RubyGems - omniauth-duodealer-oauth2 - Versions diffs - 1.0.0 - Mend

omniauth-duodealer-oauth2 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (19) hide show

checksums.yaml +7 -0
data/.github/probots.yml +2 -0
data/.gitignore +2 -0
data/.ruby-version +1 -0
data/.travis.yml +4 -0
data/Gemfile +9 -0
data/Rakefile +9 -0
data/example/Gemfile +8 -0
data/example/config.ru +67 -0
data/lib/omniauth-duodealer-oauth2.rb +1 -0
data/lib/omniauth/duodealer.rb +4 -0
data/lib/omniauth/duodealer/version.rb +7 -0
data/lib/omniauth/strategies/duodealer.rb +160 -0
data/omniauth-duodealer-oauth2.gemspec +26 -0
data/shipit.rubygems.yml +1 -0
data/spec/omniauth/strategies/duodealer_spec.rb +145 -0
data/test/integration_test.rb +454 -0
data/test/test_helper.rb +11 -0
metadata +119 -0

checksums.yaml ADDED

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 7ff6856a264f3b30185124b802f35d4b48a305455ec9cc0346c5cb52e809fd05
+  data.tar.gz: d7d8d48b5f7055c0c680ee73ddfd6416fff76e76f9b45ec01bd1a5297ab74c72
+SHA512:
+  metadata.gz: 680c5d8f690f20e308479c16741f58dcb7c99a840ce4b97a0f0d125dd62bad985d494c306f599e450359f52a2716aa73e0b1caec6f9f44dccb57b89a451449d8
+  data.tar.gz: df3498079be1c82c0f76742be0beae204f784e7736aa31be3d1469f5a042ca6534619e639d7cda66c22b1746b0096ca8f698440bf88116f6ae3d6b4e88af807e

data/.github/probots.yml ADDED

	@@ -0,0 +1,2 @@
1	+ enabled:
2	+ - cla

data/.gitignore ADDED

	@@ -0,0 +1,2 @@
1	+ pkg/*
2	+ Gemfile.lock

data/.ruby-version ADDED

	@@ -0,0 +1 @@
1	+ 2.6.4

data/.travis.yml ADDED

@@ -0,0 +1,4 @@
+language: ruby
+rvm:
+  - 2.1.9
+  - 2.2.2

data/Gemfile ADDED

@@ -0,0 +1,9 @@
+source "https://rubygems.org"
+gemspec
+if Gem::Version.new(RUBY_VERSION) < Gem::Version.new("2.2")
+  gem 'rack', '~> 1.6'
+end
+gem 'fakeweb', github: 'junaruga/fakeweb'

data/Rakefile ADDED

@@ -0,0 +1,9 @@
+require 'bundler/gem_tasks'
+require 'rake/testtask'
+task :default => :test
+Rake::TestTask.new(:test) do |t|
+  t.pattern = 'test/**/*_test.rb'
+  t.verbose = true
+end

data/example/Gemfile ADDED

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+source 'https://rubygems.org/'
+gem 'rack', '~> 1.6'
+gem 'omniauth-duodealer-oauth2', path: '../'
+gem 'sinatra', '~> 1.4'

data/example/config.ru ADDED

@@ -0,0 +1,67 @@
+require 'bundler/setup'
+require 'sinatra/base'
+require 'omniauth-duodealer-oauth2'
+SCOPE = 'read_products,read_orders,read_customers,write_shipping'
+DUODEALER_API_KEY = ENV['DUODEALER_API_KEY']
+DUODEALER_SHARED_SECRET = ENV['DUODEALER_SHARED_SECRET']
+unless DUODEALER_API_KEY && DUODEALER_SHARED_SECRET
+  abort("DUODEALER_API_KEY and DUODEALER_SHARED_SECRET environment variables must be set")
+end
+class App < Sinatra::Base
+  get '/' do
+    <<-HTML
+    <html>
+    <head>
+      <title>DuoDealer Oauth2</title>
+    </head>
+    <body>
+      <form action="/auth/duodealer" method="get">
+      <label for="shop">Enter your store's URL:</label>
+      <input type="text" name="shop" placeholder="your-shop-url.duodealer.com">
+      <button type="submit">Log In</button>
+      </form>
+    </body>
+    </html>
+    HTML
+  end
+  get '/auth/:provider/callback' do
+    <<-HTML
+    <html>
+    <head>
+      <title>DuoDealer Oauth2</title>
+    </head>
+    <body>
+      <h3>Authorized</h3>
+      <p>Shop: #{request.env['omniauth.auth'].uid}</p>
+      <p>Token: #{request.env['omniauth.auth']['credentials']['token']}</p>
+    </body>
+    </html>
+    HTML
+  end
+  get '/auth/failure' do
+    <<-HTML
+    <html>
+    <head>
+      <title>DuoDealer Oauth2</title>
+    </head>
+    <body>
+      <h3>Failed Authorization</h3>
+      <p>Message: #{params[:message]}</p>
+    </body>
+    </html>
+    HTML
+  end
+end
+use Rack::Session::Cookie, secret: SecureRandom.hex(64)
+use OmniAuth::Builder do
+  provider :duodealer, DUODEALER_API_KEY, DUODEALER_SHARED_SECRET, :scope => SCOPE
+end
+run App.new

