oauth2 1.4.7 → 1.4.11

Sign up to get free protection for your applications and to get access to all the features.
Files changed (34) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +90 -72
  3. data/CONTRIBUTING.md +44 -0
  4. data/LICENSE +1 -1
  5. data/README.md +331 -128
  6. data/SECURITY.md +26 -0
  7. data/lib/oauth2/access_token.rb +4 -2
  8. data/lib/oauth2/authenticator.rb +3 -1
  9. data/lib/oauth2/client.rb +91 -56
  10. data/lib/oauth2/error.rb +3 -1
  11. data/lib/oauth2/mac_token.rb +19 -19
  12. data/lib/oauth2/response.rb +2 -0
  13. data/lib/oauth2/strategy/assertion.rb +3 -1
  14. data/lib/oauth2/strategy/auth_code.rb +3 -1
  15. data/lib/oauth2/strategy/base.rb +2 -0
  16. data/lib/oauth2/strategy/client_credentials.rb +3 -1
  17. data/lib/oauth2/strategy/implicit.rb +3 -1
  18. data/lib/oauth2/strategy/password.rb +3 -1
  19. data/lib/oauth2/version.rb +1 -1
  20. data/lib/oauth2.rb +2 -0
  21. metadata +68 -98
  22. data/spec/helper.rb +0 -37
  23. data/spec/oauth2/access_token_spec.rb +0 -216
  24. data/spec/oauth2/authenticator_spec.rb +0 -84
  25. data/spec/oauth2/client_spec.rb +0 -506
  26. data/spec/oauth2/mac_token_spec.rb +0 -117
  27. data/spec/oauth2/response_spec.rb +0 -90
  28. data/spec/oauth2/strategy/assertion_spec.rb +0 -58
  29. data/spec/oauth2/strategy/auth_code_spec.rb +0 -107
  30. data/spec/oauth2/strategy/base_spec.rb +0 -5
  31. data/spec/oauth2/strategy/client_credentials_spec.rb +0 -69
  32. data/spec/oauth2/strategy/implicit_spec.rb +0 -26
  33. data/spec/oauth2/strategy/password_spec.rb +0 -55
  34. data/spec/oauth2/version_spec.rb +0 -23
data/README.md CHANGED
@@ -1,78 +1,295 @@
1
- # OAuth2
1
+ <p align="center">
2
+ <a href="http://oauth.net/2/" target="_blank" rel="noopener">
3
+ <img src="https://github.com/oauth-xx/oauth2/raw/main/docs/images/logo/oauth2-logo-124px.png?raw=true" alt="OAuth 2.0 Logo by Chris Messina, CC BY-SA 3.0">
4
+ </a>
5
+ <a href="https://www.ruby-lang.org/" target="_blank" rel="noopener">
6
+ <img width="124px" src="https://github.com/oauth-xx/oauth2/raw/main/docs/images/logo/ruby-logo-198px.svg?raw=true" alt="Yukihiro Matsumoto, Ruby Visual Identity Team, CC BY-SA 2.5">
7
+ </a>
8
+ </p>
2
9
 
3
- If you need the readme for a released version of the gem please find it below:
10
+ ## What
11
+
12
+ OAuth 2.0 is the industry-standard protocol for authorization.
13
+ OAuth 2.0 focuses on client developer simplicity while providing specific authorization flows for web applications,
14
+ desktop applications, mobile phones, and living room devices.
15
+ This is a RubyGem for implementing OAuth 2.0 clients and servers in Ruby applications.
16
+ See the sibling `oauth` gem for OAuth 1.0 implementations in Ruby.
17
+
18
+ ⚠️⚠️⚠️ **_WARNING_**: You are viewing the `README` of the
19
+ [supported-only-for-critical-enterprise-security-issues](#oauth2-for-enterprise) `1-4-stable`
20
+ branch. Please do not use this, and instead upgrade to version 2! ⚠️⚠️⚠️
21
+
22
+ No further releases of 1.x series are planned! [Version 2](https://gitlab.com/oauth-xx/oauth2/#what-is-new-for-v20) has *tons* of improvements!
23
+
24
+ If you must continue using 1.4.x please consider purchasing an open source security maintenance contract from [Tidelift][tidelift-ref].
25
+
26
+ ---
27
+
28
+ * [OAuth 2.0 Spec][oauth2-spec]
29
+ * [OAuth 1.0 sibling gem][sibling-gem]
30
+
31
+ [oauth2-spec]: https://oauth.net/2/
32
+ [sibling-gem]: https://gitlab.com/oauth-xx/oauth
33
+
34
+ ## Release Documentation
35
+
36
+ <details>
37
+ <summary>1.4.x Readmes</summary>
38
+
39
+ | Version | Release Date | Readme |
40
+ |---------|--------------|-------------------------------------------------------------|
41
+ | 1.4.11 | Sep 16, 2022 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.11/README.md |
42
+ | 1.4.10 | Jul 1, 2022 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.10/README.md |
43
+ | 1.4.9 | Feb 20, 2022 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.9/README.md |
44
+ | 1.4.8 | Feb 18, 2022 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.8/README.md |
45
+ | 1.4.7 | Mar 19, 2021 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.7/README.md |
46
+ | 1.4.6 | Mar 19, 2021 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.6/README.md |
47
+ | 1.4.5 | Mar 18, 2021 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.5/README.md |
48
+ | 1.4.4 | Feb 12, 2020 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.4/README.md |
49
+ | 1.4.3 | Jan 29, 2020 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.3/README.md |
50
+ | 1.4.2 | Oct 1, 2019 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.2/README.md |
51
+ | 1.4.1 | Oct 13, 2018 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.1/README.md |
52
+ | 1.4.0 | Jun 9, 2017 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.4.0/README.md |
53
+ </details>
54
+
55
+ <details>
56
+ <summary>1.3.x Readmes</summary>
4
57
 
5
58
  | Version | Release Date | Readme |
6
59
  |----------|--------------|----------------------------------------------------------|
7
- | 1.4.7 | Mar 18, 2021 | https://github.com/oauth-xx/oauth2/blob/v1.4.7/README.md |
8
- | 1.4.6 | Mar 18, 2021 | https://github.com/oauth-xx/oauth2/blob/v1.4.6/README.md |
9
- | 1.4.5 | Mar 18, 2021 | https://github.com/oauth-xx/oauth2/blob/v1.4.5/README.md |
10
- | 1.4.4 | Feb 12, 2020 | https://github.com/oauth-xx/oauth2/blob/v1.4.4/README.md |
11
- | 1.4.3 | Jan 29, 2020 | https://github.com/oauth-xx/oauth2/blob/v1.4.3/README.md |
12
- | 1.4.2 | Oct 1, 2019 | https://github.com/oauth-xx/oauth2/blob/v1.4.2/README.md |
13
- | 1.4.1 | Oct 13, 2018 | https://github.com/oauth-xx/oauth2/blob/v1.4.1/README.md |
14
- | 1.4.0 | Jun 9, 2017 | https://github.com/oauth-xx/oauth2/blob/v1.4.0/README.md |
15
- | 1.3.1 | Mar 3, 2017 | https://github.com/oauth-xx/oauth2/blob/v1.3.1/README.md |
16
- | 1.3.0 | Dec 27, 2016 | https://github.com/oauth-xx/oauth2/blob/v1.3.0/README.md |
17
- | 1.2.0 | Jun 30, 2016 | https://github.com/oauth-xx/oauth2/blob/v1.2.0/README.md |
18
- | 1.1.0 | Jan 30, 2016 | https://github.com/oauth-xx/oauth2/blob/v1.1.0/README.md |
19
- | 1.0.0 | May 23, 2014 | https://github.com/oauth-xx/oauth2/blob/v1.0.0/README.md |
20
- | < 1.0.0 | Find here | https://github.com/oauth-xx/oauth2/tags |
21
-
22
- [![Gem Version](http://img.shields.io/gem/v/oauth2.svg)][gem]
23
- [![Total Downloads](https://img.shields.io/gem/dt/oauth2.svg)][gem]
24
- [![Downloads Today](https://img.shields.io/gem/rt/oauth2.svg)][gem]
25
- [![Build Status](https://travis-ci.org/oauth-xx/oauth2.svg?branch=1-4-stable)][travis]
26
- [![Build Status](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Factions-badge.atrox.dev%2Foauth-xx%2Foauth2%2Fbadge&style=flat)][github-actions]
27
- [![Test Coverage](https://api.codeclimate.com/v1/badges/688c612528ff90a46955/test_coverage)][codeclimate-coverage]
28
- [![Maintainability](https://api.codeclimate.com/v1/badges/688c612528ff90a46955/maintainability)][codeclimate-maintainability]
29
- [![Depfu](https://badges.depfu.com/badges/6d34dc1ba682bbdf9ae2a97848241743/count.svg)][depfu]
30
- [![Open Source Helpers](https://www.codetriage.com/oauth-xx/oauth2/badges/users.svg)][code-triage]
31
- [![Chat](https://img.shields.io/gitter/room/oauth-xx/oauth2.svg)](https://gitter.im/oauth-xx/oauth2)
32
- [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)][source-license]
33
- [![Documentation](http://inch-ci.org/github/oauth-xx/oauth2.png)][inch-ci]
34
-
35
- [gem]: https://rubygems.org/gems/oauth2
36
- [travis]: http://travis-ci.org/oauth-xx/oauth2
37
- [github-actions]: https://actions-badge.atrox.dev/oauth-xx/oauth2/goto
38
- [coveralls]: https://coveralls.io/r/oauth-xx/oauth2
39
- [codeclimate-maintainability]: https://codeclimate.com/github/oauth-xx/oauth2/maintainability
40
- [codeclimate-coverage]: https://codeclimate.com/github/oauth-xx/oauth2/test_coverage
41
- [depfu]: https://depfu.com/github/oauth-xx/oauth2
42
- [source-license]: https://opensource.org/licenses/MIT
43
- [inch-ci]: http://inch-ci.org/github/oauth-xx/oauth2
44
- [code-triage]: https://www.codetriage.com/oauth-xx/oauth2
45
- [fossa1]: https://app.fossa.io/projects/git%2Bgithub.com%2Foauth-xx%2Foauth2?ref=badge_shield
46
-
47
- A Ruby wrapper for the [OAuth 2.0 specification][oauth2-spec].
60
+ | 1.3.1 | Mar 3, 2017 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.3.1/README.md |
61
+ | 1.3.0 | Dec 27, 2016 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.3.0/README.md |
62
+ </details>
48
63
 
