initializing your OAuth2::Client.
321
+
322
+ ```ruby
323
+ require 'oauth2'
324
+ client = OAuth2::Client.new(
325
+ 'client_id',
326
+ 'client_secret',
327
+ :site => 'https://example.org',
328
+ :logger => Logger.new('example.log', 'weekly')
329
+ )
330
+ ```
331
+ </details>
332
+
86
333
  ## OAuth2::Response
87
334
 
88
- The AccessToken methods #get, #post, #put and #delete and the generic #request
335
+ The `AccessToken` methods `#get`, `#post`, `#put` and `#delete` and the generic `#request`
89
336
  will return an instance of the #OAuth2::Response class.
90
337
 
91
- This instance contains a #parsed method that will parse the response body and
92
- return a Hash if the Content-Type is application/x-www-form-urlencoded or if
338
+ This instance contains a `#parsed` method that will parse the response body and
339
+ return a Hash if the `Content-Type` is `application/x-www-form-urlencoded` or if
93
340
  the body is a JSON object. It will return an Array if the body is a JSON
94
341
  array. Otherwise, it will return the original body string.
95
342
 
@@ -99,27 +346,27 @@ respective methods.
99
346
  ## OAuth2::AccessToken
100
347
 
101
348
  If you have an existing Access Token for a user, you can initialize an instance
102
- using various class methods including the standard new, from_hash (if you have
103
- a hash of the values), or from_kvform (if you have an
104
- application/x-www-form-urlencoded encoded string of the values).
349
+ using various class methods including the standard new, `from_hash` (if you have
350
+ a hash of the values), or `from_kvform` (if you have an
351
+ `application/x-www-form-urlencoded` encoded string of the values).
105
352
 
106
353
  ## OAuth2::Error
107
354
 
108
- On 400+ status code responses, an OAuth2::Error will be raised. If it is a
109
- standard OAuth2 error response, the body will be parsed and #code and #description will contain the values provided from the error and
110
- error_description parameters. The #response property of OAuth2::Error will
111
- always contain the OAuth2::Response instance.
355
+ On 400+ status code responses, an `OAuth2::Error` will be raised. If it is a
356
+ standard OAuth2 error response, the body will be parsed and `#code` and `#description` will contain the values provided from the error and
357
+ `error_description` parameters. The `#response` property of `OAuth2::Error` will
358
+ always contain the `OAuth2::Response` instance.
112
359
 
113
- If you do not want an error to be raised, you may use :raise_errors => false
114
- option on initialization of the client. In this case the OAuth2::Response
360
+ If you do not want an error to be raised, you may use `:raise_errors => false`
361
+ option on initialization of the client. In this case the `OAuth2::Response`
115
362
  instance will be returned as usual and on 400+ status code responses, the
116
- Response instance will contain the OAuth2::Error instance.
363
+ Response instance will contain the `OAuth2::Error` instance.
117
364
 
118
365
  ## Authorization Grants
119
366
 
120
367
  Currently the Authorization Code, Implicit, Resource Owner Password Credentials, Client Credentials, and Assertion
121
368
  authentication grant types have helper strategy classes that simplify client
122
- use. They are available via the #auth_code, #implicit, #password, #client_credentials, and #assertion methods respectively.
369
+ use. They are available via the `#auth_code`, `#implicit`, `#password`, `#client_credentials`, and `#assertion` methods respectively.
123
370
 
124
371
  ```ruby
125
372
  auth_url = client.auth_code.authorize_url(:redirect_uri => 'http://localhost:8080/oauth/callback')
@@ -143,56 +390,9 @@ request, add a 'headers' hash under 'params':
143
390
  token = client.auth_code.get_token('code_value', :redirect_uri => 'http://localhost:8080/oauth/callback', :headers => {'Some' => 'Header'})
144
391
  ```
145
392
 
146
- You can always use the #request method on the OAuth2::Client instance to make
393
+ You can always use the `#request` method on the `OAuth2::Client` instance to make
147
394
  requests for tokens for any Authentication grant type.
148
395
 
149
- ## Supported Ruby Versions
150
-
151
- This library aims to support and is [tested against][travis] the following Ruby
152
- implementations:
153
-
154
- ### Rubies with support ending at Oauth2 1.x
155
-
156
- * Ruby 1.9.3
157
- - [JRuby 1.7][jruby-1.7] (targets MRI v1.9)
158
-
159
- * Ruby 2.0.0
160
- - [JRuby 9.0][jruby-9.0] (targets MRI v2.0)
161
- * Ruby 2.1
162
-
163
- ---
164
-
165
- ### Rubies with continued support past Oauth2 2.x
166
-
167
- * Ruby 2.2 - Support ends with version 2.x series
168
- * Ruby 2.3 - Support ends with version 3.x series
169
- - [JRuby 9.1][jruby-9.1] (targets MRI v2.3)
170
- * Ruby 2.4 - Support ends with version 4.x series
171
- * Ruby 2.5 - Support ends with version 5.x series
172
- - [JRuby 9.2][jruby-9.2] (targets MRI v2.5)
173
- - [truffleruby][truffleruby] (targets MRI 2.5)
174
- * Ruby 2.6 - Support ends with version 6.x series
175
- * Ruby 2.7 - Support ends with version 7.x series
176
-
177
- [jruby-1.7]: https://www.jruby.org/2017/05/11/jruby-1-7-27.html
178
- [jruby-9.0]: https://www.jruby.org/2016/01/26/jruby-9-0-5-0.html
179
- [jruby-9.1]: https://www.jruby.org/2017/05/16/jruby-9-1-9-0.html
180
- [jruby-9.2]: https://www.jruby.org/2018/05/24/jruby-9-2-0-0.html
181
- [truffleruby]: https://github.com/oracle/truffleruby
182
-
183
- If something doesn't work on one of these interpreters, it's a bug.
184
-
185
- This library may inadvertently work (or seem to work) on other Ruby
186
- implementations, however support will only be provided for the versions listed
187
- above.
188
-
189
- If you would like this library to support another Ruby version, you may
190
- volunteer to be a maintainer. Being a maintainer entails making sure all tests
191
- run and pass on that implementation. When something breaks on your
192
- implementation, you will be responsible for providing patches in a timely
193
- fashion. If critical issues for a particular implementation exist at the time
194
- of a major release, support for that Ruby version may be dropped.
195
-
196
396
  ## Versioning
197
397
 
198
398
  This library aims to adhere to [Semantic Versioning 2.0.0][semver].
@@ -216,16 +416,16 @@ spec.add_dependency 'oauth2', '~> 1.4'
216
416
 
217
417
  ## License
218
418
 
219
- [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)][source-license]
419
+ [![License: MIT][🖇src-license-img]][🖇src-license]
220
420
 
221
421
  - Copyright (c) 2011-2013 Michael Bleigh and Intridea, Inc.
222
- - Copyright (c) 2017-2018 [oauth-xx organization][oauth-xx]
422
+ - Copyright (c) 2017-2022 [oauth-xx organization][oauth-xx]
223
423
  - See [LICENSE][license] for details.
224
424
 
225
425
  [![FOSSA Status](https://app.fossa.io/api/projects/git%2Bgithub.com%2Foauth-xx%2Foauth2.svg?type=large)][fossa2]
226
426
 
227
- [license]: LICENSE
228
- [oauth-xx]: https://github.com/oauth-xx
427
+ [license]: https://gitlab.com/oauth-xx/oauth2/-/blob/main/LICENSE
428
+ [oauth-xx]: https://gitlab.com/oauth-xx
229
429
  [fossa2]: https://app.fossa.io/projects/git%2Bgithub.com%2Foauth-xx%2Foauth2?ref=badge_large
230
430
 
231
431
  ## Development
@@ -236,8 +436,16 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
236
436
 
237
437
  ## Contributing
238
438
 
239
- Bug reports and pull requests are welcome on GitHub at https://github.com/oauth-xx/oauth2. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](http://contributor-covenant.org) code of conduct.
439
+ See [CONTRIBUTING.md][contributing]
440
+
441
+ [contributing]: https://gitlab.com/oauth-xx/oauth2/-/blob/main/CONTRIBUTING.md
442
+
443
+ ## Contributors
444
+
445
+ [![Contributors](https://contrib.rocks/image?repo=oauth-xx/oauth2)]("https://gitlab.com/oauth-xx/oauth2/-/graphs/main")
446
+
447
+ Made with [contributors-img](https://contrib.rocks).
240
448
 
241
449
  ## Code of Conduct
242
450
 
243
- Everyone interacting in the OAuth2 project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/oauth-xx/oauth2/blob/master/CODE_OF_CONDUCT.md).
451
+ Everyone interacting in the OAuth2 project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://gitlab.com/oauth-xx/oauth2/-/blob/main/CODE_OF_CONDUCT.md).
data/SECURITY.md ADDED
@@ -0,0 +1,26 @@
1
+ # Security Policy
2
+
3
+ ## Supported Versions
4
+
5
+ | Version | Supported | EOL | Post-EOL / Enterprise |
6
+ |----------|-----------|---------|---------------------------------------|
7
+ | 2.latest | ✅ | 04/2024 | [Tidelift Subscription][tidelift-ref] |
8
+ | 1.latest | ✅ | 04/2023 | [Tidelift Subscription][tidelift-ref] |
9
+ | <= 1 | ⛔ | ⛔ | ⛔ |
10
+
11
+ ### EOL Policy
12
+
13
+ Non-commercial support for the oldest version of Ruby (which itself is going EOL) will be dropped each year in April.
14
+
15
+ ## Reporting a Vulnerability
16
+
17
+ To report a security vulnerability, please use the [Tidelift security contact](https://tidelift.com/security).
18
+ Tidelift will coordinate the fix and disclosure.
19
+
20
+ ## OAuth2 for Enterprise
21
+
22
+ Available as part of the Tidelift Subscription.
23
+
24
+ The maintainers of oauth2 and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use. [Learn more.][tidelift-ref]
25
+
26
+ [tidelift-ref]: https://tidelift.com/subscription/pkg/rubygems-oauth2?utm_source=rubygems-oauth2&utm_medium=referral&utm_campaign=enterprise&utm_term=repo
data/lib/oauth2/access_token.rb CHANGED
@@ -1,8 +1,11 @@
1
+ # frozen_string_literal: true
2
+
1
3
  module OAuth2
2
4
  class AccessToken
3
5
  attr_reader :client, :token, :expires_in, :expires_at, :params
4
6
  attr_accessor :options, :refresh_token
5
7
 
8
+ # Should these methods be deprecated?
6
9
  class << self
7
10
  # Initializes an AccessToken from a Hash
8
11
  #
@@ -37,7 +40,7 @@ module OAuth2
37
40
  # @option opts [String] :header_format ('Bearer %s') the string format to use for the Authorization header
38
41
  # @option opts [String] :param_name ('access_token') the parameter name to use for transmission of the
39
42
  # Access Token value in :body or :query transmission mode
40
- def initialize(client, token, opts = {}) # rubocop:disable Metrics/AbcSize
43
+ def initialize(client, token, opts = {})
41
44
  @client = client
42
45
  @token = token.to_s
43
46
  opts = opts.dup
@@ -48,9 +51,9 @@ module OAuth2
48
51
  @expires_in &&= @expires_in.to_i
49
52
  @expires_at &&= convert_expires_at(@expires_at)
50
53
  @expires_at ||= Time.now.to_i + @expires_in if @expires_in
51
- @options = {:mode => opts.delete(:mode) || :header,
54
+ @options = {:mode => opts.delete(:mode) || :header,
52
55
  :header_format => opts.delete(:header_format) || 'Bearer %s',
53
- :param_name => opts.delete(:param_name) || 'access_token'}
56
+ :param_name => opts.delete(:param_name) || 'access_token'}
54
57
  @params = opts
55
58
  end
56
59
 
@@ -81,6 +84,7 @@ module OAuth2
81
84
  # @note options should be carried over to the new AccessToken
82
85
  def refresh!(params = {})
83
86
  raise('A refresh_token is not available') unless refresh_token
87
+
84
88
  params[:grant_type] = 'refresh_token'
85
89
  params[:refresh_token] = refresh_token
86
90
  new_token = @client.get_token(params)
@@ -149,7 +153,7 @@ module OAuth2
149
153
 
150
154
  private
151
155
 
152
- def configure_authentication!(opts) # rubocop:disable MethodLength, Metrics/AbcSize
156
+ def configure_authentication!(opts)
153
157
  case options[:mode]
154
158
  when :header
155
159
  opts[:headers] ||= {}
@@ -171,10 +175,9 @@ module OAuth2
171
175
  end
172
176
 
173
177
  def convert_expires_at(expires_at)
174
- expires_at_i = expires_at.to_i
175
- return expires_at_i if expires_at_i > Time.now.utc.to_i
176
- return Time.parse(expires_at).to_i if expires_at.is_a?(String)
177
- expires_at_i
178
+ Time.iso8601(expires_at.to_s).to_i
179
+ rescue ArgumentError
180
+ expires_at.to_i
178
181
  end
179
182
  end
180
183
  end
data/lib/oauth2/authenticator.rb CHANGED
@@ -1,3 +1,5 @@
1
+ # frozen_string_literal: true
2
+
1
3
  require 'base64'
2
4
 
3
5
  module OAuth2
@@ -49,7 +51,7 @@ module OAuth2
49
51
  # When using schemes that don't require the client_secret to be passed i.e TLS Client Auth,
50
52
  # we don't want to send the secret
51
53
  def apply_client_id(params)
52
- { 'client_id' => id }.merge(params)
54
+ {'client_id' => id}.merge(params)
53
55
  end
54
56
 
55
57
  # Adds an `Authorization` header with Basic Auth credentials if and only if
@@ -60,7 +62,7 @@ module OAuth2
60
62
  params.merge(:headers => headers)
61
63
  end
62
64
 
63
- # @see https://tools.ietf.org/html/rfc2617#section-2
65
+ # @see https://datatracker.ietf.org/doc/html/rfc2617#section-2
64
66
  def basic_auth_header
65
67
  {'Authorization' => self.class.encode_basic_auth(id, secret)}
66
68
  end