oauth2 2.0.0 → 2.0.3

Sign up to get free protection for your applications and to get access to all the features.
Files changed (11) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +26 -3
  3. data/CONTRIBUTING.md +27 -1
  4. data/README.md +79 -32
  5. data/SECURITY.md +11 -5
  6. data/lib/oauth2/access_token.rb +3 -3
  7. data/lib/oauth2/client.rb +48 -27
  8. data/lib/oauth2/response.rb +14 -5
  9. data/lib/oauth2/strategy/assertion.rb +1 -1
  10. data/lib/oauth2/version.rb +1 -1
  11. metadata +6 -6
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 7bd40b127f03fb47d5d897e4dd917ef3530fe06a863ce40485d3e9d02db32bc7
4
- data.tar.gz: 331dd1ee11d2e9490372c8c2106ca3492c9e743b066510ba3b111c7c0e8c5834
3
+ metadata.gz: 834cadcf40991f2fd88a74f9ee614992d17c087d5862a4f7243cb83874f87683
4
+ data.tar.gz: 9a54a67d2def4e8232ff7b764ce70d87c4d9fb7125b72e234d07b84b507565b2
5
5
  SHA512:
6
- metadata.gz: 33a5d808e3388045e441fb386793cfdd69264af585f0582e044f59a736276dbe3d84c9f98be77cc5d0b9f29c3cc569c61721dfd5816d2654b57f6170213ed8a1
7
- data.tar.gz: 9be4ba6cf11c62156b2f25fae2f04fb556166f4cbb7b8997d46af525968519073fcd6380008a2cc45ddb38986e0267becd7dfcc4f8f23560c437a2ce6f3be348
6
+ metadata.gz: 190394d6e1d046de982b9ed978c54b810a15cbfbe41507c63f103a19be06b04d4a7f2a8cad4f3fc30c9cf4eed6314e353668b7e49d8e41826e1c460f944060ed
7
+ data.tar.gz: 10bd8f3f468165150ce7d79c31d0a4c7be72322660ae7579bf579bf68054106f21d16b408c56eedcc3a2359f14c84c770fa89dec93d0811c2ed328aa7b365f00
data/CHANGELOG.md CHANGED
@@ -4,7 +4,26 @@ All notable changes to this project will be documented in this file.
4
4
  The format (since v2) is based on [Keep a Changelog v1](https://keepachangelog.com/en/1.0.0/),
5
5
  and this project adheres to [Semantic Versioning v2](https://semver.org/spec/v2.0.0.html).
6
6
 
7
- ## [2.0.0.rc3] - 2022-06-16
7
+ ## [2.0.3] - 2022-06-28
8
+ ### Added
9
+ - [#611](https://github.com/oauth-xx/oauth2/pull/611) - Proper deprecation warnings for `extract_access_token` argument (@pboling)
10
+ - [#612](https://github.com/oauth-xx/oauth2/pull/612) - Add `snaky: false` option to skip conversion to `OAuth2::SnakyHash` (default: true) (@pboling)
11
+ ### Fixed
12
+ - [#608](https://github.com/oauth-xx/oauth2/pull/608) - Wrap `Faraday::TimeoutError` in `OAuth2::TimeoutError` (@nbibler)
13
+ - [#615](https://github.com/oauth-xx/oauth2/pull/615) - Fix support for requests with blocks, see `Faraday::Connection#run_request` (@pboling)
14
+
15
+ ## [2.0.2] - 2022-06-24
16
+ ### Fixed
17
+ - [#604](https://github.com/oauth-xx/oauth2/pull/604) - Wrap `Faraday::TimeoutError` in `OAuth2::TimeoutError` (@stanhu)
18
+ - [#606](https://github.com/oauth-xx/oauth2/pull/606) - Ruby 2.7 deprecation warning fix: Move `access_token_class` parameter into `Client` constructor (@stanhu)
19
+ - [#607](https://github.com/oauth-xx/oauth2/pull/607) - CHANGELOG correction, reference to `OAuth2::ConnectionError` (@zavan)
20
+
21
+ ## [2.0.1] - 2022-06-22
22
+ ### Added
23
+ - Documentation improvements (@pboling)
24
+ - Increased test coverage to 99% (@pboling)
25
+
26
+ ## [2.0.0] - 2022-06-21
8
27
  ### Added
9
28
  - [#158](https://github.com/oauth-xx/oauth2/pull/158), [#344](https://github.com/oauth-xx/oauth2/pull/344) - Optionally pass raw response to parsers (@niels)
10
29
  - [#190](https://github.com/oauth-xx/oauth2/pull/190), [#332](https://github.com/oauth-xx/oauth2/pull/332), [#334](https://github.com/oauth-xx/oauth2/pull/334), [#335](https://github.com/oauth-xx/oauth2/pull/335), [#360](https://github.com/oauth-xx/oauth2/pull/360), [#426](https://github.com/oauth-xx/oauth2/pull/426), [#427](https://github.com/oauth-xx/oauth2/pull/427), [#461](https://github.com/oauth-xx/oauth2/pull/461) - Documentation (@josephpage, @pboling, @meganemura, @joshRpowell, @elliotcm)
@@ -24,7 +43,7 @@ and this project adheres to [Semantic Versioning v2](https://semver.org/spec/v2.
24
43
  - [#413](https://github.com/oauth-xx/oauth2/pull/413) - _Documentation_: License scan and report (@meganemura)
25
44
  - [#442](https://github.com/oauth-xx/oauth2/pull/442) - Option: `OAuth2::Client#initialize` - `:logger` (`::Logger.new($stdout)`) logger to use when OAUTH_DEBUG is enabled (for parity with `1-4-stable` branch) (@rthbound)
26
45
  - [#494](https://github.com/oauth-xx/oauth2/pull/494) - Support [OIDC 1.0 Private Key JWT](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication); based on the OAuth JWT assertion specification [(RFC 7523)](https://tools.ietf.org/html/rfc7523) (@SteveyblamWork)
27
- - [#549](https://github.com/oauth-xx/oauth2/pull/549) - Wrap `Faraday::ConnectionFailed` in `OAuth2::ConnectionFailed` (@nikkypx)
46
+ - [#549](https://github.com/oauth-xx/oauth2/pull/549) - Wrap `Faraday::ConnectionFailed` in `OAuth2::ConnectionError` (@nikkypx)
28
47
  - [#550](https://github.com/oauth-xx/oauth2/pull/550) - Raise error if location header not present when redirecting (@stanhu)
29
48
  - [#552](https://github.com/oauth-xx/oauth2/pull/552) - Add missing `version.rb` require (@ahorek)
30
49
  - [#553](https://github.com/oauth-xx/oauth2/pull/553) - Support `application/problem+json` format (@janz93)
@@ -210,7 +229,7 @@ and this project adheres to [Semantic Versioning v2](https://semver.org/spec/v2.
210
229
 
211
230
  ## [0.0.4] + [0.0.3] + [0.0.2] + [0.0.1] - 2010-04-22
212
231
 
213
- [Unreleased]: https://github.com/oauth-xx/oauth2/compare/v1.4.9...HEAD
232
+ [Unreleased]: https://github.com/oauth-xx/oauth2/compare/v2.0.3...HEAD
214
233
  [0.0.1]: https://github.com/oauth-xx/oauth2/compare/311d9f4...v0.0.1
215
234
  [0.0.2]: https://github.com/oauth-xx/oauth2/compare/v0.0.1...v0.0.2
216
235
  [0.0.3]: https://github.com/oauth-xx/oauth2/compare/v0.0.2...v0.0.3
@@ -246,4 +265,8 @@ and this project adheres to [Semantic Versioning v2](https://semver.org/spec/v2.
246
265
  [1.4.7]: https://github.com/oauth-xx/oauth2/compare/v1.4.6...v1.4.7
247
266
  [1.4.8]: https://github.com/oauth-xx/oauth2/compare/v1.4.7...v1.4.8
248
267
  [1.4.9]: https://github.com/oauth-xx/oauth2/compare/v1.4.8...v1.4.9
268
+ [2.0.0]: https://github.com/oauth-xx/oauth2/compare/v1.4.9...v2.0.0
269
+ [2.0.1]: https://github.com/oauth-xx/oauth2/compare/v2.0.0...v2.0.1
270
+ [2.0.2]: https://github.com/oauth-xx/oauth2/compare/v2.0.1...v2.0.2
271
+ [2.0.3]: https://github.com/oauth-xx/oauth2/compare/v2.0.2...v2.0.3
249
272
  [gemfiles/readme]: gemfiles/README.md
data/CONTRIBUTING.md CHANGED
@@ -1,4 +1,12 @@
1
- ## Submitting a Pull Request
1
+ ## Contributing
2
+
3
+ Bug reports and pull requests are welcome on GitHub at [https://github.com/oauth-xx/oauth2][source]
4
+ . This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to
5
+ the [code of conduct][conduct].
6
+
7
+ To submit a patch, please fork the project and create a patch with tests. Once you're happy with it send a pull request!
8
+
9
+ ## Detailed instructions on Submitting a Pull Request
2
10
  1. [Fork the repository.][fork]
3
11
  2. [Create a topic branch.][branch]
4
12
  3. Add specs for your unimplemented feature or bug fix.
@@ -16,3 +24,21 @@
16
24
  [fork]: http://help.github.com/fork-a-repo/
17
25
  [branch]: http://learn.github.com/p/branching.html
18
26
  [pr]: http://help.github.com/send-pull-requests/
27
+
28
+ ## Contributors
29
+
30
+ [![Contributors](https://contrib.rocks/image?repo=oauth-xx/oauth2)][contributors]
31
+
32
+ Made with [contributors-img][contrib-rocks].
33
+
34
+ [comment]: <> (Following links are used by README, CONTRIBUTING)
35
+
36
+ [conduct]: https://github.com/oauth-xx/oauth2/blob/master/CODE_OF_CONDUCT.md
37
+
38
+ [contrib-rocks]: https://contrib.rocks
39
+
40
+ [contributors]: https://github.com/oauth-xx/oauth2/graphs/contributors
41
+
42
+ [comment]: <> (Following links are used by README, CONTRIBUTING, Homepage)
43
+
44
+ [source]: https://github.com/oauth-xx/oauth2/
data/README.md CHANGED
@@ -22,8 +22,6 @@ See the sibling `oauth` gem for OAuth 1.0 implementations in Ruby.
22
22
 
23
23
  [oauth2-spec]: https://oauth.net/2/
24
24
  [sibling-gem]: https://github.com/oauth-xx/oauth-ruby
25
- [next-milestone-pct]: https://github.com/oauth-xx/oauth2/milestone/1
26
- [next-milestone-pct-img]: https://img.shields.io/github/milestones/progress-percent/oauth-xx/oauth2/1
27
25
 
28
26
  ## Release Documentation
29
27
 
@@ -34,7 +32,10 @@ See the sibling `oauth` gem for OAuth 1.0 implementations in Ruby.
34
32
 
35
33
  | Version | Release Date | Readme |
36
34
  |---------|--------------|----------------------------------------------------------|
37
- | 2.0.0 | Soon | https://github.com/oauth-xx/oauth2/blob/master/README.md |
35
+ | 2.0.3 | 2022-06-28 | https://github.com/oauth-xx/oauth2/blob/v2.0.3/README.md |
36
+ | 2.0.2 | 2022-06-24 | https://github.com/oauth-xx/oauth2/blob/v2.0.2/README.md |
37
+ | 2.0.1 | 2022-06-22 | https://github.com/oauth-xx/oauth2/blob/v2.0.1/README.md |
38
+ | 2.0.0 | 2022-06-21 | https://github.com/oauth-xx/oauth2/blob/v2.0.0/README.md |
38
39
  </details>
39
40
 
40
41
  ### Older Releases
@@ -105,15 +106,15 @@ appended indicators:
105
106
  ♻️ - URL needs to be updated from SASS integration. Find / Replace is insufficient.
106
107
  -->
107
108
 
108
- | | Project | bundle add oauth2 |
109
- |:----|-----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
110
- | 1️⃣ | name, license, docs | [![RubyGems.org][⛳️name-img]][⛳️gem] [![License: MIT][🖇src-license-img]][🖇src-license] [![FOSSA][🏘fossa-img]][🏘fossa] [![RubyDoc.info][🚎yard-img]][🚎yard] [![InchCI][🖐inch-ci-img]][🚎yard] |
111
- | 2️⃣ | version & activity | [![Gem Version][⛳️version-img]][⛳️gem] [![Total Downloads][🖇DL-total-img]][⛳️gem] [![Download Rank][🏘DL-rank-img]][⛳️gem] [![Source Code][🚎src-home-img]][🚎src-home] [![Open PRs][🖐prs-o-img]][🖐prs-o] [![Closed PRs][🧮prs-c-img]][🧮prs-c] [![Next Version][📗next-img]][📗next] |
112
- | 3️⃣ | maintanence & linting | [![Maintainability][⛳cclim-maint-img♻️]][⛳cclim-maint] [![Helpers][🖇triage-help-img]][🖇triage-help] [![Depfu][🏘depfu-img♻️]][🏘depfu♻️] [![Contributors][🚎contributors-img]][🚎contributors] [![Style][🖐style-wf-img]][🖐style-wf] [![Kloc Roll][🧮kloc-img]][🧮kloc] |
113
- | 4️⃣ | testing | [![Open Issues][⛳iss-o-img]][⛳iss-o] [![Closed Issues][🖇iss-c-img]][🖇iss-c] [![Supported][🏘sup-wf-img]][🏘sup-wf] [![Heads][🚎heads-wf-img]][🚎heads-wf] [![Unofficial Support][🖐uns-wf-img]][🖐uns-wf] [![MacOS][🧮mac-wf-img]][🧮mac-wf] [![Windows][📗win-wf-img]][📗win-wf] |
114
- | 5️⃣ | coverage & security | [![CodeClimate][⛳cclim-cov-img♻️]][⛳cclim-cov] [![CodeCov][🖇codecov-img♻️]][🖇codecov] [![Coveralls][🏘coveralls-img]][🏘coveralls] [![Security Policy][🚎sec-pol-img]][🚎sec-pol] [![CodeQL][🖐codeQL-img]][🖐codeQL] [![Code Coverage][🧮cov-wf-img]][🧮cov-wf] |
115
- | 6️⃣ | resources | [![Discussion][⛳gh-discussions-img]][⛳gh-discussions] [![Get help on Codementor][🖇codementor-img]][🖇codementor] [![Chat][🏘chat-img]][🏘chat] [![Blog][🚎blog-img]][🚎blog] [![Blog][🖐wiki-img]][🖐wiki] |
116
- | 7️⃣ | spread 💖 | [![Liberapay Patrons][⛳liberapay-img]][⛳liberapay] [![Sponsor Me][🖇sponsor-img]][🖇sponsor] [![Tweet @ Peter][🏘tweet-img]][🏘tweet] [🌏][aboutme] [👼][angelme] [💻][coderme] [🌹][politicme] |
109
+ | | Project | bundle add oauth2 |
110
+ |:----|-----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
111
+ | 1️⃣ | name, license, docs | [![RubyGems.org][⛳️name-img]][⛳️gem] [![License: MIT][🖇src-license-img]][🖇src-license] [![FOSSA][🏘fossa-img]][🏘fossa] [![RubyDoc.info][🚎yard-img]][🚎yard] [![InchCI][🖐inch-ci-img]][🚎yard] |
112
+ | 2️⃣ | version & activity | [![Gem Version][⛳️version-img]][⛳️gem] [![Total Downloads][🖇DL-total-img]][⛳️gem] [![Download Rank][🏘DL-rank-img]][⛳️gem] [![Source Code][🚎src-home-img]][🚎src-home] [![Open PRs][🖐prs-o-img]][🖐prs-o] [![Closed PRs][🧮prs-c-img]][🧮prs-c] [![Next Version][📗next-img♻️]][📗next♻️] |
113
+ | 3️⃣ | maintanence & linting | [![Maintainability][⛳cclim-maint-img♻️]][⛳cclim-maint] [![Helpers][🖇triage-help-img]][🖇triage-help] [![Depfu][🏘depfu-img♻️]][🏘depfu♻️] [![Contributors][🚎contributors-img]][🚎contributors] [![Style][🖐style-wf-img]][🖐style-wf] [![Kloc Roll][🧮kloc-img]][🧮kloc] |
114
+ | 4️⃣ | testing | [![Open Issues][⛳iss-o-img]][⛳iss-o] [![Closed Issues][🖇iss-c-img]][🖇iss-c] [![Supported][🏘sup-wf-img]][🏘sup-wf] [![Heads][🚎heads-wf-img]][🚎heads-wf] [![Unofficial Support][🖐uns-wf-img]][🖐uns-wf] [![MacOS][🧮mac-wf-img]][🧮mac-wf] [![Windows][📗win-wf-img]][📗win-wf] |
115
+ | 5️⃣ | coverage & security | [![CodeClimate][⛳cclim-cov-img♻️]][⛳cclim-cov] [![CodeCov][🖇codecov-img♻️]][🖇codecov] [![Coveralls][🏘coveralls-img]][🏘coveralls] [![Security Policy][🚎sec-pol-img]][🚎sec-pol] [![CodeQL][🖐codeQL-img]][🖐codeQL] [![Code Coverage][🧮cov-wf-img]][🧮cov-wf] |
116
+ | 6️⃣ | resources | [![Discussion][⛳gh-discussions-img]][⛳gh-discussions] [![Get help on Codementor][🖇codementor-img]][🖇codementor] [![Chat][🏘chat-img]][🏘chat] [![Blog][🚎blog-img]][🚎blog] [![Blog][🖐wiki-img]][🖐wiki] |
117
+ | 7️⃣ | spread 💖 | [![Liberapay Patrons][⛳liberapay-img]][⛳liberapay] [![Sponsor Me][🖇sponsor-img]][🖇sponsor] [![Tweet @ Peter][🏘tweet-img]][🏘tweet] [🌏][aboutme] [👼][angelme] [💻][coderme] |
117
118
 
118
119
  <!--
119
120
  The link tokens in the following sections should be kept ordered by the row and badge numbering scheme
@@ -140,8 +141,8 @@ The link tokens in the following sections should be kept ordered by the row and
140
141
  [🖐prs-o-img]: https://img.shields.io/github/issues-pr/oauth-xx/oauth2
141
142
  [🧮prs-c]: https://github.com/oauth-xx/oauth2/pulls?q=is%3Apr+is%3Aclosed
142
143
  [🧮prs-c-img]: https://img.shields.io/github/issues-pr-closed/oauth-xx/oauth2
143
- [📗next]: https://github.com/oauth-xx/oauth2/milestone/1
144
- [📗next-img]: https://img.shields.io/github/milestones/progress/oauth-xx/oauth2/1?label=Next%20Version
144
+ [📗next♻️]: https://github.com/oauth-xx/oauth2/milestone/15
145
+ [📗next-img♻️]: https://img.shields.io/github/milestones/progress/oauth-xx/oauth2/15?label=Next%20Version
145
146
 
146
147
  <!-- 3️⃣ maintanence & linting -->
147
148
  [⛳cclim-maint]: https://codeclimate.com/github/oauth-xx/oauth2/maintainability
@@ -213,7 +214,6 @@ The link tokens in the following sections should be kept ordered by the row and
213
214
  [aboutme]: https://about.me/peter.boling
214
215
  [angelme]: https://angel.co/peter-boling
215
216
  [coderme]:http://coderwall.com/pboling
216
- [politicme]: https://nationalprogressiveparty.org
217
217
 
218
218
  ## Installation
219
219
 
@@ -238,7 +238,7 @@ Tidelift will coordinate the fix and disclosure.
238
238
 
239
239
  For more see [SECURITY.md][🚎sec-pol].
240
240
 
241
- ## What is new for v2.0 (unreleased, `master` branch)?
241
+ ## What is new for v2.0?
242
242
 
243
243
  - Officially support Ruby versions >= 2.7
244
244
  - Unofficially support Ruby versions >= 2.5
@@ -253,7 +253,7 @@ For more see [SECURITY.md][🚎sec-pol].
253
253
  - `:access_token_class` (`AccessToken`); user specified class to use for all calls to `get_token`
254
254
  - Adds new option to `OAuth2::AccessToken#initialize`:
255
255
  - `:expires_latency` (`nil`); number of seconds by which AccessToken validity will be reduced to offset latency
256
- - [... A lot more](https://github.com/oauth-xx/oauth2/blob/master/CHANGELOG.md#unreleased)
256
+ - [... A lot more](https://github.com/oauth-xx/oauth2/blob/master/CHANGELOG.md#2.0.0)
257
257
 
258
258
  ## Compatibility
259
259
 
@@ -291,7 +291,7 @@ of a major release, support for that Ruby version may be dropped.
291
291
 
292
292
  | | Ruby OAuth 2 Version | Maintenance Branch | Supported Officially | Supported Unofficially | Supported Incidentally |
293
293
  |:----|----------------------|--------------------|-------------------------|------------------------|------------------------|
294
- | 1️⃣ | 2.0.x (unreleased) | `master` | 2.7, 3.0, 3.1 | 2.5, 2.6 | 2.2, 2.3, 2.4 |
294
+ | 1️⃣ | 2.0.x | `master` | 2.7, 3.0, 3.1 | 2.5, 2.6 | 2.2, 2.3, 2.4 |
295
295
  | 2️⃣ | 1.4.x | `1-4-stable` | 2.5, 2.6, 2.7, 3.0, 3.1 | 2.1, 2.2, 2.3, 2.4 | 1.9, 2.0 |
296
296
  | 3️⃣ | older | N/A | Best of luck to you! | Please upgrade! | |
297
297
 
@@ -309,8 +309,8 @@ client = OAuth2::Client.new('client_id', 'client_secret', site: 'https://example
309
309
  client.auth_code.authorize_url(redirect_uri: 'http://localhost:8080/oauth2/callback')
310
310
  # => "https://example.org/oauth/authorize?client_id=client_id&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth2%2Fcallback&response_type=code"
311
311
 
312
- token = client.auth_code.get_token('authorization_code_value', redirect_uri: 'http://localhost:8080/oauth2/callback', headers: {'Authorization' => 'Basic some_password'})
313
- response = token.get('/api/resource', params: {'query_foo' => 'bar'})
312
+ access = client.auth_code.get_token('authorization_code_value', redirect_uri: 'http://localhost:8080/oauth2/callback', headers: {'Authorization' => 'Basic some_password'})
313
+ response = access.get('/api/resource', params: {'query_foo' => 'bar'})
314
314
  response.class.name
315
315
  # => OAuth2::Response
316
316
  ```
@@ -342,6 +342,31 @@ client.class.name
342
342
  # => OAuth2::Client
343
343
  ```
344
344
 
345
+ ### snake_case and indifferent access in Response#parsed
346
+
347
+ ```ruby
348
+ response = access.get('/api/resource', params: {'query_foo' => 'bar'})
349
+ # Even if the actual response is CamelCase. it will be made available as snaky:
350
+ JSON.parse(response.body) # => {"accessToken"=>"aaaaaaaa", "additionalData"=>"additional"}
351
+ response.parsed # => {"access_token"=>"aaaaaaaa", "additional_data"=>"additional"}
352
+ response.parsed.access_token # => "aaaaaaaa"
353
+ response.parsed[:access_token] # => "aaaaaaaa"
354
+ response.parsed.additional_data # => "additional"
355
+ response.parsed[:additional_data] # => "additional"
356
+ response.parsed.class.name # => OAuth2::SnakyHash (subclass of Hashie::Mash::Rash, from `rash_alt` gem)
357
+ ```
358
+
359
+ #### What if I hate snakes and/or indifference?
360
+
361
+ ```ruby
362
+ response = access.get('/api/resource', params: {'query_foo' => 'bar'}, snaky: false)
363
+ JSON.parse(response.body) # => {"accessToken"=>"aaaaaaaa", "additionalData"=>"additional"}
364
+ response.parsed # => {"accessToken"=>"aaaaaaaa", "additionalData"=>"additional"}
365
+ response.parsed['accessToken'] # => "aaaaaaaa"
366
+ response.parsed['additionalData'] # => "additional"
367
+ response.parsed.class.name # => Hash (just, regular old Hash)
368
+ ```
369
+
345
370
  <details>
346
371
  <summary>Debugging</summary>
347
372
 
@@ -372,7 +397,7 @@ The `AccessToken` methods `#get`, `#post`, `#put` and `#delete` and the generic
372
397
  will return an instance of the #OAuth2::Response class.
373
398
 
374
399
  This instance contains a `#parsed` method that will parse the response body and
375
- return a Hash if the `Content-Type` is `application/x-www-form-urlencoded` or if
400
+ return a Hash-like [`OAuth2::SnakyHash`](https://github.com/oauth-xx/oauth2/blob/master/lib/oauth2/snaky_hash.rb) if the `Content-Type` is `application/x-www-form-urlencoded` or if
376
401
  the body is a JSON object. It will return an Array if the body is a JSON
377
402
  array. Otherwise, it will return the original body string.
378
403
 
@@ -402,28 +427,42 @@ Response instance will contain the `OAuth2::Error` instance.
402
427
 
403
428
  Currently the Authorization Code, Implicit, Resource Owner Password Credentials, Client Credentials, and Assertion
404
429
  authentication grant types have helper strategy classes that simplify client
405
- use. They are available via the `#auth_code`, `#implicit`, `#password`, `#client_credentials`, and `#assertion` methods respectively.
430
+ use. They are available via the [`#auth_code`](https://github.com/oauth-xx/oauth2/blob/master/lib/oauth2/strategy/auth_code.rb), [`#implicit`](https://github.com/oauth-xx/oauth2/blob/master/lib/oauth2/strategy/implicit.rb), [`#password`](https://github.com/oauth-xx/oauth2/blob/master/lib/oauth2/strategy/password.rb), [`#client_credentials`](https://github.com/oauth-xx/oauth2/blob/master/lib/oauth2/strategy/client_credentials.rb), and [`#assertion`](https://github.com/oauth-xx/oauth2/blob/master/lib/oauth2/strategy/assertion.rb) methods respectively.
406
431
 
432
+ These aren't full examples, but demonstrative of the differences between usage for each strategy.
407
433
  ```ruby
408
434
  auth_url = client.auth_code.authorize_url(redirect_uri: 'http://localhost:8080/oauth/callback')
409
- token = client.auth_code.get_token('code_value', redirect_uri: 'http://localhost:8080/oauth/callback')
435
+ access = client.auth_code.get_token('code_value', redirect_uri: 'http://localhost:8080/oauth/callback')
410
436
 
411
437
  auth_url = client.implicit.authorize_url(redirect_uri: 'http://localhost:8080/oauth/callback')
412
438
  # get the token params in the callback and
413
- token = OAuth2::AccessToken.from_kvform(client, query_string)
414
-
415
- token = client.password.get_token('username', 'password')
416
-
417
- token = client.client_credentials.get_token
418
-
419
- token = client.assertion.get_token(assertion_params)
439
+ access = OAuth2::AccessToken.from_kvform(client, query_string)
440
+
441
+ access = client.password.get_token('username', 'password')
442
+
443
+ access = client.client_credentials.get_token
444
+
445
+ # Client Assertion Strategy
446
+ # see: https://tools.ietf.org/html/rfc7523
447
+ claimset = {
448
+ iss: 'http://localhost:3001',
449
+ aud: 'http://localhost:8080/oauth2/token',
450
+ sub: 'me@example.com',
451
+ exp: Time.now.utc.to_i + 3600,
452
+ }
453
+ assertion_params = [claimset, 'HS256', 'secret_key']
454
+ access = client.assertion.get_token(assertion_params)
455
+
456
+ # The `access` (i.e. access token) is then used like so:
457
+ access.token # actual access_token string, if you need it somewhere
458
+ access.get('/api/stuff') # making api calls with access token
420
459
  ```
421
460
 
