oauthenticator 1.3.0 → 1.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 1c1af0773c8a1b3a3d9c3f1868856e19413eb8d6
-  data.tar.gz: 7d25f481acab4498447468b50dafcbd3d3afa87c
+SHA256:
+  metadata.gz: 16ab24b09d173ed8caca336faa49d9cc263513b5a1b918f656985dff431caa61
+  data.tar.gz: d3439a11045ed50fb9c72ccb85d137c72ea04b04189d58729b24ca365744937f
 SHA512:
-  metadata.gz: b087ed346c3d4919a29882e7d499cee5a316fa75e0193123617b8e18c0490c1a9791db2a2aac98bf73675736b8ff2741e4859c0c22b3c55dc78442d34bde31b9
-  data.tar.gz: c007f8fa60d9a7b0e1c54af75a56fe81f02faa4f449cba5030c184a59844ef9efc4f05f7a87e05101c41565f36f0ae67acff06a1f033dc2926e1985fef7a0130
+  metadata.gz: bd14158bfbc8c6ff4f998226ae110d5d3c9d251fb011968dd5ddc7d3fd1d131450e5dce683e1590728218527ea2a9f31e82b17f81b674eb4ea391a4d68d0bdb0
+  data.tar.gz: 82aef9ae6b004bcd95b5cf6a96c198089195022b3a131ec1346a62a2c18d3db1b6b2eae54af4ba41e665ef57677dc72bed6a9f886615fdeb53e7351e0a697918

data/CHANGELOG.md

@@ -1,3 +1,26 @@
+# 1.3.5
+
+- relax faraday and rack gem dependency constraints
+
+# 1.3.4
+
+- relax json gem dependency constraint
+
+# 1.3.3
+
+- env["oauth.signed_request"] contains the signed request. this makes any helper methods from the implemented 
+config methods module available and helps avoid code duplication (and sometimes duplicated db queries - 
+depending on implementation)
+- fix irrelevant warning with Hash#reject called on hash with a default proc
+
+# 1.3.2
+
+- loosen dependency to allow rack 2.0
+
+# 1.3.1
+
+- set media type to the default that the adapter will use if it's not specified on a request that is expected to have a body
+
 # 1.3.0
 
 - Make error messages fully-human readable on their own (not requiring context of the error key)

data/README.md

@@ -1,5 +1,7 @@
 # OAuthenticator
 
+[![Build Status](https://travis-ci.org/notEthan/oauthenticator.svg?branch=master)](https://travis-ci.org/notEthan/oauthenticator)
+
 OAuthenticator signs outgoing requests with OAuth 1.0. 
 
 OAuthenticator authenticates incoming OAuth 1.0 signed requests, primarily as a middleware, and forms useful 
@@ -46,7 +48,10 @@ connection.get '/path'
 ```
 
 Note that `:url_encoded` is only included to illustrate that other middleware should all go before 
-`:oauthenticator_signer`; the use of `:url_encoded` is not related to OAuthenticator. 
+`:oauthenticator_signer`; the use of `:url_encoded` is not related to OAuthenticator.
+
+Note that for the RSA-SHA1 signature method, the token secret is the contents of the RSA certificate
+used for signing the requests.
 
 ### Any other HTTP library
 
@@ -73,13 +78,13 @@ See the documentation for {OAuthenticator::SignableRequest} for more detailed in
 
 ### OAuth Request Body Hash
 
-The [OAuth Request Body Hash](https://oauth.googlecode.com/svn/spec/ext/body_hash/1.0/oauth-bodyhash.html)
+The [OAuth Request Body Hash](https://tools.ietf.org/html/draft-eaton-oauth-bodyhash-00)
 specification is supported. By default all signing of outgoing does include the body hash. This can be 
 disabled by setting the `:hash_body?` / `'hash_body?'` attribute to false when instantiating an 
 OAuthenticator::SignableRequest. 
 
 For info on when to include the body hash, see 
-[When to Include the Body Hash](https://oauth.googlecode.com/svn/spec/ext/body_hash/1.0/oauth-bodyhash.html#when_to_include). 
+[When to Include the Body Hash](https://tools.ietf.org/html/draft-eaton-oauth-bodyhash-00#section-4.1.1). 
 
 ## Authenticating incoming requests
 
@@ -193,7 +198,7 @@ methods it needs to function.
 
 ### OAuth Request Body Hash
 
-The [OAuth Request Body Hash](https://oauth.googlecode.com/svn/spec/ext/body_hash/1.0/oauth-bodyhash.html)
+The [OAuth Request Body Hash](https://tools.ietf.org/html/draft-eaton-oauth-bodyhash-00)
 specification is supported. Requests which include the oauth_body_hash parameter are authenticated according 
 to the spec. 
 

data/Rakefile.rb

@@ -4,7 +4,8 @@ Rake::TestTask.new do |t|
   t.test_files = FileList['test/**/*_test.rb']
   t.verbose = true
 end
-task 'default' => 'test'
+require 'wwtd/tasks'
+task 'default' => 'wwtd'
 
 require 'yard'
 YARD::Rake::YardocTask.new do |t|

data/lib/oauthenticator/faraday_signer.rb

@@ -1,5 +1,5 @@
-require 'oauthenticator'
 require 'faraday'
+require 'rack'
 
 if Faraday.respond_to?(:register_middleware)
   Faraday.register_middleware(:request, :oauthenticator_signer => proc { OAuthenticator::FaradaySigner })
@@ -30,7 +30,7 @@ module OAuthenticator
   class FaradaySigner
     # options are passed to {OAuthenticator::SignableRequest}. 
     #
-    # attributes of the request are added by the middleware, so you should not provide those as optiosn 
+    # attributes of the request are added by the middleware, so you should not provide those as options
     # (it would not make sense to do so on the connection level). 
     #
     # These are the options you should or may provide (see {OAuthenticator::SignableRequest} for details of 
@@ -49,14 +49,25 @@ module OAuthenticator
       @options = options
     end
 
+    # see also Faraday::Env::MethodsWithBodies
+    METHODS_WITH_BODIES = %w(post put patch options)
+
     # do the thing
     def call(request_env)
+      media_type = Rack::Request.new('CONTENT_TYPE' => request_env[:request_headers]['Content-Type']).media_type
       request_attributes = {
         :request_method => request_env[:method],
         :uri => request_env[:url],
-        :media_type => request_env[:request_headers]['Content-Type'],
+        :media_type => media_type,
         :body => request_env[:body]
       }
+      # the adapter will set the media type to form-encoded when not otherwise specified on 
+      # requests it expects to have a body. see 
+      # Net::HTTPGenericRequest#supply_default_content_type called in #send_request_with_body. 
+      # other adapters do similarly, I think. 
+      if METHODS_WITH_BODIES.include?(request_env[:method].to_s.downcase) && !request_attributes[:media_type]
+        request_attributes[:media_type] = 'application/x-www-form-urlencoded'
+      end
       oauthenticator_signable_request = OAuthenticator::SignableRequest.new(@options.merge(request_attributes))
       request_env[:request_headers]['Authorization'] = oauthenticator_signable_request.authorization
       @app.call(request_env)

data/lib/oauthenticator/parse_authorization.rb

@@ -33,16 +33,16 @@ module OAuthenticator
       header = header.to_s
       scanner = StringScanner.new(header)
       auth_parse_error = proc { |message| raise ParseError.new(message, {'Authorization' => [message]}) }
-      scanner.scan(/OAuth\s*/i) || auth_parse_error.call("Authorization scheme is not OAuth - recieved: #{header}")
-      attributes = Hash.new { |h,k| h[k] = [] }
-      while match = scanner.scan(/(\w+)="([^"]*)"\s*(,?)\s*/)
+      scanner.scan(/OAuth\s*/i) || auth_parse_error.call("Authorization scheme is not OAuth - received: #{header}")
+      attributes = {}
+      while scanner.scan(/(\w+)="([^"]*)"\s*(,?)\s*/)
         key = scanner[1]
         value = scanner[2]
         comma_follows = !scanner[3].empty?
         if !comma_follows && !scanner.eos?
           auth_parse_error.call("Could not parse Authorization header: #{header}\naround or after character #{scanner.pos}: #{scanner.rest}")
         end
-        attributes[unescape(key)] << unescape(value)
+        (attributes[unescape(key)] ||= []) << unescape(value)
       end
       unless scanner.eos?
         auth_parse_error.call("Could not parse Authorization header: #{header}\naround or after character #{scanner.pos}: #{scanner.rest}")

data/lib/oauthenticator/rack_authenticator.rb

@@ -25,8 +25,8 @@ module OAuthenticator
     #
     # - `:realm` - 401 responses include a `WWW-Authenticate` with the realm set to the given value. default 
     #   is an empty string.
-    def initialize(app, options={})
-      @app=app
+    def initialize(app, options = {})
+      @app = app
       @options = options
       unless @options[:config_methods].is_a?(Module)
         raise ArgumentError, "options[:config_methods] must be a Module"
@@ -48,6 +48,7 @@ module OAuthenticator
           unauthenticated_response(oauth_request.errors)
         else
           log_success(env, oauth_request)
+          env["oauth.signed_request"] = oauth_request
           env["oauth.consumer_key"] = oauth_request.consumer_key
           env["oauth.token"] = oauth_request.token
           env["oauth.authenticated"] = true
@@ -60,7 +61,7 @@ module OAuthenticator
 
     # the response for an unauthenticated request. the argument will be a hash with the key 'errors', whose 
     # value is a hash with string keys indicating attributes with errors, and values being arrays of strings 
-    # indicating error messages on the attribute key.. 
+    # indicating error messages on the attribute key. 
     def unauthenticated_response(errors)
       # default to a blank realm, I suppose
       realm = @options[:realm] || ''

data/lib/oauthenticator/version.rb

@@ -1,5 +1,5 @@
 # OAuthenticator 
 module OAuthenticator
   # OAuthenticator::VERSION
-  VERSION = "1.3.0"
+  VERSION = "1.3.5"
 end

data/test/faraday_signer_test.rb

@@ -46,6 +46,23 @@ describe OAuthenticator::FaradaySigner do
     assert_response 200, '☺', response
   end
 
+  it 'succeeds with charset' do
+    signing_options = {
+      :signature_method => 'HMAC-SHA1',
+      :consumer_key => consumer_key,
+      :consumer_secret => consumer_secret,
+      :token => token,
+      :token_secret => token_secret,
+    }
+
+    connection = Faraday.new(:url => 'http://example.com', :headers => {'Content-Type' => 'application/x-www-form-urlencoded; charset=UTF-8'}) do |faraday|
+      faraday.request :oauthenticator_signer, signing_options
+      faraday.adapter :rack, oapp
+    end
+    response = connection.post('/', 'a=b')
+    assert_response 200, '☺', response
+  end
+
   it 'is unauthorized' do
     signing_options = {
       :signature_method => 'PLAINTEXT',

data/test/rack_authenticator_test.rb

@@ -592,14 +592,16 @@ describe OAuthenticator::RackAuthenticator do
       end
     end
 
-    it 'sets oauth.authenticated, oauth.token, oauth.consumer_key' do
+    it 'sets oauth.authenticated, oauth.token, oauth.consumer_key, oauth.signed_request' do
       oauth_authenticated = nil
       oauth_token = nil
       oauth_consumer_key = nil
+      oauth_signed_request = nil
       testapp = proc do |env|
         oauth_authenticated = env['oauth.authenticated']
         oauth_token = env['oauth.token']
         oauth_consumer_key = env['oauth.consumer_key']
+        oauth_signed_request = env['oauth.signed_request']
         [200, {}, ['☺']]
       end
       otestapp = OAuthenticator::RackAuthenticator.new(testapp, :config_methods => OAuthenticatorTestConfigMethods)
@@ -607,6 +609,7 @@ describe OAuthenticator::RackAuthenticator do
       assert_equal(token, oauth_token)
       assert_equal(consumer_key, oauth_consumer_key)
       assert_equal(true, oauth_authenticated)
+      assert_kind_of(OAuthenticator::SignedRequest, oauth_signed_request)
     end
   end
 end

data/test/signable_request_test.rb

@@ -87,7 +87,7 @@ describe OAuthenticator::SignableRequest do
         end
         it 'does not generate timestamp' do
           request = example_request(:signature_method => 'PLAINTEXT')
-          assert(!request.protocol_params.key?('oauth_timestapm'))
+          assert(!request.protocol_params.key?('oauth_timestamp'))
         end
       end
     end
@@ -329,6 +329,7 @@ describe OAuthenticator::SignableRequest do
 
     it 'excludes query and fragment' do
       assert_equal('http://example.com/FooBar', example_request(:uri => 'http://example.com/FooBar?foo=bar#foobar').send(:base_string_uri))
+      assert_equal('http://example.com/FooBar', example_request(:uri => 'http://example.com/FooBar#foobar').send(:base_string_uri))
     end
   end
 

metadata

@@ -1,57 +1,69 @@
 --- !ruby/object:Gem::Specification
 name: oauthenticator
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.3.5
 platform: ruby
 authors:
 - Ethan
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-11-14 00:00:00.000000000 Z
+date: 2020-08-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.4'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.4'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: json
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.8'
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.8'
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: faraday
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0.9'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0.9'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: addressable
   requirement: !ruby/object:Gem::Requirement
@@ -228,8 +240,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.2.2
+rubygems_version: 3.0.6
 signing_key: 
 specification_version: 4
 summary: OAuth 1.0 request signing and authentication
@@ -244,4 +255,3 @@ test_files:
 - test/signed_request_test.rb
 - test/test_config_methods.rb
 - ".simplecov"
-has_rdoc: