oauth_im 0.7.1 → 0.7.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a5e7322e6a158fea186973bf430407b662f5e8f9062767da8f736dfe3722fc09
-  data.tar.gz: c9444faa60059de5c4f29c50440e9b0eb63e77b70f644d538979a9dd71e647f7
+  metadata.gz: 85fc483377f0cf348af3a8399c70fec84395915203cb6bfa203f7d147eedb7d6
+  data.tar.gz: 40f90809e1e7405640098732aa41ac1ab96771230d9721d22f41ebfed3b19e74
 SHA512:
-  metadata.gz: 2e001cb039986d3aa5d9e44730e490065b8358ee781f8857e9166d243f3c3c76108cdf689d943e7c97615880cc7761ab95cc6993a5790c5bb4923d05ef31f6f7
-  data.tar.gz: 82c38b140fa0191f9c4f4e0b3f150d795c1d5925b72fa078d719fae87a069c28adfd180ab38597f3addc91650c4a4a745c783f80ab28980fa80dedde7b367185
+  metadata.gz: ec6f87a823e4ea3c8bd51bfc6ef09d65908840282c9228d88b78e98f686933c8eaaf2b0d844e0b2967bbed54e271f9f4c5c3b27cd7d4824b52539007018bbf29
+  data.tar.gz: dfbb145b3cf8658853b41f7d86e62024f957a21a5f6a99b69a9f682e49ad839734ab629c4a5d9ced89a53265726de029724645710dee9efa42760a0650bf2dd8

data/README.md

@@ -23,20 +23,39 @@ Once the gem is installed, add an initializer. Here is an example:
 # config/initializers/oauth_im.rb
 module OauthIm
   configure do |config|
-    config.api_key        = ENV['FUSION_AUTH_API_KEY']
-    config.callback_route = ENV['FUSION_CALLBACK_ROUTE] || DEFAULT_CALLBACK_ROUTE
+    #####################################
+    # these routes are local to the app #
+    #####################################
+    config.authorize_url  = ENV.fetch 'FUSION_AUTH_AUTHORIZE_URL', DEFAULT_AUTHORIZE_URL
+    config.callback_route = ENV.fetch 'FUSION_CALLBACK_ROUTE',     DEFAULT_CALLBACK_ROUTE
+    config.token_url      = ENV.fetch 'FUSION_AUTH_TOKEN_URL',     DEFAULT_TOKEN_URL
+
+    ##############################################
+    # identity provider url (e.g., fusion auth): #
+    ##############################################
+    config.idp_url        = ENV.fetch 'FUSION_AUTH_IDP_URL',       DEFAULT_IDP_URL
+
+    ################################################
+    # Issuer domain: find on FA tenant General tab #
+    ################################################
+    config.iss_domain     = ENV.fetch 'FUSION_AUTH_ISS_DOMAIN',    DEFAULT_ISS_DOMAIN
+
+    ###############################
+    # on FA application OAuth tab #
+    ###############################
     config.client_id      = ENV['FUSION_AUTH_CLIENT_ID']
     config.client_secret  = ENV['FUSION_AUTH_CLIENT_SECRET']
-    config.domain         = ENV['FUSION_AUTH_DOMAIN']
+
+    ###################################################################################
+    # View default signing key: https://illustrativemath-dev.fusionauth.io/admin/key/ #
+    ###################################################################################
     config.hmac           = ENV['FUSION_AUTH_HMAC']
-    config.iss_domain     = ENV['FUSION_AUTH_ISS_DOMAIN']
-    config.authorize_url  = ENV['FUSION_AUTH_AUTHORIZE_URL'] || DEFAULT_AUTHORIZE_URL
-    config.token_url      = ENV['FUSION_AUTH_TOKEN_URL']     || DEFAULT_TOKEN_URL
   end
 end
 ```
 
 * The `ENV` variable values can be obtained from the OAuth provider.
+* Here is [an article at FusionAuth](https://fusionauth.io/blog/2020/12/14/how-to-securely-implement-oauth-rails) describing many of these settings.
 * The `callback_route` setting is used in two related ways:
   * It [defines a route](https://github.com/illustrativemathematics/oauth_im/blob/main/config/routes.rb#L4) to the [`OAuthIm::ClientController#callback`
     action](https://github.com/illustrativemathematics/oauth_im/blob/main/app/controllers/oauth_im/client_controller.rb#L7-L12).
@@ -54,9 +73,9 @@ end
 The engine provides [two endpoints](https://github.com/illustrativemathematics/oauth_im/blob/main/config/routes.rb#L5-L6) for logging in and out, and exposes
 corresponding view helpers. These are accessible from the main app as:
 
-| path | url |
-|------|-----|
-| `oauth_im.login_path` | `oauth_im.login_url` |
+| path                   | url                   |
+|------------------------|-----------------------|
+| `oauth_im.login_path`  | `oauth_im.login_url`  |
 | `oauth_im.logout_path` | `oauth_im.logout_url` |
 
 * Note that the helpers are namespaced to the engine.
@@ -123,6 +142,14 @@ After many false starts, this repo includes two (seemingly functional) github wo
   you.
 
 ## Version History
+### 0.7.4
+* Use https protocol for callback in production; http otherwise
+
+### 0.7.3
+* Cleaned up configuration
+
+### 0.7.2
+* Using :http protocol in tests (not https)
 
 ### 0.7.1
 * Improving separation of concerns by way of a separate service object to manage oauth client.

data/app/services/oauth_im/client.rb

@@ -13,7 +13,7 @@ module OauthIm
     end
 
     def logout_url
-      @logout_url ||= "#{domain}/oauth2/logout" \
+      @logout_url ||= "#{idp_url}/oauth2/logout" \
                       "?post_logout_redirect_uri=#{return_to_url}" \
                       "&client_id=#{client_id}"
     end
@@ -26,7 +26,7 @@ module OauthIm
 
     delegate :host_with_port, :params, to: :request
     delegate :configuration, to: OauthIm
-    delegate :authorize_url, :client_id, :client_secret, :domain, :token_url,
+    delegate :authorize_url, :token_url, :idp_url, :client_id, :client_secret,
              to: :configuration
     delegate :auth_code, to: :oauth_client
 
@@ -39,7 +39,17 @@ module OauthIm
     end
 
     def redirect_url
-      @redirect_url ||= Engine.routes.url_helpers.callback_url(host: host_with_port)
+      @redirect_url ||=
+        Engine.routes.url_helpers.callback_url callback_url_params
+    end
+
+    def callback_url_params
+      @callback_url_params ||= { host: host_with_port,
+                                 protocol: protocol }.freeze
+    end
+
+    def protocol
+      @protocol ||= Rails.env.production? ? :https : :http
     end
 
     def decoded_token
@@ -54,7 +64,7 @@ module OauthIm
       @oauth_client ||= ::OAuth2::Client.new client_id,
                                              client_secret,
                                              authorize_url: authorize_url,
-                                             site: domain,
+                                             site: idp_url,
                                              token_url: token_url,
                                              redirect_uri: redirect_url
     end

data/lib/oauth_im/configuration.rb

@@ -1,16 +1,21 @@
 # frozen_string_literal: true
 
+########################################################################################
+# edc: see https://fusionauth.io/blog/2020/12/14/how-to-securely-implement-oauth-rails #
+########################################################################################
+
 module OauthIm
   CONFIGURABLE_FIELDS =
-    %i[api_key
-       authorize_url
-       callback_route
-       client_id
-       client_secret
-       domain
-       hmac
-       iss_domain
-       token_url].freeze
+    %i[
+      authorize_url
+      callback_route
+      token_url
+      idp_url
+      iss_domain
+      client_id
+      client_secret
+      hmac
+    ].freeze
 
   class Configuration
     attr_reader(* CONFIGURABLE_FIELDS)

data/lib/oauth_im/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module OauthIm
-  VERSION = '0.7.1'
+  VERSION = '0.7.4'
 end

data/lib/oauth_im.rb

@@ -1,13 +1,19 @@
 # frozen_string_literal: true
 
+########################################################################################
+# edc: see https://fusionauth.io/blog/2020/12/14/how-to-securely-implement-oauth-rails #
+########################################################################################
+
 require 'oauth_im/version'
 require 'oauth_im/engine'
 require 'oauth_im/configuration'
 
 module OauthIm
   DEFAULT_AUTHORIZE_URL  = '/oauth2/authorize'
-  DEFAULT_TOKEN_URL      = '/oauth2/token'
   DEFAULT_CALLBACK_ROUTE = 'callback'
+  DEFAULT_TOKEN_URL      = '/oauth2/token'
+  DEFAULT_IDP_URL        = 'https://illustrativemath-dev.fusionauth.io'
+  DEFAULT_ISS_DOMAIN     = 'illustrativemathematics.org'
 
   class << self
     attr_reader :configuration

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: oauth_im
 version: !ruby/object:Gem::Version
-  version: 0.7.1
+  version: 0.7.4
 platform: ruby
 authors:
 - Eric Connally
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-05-23 00:00:00.000000000 Z
+date: 2022-05-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt