oauth2 2.0.1 → 2.0.9

data/lib/oauth2/client.rb

@@ -5,9 +5,11 @@ require 'logger'
 
 module OAuth2
   ConnectionError = Class.new(Faraday::ConnectionFailed)
+  TimeoutError = Class.new(Faraday::TimeoutError)
+
   # The OAuth2::Client class
   class Client # rubocop:disable Metrics/ClassLength
-    RESERVED_PARAM_KEYS = %w[headers parse].freeze
+    RESERVED_PARAM_KEYS = %w[body headers params parse snaky].freeze
 
     attr_reader :id, :secret, :site
     attr_accessor :options
@@ -31,6 +33,7 @@ module OAuth2
     # @option options [Boolean] :raise_errors (true) whether or not to raise an OAuth2::Error on responses with 400+ status codes
     # @option options [Logger] :logger (::Logger.new($stdout)) which logger to use when OAUTH_DEBUG is enabled
     # @option options [Proc] :extract_access_token proc that takes the client and the response Hash and extracts the access token from the response (DEPRECATED)
+    # @option options [Class] :access_token_class [Class] class of access token for easier subclassing OAuth2::AccessToken, @version 2.0+
     # @yield [builder] The Faraday connection builder
     def initialize(client_id, client_secret, options = {}, &block)
       opts = options.dup
@@ -38,7 +41,7 @@ module OAuth2
       @secret = client_secret
       @site = opts.delete(:site)
       ssl = opts.delete(:ssl)
-
+      warn('OAuth2::Client#initialize argument `extract_access_token` will be removed in oauth2 v3. Refactor to use `access_token_class`.') if opts[:extract_access_token]
       @options = {
         authorize_url: 'oauth/authorize',
         token_url: 'oauth/token',
@@ -49,6 +52,7 @@ module OAuth2
         max_redirects: 5,
         raise_errors: true,
         logger: ::Logger.new($stdout),
+        access_token_class: AccessToken,
       }.merge(opts)
       @options[:connection_opts][:ssl] = ssl if ssl
     end
@@ -104,20 +108,10 @@ module OAuth2
     # @option opts [Boolean] :raise_errors whether or not to raise an OAuth2::Error on 400+ status
     #   code response for this request.  Will default to client option
     # @option opts [Symbol] :parse @see Response::initialize
-    # @yield [req] The Faraday request
-    def request(verb, url, opts = {})
-      url = connection.build_url(url).to_s
-
-      begin
-        response = connection.run_request(verb, url, opts[:body], opts[:headers]) do |req|
-          req.params.update(opts[:params]) if opts[:params]
-          yield(req) if block_given?
-        end
-      rescue Faraday::ConnectionFailed => e
-        raise ConnectionError, e
-      end
-
-      response = Response.new(response, parse: opts[:parse])
+    # @option opts [true, false] :snaky (true) @see Response::initialize
+    # @yield [req] @see Faraday::Connection#run_request
+    def request(verb, url, opts = {}, &block)
+      response = execute_request(verb, url, opts, &block)
 
       case response.status
       when 301, 302, 303, 307
@@ -153,45 +147,60 @@ module OAuth2
 
     # Initializes an AccessToken by making a request to the token endpoint
     #
-    # @param params [Hash] a Hash of params for the token endpoint
+    # @param params [Hash] a Hash of params for the token endpoint, except:
+    #   @option params [Symbol] :parse @see Response#initialize
+    #   @option params [true, false] :snaky (true) @see Response#initialize
     # @param access_token_opts [Hash] access token options, to pass to the AccessToken object
     # @param extract_access_token [Proc] proc that extracts the access token from the response (DEPRECATED)
-    # @param access_token_class [Class] class of access token for easier subclassing OAuth2::AccessToken, @version 2.0+
+    # @yield [req] @see Faraday::Connection#run_request
     # @return [AccessToken] the initialized AccessToken
-    def get_token(params, access_token_opts = {}, extract_access_token = options[:extract_access_token], access_token_class: AccessToken)
-      params = params.map do |key, value|
-        if RESERVED_PARAM_KEYS.include?(key)
-          [key.to_sym, value]
-        else
-          [key, value]
-        end
-      end.to_h
-
-      params = authenticator.apply(params)
-      opts = {raise_errors: options[:raise_errors], parse: params.delete(:parse)}
-      headers = params.delete(:headers) || {}
+    def get_token(params, access_token_opts = {}, extract_access_token = nil, &block)
+      warn('OAuth2::Client#get_token argument `extract_access_token` will be removed in oauth2 v3. Refactor to use `access_token_class` on #initialize.') if extract_access_token
+      extract_access_token ||= options[:extract_access_token]
+      parse, snaky, params, headers = parse_snaky_params_headers(params)
+
+      request_opts = {
+        raise_errors: options[:raise_errors],
+        parse: parse,
+        snaky: snaky,
+      }
       if options[:token_method] == :post
-        opts[:body] = params
-        opts[:headers] = {'Content-Type' => 'application/x-www-form-urlencoded'}
+
+        # NOTE: If proliferation of request types continues we should implement a parser solution for Request,
+        #       just like we have with Response.
+        request_opts[:body] = if headers['Content-Type'] == 'application/json'
+                                params.to_json
+                              else
+                                params
+                              end
+
+        request_opts[:headers] = {'Content-Type' => 'application/x-www-form-urlencoded'}
       else
-        opts[:params] = params
-        opts[:headers] = {}
+        request_opts[:params] = params
+        request_opts[:headers] = {}
       end
-      opts[:headers].merge!(headers)
-      http_method = options[:token_method]
-      http_method = :post if http_method == :post_with_query_string
-      response = request(http_method, token_url, opts)
+      request_opts[:headers].merge!(headers)
+      response = request(http_method, token_url, request_opts, &block)
 
       # In v1.4.x, the deprecated extract_access_token option retrieves the token from the response.
       # We preserve this behavior here, but a custom access_token_class that implements #from_hash
       # should be used instead.
       if extract_access_token
-        parse_response_with_legacy_extract(response, access_token_opts, extract_access_token)
+        parse_response_legacy(response, access_token_opts, extract_access_token)
       else
-        parse_response(response, access_token_opts, access_token_class)
+        parse_response(response, access_token_opts)
       end
     end
 
+    # The HTTP Method of the request
+    # @return [Symbol] HTTP verb, one of :get, :post, :put, :delete
+    def http_method
+      http_meth = options[:token_method].to_sym
+      return :post if http_meth == :post_with_query_string
+
+      http_meth
+    end
+
     # The Authorization Code strategy
     #
     # @see http://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-15#section-4.1
@@ -250,6 +259,42 @@ module OAuth2
 
   private
 
+    def parse_snaky_params_headers(params)
+      params = params.map do |key, value|
+        if RESERVED_PARAM_KEYS.include?(key)
+          [key.to_sym, value]
+        else
+          [key, value]
+        end
+      end.to_h
+      parse = params.key?(:parse) ? params.delete(:parse) : Response::DEFAULT_OPTIONS[:parse]
+      snaky = params.key?(:snaky) ? params.delete(:snaky) : Response::DEFAULT_OPTIONS[:snaky]
+      params = authenticator.apply(params)
+      # authenticator may add :headers, and we remove them here
+      headers = params.delete(:headers) || {}
+      [parse, snaky, params, headers]
+    end
+
+    def execute_request(verb, url, opts = {})
+      url = connection.build_url(url).to_s
+
+      begin
+        response = connection.run_request(verb, url, opts[:body], opts[:headers]) do |req|
+          req.params.update(opts[:params]) if opts[:params]
+          yield(req) if block_given?
+        end
+      rescue Faraday::ConnectionFailed => e
+        raise ConnectionError, e
+      rescue Faraday::TimeoutError => e
+        raise TimeoutError, e
+      end
+
+      parse = opts.key?(:parse) ? opts.delete(:parse) : Response::DEFAULT_OPTIONS[:parse]
+      snaky = opts.key?(:snaky) ? opts.delete(:snaky) : Response::DEFAULT_OPTIONS[:snaky]
+
+      Response.new(response, parse: parse, snaky: snaky)
+    end
+
     # Returns the authenticator object
     #
     # @return [Authenticator] the initialized Authenticator
@@ -257,8 +302,8 @@ module OAuth2
       Authenticator.new(id, secret, options[:auth_scheme])
     end
 
-    def parse_response_with_legacy_extract(response, access_token_opts, extract_access_token)
-      access_token = build_access_token_legacy_extract(response, access_token_opts, extract_access_token)
+    def parse_response_legacy(response, access_token_opts, extract_access_token)
+      access_token = build_access_token_legacy(response, access_token_opts, extract_access_token)
 
       return access_token if access_token
 
@@ -270,10 +315,11 @@ module OAuth2
       nil
     end
 
-    def parse_response(response, access_token_opts, access_token_class)
+    def parse_response(response, access_token_opts)
+      access_token_class = options[:access_token_class]
       data = response.parsed
 
-      unless data.is_a?(Hash) && access_token_class.contains_token?(data)
+      unless data.is_a?(Hash) && !data.empty?
         return unless options[:raise_errors]
 
         error = Error.new(response)
@@ -295,7 +341,7 @@ module OAuth2
     # Builds the access token from the response of the HTTP call with legacy extract_access_token
     #
     # @return [AccessToken] the initialized AccessToken
-    def build_access_token_legacy_extract(response, access_token_opts, extract_access_token)
+    def build_access_token_legacy(response, access_token_opts, extract_access_token)
       extract_access_token.call(self, response.parsed.merge(access_token_opts))
     rescue StandardError
       nil

data/lib/oauth2/error.rb

@@ -2,21 +2,29 @@
 
 module OAuth2
   class Error < StandardError
-    attr_reader :response, :code, :description
+    attr_reader :response, :body, :code, :description
 
     # standard error codes include:
     # 'invalid_request', 'invalid_client', 'invalid_token', 'invalid_grant', 'unsupported_grant_type', 'invalid_scope'
+    # response might be a Response object, or the response.parsed hash
     def initialize(response)
       @response = response
-      message_opts = {}
-
-      if response.parsed.is_a?(Hash)
-        @code = response.parsed['error']
-        @description = response.parsed['error_description']
-        message_opts = parse_error_description(@code, @description)
+      if response.respond_to?(:parsed)
+        if response.parsed.is_a?(Hash)
+          @code = response.parsed['error']
+          @description = response.parsed['error_description']
+        end
+      elsif response.is_a?(Hash)
+        @code = response['error']
+        @description = response['error_description']
       end
-
-      super(error_message(response.body, message_opts))
+      @body = if response.respond_to?(:body)
+                response.body
+              else
+                @response
+              end
+      message_opts = parse_error_description(@code, @description)
+      super(error_message(@body, message_opts))
     end
 
   private

data/lib/oauth2/response.rb

@@ -7,6 +7,10 @@ require 'rack'
 module OAuth2
   # OAuth2::Response class
   class Response
+    DEFAULT_OPTIONS = {
+      parse: :automatic,
+      snaky: true,
+    }.freeze
     attr_reader :response
     attr_accessor :options
 
@@ -39,12 +43,17 @@ module OAuth2
     # Initializes a Response instance
     #
     # @param [Faraday::Response] response The Faraday response instance
-    # @param [Hash] opts options in which to initialize the instance
-    # @option opts [Symbol] :parse (:automatic) how to parse the response body.  one of :query (for x-www-form-urlencoded),
+    # @param [Symbol] parse (:automatic) how to parse the response body.  one of :query (for x-www-form-urlencoded),
     #   :json, or :automatic (determined by Content-Type response header)
-    def initialize(response, opts = {})
+    # @param [true, false] snaky (true) Convert @parsed to a snake-case,
+    #   indifferent-access SnakyHash::StringKeyed, which is a subclass of Hashie::Mash (from hashie gem)?
+    # @param [Hash] options all other options for initializing the instance
+    def initialize(response, parse: :automatic, snaky: true, **options)
       @response = response
-      @options = {parse: :automatic}.merge(opts)
+      @options = {
+        parse: parse,
+        snaky: snaky,
+      }.merge(options)
     end
 
     # The HTTP response headers
@@ -81,7 +90,7 @@ module OAuth2
           end
         end
 
-      @parsed = OAuth2::SnakyHash.new(@parsed) if @parsed.is_a?(Hash)
+      @parsed = SnakyHash::StringKeyed.new(@parsed) if options[:snaky] && @parsed.is_a?(Hash)
 
       @parsed
     end
@@ -125,10 +134,14 @@ module OAuth2
 end
 
 OAuth2::Response.register_parser(:xml, ['text/xml', 'application/rss+xml', 'application/rdf+xml', 'application/atom+xml', 'application/xml']) do |body|
+  next body unless body.respond_to?(:to_str)
+
   MultiXml.parse(body)
 end
 
 OAuth2::Response.register_parser(:json, ['application/json', 'text/javascript', 'application/hal+json', 'application/vnd.collection+json', 'application/vnd.api+json', 'application/problem+json']) do |body|
+  next body unless body.respond_to?(:to_str)
+
   body = body.dup.force_encoding(::Encoding::ASCII_8BIT) if body.respond_to?(:force_encoding)
 
   ::JSON.parse(body)

data/lib/oauth2/strategy/assertion.rb

@@ -80,7 +80,7 @@ module OAuth2
         assertion = build_assertion(claims, encoding_opts)
         params = build_request(assertion, request_opts)
 
-        @client.get_token(params, response_opts.merge('refresh_token' => nil))
+        @client.get_token(params, response_opts)
       end
 
     private

data/lib/oauth2/strategy/auth_code.rb

@@ -25,7 +25,7 @@ module OAuth2
       #
       # @param [String] code The Authorization Code value
       # @param [Hash] params additional params
-      # @param [Hash] opts options
+      # @param [Hash] opts access_token_opts, @see Client#get_token
       # @note that you must also provide a :redirect_uri with most OAuth 2.0 providers
       def get_token(code, params = {}, opts = {})
         params = {'grant_type' => 'authorization_code', 'code' => code}.merge(@client.redirection_params).merge(params)

data/lib/oauth2/strategy/client_credentials.rb

@@ -19,7 +19,7 @@ module OAuth2
       # @param [Hash] opts options
       def get_token(params = {}, opts = {})
         params = params.merge('grant_type' => 'client_credentials')
-        @client.get_token(params, opts.merge('refresh_token' => nil))
+        @client.get_token(params, opts)
       end
     end
   end

data/lib/oauth2/version.rb

@@ -2,6 +2,6 @@
 
 module OAuth2
   module Version
-    VERSION = '2.0.1'.freeze
+    VERSION = '2.0.9'.freeze
   end
 end

data/lib/oauth2.rb

@@ -5,13 +5,12 @@ require 'cgi'
 require 'time'
 
 # third party gems
-require 'rash'
+require 'snaky_hash'
 require 'version_gem'
 
 # includes gem files
 require 'oauth2/version'
 require 'oauth2/error'
-require 'oauth2/snaky_hash'
 require 'oauth2/authenticator'
 require 'oauth2/client'
 require 'oauth2/strategy/base'
@@ -25,6 +24,15 @@ require 'oauth2/response'
 
 # The namespace of this library
 module OAuth2
+  DEFAULT_CONFIG = SnakyHash::SymbolKeyed.new(silence_extra_tokens_warning: false)
+  @config = DEFAULT_CONFIG.dup
+  class << self
+    attr_accessor :config
+  end
+  def configure
+    yield @config
+  end
+  module_function :configure
 end
 
 OAuth2::Version.class_eval do

metadata

@@ -1,16 +1,16 @@
 --- !ruby/object:Gem::Specification
 name: oauth2
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 2.0.9
 platform: ruby
 authors:
 - Peter Boling
 - Erik Michaels-Ober
 - Michael Bleigh
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2022-06-22 00:00:00.000000000 Z
+date: 2022-09-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -75,7 +75,7 @@ dependencies:
         version: '1.2'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '3'
+        version: '4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -85,41 +85,35 @@ dependencies:
         version: '1.2'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '3'
+        version: '4'
 - !ruby/object:Gem::Dependency
-  name: rash_alt
+  name: snaky_hash
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0.4'
-    - - "<"
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1'
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0.4'
-    - - "<"
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1'
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: version_gem
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.1'
 - !ruby/object:Gem::Dependency
   name: addressable
   requirement: !ruby/object:Gem::Requirement
@@ -294,7 +288,6 @@ files:
 - lib/oauth2/client.rb
 - lib/oauth2/error.rb
 - lib/oauth2/response.rb
-- lib/oauth2/snaky_hash.rb
 - lib/oauth2/strategy/assertion.rb
 - lib/oauth2/strategy/auth_code.rb
 - lib/oauth2/strategy/base.rb
@@ -302,18 +295,35 @@ files:
 - lib/oauth2/strategy/implicit.rb
 - lib/oauth2/strategy/password.rb
 - lib/oauth2/version.rb
-homepage: https://github.com/oauth-xx/oauth2
+homepage: https://gitlab.com/oauth-xx/oauth2
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/oauth-xx/oauth2
-  source_code_uri: https://github.com/oauth-xx/oauth2/tree/v2.0.1
-  changelog_uri: https://github.com/oauth-xx/oauth2/blob/v2.0.1/CHANGELOG.md
-  bug_tracker_uri: https://github.com/oauth-xx/oauth2/issues
-  documentation_uri: https://www.rubydoc.info/gems/oauth2/2.0.1
-  wiki_uri: https://github.com/oauth-xx/oauth2/wiki
+  homepage_uri: https://gitlab.com/oauth-xx/oauth2
+  source_code_uri: https://gitlab.com/oauth-xx/oauth2/-/tree/v2.0.9
+  changelog_uri: https://gitlab.com/oauth-xx/oauth2/-/blob/v2.0.9/CHANGELOG.md
+  bug_tracker_uri: https://gitlab.com/oauth-xx/oauth2/-/issues
+  documentation_uri: https://www.rubydoc.info/gems/oauth2/2.0.9
+  wiki_uri: https://gitlab.com/oauth-xx/oauth2/-/wiki
+  funding_uri: https://liberapay.com/pboling
   rubygems_mfa_required: 'true'
-post_install_message: 
+post_install_message: |2+
+
+  You have installed oauth2 version 2.0.9, congratulations!
+
+  There are BREAKING changes if you are upgrading from < v2, but most will not encounter them, and updating your code should be easy!
+
+  We have made two other major migrations:
+  1. master branch renamed to main
+  2. Github has been replaced with Gitlab
+
+  Please see:
+  • https://gitlab.com/oauth-xx/oauth2#what-is-new-for-v20
+  • https://gitlab.com/oauth-xx/oauth2/-/blob/main/CHANGELOG.md
+  • https://groups.google.com/g/oauth-ruby/c/QA_dtrXWXaE
+
+  Please report issues, and support the project! Thanks, |7eter l-|. l3oling
+
 rdoc_options: []
 require_paths:
 - lib
@@ -328,8 +338,9 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.16
-signing_key: 
+rubygems_version: 3.3.21
+signing_key:
 specification_version: 4
 summary: A Ruby wrapper for the OAuth 2.0 protocol.
 test_files: []
+...

data/lib/oauth2/snaky_hash.rb

@@ -1,8 +0,0 @@
-# frozen_string_literal: true
-
-module OAuth2
-  # Hash which allow assign string key in camel case
-  # and query on both camel and snake case
-  class SnakyHash < ::Hashie::Mash::Rash
-  end
-end