422
461
  If you want to specify additional headers to be sent out with the
423
462
  request, add a 'headers' hash under 'params':
424
463
 
425
464
  ```ruby
426
- token = client.auth_code.get_token('code_value', redirect_uri: 'http://localhost:8080/oauth/callback', headers: {'Some' => 'Header'})
465
+ access = client.auth_code.get_token('code_value', redirect_uri: 'http://localhost:8080/oauth/callback', headers: {'Some' => 'Header'})
427
466
  ```
428
467
 
429
468
  You can always use the `#request` method on the `OAuth2::Client` instance to make
@@ -472,7 +511,15 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
472
511
 
473
512
  ## Contributing
474
513
 
475
- Bug reports and pull requests are welcome on GitHub at https://github.com/oauth-xx/oauth2. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](http://contributor-covenant.org) code of conduct.
514
+ See [CONTRIBUTING.md][contributing]
515
+
516
+ [contributing]: https://github.com/oauth-xx/oauth2/blob/main/CONTRIBUTING.md
517
+
518
+ ## Contributors
519
+
520
+ [![Contributors](https://contrib.rocks/image?repo=oauth-xx/oauth2)]("https://github.com/oauth-xx/oauth2/graphs/contributors")
521
+
522
+ Made with [contributors-img](https://contrib.rocks).
476
523
 
477
524
  ## Code of Conduct
478
525
 
data/SECURITY.md CHANGED
@@ -2,13 +2,19 @@
2
2
 
3
3
  ## Supported Versions
4
4
 
5
- | Version | Supported |
6
- |--------------|-----------|
7
- | 2.0.<latest> | ✅ |
8
- | 1.4.<latest> | ✅ |
9
- | older | ⛔️ |
5
+ | Version | Supported |
6
+ |----------|---------------------------|
7
+ | 2.latest | ✅ |
8
+ | 1.latest | ✅ (security updates only) |
9
+ | older | ⛔️ |
10
10
 
11
11
  ## Reporting a Vulnerability
12
12
 
13
13
  To report a security vulnerability, please use the [Tidelift security contact](https://tidelift.com/security).
14
14
  Tidelift will coordinate the fix and disclosure.
15
+
16
+ ## OAuth2 for Enterprise
17
+
18
+ Available as part of the Tidelift Subscription.
19
+
20
+ The maintainers of oauth2 and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use. [Learn more.](https://tidelift.com/subscription/pkg/rubygems-oauth2?utm_source=rubygems-oauth2&utm_medium=referral&utm_campaign=enterprise&utm_term=repo)
data/lib/oauth2/access_token.rb CHANGED
@@ -88,12 +88,12 @@ module OAuth2
88
88
  #
89
89
  # @return [AccessToken] a new AccessToken
90
90
  # @note options should be carried over to the new AccessToken
91
- def refresh(params = {}, access_token_opts = {}, access_token_class: self.class)
91
+ def refresh(params = {}, access_token_opts = {})
92
92
  raise('A refresh_token is not available') unless refresh_token
93
93
 
94
94
  params[:grant_type] = 'refresh_token'
95
95
  params[:refresh_token] = refresh_token
96
- new_token = @client.get_token(params, access_token_opts, access_token_class: access_token_class)
96
+ new_token = @client.get_token(params, access_token_opts)
97
97
  new_token.options = options
98
98
  new_token.refresh_token = refresh_token unless new_token.refresh_token
99
99
  new_token
@@ -114,7 +114,7 @@ module OAuth2
114
114
  # @param [Symbol] verb the HTTP request method
115
115
  # @param [String] path the HTTP URL path of the request
116
116
  # @param [Hash] opts the options to make the request with
117
- # @see Client#request
117
+ # @see Client#request
118
118
  def request(verb, path, opts = {}, &block)
119
119
  configure_authentication!(opts)
120
120
  @client.request(verb, path, opts, &block)
data/lib/oauth2/client.rb CHANGED
@@ -5,6 +5,8 @@ require 'logger'
5
5
 
6
6
  module OAuth2
7
7
  ConnectionError = Class.new(Faraday::ConnectionFailed)
8
+ TimeoutError = Class.new(Faraday::TimeoutError)
9
+
8
10
  # The OAuth2::Client class
9
11
  class Client # rubocop:disable Metrics/ClassLength
10
12
  RESERVED_PARAM_KEYS = %w[headers parse].freeze
@@ -31,6 +33,7 @@ module OAuth2
31
33
  # @option options [Boolean] :raise_errors (true) whether or not to raise an OAuth2::Error on responses with 400+ status codes
32
34
  # @option options [Logger] :logger (::Logger.new($stdout)) which logger to use when OAUTH_DEBUG is enabled
33
35
  # @option options [Proc] :extract_access_token proc that takes the client and the response Hash and extracts the access token from the response (DEPRECATED)
36
+ # @option options [Class] :access_token_class [Class] class of access token for easier subclassing OAuth2::AccessToken, @version 2.0+
34
37
  # @yield [builder] The Faraday connection builder
35
38
  def initialize(client_id, client_secret, options = {}, &block)
36
39
  opts = options.dup
@@ -38,7 +41,7 @@ module OAuth2
38
41
  @secret = client_secret
39
42
  @site = opts.delete(:site)
40
43
  ssl = opts.delete(:ssl)
41
-
44
+ warn('OAuth2::Client#initialize argument `extract_access_token` will be removed in oauth2 v3. Refactor to use `access_token_class`.') if opts[:extract_access_token]
42
45
  @options = {
43
46
  authorize_url: 'oauth/authorize',
44
47
  token_url: 'oauth/token',
@@ -49,6 +52,7 @@ module OAuth2
49
52
  max_redirects: 5,
50
53
  raise_errors: true,
51
54
  logger: ::Logger.new($stdout),
55
+ access_token_class: AccessToken,
52
56
  }.merge(opts)
53
57
  @options[:connection_opts][:ssl] = ssl if ssl
54
58
  end
@@ -104,20 +108,10 @@ module OAuth2
104
108
  # @option opts [Boolean] :raise_errors whether or not to raise an OAuth2::Error on 400+ status
105
109
  # code response for this request. Will default to client option
106
110
  # @option opts [Symbol] :parse @see Response::initialize
107
- # @yield [req] The Faraday request
108
- def request(verb, url, opts = {})
109
- url = connection.build_url(url).to_s
110
-
111
- begin
112
- response = connection.run_request(verb, url, opts[:body], opts[:headers]) do |req|
113
- req.params.update(opts[:params]) if opts[:params]
114
- yield(req) if block_given?
115
- end
116
- rescue Faraday::ConnectionFailed => e
117
- raise ConnectionError, e
118
- end
119
-
120
- response = Response.new(response, parse: opts[:parse])
111
+ # @option opts [Symbol] :snaky @see Response::initialize
112
+ # @yield [req] @see Faraday::Connection#run_request
113
+ def request(verb, url, opts = {}, &block)
114
+ response = execute_request(verb, url, opts, &block)
121
115
 
122
116
  case response.status
123
117
  when 301, 302, 303, 307
@@ -153,12 +147,16 @@ module OAuth2
153
147
 
154
148
  # Initializes an AccessToken by making a request to the token endpoint
155
149
  #
156
- # @param params [Hash] a Hash of params for the token endpoint
150
+ # @param params [Hash] a Hash of params for the token endpoint, except:
151
+ # @option params [Symbol] :parse @see Response#initialize
152
+ # @option params [true, false] :snaky @see Response#initialize
157
153
  # @param access_token_opts [Hash] access token options, to pass to the AccessToken object
158
154
  # @param extract_access_token [Proc] proc that extracts the access token from the response (DEPRECATED)
159
- # @param access_token_class [Class] class of access token for easier subclassing OAuth2::AccessToken, @version 2.0+
155
+ # @yield [req] @see Faraday::Connection#run_request
160
156
  # @return [AccessToken] the initialized AccessToken
161
- def get_token(params, access_token_opts = {}, extract_access_token = options[:extract_access_token], access_token_class: AccessToken)
157
+ def get_token(params, access_token_opts = {}, extract_access_token = nil, &block)
158
+ warn('OAuth2::Client#get_token argument `extract_access_token` will be removed in oauth2 v3. Refactor to use `access_token_class` on #initialize.') if extract_access_token
159
+ extract_access_token ||= options[:extract_access_token]
162
160
  params = params.map do |key, value|
163
161
  if RESERVED_PARAM_KEYS.include?(key)
164
162
  [key.to_sym, value]
@@ -167,20 +165,25 @@ module OAuth2
167
165
  end
168
166
  end.to_h
169
167
 
168
+ request_opts = {
169
+ raise_errors: options[:raise_errors],
170
+ parse: params.delete(:parse),
171
+ snaky: params.delete(:snaky),
172
+ }
173
+
170
174
  params = authenticator.apply(params)
171
- opts = {raise_errors: options[:raise_errors], parse: params.delete(:parse)}
172
175
  headers = params.delete(:headers) || {}
173
176
  if options[:token_method] == :post
174
- opts[:body] = params
175
- opts[:headers] = {'Content-Type' => 'application/x-www-form-urlencoded'}
177
+ request_opts[:body] = params
178
+ request_opts[:headers] = {'Content-Type' => 'application/x-www-form-urlencoded'}
176
179
  else
177
- opts[:params] = params
178
- opts[:headers] = {}
180
+ request_opts[:params] = params
181
+ request_opts[:headers] = {}
179
182
  end
180
- opts[:headers].merge!(headers)
183
+ request_opts[:headers].merge!(headers)
181
184
  http_method = options[:token_method]
182
185
  http_method = :post if http_method == :post_with_query_string
183
- response = request(http_method, token_url, opts)
186
+ response = request(http_method, token_url, request_opts, &block)
184
187
 
185
188
  # In v1.4.x, the deprecated extract_access_token option retrieves the token from the response.
186
189
  # We preserve this behavior here, but a custom access_token_class that implements #from_hash
@@ -188,7 +191,7 @@ module OAuth2
188
191
  if extract_access_token
189
192
  parse_response_with_legacy_extract(response, access_token_opts, extract_access_token)
190
193
  else
191
- parse_response(response, access_token_opts, access_token_class)
194
+ parse_response(response, access_token_opts)
192
195
  end
193
196
  end
194
197
 
@@ -250,6 +253,23 @@ module OAuth2
250
253
 
251
254
  private
252
255
 
256
+ def execute_request(verb, url, opts = {})
257
+ url = connection.build_url(url).to_s
258
+
259
+ begin
260
+ response = connection.run_request(verb, url, opts[:body], opts[:headers]) do |req|
261
+ req.params.update(opts[:params]) if opts[:params]
262
+ yield(req) if block_given?
263
+ end
264
+ rescue Faraday::ConnectionFailed => e
265
+ raise ConnectionError, e
266
+ rescue Faraday::TimeoutError => e
267
+ raise TimeoutError, e
268
+ end
269
+
270
+ Response.new(response, parse: opts[:parse], snaky: opts[:snaky])
271
+ end
272
+
253
273
  # Returns the authenticator object
254
274
  #
255
275
  # @return [Authenticator] the initialized Authenticator
@@ -270,7 +290,8 @@ module OAuth2
270
290
  nil
271
291
  end
272
292
 
273
- def parse_response(response, access_token_opts, access_token_class)
293
+ def parse_response(response, access_token_opts)
294
+ access_token_class = options[:access_token_class]
274
295
  data = response.parsed
275
296
 
276
297
  unless data.is_a?(Hash) && access_token_class.contains_token?(data)
data/lib/oauth2/response.rb CHANGED
@@ -39,12 +39,17 @@ module OAuth2
39
39
  # Initializes a Response instance
40
40
  #
41
41
  # @param [Faraday::Response] response The Faraday response instance
42
- # @param [Hash] opts options in which to initialize the instance
43
- # @option opts [Symbol] :parse (:automatic) how to parse the response body. one of :query (for x-www-form-urlencoded),
42
+ # @param [Symbol] parse (:automatic) how to parse the response body. one of :query (for x-www-form-urlencoded),
44
43
  # :json, or :automatic (determined by Content-Type response header)
45
- def initialize(response, opts = {})
44
+ # @param [true, false] snaky (true) Convert @parsed to a snake-case,
45
+ # indifferent-access OAuth2::SnakyHash, which is a subclass of Hashie::Mash::Rash (from rash_alt gem)?
46
+ # @param [Hash] options all other options for initializing the instance
47
+ def initialize(response, parse: :automatic, snaky: true, **options)
46
48
  @response = response
47
- @options = {parse: :automatic}.merge(opts)
49
+ @options = {
50
+ parse: parse,
51
+ snaky: snaky,
52
+ }.merge(options)
48
53
  end
49
54
 
50
55
  # The HTTP response headers
@@ -81,7 +86,7 @@ module OAuth2
81
86
  end
82
87
  end
83
88
 
84
- @parsed = OAuth2::SnakyHash.new(@parsed) if @parsed.is_a?(Hash)
89
+ @parsed = OAuth2::SnakyHash.new(@parsed) if options[:snaky] && @parsed.is_a?(Hash)
85
90
 
86
91
  @parsed
87
92
  end
@@ -125,10 +130,14 @@ module OAuth2
125
130
  end
126
131
 
127
132
  OAuth2::Response.register_parser(:xml, ['text/xml', 'application/rss+xml', 'application/rdf+xml', 'application/atom+xml', 'application/xml']) do |body|
133
+ next body unless body.respond_to?(:to_str)
134
+
128
135
  MultiXml.parse(body)
129
136
  end
130
137
 
131
138
  OAuth2::Response.register_parser(:json, ['application/json', 'text/javascript', 'application/hal+json', 'application/vnd.collection+json', 'application/vnd.api+json', 'application/problem+json']) do |body|
139
+ next body unless body.respond_to?(:to_str)
140
+
132
141
  body = body.dup.force_encoding(::Encoding::ASCII_8BIT) if body.respond_to?(:force_encoding)
133
142
 
134
143
  ::JSON.parse(body)
data/lib/oauth2/strategy/assertion.rb CHANGED
@@ -15,7 +15,7 @@ module OAuth2
15
15
  #
16
16
  # claim_set = {
17
17
  # :iss => "http://localhost:3001",
18
- # :aud => "http://localhost:8080/oauth2/token"
18
+ # :aud => "http://localhost:8080/oauth2/token",
19
19
  # :sub => "me@example.com",
20
20
  # :exp => Time.now.utc.to_i + 3600,
21
21
  # }
data/lib/oauth2/version.rb CHANGED
@@ -2,6 +2,6 @@
2
2
 
3
3
  module OAuth2
4
4
  module Version
5
- VERSION = '2.0.0'.freeze
5
+ VERSION = '2.0.3'.freeze
6
6
  end
7
7
  end
metadata CHANGED
@@ -1,16 +1,16 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: oauth2
3
3
  version: !ruby/object:Gem::Version
4
- version: 2.0.0
4
+ version: 2.0.3
5
5
  platform: ruby
6
6
  authors:
7
7
  - Peter Boling
8
- - Michael Bleigh
9
8
  - Erik Michaels-Ober
9
+ - Michael Bleigh
10
10
  autorequire:
11
11
  bindir: exe
12
12
  cert_chain: []
13
- date: 2022-06-21 00:00:00.000000000 Z
13
+ date: 2022-06-28 00:00:00.000000000 Z
14
14
  dependencies:
15
15
  - !ruby/object:Gem::Dependency
16
16
  name: faraday
@@ -307,10 +307,10 @@ licenses:
307
307
  - MIT
308
308
  metadata:
309
309
  homepage_uri: https://github.com/oauth-xx/oauth2
310
- source_code_uri: https://github.com/oauth-xx/oauth2/tree/v2.0.0
311
- changelog_uri: https://github.com/oauth-xx/oauth2/blob/v2.0.0/CHANGELOG.md
310
+ source_code_uri: https://github.com/oauth-xx/oauth2/tree/v2.0.3
311
+ changelog_uri: https://github.com/oauth-xx/oauth2/blob/v2.0.3/CHANGELOG.md
312
312
  bug_tracker_uri: https://github.com/oauth-xx/oauth2/issues
313
- documentation_uri: https://www.rubydoc.info/gems/oauth2/2.0.0
313
+ documentation_uri: https://www.rubydoc.info/gems/oauth2/2.0.3
314
314
  wiki_uri: https://github.com/oauth-xx/oauth2/wiki
315
315
  rubygems_mfa_required: 'true'
316
316
  post_install_message: