oauth_im 0.7.2 → 0.7.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fa5dbaae2a3e5884523e938a1a2c1a5009297260c2ced57a69eb6b9b43bc0116
-  data.tar.gz: 5d80271d7c2aa8d9baa53119180c7889da5c47f30f51cf92d8f0aa2f1c2e5376
+  metadata.gz: f4b28f51bcd7b2893dd52780a267678fab317eb70feefa6d3ab9d714cad45834
+  data.tar.gz: c605bb66ede19ea12e1e124f12164d3cee63358d24a0bd0971693732e96b380f
 SHA512:
-  metadata.gz: 873154c1389b866c7d68d209d6bf83e107c7db64e01ab0bffcba9578ad5f6e0df22ea91a66fda1dd67ee9675ad18c330716c7572b772e9e721a241e5a473369c
-  data.tar.gz: 8e1c2d0c1ef24d23f4348788fee37befbf216af10b9425f4dc861739dc745ab57db76b3c7b0a3d8869457aa1b701d7a5fe6940358a47ec104fe7aca9027fb9b0
+  metadata.gz: a61461548d89152f21df67bdafc810ff7e38826e070a61185a5b557c28c42d3477fc92acf1de2e256d0a6349a1a8c6923248bda1586c7303fe5f77aa5d1a2c4f
+  data.tar.gz: 3c4db160ded76f36e56ed22791f404741b43cc1b204c8221f09852c0ab3ca71b7c9cbd0ed28a5a0d298b7d855becc841efb768e5578359057db8d8cc062208d3

data/README.md

@@ -23,20 +23,39 @@ Once the gem is installed, add an initializer. Here is an example:
 # config/initializers/oauth_im.rb
 module OauthIm
   configure do |config|
-    config.api_key        = ENV['FUSION_AUTH_API_KEY']
-    config.callback_route = ENV['FUSION_CALLBACK_ROUTE] || DEFAULT_CALLBACK_ROUTE
+    #####################################
+    # these routes are local to the app #
+    #####################################
+    config.authorize_url  = ENV.fetch 'FUSION_AUTH_AUTHORIZE_URL', DEFAULT_AUTHORIZE_URL
+    config.callback_route = ENV.fetch 'FUSION_CALLBACK_ROUTE',     DEFAULT_CALLBACK_ROUTE
+    config.token_url      = ENV.fetch 'FUSION_AUTH_TOKEN_URL',     DEFAULT_TOKEN_URL
+
+    ##############################################
+    # identity provider url (e.g., fusion auth): #
+    ##############################################
+    config.idp_url        = ENV.fetch 'FUSION_AUTH_IDP_URL',       DEFAULT_IDP_URL
+
+    ################################################
+    # Issuer domain: find on FA tenant General tab #
+    ################################################
+    config.iss_domain     = ENV.fetch 'FUSION_AUTH_ISS_DOMAIN',    DEFAULT_ISS_DOMAIN
+
+    ###############################
+    # on FA application OAuth tab #
+    ###############################
     config.client_id      = ENV['FUSION_AUTH_CLIENT_ID']
     config.client_secret  = ENV['FUSION_AUTH_CLIENT_SECRET']
-    config.domain         = ENV['FUSION_AUTH_DOMAIN']
+
+    ###################################################################################
+    # View default signing key: https://illustrativemath-dev.fusionauth.io/admin/key/ #
+    ###################################################################################
     config.hmac           = ENV['FUSION_AUTH_HMAC']
-    config.iss_domain     = ENV['FUSION_AUTH_ISS_DOMAIN']
-    config.authorize_url  = ENV['FUSION_AUTH_AUTHORIZE_URL'] || DEFAULT_AUTHORIZE_URL
-    config.token_url      = ENV['FUSION_AUTH_TOKEN_URL']     || DEFAULT_TOKEN_URL
   end
 end
 ```
 
 * The `ENV` variable values can be obtained from the OAuth provider.
+* Here is [an article at FusionAuth](https://fusionauth.io/blog/2020/12/14/how-to-securely-implement-oauth-rails) describing many of these settings.
 * The `callback_route` setting is used in two related ways:
   * It [defines a route](https://github.com/illustrativemathematics/oauth_im/blob/main/config/routes.rb#L4) to the [`OAuthIm::ClientController#callback`
     action](https://github.com/illustrativemathematics/oauth_im/blob/main/app/controllers/oauth_im/client_controller.rb#L7-L12).
@@ -54,9 +73,9 @@ end
 The engine provides [two endpoints](https://github.com/illustrativemathematics/oauth_im/blob/main/config/routes.rb#L5-L6) for logging in and out, and exposes
 corresponding view helpers. These are accessible from the main app as:
 
-| path | url |
-|------|-----|
-| `oauth_im.login_path` | `oauth_im.login_url` |
+| path                   | url                   |
+|------------------------|-----------------------|
+| `oauth_im.login_path`  | `oauth_im.login_url`  |
 | `oauth_im.logout_path` | `oauth_im.logout_url` |
 
 * Note that the helpers are namespaced to the engine.
@@ -124,6 +143,9 @@ After many false starts, this repo includes two (seemingly functional) github wo
 
 ## Version History
 
+### 0.7.3
+* Cleaned up configuration
+
 ### 0.7.2
 * Using :http protocol in tests (not https)
 

data/app/services/oauth_im/client.rb

@@ -13,7 +13,7 @@ module OauthIm
     end
 
     def logout_url
-      @logout_url ||= "#{domain}/oauth2/logout" \
+      @logout_url ||= "#{idp_url}/oauth2/logout" \
                       "?post_logout_redirect_uri=#{return_to_url}" \
                       "&client_id=#{client_id}"
     end
@@ -26,7 +26,7 @@ module OauthIm
 
     delegate :host_with_port, :params, to: :request
     delegate :configuration, to: OauthIm
-    delegate :authorize_url, :client_id, :client_secret, :domain, :token_url,
+    delegate :authorize_url, :token_url, :idp_url, :client_id, :client_secret,
              to: :configuration
     delegate :auth_code, to: :oauth_client
 
@@ -64,7 +64,7 @@ module OauthIm
       @oauth_client ||= ::OAuth2::Client.new client_id,
                                              client_secret,
                                              authorize_url: authorize_url,
-                                             site: domain,
+                                             site: idp_url,
                                              token_url: token_url,
                                              redirect_uri: redirect_url
     end

data/lib/oauth_im/configuration.rb

@@ -1,16 +1,21 @@
 # frozen_string_literal: true
 
+########################################################################################
+# edc: see https://fusionauth.io/blog/2020/12/14/how-to-securely-implement-oauth-rails #
+########################################################################################
+
 module OauthIm
   CONFIGURABLE_FIELDS =
-    %i[api_key
-       authorize_url
-       callback_route
-       client_id
-       client_secret
-       domain
-       hmac
-       iss_domain
-       token_url].freeze
+    %i[
+      authorize_url
+      callback_route
+      token_url
+      idp_url
+      iss_domain
+      client_id
+      client_secret
+      hmac
+    ].freeze
 
   class Configuration
     attr_reader(* CONFIGURABLE_FIELDS)

data/lib/oauth_im/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module OauthIm
-  VERSION = '0.7.2'
+  VERSION = '0.7.3'
 end

data/lib/oauth_im.rb

@@ -1,13 +1,19 @@
 # frozen_string_literal: true
 
+########################################################################################
+# edc: see https://fusionauth.io/blog/2020/12/14/how-to-securely-implement-oauth-rails #
+########################################################################################
+
 require 'oauth_im/version'
 require 'oauth_im/engine'
 require 'oauth_im/configuration'
 
 module OauthIm
   DEFAULT_AUTHORIZE_URL  = '/oauth2/authorize'
-  DEFAULT_TOKEN_URL      = '/oauth2/token'
   DEFAULT_CALLBACK_ROUTE = 'callback'
+  DEFAULT_TOKEN_URL      = '/oauth2/token'
+  DEFAULT_IDP_URL        = 'https://illustrativemath-dev.fusionauth.io'
+  DEFAULT_ISS_DOMAIN     = 'illustrativemathematics.org'
 
   class << self
     attr_reader :configuration

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: oauth_im
 version: !ruby/object:Gem::Version
-  version: 0.7.2
+  version: 0.7.3
 platform: ruby
 authors:
 - Eric Connally