data/lib/omniauth-duodealer-oauth2.rb ADDED

	@@ -0,0 +1 @@
1	+ require 'omniauth/duodealer'

data/lib/omniauth/duodealer.rb ADDED

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+require 'omniauth/duodealer/version'
+require 'omniauth/strategies/duodealer'

data/lib/omniauth/duodealer/version.rb ADDED

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+module OmniAuth
+  module Duodealer
+    VERSION = '1.0.0'
+  end
+end

data/lib/omniauth/strategies/duodealer.rb ADDED

@@ -0,0 +1,160 @@
+require 'omniauth/strategies/oauth2'
+module OmniAuth
+  module Strategies
+    class Duodealer < OmniAuth::Strategies::OAuth2
+      # Available scopes: content themes products customers orders script_tags shipping
+      # read_*  or write_*
+      DEFAULT_SCOPE = 'read_products'
+      SCOPE_DELIMITER = ','
+      MINUTE = 60
+      CODE_EXPIRES_AFTER = 10 * MINUTE
+      option :name, "duodealer"
+      option :client_options, {
+        :authorize_url => '/admin/oauth/authorize',
+        :token_url => '/admin/oauth/access_token'
+      }
+      option :callback_url
+      option :duodealer_domain, 'duodealer.com'
+      option :old_client_secret
+      # When `true`, the user's permission level will apply (in addition to
+      # the requested access scope) when making API requests to duodealer.
+      option :per_user_permissions, false
+      option :setup, proc { |env|
+        strategy = env['omniauth.strategy']
+        duodealer_auth_params = strategy.session['duodealer.omniauth_params'] && strategy.session['duodealer.omniauth_params'].with_indifferent_access
+        shop = if duodealer_auth_params && duodealer_auth_params['shop']
+          "https://#{duodealer_auth_params['shop']}"
+        else
+          ''
+        end
+        strategy.options[:client_options][:site] = shop
+      }
+      uid { URI.parse(options[:client_options][:site]).host }
+      extra do
+        if access_token
+          {
+            'associated_user' => access_token['associated_user'],
+            'associated_user_scope' => access_token['associated_user_scope'],
+            'scope' => access_token['scope'],
+            'session' => access_token['session']
+          }
+        end
+      end
+      def valid_site?
+        !!(/\A(https|http)\:\/\/[a-zA-Z0-9][a-zA-Z0-9\-]*\.#{Regexp.quote(options[:duodealer_domain])}[\/]?\z/ =~ options[:client_options][:site])
+      end
+      def valid_signature?
+        return false unless request.POST.empty?
+        params = request.GET
+        signature = params['hmac']
+        timestamp = params['timestamp']
+        return false unless signature && timestamp
+        return false unless timestamp.to_i > Time.now.to_i - CODE_EXPIRES_AFTER
+        new_secret = options.client_secret
+        old_secret = options.old_client_secret
+        validate_signature(new_secret) || (old_secret && validate_signature(old_secret))
+      end
+      def valid_scope?(token)
+        params = options.authorize_params.merge(options_for("authorize"))
+        return false unless token && params[:scope] && token['scope']
+        expected_scope = normalized_scopes(params[:scope]).sort
+        (expected_scope == token['scope'].split(SCOPE_DELIMITER).sort)
+      end
+      def normalized_scopes(scopes)
+        scope_list = scopes.to_s.split(SCOPE_DELIMITER).map(&:strip).reject(&:empty?).uniq
+        ignore_scopes = scope_list.map { |scope| scope =~ /\Awrite_(.*)\z/ && "read_#{$1}" }.compact
+        scope_list - ignore_scopes
+      end
+      def self.encoded_params_for_signature(params)
+        params = params.dup
+        params.delete('hmac')
+        params.delete('signature') # deprecated signature
+        Rack::Utils.build_query(params.sort)
+      end
+      def self.hmac_sign(encoded_params, secret)
+        OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new, secret, encoded_params)
+      end
+      def valid_permissions?(token)
+        token && (options[:per_user_permissions] == !token['associated_user'].nil?)
+      end
+      def fix_https
+        options[:client_options][:site] = options[:client_options][:site].gsub(/\Ahttp\:/, 'https:')
+      end
+      def setup_phase
+        super
+        fix_https
+      end
+      def request_phase
+        if valid_site?
+          super
+        else
+          fail!(:invalid_site)
+        end
+      end
+      def callback_phase
+        return fail!(:invalid_site, CallbackError.new(:invalid_site, "OAuth endpoint is not a duodealer site.")) unless valid_site?
+        return fail!(:invalid_signature, CallbackError.new(:invalid_signature, "Signature does not match, it may have been tampered with.")) unless valid_signature?
+        token = build_access_token
+        unless valid_scope?(token)
+          return fail!(:invalid_scope, CallbackError.new(:invalid_scope, "Scope does not match, it may have been tampered with."))
+        end
+        unless valid_permissions?(token)
+          return fail!(:invalid_permissions, CallbackError.new(:invalid_permissions, "Requested API access mode does not match."))
+        end
+        super
+      rescue ::OAuth2::Error => e
+        fail!(:invalid_credentials, e)
+      end
+      def build_access_token
+        @built_access_token ||= super
+      end
+      def authorize_params
+        super.tap do |params|
+          params[:scope] = normalized_scopes(params[:scope] || DEFAULT_SCOPE).join(SCOPE_DELIMITER)
+          params[:grant_options] = ['per-user'] if options[:per_user_permissions]
+        end
+      end
+      def callback_url
+        options[:callback_url] || full_host + script_name + callback_path
+      end
+      private
+      def validate_signature(secret)
+        params = request.GET
+        calculated_signature = self.class.hmac_sign(self.class.encoded_params_for_signature(params), secret)
+        Rack::Utils.secure_compare(calculated_signature, params['hmac'])
+      end
+    end
+  end
+end

data/omniauth-duodealer-oauth2.gemspec ADDED

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+$LOAD_PATH.push File.expand_path('lib', __dir__)
+require 'omniauth/duodealer/version'
+Gem::Specification.new do |s|
+  s.name     = 'omniauth-duodealer-oauth2'
+  s.version  = OmniAuth::Duodealer::VERSION
+  s.authors  = ['Eric Raio']
+  s.email    = ['eric@duodealer.com']
+  s.summary  = 'duodealer strategy for OmniAuth'
+  s.homepage = 'https://gitlab.com/duodealer/omniauth-duodealer-oauth2'
+  s.license = 'MIT'
+  s.files         = `git ls-files`.split("\n")
+  s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
+  s.executables   = `git ls-files -- bin/*`.split("\n").map { |f| File.basename(f) }
+  s.require_paths = ['lib']
+  s.required_ruby_version = '>= 2.1.9'
+  s.add_runtime_dependency 'activesupport'
+  s.add_runtime_dependency 'omniauth-oauth2', '~> 1.5.0'
+  s.add_development_dependency 'minitest', '~> 5.6'
+  s.add_development_dependency 'rake'
+end

data/shipit.rubygems.yml ADDED

	@@ -0,0 +1 @@
1	+ # using the default shipit config

data/spec/omniauth/strategies/duodealer_spec.rb ADDED

@@ -0,0 +1,145 @@
+# frozen_string_literal: true
+require 'spec_helper'
+require 'omniauth-duodealer-oauth2'
+require 'base64'
+describe OmniAuth::Strategies::Duodealer do
+  before :each do
+    @request = double('Request',
+                      env: {})
+    @request.stub(:params) { {} }
+    @request.stub(:cookies) { {} }
+    @client_id = '123'
+    @client_secret = '53cr3tz'
+    @options = { client_options: { site: 'https://example.duodealer.com' } }
+  end
+  subject do
+    args = [@client_id, @client_secret, @options].compact
+    OmniAuth::Strategies::Duodealer.new(nil, *args).tap do |strategy|
+      strategy.stub(:request) { @request }
+      strategy.stub(:session) { {} }
+    end
+  end
+  describe '#fix_https' do
+    it 'replaces http scheme by https' do
+      @options = { client_options: { site: 'http://foo.bar/' } }
+      subject.fix_https
+      subject.options[:client_options][:site].should eq('https://foo.bar/')
+    end
+    it 'replaces http scheme by https with an immutable string' do
+      @options = { client_options: { site: 'http://foo.bar/' } }
+      subject.fix_https
+      subject.options[:client_options][:site].should eq('https://foo.bar/')
+    end
+    it 'does not replace https scheme' do
+      @options = { client_options: { site: 'https://foo.bar/' } }
+      subject.fix_https
+      subject.options[:client_options][:site].should eq('https://foo.bar/')
+    end
+  end
+  describe '#client' do
+    it 'has correct duodealer site' do
+      subject.client.site.should eq('https://example.duodealer.com')
+    end
+    it 'has correct authorize url' do
+      subject.client.options[:authorize_url].should eq('/admin/oauth/authorize')
+    end
+    it 'has correct token url' do
+      subject.client.options[:token_url].should eq('/admin/oauth/access_token')
+    end
+  end
+  describe '#callback_url' do
+    it 'returns value from #callback_url' do
+      url = 'http://auth.myapp.com/auth/callback'
+      @options = { callback_url: url }
+      subject.callback_url.should eq(url)
+    end
+    it 'defaults to callback' do
+      url_base = 'http://auth.request.com'
+      @request.stub(:url) { "#{url_base}/page/path" }
+      @request.stub(:scheme) { 'http' }
+      subject.stub(:script_name) { '' } # to not depend from Rack env
+      subject.callback_url.should eq("#{url_base}/auth/duodealer/callback")
+    end
+  end
+  describe '#authorize_params' do
+    it 'includes default scope for read_products' do
+      subject.authorize_params.should be_a(Hash)
+      subject.authorize_params[:scope].should eq('read_products')
+    end
+    it 'includes custom scope' do
+      @options = { scope: 'write_products' }
+      subject.authorize_params.should be_a(Hash)
+      subject.authorize_params[:scope].should eq('write_products')
+    end
+  end
+  describe '#uid' do
+    it 'returns the shop' do
+      subject.uid.should eq('example.duodealer.com')
+    end
+  end
+  describe '#credentials' do
+    before :each do
+      @access_token = double('OAuth2::AccessToken')
+      @access_token.stub(:token)
+      @access_token.stub(:expires?)
+      @access_token.stub(:expires_at)
+      @access_token.stub(:refresh_token)
+      subject.stub(:access_token) { @access_token }
+    end
+    it 'returns a Hash' do
+      subject.credentials.should be_a(Hash)
+    end
+    it 'returns the token' do
+      @access_token.stub(:token) { '123' }
+      subject.credentials['token'].should eq('123')
+    end
+    it 'returns the expiry status' do
+      @access_token.stub(:expires?) { true }
+      subject.credentials['expires'].should eq(true)
+      @access_token.stub(:expires?) { false }
+      subject.credentials['expires'].should eq(false)
+    end
+  end
+  describe '#valid_site?' do
+    it 'returns true if the site contains .duodealer.com' do
+      @options = { client_options: { site: 'http://foo.duodealer.com/' } }
+      subject.valid_site?.should eq(true)
+    end
+    it 'returns false if the site does not contain .duodealer.com' do
+      @options = { client_options: { site: 'http://foo.example.com/' } }
+      subject.valid_site?.should eq(false)
+    end
+    it 'uses configurable option for duodealer_domain' do
+      @options = { client_options: { site: 'http://foo.example.com/' }, duodealer_domain: 'example.com' }
+      subject.valid_site?.should eq(true)
+    end
+    it 'allows custom port for duodealer_domain' do
+      @options = { client_options: { site: 'http://foo.example.com:3456/' }, duodealer_domain: 'example.com:3456' }
+      subject.valid_site?.should eq(true)
+    end
+  end
+end

data/test/integration_test.rb ADDED

@@ -0,0 +1,454 @@
+require_relative 'test_helper'
+class IntegrationTest < Minitest::Test
+  def setup
+    build_app(scope: OmniAuth::Strategies::Duodealer::DEFAULT_SCOPE)
+  end
+  def teardown
+    FakeWeb.clean_registry
+    FakeWeb.last_request = nil
+  end
+  def test_authorize
+    response = authorize('snowdevil.duodealer.com')
+    assert_equal 302, response.status
+    assert_match %r{\A#{Regexp.quote(duodealer_authorize_url)}}, response.location
+    redirect_params = Rack::Utils.parse_query(URI(response.location).query)
+    assert_equal "123", redirect_params['client_id']
+    assert_equal "https://app.example.com/auth/duodealer/callback", redirect_params['redirect_uri']
+    assert_equal "read_products", redirect_params['scope']
+    assert_nil redirect_params['grant_options']
+  end
+  def test_authorize_includes_auth_type_when_per_user_permissions_are_requested
+    build_app(per_user_permissions: true)
+    response = authorize('snowdevil.duodealer.com')
+    redirect_params = Rack::Utils.parse_query(URI(response.location).query)
+    assert_equal 'per-user', redirect_params['grant_options[]']
+  end
+  def test_authorize_overrides_site_with_https_scheme
+    build_app setup: lambda { |env|
+      params = Rack::Utils.parse_query(env['QUERY_STRING'])
+      env['omniauth.strategy'].options[:client_options][:site] = "http://#{params['shop']}"
+    }
+    response = request.get('https://app.example.com/auth/duodealer?shop=snowdevil.duodealer.com')
+    assert_match %r{\A#{Regexp.quote(duodealer_authorize_url)}}, response.location
+  end
+  def test_site_validation
+    code = SecureRandom.hex(16)
+    [
+      'foo.example.com',                # shop doesn't end with .duodealer.com
+      'http://snowdevil.duodealer.com', # shop contains protocol
+      'snowdevil.duodealer.com/path',   # shop contains path
+      'user@snowdevil.duodealer.com',   # shop contains user
+      'snowdevil.duodealer.com:22',     # shop contains port
+    ].each do |shop, valid|
+      @shop = shop
+      response = authorize(shop)
+      assert_auth_failure(response, 'invalid_site')
+      response = callback(sign_with_new_secret(shop: shop, code: code))
+      assert_auth_failure(response, 'invalid_site')
+    end
+  end
+  def test_callback
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, OmniAuth::Strategies::Duodealer::DEFAULT_SCOPE)
+    response = callback(sign_with_new_secret(shop: 'snowdevil.duodealer.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    assert_callback_success(response, access_token, code)
+  end
+  def test_callback_with_legacy_signature
+    build_app scope: OmniAuth::Strategies::Duodealer::DEFAULT_SCOPE
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, OmniAuth::Strategies::Duodealer::DEFAULT_SCOPE)
+    response = callback(sign_with_new_secret(shop: 'snowdevil.duodealer.com', code: code, state: opts["rack.session"]["omniauth.state"]).merge(signature: 'ignored'))
+    assert_callback_success(response, access_token, code)
+  end
+  def test_callback_custom_params
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, OmniAuth::Strategies::Duodealer::DEFAULT_SCOPE)
+    now = Time.now.to_i
+    params = { shop: 'snowdevil.duodealer.com', code: code, timestamp: now, next: '/products?page=2&q=red%20shirt', state: opts["rack.session"]["omniauth.state"] }
+    encoded_params = "code=#{code}&next=%2Fproducts%3Fpage%3D2%26q%3Dred%2520shirt&shop=snowdevil.duodealer.com&state=#{opts["rack.session"]["omniauth.state"]}&timestamp=#{now}"
+    params[:hmac] = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new, @secret, encoded_params)
+    response = callback(params)
+    assert_callback_success(response, access_token, code)
+  end
+  def test_callback_with_spaces_in_scope
+    build_app scope: 'write_products, read_orders'
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'read_orders,write_products')
+    response = callback(sign_with_new_secret(shop: 'snowdevil.duodealer.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    assert_callback_success(response, access_token, code)
+  end
+  def test_callback_rejects_invalid_hmac
+    @secret = 'wrong_secret'
+    response = callback(sign_with_new_secret(shop: 'snowdevil.duodealer.com', code: SecureRandom.hex(16)))
+    assert_auth_failure(response, 'invalid_signature')
+  end
+  def test_callback_rejects_old_timestamps
+    expired_timestamp = Time.now.to_i - OmniAuth::Strategies::Duodealer::CODE_EXPIRES_AFTER - 1
+    response = callback(sign_with_new_secret(shop: 'snowdevil.duodealer.com', code: SecureRandom.hex(16), timestamp: expired_timestamp))
+    assert_auth_failure(response, 'invalid_signature')
+  end
+  def test_callback_rejects_missing_hmac
+    code = SecureRandom.hex(16)
+    response = callback(shop: 'snowdevil.duodealer.com', code: code, timestamp: Time.now.to_i)
+    assert_auth_failure(response, 'invalid_signature')
+  end
+  def test_callback_rejects_body_params
+    code = SecureRandom.hex(16)
+    params = sign_with_new_secret(shop: 'snowdevil.duodealer.com', code: code)
+    body = Rack::Utils.build_nested_query(unsigned: 'value')
+    response = request.get("https://app.example.com/auth/duodealer/callback?#{Rack::Utils.build_query(params)}",
+                           input: body,
+                           "CONTENT_TYPE" => 'application/x-www-form-urlencoded',
+                           'rack.session' => {
+                              'duodealer.omniauth_params' => { shop: 'snowdevil.duodealer.com' }
+                            })
+    assert_auth_failure(response, 'invalid_signature')
+  end
+  def test_provider_options
+    build_app scope: 'read_products,read_orders,write_content',
+              callback_path: '/admin/auth/legacy/callback',
+              duodealer_domain: 'duodealer.dev:3000',
+              setup: lambda { |env|
+                shop = Rack::Request.new(env).GET['shop']
+                shop += ".duodealer.dev:3000" unless shop.include?(".")
+                env['omniauth.strategy'].options[:client_options][:site] = "https://#{shop}"
+              }
+    response = request.get("https://app.example.com/auth/duodealer?shop=snowdevil.duodealer.dev:3000")
+    assert_equal 302, response.status
+    assert_match %r{\A#{Regexp.quote("https://snowdevil.duodealer.dev:3000/admin/oauth/authorize?")}}, response.location
+    redirect_params = Rack::Utils.parse_query(URI(response.location).query)
+    assert_equal 'read_products,read_orders,write_content', redirect_params['scope']
+    assert_equal 'https://app.example.com/admin/auth/legacy/callback', redirect_params['redirect_uri']
+  end
+  def test_default_setup_reads_shop_from_session
+    build_app
+    response = authorize('snowdevil.duodealer.com')
+    assert_equal 302, response.status
+    assert_match %r{\A#{Regexp.quote("https://snowdevil.duodealer.com/admin/oauth/authorize?")}}, response.location
+    redirect_params = Rack::Utils.parse_query(URI(response.location).query)
+    assert_equal 'https://app.example.com/auth/duodealer/callback', redirect_params['redirect_uri']
+  end
+  def test_unnecessary_read_scopes_are_removed
+    build_app scope: 'read_content,read_products,write_products',
+              callback_path: '/admin/auth/legacy/callback',
+              duodealer_domain: 'duodealer.dev:3000',
+              setup: lambda { |env|
+                shop = Rack::Request.new(env).GET['shop']
+                env['omniauth.strategy'].options[:client_options][:site] = "https://#{shop}"
+              }
+    response = request.get("https://app.example.com/auth/duodealer?shop=snowdevil.duodealer.dev:3000")
+    assert_equal 302, response.status
+    redirect_params = Rack::Utils.parse_query(URI(response.location).query)
+    assert_equal 'read_content,write_products', redirect_params['scope']
+  end
+  def test_callback_with_invalid_state_fails
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, OmniAuth::Strategies::Duodealer::DEFAULT_SCOPE)
+    response = callback(sign_with_new_secret(shop: 'snowdevil.duodealer.com', code: code, state: 'invalid'))
+    assert_equal 302, response.status
+    assert_equal '/auth/failure?message=csrf_detected&strategy=duodealer', response.location
+  end
+  def test_callback_with_mismatching_scope_fails
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'some_invalid_scope', nil)
+    response = callback(sign_with_new_secret(shop: 'snowdevil.duodealer.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    assert_equal 302, response.status
+    assert_equal '/auth/failure?message=invalid_scope&strategy=duodealer', response.location
+  end
+  def test_callback_with_no_scope_fails
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, nil)
+    response = callback(sign_with_new_secret(shop: 'snowdevil.duodealer.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    assert_equal 302, response.status
+    assert_equal '/auth/failure?message=invalid_scope&strategy=duodealer', response.location
+  end
+  def test_callback_with_missing_access_scope_fails
+    build_app scope: 'first_scope,second_scope'
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'first_scope')
+    response = callback(sign_with_new_secret(shop: 'snowdevil.duodealer.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    assert_equal 302, response.status
+    assert_equal '/auth/failure?message=invalid_scope&strategy=duodealer', response.location
+  end
+  def test_callback_with_extra_access_scope_fails
+    build_app scope: 'first_scope,second_scope'
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'second_scope,first_scope,third_scope')
+    response = callback(sign_with_new_secret(shop: 'snowdevil.duodealer.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    assert_equal 302, response.status
+    assert_equal '/auth/failure?message=invalid_scope&strategy=duodealer', response.location
+  end
+  def test_callback_with_scopes_out_of_order_works
+    build_app scope: 'first_scope,second_scope'
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'second_scope,first_scope')
+    response = callback(sign_with_new_secret(shop: 'snowdevil.duodealer.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    assert_callback_success(response, access_token, code)
+  end
+  def test_callback_with_extra_coma_works
+    build_app scope: 'read_content,,write_products,'
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'read_content,write_products')
+    response = callback(sign_with_new_secret(shop: 'snowdevil.duodealer.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    assert_callback_success(response, access_token, code)
+  end
+  def test_callback_when_per_user_permissions_are_present_but_not_requested
+    build_app(scope: 'scope', per_user_permissions: false)
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'scope', { id: 1, email: 'bob@bobsen.com'})
+    response = callback(sign_with_new_secret(shop: 'snowdevil.duodealer.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    assert_equal 302, response.status
+    assert_equal '/auth/failure?message=invalid_permissions&strategy=duodealer', response.location
+  end
+  def test_callback_when_per_user_permissions_are_not_present_but_requested
+    build_app(scope: 'scope', per_user_permissions: true)
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'scope', nil)
+    response = callback(sign_with_new_secret(shop: 'snowdevil.duodealer.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    assert_equal 302, response.status
+    assert_equal '/auth/failure?message=invalid_permissions&strategy=duodealer', response.location
+  end
+  def test_callback_works_when_per_user_permissions_are_present_and_requested
+    build_app(scope: 'scope', per_user_permissions: true)
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'scope', { id: 1, email: 'bob@bobsen.com'})
+    response = callback(sign_with_new_secret(shop: 'snowdevil.duodealer.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    assert_equal 200, response.status
+  end
+  def test_callback_when_a_session_is_present
+    build_app(scope: 'scope', per_user_permissions: true)
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    session = SecureRandom.hex
+    expect_access_token_request(access_token, 'scope', { id: 1, email: 'bob@bobsen.com'}, session)
+    response = callback(sign_with_new_secret(shop: 'snowdevil.duodealer.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    assert_equal 200, response.status
+  end
+  def test_callback_works_with_old_secret
+    build_app scope: OmniAuth::Strategies::Duodealer::DEFAULT_SCOPE
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, OmniAuth::Strategies::Duodealer::DEFAULT_SCOPE)
+    signed_params = sign_with_old_secret(
+      shop: 'snowdevil.duodealer.com',
+      code: code,
+      state: opts["rack.session"]["omniauth.state"]
+    )
+    response = callback(signed_params)
+    assert_callback_success(response, access_token, code)
+  end
+  def test_callback_when_creds_are_invalid
+    build_app scope: OmniAuth::Strategies::Duodealer::DEFAULT_SCOPE
+    FakeWeb.register_uri(
+      :post,
+      "https://snowdevil.duodealer.com/admin/oauth/access_token",
+      status: [ "401", "Invalid token" ],
+      body: "Token is invalid or has already been requested"
+    )
+    signed_params = sign_with_new_secret(
+      shop: 'snowdevil.duodealer.com',
+      code: SecureRandom.hex(16),
+      state: opts["rack.session"]["omniauth.state"]
+    )
+    response = callback(signed_params)
+    assert_equal 302, response.status
+    assert_equal '/auth/failure?message=invalid_credentials&strategy=duodealer', response.location
+  end
+  private
+  def sign_with_old_secret(params)
+    params = add_time(params)
+    encoded_params = OmniAuth::Strategies::Duodealer.encoded_params_for_signature(params)
+    params['hmac'] = OmniAuth::Strategies::Duodealer.hmac_sign(encoded_params, @old_secret)
+    params
+  end
+  def add_time(params)
+    params = params.dup
+    params[:timestamp] ||= Time.now.to_i
+    params
+  end
+  def sign_with_new_secret(params)
+    params = add_time(params)
+    encoded_params = OmniAuth::Strategies::Duodealer.encoded_params_for_signature(params)
+    params['hmac'] = OmniAuth::Strategies::Duodealer.hmac_sign(encoded_params, @secret)
+    params
+  end
+  def expect_access_token_request(access_token, scope, associated_user=nil, session=nil)
+    FakeWeb.register_uri(:post, "https://snowdevil.duodealer.com/admin/oauth/access_token",
+                         body: JSON.dump(
+                           access_token: access_token,
+                           scope: scope,
+                           associated_user: associated_user,
+                           session: session,
+    ),
+    content_type: 'application/json')
+  end
+  def assert_callback_success(response, access_token, code)
+    token_request_params = Rack::Utils.parse_query(FakeWeb.last_request.body)
+    assert_equal token_request_params['client_id'], '123'
+    assert_equal token_request_params['client_secret'], @secret
+    assert_equal token_request_params['code'], code
+    assert_equal 'snowdevil.duodealer.com', @omniauth_result.uid
+    assert_equal access_token, @omniauth_result.credentials.token
+    assert_equal false, @omniauth_result.credentials.expires
+    assert_equal 200, response.status
+    assert_equal "OK", response.body
+  end
+  def assert_auth_failure(response, reason)
+    assert_nil FakeWeb.last_request
+    assert_equal 302, response.status
+    assert_match %r{\A#{Regexp.quote("/auth/failure?message=#{reason}")}}, response.location
+  end
+  def build_app(options={})
+    @old_secret = '12d34s1'
+    @secret = '53cr3tz'
+    options.merge!(old_client_secret: @old_secret)
+    app = proc { |env|
+      @omniauth_result = env['omniauth.auth']
+      [200, {Rack::CONTENT_TYPE => "text/plain"}, "OK"]
+    }
+    opts["rack.session"]["omniauth.state"] = SecureRandom.hex(32)
+    app = OmniAuth::Builder.new(app) do
+      provider :duodealer, '123', '53cr3tz' , options
+    end
+    @app = Rack::Session::Cookie.new(app, secret: SecureRandom.hex(64))
+  end
+  def shop
+    @shop ||= 'snowdevil.duodealer.com'
+  end
+  def authorize(shop)
+    @opts['rack.session']['duodealer.omniauth_params'] = { shop: shop }
+    request.get('https://app.example.com/auth/duodealer', opts)
+  end
+  def callback(params)
+    @opts['rack.session']['duodealer.omniauth_params'] = { shop: shop }
+    request.get("https://app.example.com/auth/duodealer/callback?#{Rack::Utils.build_query(params)}", opts)
+  end
+  def opts
+    @opts ||= { "rack.session" => {} }
+  end
+  def request
+    Rack::MockRequest.new(@app)
+  end
+  def duodealer_authorize_url
+    "https://snowdevil.duodealer.com/admin/oauth/authorize?"
+  end
+end

data/test/test_helper.rb ADDED

@@ -0,0 +1,11 @@
+$: << File.expand_path("../../lib", __FILE__)
+require 'bundler/setup'
+require 'omniauth-duodealer-oauth2'
+require 'minitest/autorun'
+require 'fakeweb'
+require 'json'
+require 'active_support/core_ext/hash'
+OmniAuth.config.logger = Logger.new(nil)
+FakeWeb.allow_net_connect = false

metadata ADDED

@@ -0,0 +1,119 @@
+--- !ruby/object:Gem::Specification
+name: omniauth-duodealer-oauth2
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- Eric Raio
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2020-02-22 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: omniauth-oauth2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.5.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.5.0
+- !ruby/object:Gem::Dependency
+  name: minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.6'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.6'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description:
+email:
+- eric@duodealer.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".github/probots.yml"
+- ".gitignore"
+- ".ruby-version"
+- ".travis.yml"
+- Gemfile
+- Rakefile
+- example/Gemfile
+- example/config.ru
+- lib/omniauth-duodealer-oauth2.rb
+- lib/omniauth/duodealer.rb
+- lib/omniauth/duodealer/version.rb
+- lib/omniauth/strategies/duodealer.rb
+- omniauth-duodealer-oauth2.gemspec
+- shipit.rubygems.yml
+- spec/omniauth/strategies/duodealer_spec.rb
+- test/integration_test.rb
+- test/test_helper.rb
+homepage: https://gitlab.com/duodealer/omniauth-duodealer-oauth2
+licenses:
+- MIT
+metadata: {}
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.1.9
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.0.3
+signing_key:
+specification_version: 4
+summary: duodealer strategy for OmniAuth
+test_files:
+- spec/omniauth/strategies/duodealer_spec.rb
+- test/integration_test.rb
+- test/test_helper.rb