49
- [oauth2-spec]: https://oauth.net/2/
64
+ <details>
65
+ <summary>&le;= 1.2.x Readmes (2016 and before)</summary>
66
+
67
+ | Version | Release Date | Readme |
68
+ |----------|--------------|----------------------------------------------------------|
69
+ | 1.2.0 | Jun 30, 2016 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.2.0/README.md |
70
+ | 1.1.0 | Jan 30, 2016 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.1.0/README.md |
71
+ | 1.0.0 | May 23, 2014 | https://gitlab.com/oauth-xx/oauth2/-/blob/v1.0.0/README.md |
72
+ | < 1.0.0 | Find here | https://gitlab.com/oauth-xx/oauth2/-/tags |
73
+ </details>
74
+
75
+ ## Status
76
+
77
+ <!--
78
+ Numbering rows and badges in each row as a visual "database" lookup,
79
+ as the table is extremely dense, and it can be very difficult to find anything
80
+ Putting one on each row here, to document the emoji that should be used, and for ease of copy/paste.
81
+
82
+ row #s:
83
+ 1️⃣
84
+ 2️⃣
85
+ 3️⃣
86
+ 4️⃣
87
+ 5️⃣
88
+ 6️⃣
89
+ 7️⃣
90
+
91
+ badge #s:
92
+ ⛳️
93
+ 🖇
94
+ 🏘
95
+ 🚎
96
+ 🖐
97
+ 🧮
98
+ 📗
99
+
100
+ appended indicators:
101
+ ♻️ - URL needs to be updated from SASS integration. Find / Replace is insufficient.
102
+ -->
103
+
104
+ | | Project | bundle add oauth2 |
105
+ |:----|-----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
106
+ | 1️⃣ | name, license, docs | [![RubyGems.org][⛳️name-img]][⛳️gem] [![License: MIT][🖇src-license-img]][🖇src-license] [![FOSSA][🏘fossa-img]][🏘fossa] [![RubyDoc.info][🚎yard-img]][🚎yard] [![InchCI][🖐inch-ci-img]][🚎yard] |
107
+ | 2️⃣ | version & activity | [![Gem Version][⛳️version-img]][⛳️gem] [![Total Downloads][🖇DL-total-img]][⛳️gem] [![Download Rank][🏘DL-rank-img]][⛳️gem] [![Source Code][🚎src-home-img]][🚎src-home] |
108
+ | 3️⃣ | maintanence & linting | [![Maintainability][⛳cclim-maint-img♻️]][⛳cclim-maint] [![Helpers][🖇triage-help-img]][🖇triage-help] [![Depfu][🏘depfu-img♻️]][🏘depfu♻️] [![Contributors][🚎contributors-img]][🚎contributors] [![Style][🖐style-wf-img]][🖐style-wf] [![Kloc Roll][🧮kloc-img]][🧮kloc] |
109
+ | 4️⃣ | testing | [![Supported][🏘sup-wf-img]][🏘sup-wf] [![Heads][🚎heads-wf-img]][🚎heads-wf] [![Unofficial Support][🖐uns-wf-img]][🖐uns-wf] [![MacOS][🧮mac-wf-img]][🧮mac-wf] [![Windows][📗win-wf-img]][📗win-wf] |
110
+ | 5️⃣ | coverage & security | [![CodeClimate][⛳cclim-cov-img♻️]][⛳cclim-cov] [![CodeCov][🖇codecov-img♻️]][🖇codecov] [![Coveralls][🏘coveralls-img]][🏘coveralls] [![Security Policy][🚎sec-pol-img]][🚎sec-pol] [![CodeQL][🖐codeQL-img]][🖐codeQL] [![Code Coverage][🧮cov-wf-img]][🧮cov-wf] |
111
+ | 6️⃣ | resources | [![Discussion][⛳gg-discussions-img]][⛳gg-discussions] [![Get help on Codementor][🖇codementor-img]][🖇codementor] [![Chat][🏘chat-img]][🏘chat] [![Blog][🚎blog-img]][🚎blog] [![Blog][🖐wiki-img]][🖐wiki] |
112
+ | 7️⃣ | spread 💖 | [![Liberapay Patrons][⛳liberapay-img]][⛳liberapay] [![Sponsor Me][🖇sponsor-img]][🖇sponsor] [![Tweet @ Peter][🏘tweet-img]][🏘tweet] [🌏][aboutme] [👼][angelme] [💻][coderme] |
113
+
114
+ <!--
115
+ The link tokens in the following sections should be kept ordered by the row and badge numbering scheme
116
+ -->
117
+
118
+ <!-- 1️⃣ name, license, docs -->
119
+ [⛳️gem]: https://rubygems.org/gems/oauth2
120
+ [⛳️name-img]: https://img.shields.io/badge/name-oauth2-brightgreen.svg?style=flat
121
+ [🖇src-license]: https://opensource.org/licenses/MIT
122
+ [🖇src-license-img]: https://img.shields.io/badge/License-MIT-green.svg
123
+ [🏘fossa]: https://app.fossa.io/projects/git%2Bgithub.com%2Foauth-xx%2Foauth2?ref=badge_shield
124
+ [🏘fossa-img]: https://app.fossa.io/api/projects/git%2Bgithub.com%2Foauth-xx%2Foauth2.svg?type=shield
125
+ [🚎yard]: https://www.rubydoc.info/github/oauth-xx/oauth2
126
+ [🚎yard-img]: https://img.shields.io/badge/documentation-rubydoc-brightgreen.svg?style=flat
127
+ [🖐inch-ci-img]: http://inch-ci.org/github/oauth-xx/oauth2.png
128
+
129
+ <!-- 2️⃣ version & activity -->
130
+ [⛳️version-img]: http://img.shields.io/gem/v/oauth2.svg
131
+ [🖇DL-total-img]: https://img.shields.io/gem/dt/oauth2.svg
132
+ [🏘DL-rank-img]: https://img.shields.io/gem/rt/oauth2.svg
133
+ [🚎src-home]: https://gitlab.com/oauth-xx/oauth2/
134
+ [🚎src-home-img]: https://img.shields.io/badge/source-gitlab-blue.svg?style=flat
135
+
136
+ <!-- 3️⃣ maintenance & linting -->
137
+ [⛳cclim-maint]: https://codeclimate.com/github/oauth-xx/oauth2/maintainability
138
+ [⛳cclim-maint-img♻️]: https://api.codeclimate.com/v1/badges/688c612528ff90a46955/maintainability
139
+ [🖇triage-help]: https://www.codetriage.com/oauth-xx/oauth2
140
+ [🖇triage-help-img]: https://www.codetriage.com/oauth-xx/oauth2/badges/users.svg
141
+ [🏘depfu♻️]: https://depfu.com/github/oauth-xx/oauth2?project_id=4445
142
+ [🏘depfu-img♻️]: https://badges.depfu.com/badges/6d34dc1ba682bbdf9ae2a97848241743/count.svg
143
+ [🚎contributors]: https://gitlab.com/oauth-xx/oauth2/-/graphs/main
144
+ [🚎contributors-img]: https://img.shields.io/github/contributors-anon/oauth-xx/oauth2
145
+ [🖐style-wf]: https://github.com/oauth-xx/oauth2/actions/workflows/style.yml
146
+ [🖐style-wf-img]: https://github.com/oauth-xx/oauth2/actions/workflows/style.yml/badge.svg
147
+ [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
148
+ [🧮kloc-img]: https://img.shields.io/tokei/lines/github.com/oauth-xx/oauth2
149
+
150
+ <!-- 4️⃣ testing -->
151
+ [🏘sup-wf]: https://github.com/oauth-xx/oauth2/actions/workflows/supported.yml
152
+ [🏘sup-wf-img]: https://github.com/oauth-xx/oauth2/actions/workflows/supported.yml/badge.svg
153
+ [🚎heads-wf]: https://github.com/oauth-xx/oauth2/actions/workflows/heads.yml
154
+ [🚎heads-wf-img]: https://github.com/oauth-xx/oauth2/actions/workflows/heads.yml/badge.svg
155
+ [🖐uns-wf]: https://github.com/oauth-xx/oauth2/actions/workflows/unsupported.yml
156
+ [🖐uns-wf-img]: https://github.com/oauth-xx/oauth2/actions/workflows/unsupported.yml/badge.svg
157
+ [🧮mac-wf]: https://github.com/oauth-xx/oauth2/actions/workflows/macos.yml
158
+ [🧮mac-wf-img]: https://github.com/oauth-xx/oauth2/actions/workflows/macos.yml/badge.svg
159
+ [📗win-wf]: https://github.com/oauth-xx/oauth2/actions/workflows/windows.yml
160
+ [📗win-wf-img]: https://github.com/oauth-xx/oauth2/actions/workflows/windows.yml/badge.svg
161
+
162
+ <!-- 5️⃣ coverage & security -->
163
+ [⛳cclim-cov]: https://codeclimate.com/github/oauth-xx/oauth2/test_coverage
164
+ [⛳cclim-cov-img♻️]: https://api.codeclimate.com/v1/badges/688c612528ff90a46955/test_coverage
165
+ [🖇codecov-img♻️]: https://codecov.io/gh/oauth-xx/oauth2/branch/1-4-stable/graph/badge.svg?token=bNqSzNiuo2
166
+ [🖇codecov]: https://codecov.io/gh/oauth-xx/oauth2
167
+ [🏘coveralls]: https://coveralls.io/github/oauth-xx/oauth2?branch=1-4-stable
168
+ [🏘coveralls-img]: https://coveralls.io/repos/github/oauth-xx/oauth2/badge.svg?branch=1-4-stable
169
+ [🚎sec-pol]: https://gitlab.com/oauth-xx/oauth2/-/blob/main/SECURITY.md
170
+ [🚎sec-pol-img]: https://img.shields.io/badge/security-policy-brightgreen.svg?style=flat
171
+ [🖐codeQL]: https://github.com/oauth-xx/oauth2/security/code-scanning
172
+ [🖐codeQL-img]: https://github.com/oauth-xx/oauth2/actions/workflows/codeql-analysis.yml/badge.svg
173
+ [🧮cov-wf]: https://github.com/oauth-xx/oauth2/actions/workflows/coverage.yml
174
+ [🧮cov-wf-img]: https://github.com/oauth-xx/oauth2/actions/workflows/coverage.yml/badge.svg
175
+
176
+ <!-- 6️⃣ resources -->
177
+ [⛳gg-discussions]: https://groups.google.com/g/oauth-ruby
178
+ [⛳gg-discussions-img]: https://img.shields.io/badge/google-group-purple.svg?style=flat
179
+ [🖇codementor]: https://www.codementor.io/peterboling?utm_source=github&utm_medium=button&utm_term=peterboling&utm_campaign=github
180
+ [🖇codementor-img]: https://cdn.codementor.io/badges/get_help_github.svg
181
+ [🏘chat]: https://gitter.im/oauth-xx/oauth2
182
+ [🏘chat-img]: https://img.shields.io/gitter/room/oauth-xx/oauth2.svg
183
+ [🚎blog]: http://www.railsbling.com/tags/oauth2/
184
+ [🚎blog-img]: https://img.shields.io/badge/blog-railsbling-brightgreen.svg?style=flat
185
+ [🖐wiki]: https://gitlab.com/oauth-xx/oauth2/-/wikis/home
186
+ [🖐wiki-img]: https://img.shields.io/badge/wiki-examples-brightgreen.svg?style=flat
187
+
188
+ <!-- 7️⃣ spread 💖 -->
189
+ [⛳liberapay-img]: https://img.shields.io/liberapay/patrons/pboling.svg?logo=liberapay
190
+ [⛳liberapay]: https://liberapay.com/pboling/donate
191
+ [🖇sponsor-img]: https://img.shields.io/badge/sponsor-pboling.svg?style=social&logo=github
192
+ [🖇sponsor]: https://github.com/sponsors/pboling
193
+ [🏘tweet-img]: https://img.shields.io/twitter/follow/galtzo.svg?style=social&label=Follow
194
+ [🏘tweet]: http://twitter.com/galtzo
195
+
196
+ <!-- Maintainer Contact Links -->
197
+ [railsbling]: http://www.railsbling.com
198
+ [peterboling]: http://www.peterboling.com
199
+ [aboutme]: https://about.me/peter.boling
200
+ [angelme]: https://angel.co/peter-boling
201
+ [coderme]:http://coderwall.com/pboling
50
202
 
51
203
  ## Installation
52
204
 
53
- Add this line to your application's Gemfile:
205
+ Install the gem and add to the application's Gemfile by executing:
54
206
 
55
- ```ruby
56
- gem 'oauth2'
57
- ```
207
+ $ bundle add oauth2
58
208
 
59
- And then execute:
209
+ If bundler is not being used to manage dependencies, install the gem by executing:
60
210
 
61
- $ bundle
211
+ $ gem install oauth2
62
212
 
63
- Or install it yourself as:
213
+ ## OAuth2 for Enterprise
64
214
 
65
- $ gem install oauth2
215
+ Available as part of the Tidelift Subscription.
216
+
217
+ The maintainers of OAuth2 and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use. [Learn more.][tidelift-ref]
218
+
219
+ [tidelift-ref]: https://tidelift.com/subscription/pkg/rubygems-oauth2?utm_source=rubygems-oauth2&utm_medium=referral&utm_campaign=enterprise
220
+
221
+ ## Security contact information
66
222
 
67
- ## Resources
223
+ To report a security vulnerability, please use the [Tidelift security contact](https://tidelift.com/security).
224
+ Tidelift will coordinate the fix and disclosure.
68
225
 
69
- * [View Source on GitHub][code]
70
- * [Report Issues on GitHub][issues]
71
- * [Read More at the Wiki][wiki]
226
+ For more see [SECURITY.md][🚎sec-pol].
227
+
228
+ ## Why should you upgrade to version v2.0?
229
+
230
+ - Officially support Ruby versions >= 2.7
231
+ - Unofficially support Ruby versions >= 2.5
232
+ - Incidentally support Ruby versions >= 2.2
233
+ - Drop support for the expired MAC Draft (all versions)
234
+ - Support IETF rfc7523 JWT Bearer Tokens
235
+ - Support IETF rfc7231 Relative Location in Redirect
236
+ - Support IETF rfc6749 Don't set oauth params when nil
237
+ - Support [OIDC 1.0 Private Key JWT](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication); based on the OAuth JWT assertion specification [(RFC 7523)](https://tools.ietf.org/html/rfc7523)
238
+ - Support new formats, including from [jsonapi.org](http://jsonapi.org/format/): `application/vdn.api+json`, `application/vnd.collection+json`, `application/hal+json`, `application/problem+json`
239
+ - Adds new option to `OAuth2::Client#get_token`:
240
+ - `:access_token_class` (`AccessToken`); user specified class to use for all calls to `get_token`
241
+ - Adds new option to `OAuth2::AccessToken#initialize`:
242
+ - `:expires_latency` (`nil`); number of seconds by which AccessToken validity will be reduced to offset latency
243
+ - By default, keys are transformed to camel case.
244
+ - Original keys will still work as previously, in most scenarios, thanks to `rash_alt` gem.
245
+ - However, this is a _breaking_ change if you rely on `response.parsed.to_h`, as the keys in the result will be camel case.
246
+ - As of version 2.0.4 you can turn key transformation off with the `snaky: false` option.
247
+ - By default, the `:auth_scheme` is now `:basic_auth` (instead of `:request_body`)
248
+ - Third-party strategies and gems may need to be updated if a provider was requiring client id/secret in the request body
249
+ - [... A lot more](https://gitlab.com/oauth-xx/oauth2/-/blob/main/CHANGELOG.md#2.0.0)
250
+
251
+ ## Compatibility
252
+
253
+ Targeted ruby compatibility is 2.7, 3.0 and 3.1. Compatibility is further distinguished by
254
+ supported and unsupported versions of Ruby.
255
+ This gem will work with Ruby versions back to 1.9, though it remains unsupported.
256
+ Ruby is limited to 1.9+ in the gemspec for the 1.4.x series and is be 2.2+ for next major version releases (see `master` branch).
257
+
258
+ <details>
259
+ <summary>Ruby Engine Compatibility Policy</summary>
260
+
261
+ This gem is tested against MRI, JRuby, and Truffleruby.
262
+ Each of those has varying versions that target a specific version of MRI Ruby.
263
+ This gem should work in the just-listed Ruby engines according to the targeted MRI compatibility in the table below.
264
+ If you would like to add support for additional engines,
265
+ see `gemfiles/README.md`, then submit a PR to the correct maintenance branch as according to the table below.
266
+ </details>
267
+
268
+ <details>
269
+ <summary>Ruby Version Compatibility Policy</summary>
270
+
271
+ If something doesn't work on one of these interpreters, it's a bug.
272
+
273
+ This library may inadvertently work (or seem to work) on other Ruby
274
+ implementations, however support will only be provided for the versions listed
275
+ above.
276
+
277
+ If you would like this library to support another Ruby version, you may
278
+ volunteer to be a maintainer. Being a maintainer entails making sure all tests
279
+ run and pass on that implementation. When something breaks on your
280
+ implementation, you will be responsible for providing patches in a timely
281
+ fashion. If critical issues for a particular implementation exist at the time
282
+ of a major release, support for that Ruby version may be dropped.
283
+ </details>
72
284
 
73
- [code]: https://github.com/oauth-xx/oauth2
74
- [issues]: https://github.com/oauth-xx/oauth2/issues
75
- [wiki]: https://wiki.github.com/oauth-xx/oauth2
285
+ | | Ruby OAuth2 Version | Maintenance Branch | Supported Officially | Supported Unofficially | Supported Incidentally |
286
+ |:----|---------------------|--------------------|-------------------------|------------------------|------------------------|
287
+ | 1️⃣ | 2.0.x | `main` | 2.7, 3.0, 3.1 | 2.5, 2.6 | 2.2, 2.3, 2.4 |
288
+ | 2️⃣ | 1.4.x | `1-4-stable` | 2.5, 2.6, 2.7, 3.0, 3.1 | 2.1, 2.2, 2.3, 2.4 | 1.9, 2.0 |
289
+ | 3️⃣ | older | N/A | Best of luck to you! | Please upgrade! | |
290
+
291
+ NOTE: The 1.4 series will only receive critical security updates.
292
+ See [SECURITY.md][🚎sec-pol]
76
293
 
77
294
  ## Usage Examples
78
295
 
@@ -88,13 +305,38 @@ response = token.get('/api/resource', :params => {'query_foo' => 'bar'})
88
305
  response.class.name
89
306
  # => OAuth2::Response
90
307
  ```
308
+
309
+ <details>
310
+ <summary>Debugging</summary>
311
+
312
+ Set an environment variable, however you would [normally do that](https://github.com/bkeepers/dotenv).
313
+
314
+ ```ruby
315
+ # will log both request and response, including bodies
316
+ ENV['OAUTH_DEBUG'] = 'true'
317
+ ```
318
+
319
+ By default, debug output will go to `$stdout`. This can be overridden when
320
+ initializing your OAuth2::Client.
321
+
322
+ ```ruby
323
+ require 'oauth2'
324
+ client = OAuth2::Client.new(
325
+ 'client_id',
326
+ 'client_secret',
327
+ :site => 'https://example.org',
328
+ :logger => Logger.new('example.log', 'weekly')
329
+ )
330
+ ```
331
+ </details>
332
+
91
333
  ## OAuth2::Response
92
334
 
93
- The AccessToken methods #get, #post, #put and #delete and the generic #request
335
+ The `AccessToken` methods `#get`, `#post`, `#put` and `#delete` and the generic `#request`
94
336
  will return an instance of the #OAuth2::Response class.
95
337
 
96
- This instance contains a #parsed method that will parse the response body and
97
- return a Hash if the Content-Type is application/x-www-form-urlencoded or if
338
+ This instance contains a `#parsed` method that will parse the response body and
339
+ return a Hash if the `Content-Type` is `application/x-www-form-urlencoded` or if
98
340
  the body is a JSON object. It will return an Array if the body is a JSON
99
341
  array. Otherwise, it will return the original body string.
100
342
 
@@ -104,27 +346,27 @@ respective methods.
104
346
  ## OAuth2::AccessToken
105
347
 
106
348
  If you have an existing Access Token for a user, you can initialize an instance
107
- using various class methods including the standard new, from_hash (if you have
108
- a hash of the values), or from_kvform (if you have an
109
- application/x-www-form-urlencoded encoded string of the values).
349
+ using various class methods including the standard new, `from_hash` (if you have
350
+ a hash of the values), or `from_kvform` (if you have an
351
+ `application/x-www-form-urlencoded` encoded string of the values).
110
352
 
111
353
  ## OAuth2::Error
112
354
 
113
- On 400+ status code responses, an OAuth2::Error will be raised. If it is a
114
- standard OAuth2 error response, the body will be parsed and #code and #description will contain the values provided from the error and
115
- error_description parameters. The #response property of OAuth2::Error will
116
- always contain the OAuth2::Response instance.
355
+ On 400+ status code responses, an `OAuth2::Error` will be raised. If it is a
356
+ standard OAuth2 error response, the body will be parsed and `#code` and `#description` will contain the values provided from the error and
357
+ `error_description` parameters. The `#response` property of `OAuth2::Error` will
358
+ always contain the `OAuth2::Response` instance.
117
359
 
118
- If you do not want an error to be raised, you may use :raise_errors => false
119
- option on initialization of the client. In this case the OAuth2::Response
360
+ If you do not want an error to be raised, you may use `:raise_errors => false`
361
+ option on initialization of the client. In this case the `OAuth2::Response`
120
362
  instance will be returned as usual and on 400+ status code responses, the
121
- Response instance will contain the OAuth2::Error instance.
363
+ Response instance will contain the `OAuth2::Error` instance.
122
364
 
123
365
  ## Authorization Grants
124
366
 
125
367
  Currently the Authorization Code, Implicit, Resource Owner Password Credentials, Client Credentials, and Assertion
126
368
  authentication grant types have helper strategy classes that simplify client
127
- use. They are available via the #auth_code, #implicit, #password, #client_credentials, and #assertion methods respectively.
369
+ use. They are available via the `#auth_code`, `#implicit`, `#password`, `#client_credentials`, and `#assertion` methods respectively.
128
370
 
129
371
  ```ruby
130
372
  auth_url = client.auth_code.authorize_url(:redirect_uri => 'http://localhost:8080/oauth/callback')
@@ -148,56 +390,9 @@ request, add a 'headers' hash under 'params':
148
390
  token = client.auth_code.get_token('code_value', :redirect_uri => 'http://localhost:8080/oauth/callback', :headers => {'Some' => 'Header'})
149
391
  ```
150
392
 
151
- You can always use the #request method on the OAuth2::Client instance to make
393
+ You can always use the `#request` method on the `OAuth2::Client` instance to make
152
394
  requests for tokens for any Authentication grant type.
153
395
 
154
- ## Supported Ruby Versions
155
-
156
- This library aims to support and is [tested against][travis] the following Ruby
157
- implementations:
158
-
159
- ### Rubies with support ending at Oauth2 1.x
160
-
161
- * Ruby 1.9.3
162
- - [JRuby 1.7][jruby-1.7] (targets MRI v1.9)
163
-
164
- * Ruby 2.0.0
165
- - [JRuby 9.0][jruby-9.0] (targets MRI v2.0)
166
- * Ruby 2.1
167
-
168
- ---
169
-
170
- ### Rubies with continued support past Oauth2 2.x
171
-
172
- * Ruby 2.2 - Support ends with version 2.x series
173
- * Ruby 2.3 - Support ends with version 3.x series
174
- - [JRuby 9.1][jruby-9.1] (targets MRI v2.3)
175
- * Ruby 2.4 - Support ends with version 4.x series
176
- * Ruby 2.5 - Support ends with version 5.x series
177
- - [JRuby 9.2][jruby-9.2] (targets MRI v2.5)
178
- - [truffleruby][truffleruby] (targets MRI 2.5)
179
- * Ruby 2.6 - Support ends with version 6.x series
180
- * Ruby 2.7 - Support ends with version 7.x series
181
-
182
- [jruby-1.7]: https://www.jruby.org/2017/05/11/jruby-1-7-27.html
183
- [jruby-9.0]: https://www.jruby.org/2016/01/26/jruby-9-0-5-0.html
184
- [jruby-9.1]: https://www.jruby.org/2017/05/16/jruby-9-1-9-0.html
185
- [jruby-9.2]: https://www.jruby.org/2018/05/24/jruby-9-2-0-0.html
186
- [truffleruby]: https://github.com/oracle/truffleruby
187
-
188
- If something doesn't work on one of these interpreters, it's a bug.
189
-
190
- This library may inadvertently work (or seem to work) on other Ruby
191
- implementations, however support will only be provided for the versions listed
192
- above.
193
-
194
- If you would like this library to support another Ruby version, you may
195
- volunteer to be a maintainer. Being a maintainer entails making sure all tests
196
- run and pass on that implementation. When something breaks on your
197
- implementation, you will be responsible for providing patches in a timely
198
- fashion. If critical issues for a particular implementation exist at the time
199
- of a major release, support for that Ruby version may be dropped.
200
-
201
396
  ## Versioning
202
397
 
203
398
  This library aims to adhere to [Semantic Versioning 2.0.0][semver].
@@ -221,28 +416,36 @@ spec.add_dependency 'oauth2', '~> 1.4'
221
416
 
222
417
  ## License
223
418
 
224
- [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)][source-license]
419
+ [![License: MIT][🖇src-license-img]][🖇src-license]
225
420
 
226
421
  - Copyright (c) 2011-2013 Michael Bleigh and Intridea, Inc.
227
- - Copyright (c) 2017-2018 [oauth-xx organization][oauth-xx]
422
+ - Copyright (c) 2017-2022 [oauth-xx organization][oauth-xx]
228
423
  - See [LICENSE][license] for details.
229
424
 
230
425
  [![FOSSA Status](https://app.fossa.io/api/projects/git%2Bgithub.com%2Foauth-xx%2Foauth2.svg?type=large)][fossa2]
231
426
 
232
- [license]: LICENSE
233
- [oauth-xx]: https://github.com/oauth-xx
427
+ [license]: https://gitlab.com/oauth-xx/oauth2/-/blob/main/LICENSE
428
+ [oauth-xx]: https://gitlab.com/oauth-xx
234
429
  [fossa2]: https://app.fossa.io/projects/git%2Bgithub.com%2Foauth-xx%2Foauth2?ref=badge_large
235
430
 
236
431
  ## Development
237
432
 
238
- After checking out the repo, run `bundle install` to install dependencies. Then, run `rake spec` to run the tests.
433
+ After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
239
434
 
240
435
  To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
241
436
 
242
437
  ## Contributing
243
438
 
244
- Bug reports and pull requests are welcome on GitHub at https://github.com/oauth-xx/oauth2. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](http://contributor-covenant.org) code of conduct.
439
+ See [CONTRIBUTING.md][contributing]
440
+
441
+ [contributing]: https://gitlab.com/oauth-xx/oauth2/-/blob/main/CONTRIBUTING.md
442
+
443
+ ## Contributors
444
+
445
+ [![Contributors](https://contrib.rocks/image?repo=oauth-xx/oauth2)]("https://gitlab.com/oauth-xx/oauth2/-/graphs/main")
446
+
447
+ Made with [contributors-img](https://contrib.rocks).
245
448
 
246
449
  ## Code of Conduct
247
450
 
248
- Everyone interacting in the OAuth2 project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/oauth-xx/oauth2/blob/master/CODE_OF_CONDUCT.md).
451
+ Everyone interacting in the OAuth2 project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://gitlab.com/oauth-xx/oauth2/-/blob/main/CODE_OF_CONDUCT.md).
data/SECURITY.md ADDED
@@ -0,0 +1,26 @@
1
+ # Security Policy
2
+
3
+ ## Supported Versions
4
+
5
+ | Version | Supported | EOL | Post-EOL / Enterprise |
6
+ |----------|-----------|---------|---------------------------------------|
7
+ | 2.latest | ✅ | 04/2024 | [Tidelift Subscription][tidelift-ref] |
8
+ | 1.latest | ✅ | 04/2023 | [Tidelift Subscription][tidelift-ref] |
9
+ | <= 1 | ⛔ | ⛔ | ⛔ |
10
+
11
+ ### EOL Policy
12
+
13
+ Non-commercial support for the oldest version of Ruby (which itself is going EOL) will be dropped each year in April.
14
+
15
+ ## Reporting a Vulnerability
16
+
17
+ To report a security vulnerability, please use the [Tidelift security contact](https://tidelift.com/security).
18
+ Tidelift will coordinate the fix and disclosure.
19
+
20
+ ## OAuth2 for Enterprise
21
+
22
+ Available as part of the Tidelift Subscription.
23
+
24
+ The maintainers of oauth2 and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use. [Learn more.][tidelift-ref]
25
+
26
+ [tidelift-ref]: https://tidelift.com/subscription/pkg/rubygems-oauth2?utm_source=rubygems-oauth2&utm_medium=referral&utm_campaign=enterprise&utm_term=repo
data/lib/oauth2/access_token.rb CHANGED
@@ -1,3 +1,5 @@
1
+ # frozen_string_literal: true
2
+
1
3
  module OAuth2
2
4
  class AccessToken
3
5
  attr_reader :client, :token, :expires_in, :expires_at, :params
@@ -38,7 +40,7 @@ module OAuth2
38
40
  # @option opts [String] :header_format ('Bearer %s') the string format to use for the Authorization header
39
41
  # @option opts [String] :param_name ('access_token') the parameter name to use for transmission of the
40
42
  # Access Token value in :body or :query transmission mode
41
- def initialize(client, token, opts = {}) # rubocop:disable Metrics/AbcSize
43
+ def initialize(client, token, opts = {})
42
44
  @client = client
43
45
  @token = token.to_s
44
46
  opts = opts.dup
@@ -151,7 +153,7 @@ module OAuth2
151
153
 
152
154
  private
153
155
 
154
- def configure_authentication!(opts) # rubocop:disable Metrics/AbcSize
156
+ def configure_authentication!(opts)
155
157
  case options[:mode]
156
158
  when :header
157
159
  opts[:headers] ||= {}
data/lib/oauth2/authenticator.rb CHANGED
@@ -1,3 +1,5 @@
1
+ # frozen_string_literal: true
2
+
1
3
  require 'base64'
2
4
 
3
5
  module OAuth2
@@ -60,7 +62,7 @@ module OAuth2
60
62
  params.merge(:headers => headers)
61
63
  end
62
64
 
63
- # @see https://tools.ietf.org/html/rfc2617#section-2
65
+ # @see https://datatracker.ietf.org/doc/html/rfc2617#section-2
64
66
  def basic_auth_header
65
67
  {'Authorization' => self.class.encode_basic_auth(id, secret)}
66
68
  end