omniauth-facebook 10.0.0 → 11.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0a121c1f37d032c1669ec67eb4cd7629f569dfc063e69f054a776a80b68409eb
-  data.tar.gz: 5b38258394e3cac9e7579ccb5bbe2af62034965ab870739fcf7e94800cb614be
+  metadata.gz: 84cc0553d04d99409310d315bd015cdb8ccb9d9b44a7e1ba2e4e5dc1bb0e3352
+  data.tar.gz: '0810f2c70af2a19545eb8ba78917f50fd484fd49763e7000d184d66f4775a892'
 SHA512:
-  metadata.gz: '00297b6593b4a91e1738df9d6af7bb9252ca8404fb0ed0d269580337557f9f777a43fc121abbca9627bb83f085e6f7192eee8e959876c5a158b0bdb925831983'
-  data.tar.gz: e8029bc7178ec6675393f7689de9c531977981e5f5b589be5ad5238d78f01a8a1bec93a539cbcac490ac91d62f3a0270336bfaddc9a5c3cf924fe95711a2abbe
+  metadata.gz: f43b2f8440b47bea9033b951ea6195abd1e2618204790830cefaf5e2b98ccb67d6c4e2678531f654e5e647738008ef8f21d25bd29837b5f4438ad4e84abd0205
+  data.tar.gz: d193ba5cb97033c62c4127f32155d5741f324adf6582e9e567c36e75b9e7eef7ec0c67b95decf37e20e97ebbfe025dcb7b5682dad11798adf7b83ec123c1998e

data/.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

data/.github/workflows/ci.yml

@@ -9,13 +9,12 @@ jobs:
       fail-fast: false
       matrix:
         ruby:
-          - "3.0"
-          - "3.1"
-          - "3.2"
           - "3.3"
+          - "3.4"
+          - "4.0"
           - head
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1
       with:

data/.github/workflows/stale.yml

@@ -17,7 +17,7 @@ jobs:
         stale-pr-message: 'This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.'
         stale-issue-label: 'no-issue-activity'
         stale-pr-label: 'no-pr-activity'
-        days-before-stale: 30
-        days-before-close: 5
+        days-before-stale: 90
+        days-before-close: 60
         exempt-pr-label: 'pinned'
         exempt-issue-label: 'pinned'

data/CHANGELOG.md

@@ -1,8 +1,18 @@
+## 11.0.0 (2026-07-18)
+
+Changes:
+
+  - bumped version of FB Graph API to v24.0
+  - remove access token from profile picture URL (#388, @Rubyist007)
+
 ## 10.0.0 (2024-05-23)
 
 Changes:
 
   - bumped version of FB Graph API to v19.0
+  - add `config_id` to per-request options and configuration (#386, @harism2)
+  - fix duplicated `script_name` in `callback_url` (#380, @tak1n)
+  - add `bigdecimal` dependency for Ruby 3.4 compatibility
 
 ## 9.0.0 (2021-10-25)
 

data/README.md

@@ -1,4 +1,4 @@
-# OmniAuth Facebook  [![Build Status](https://secure.travis-ci.org/simi/omniauth-facebook.svg?branch=master)](https://travis-ci.org/simi/omniauth-facebook) [![Gem Version](https://img.shields.io/gem/v/omniauth-facebook.svg)](https://rubygems.org/gems/omniauth-facebook)
+# OmniAuth Facebook  [![CI](https://github.com/simi/omniauth-facebook/actions/workflows/ci.yml/badge.svg?branch=master)](https://github.com/simi/omniauth-facebook/actions/workflows/ci.yml) [![Gem Version](https://img.shields.io/gem/v/omniauth-facebook.svg)](https://rubygems.org/gems/omniauth-facebook)
 
 📣 **NOTICE** We’re looking for maintainers to help keep this project up-to-date. If you are interested in helping please open an Issue expressing your interest. Thanks! 📣
 
@@ -60,7 +60,7 @@ end
 
 ### API Version
 
-OmniAuth Facebook uses versioned API endpoints by default (current v19.0). You can configure a different version via `client_options` hash passed to `provider`, specifically you should change the version in the `site` and `authorize_url` parameters. For example, to change to v20.0 (assuming that exists):
+OmniAuth Facebook uses versioned API endpoints by default (current v24.0). You can configure a different version via `client_options` hash passed to `provider`, specifically you should change the version in the `site` and `authorize_url` parameters. For example, to change to v20.0 (assuming that exists):
 
 ```ruby
 use OmniAuth::Builder do
@@ -89,7 +89,7 @@ Here's an example *Auth Hash* available in `request.env['omniauth.auth']`:
     name: 'Joe Bloggs',
     first_name: 'Joe',
     last_name: 'Bloggs',
-    image: 'http://graph.facebook.com/1234567/picture?type=square&access_token=...',
+    image: 'http://graph.facebook.com/1234567/picture?type=square',
     verified: true
   },
   credentials: {

data/lib/omniauth/facebook/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module Facebook
-    VERSION = '10.0.0'
+    VERSION = '11.0.0'
   end
 end

data/lib/omniauth/strategies/facebook.rb

@@ -10,7 +10,7 @@ module OmniAuth
       class NoAuthorizationCodeError < StandardError; end
 
       DEFAULT_SCOPE = 'email'
-      DEFAULT_FACEBOOK_API_VERSION = 'v19.0'.freeze
+      DEFAULT_FACEBOOK_API_VERSION = 'v24.0'.freeze
 
       option :client_options, {
         site: "https://graph.facebook.com/#{DEFAULT_FACEBOOK_API_VERSION}",
@@ -164,15 +164,13 @@ module OmniAuth
         uri_class = options[:secure_image_url] ? URI::HTTPS : URI::HTTP
         site_uri = URI.parse(client.site)
         url = uri_class.build({host: site_uri.host, path: "#{site_uri.path}/#{uid}/picture"})
-        query = { access_token: access_token.token }
 
-        if options[:image_size].is_a?(String) || options[:image_size].is_a?(Symbol)
-          query[:type] = options[:image_size]
+        query = if options[:image_size].is_a?(String) || options[:image_size].is_a?(Symbol)
+          { type: options[:image_size] }
         elsif options[:image_size].is_a?(Hash)
-          query.merge!(options[:image_size])
+          options[:image_size]
         end
-
-        url.query = Rack::Utils.build_query(query)
+        url.query = Rack::Utils.build_query(query) if query
 
         url.to_s
       end

data/omniauth-facebook.gemspec

@@ -11,7 +11,7 @@ Gem::Specification.new do |s|
   s.homepage = 'https://github.com/simi/omniauth-facebook'
   s.license  = 'MIT'
 
-  s.files         = `git ls-files`.split("\n")
+  s.files         = `git ls-files`.split("\n").reject { |path| path.start_with? "example/" }
   s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
   s.executables   = `git ls-files -- bin/*`.split("\n").map { |f| File.basename(f) }
   s.require_paths = ['lib']

data/test/strategy_test.rb

@@ -102,67 +102,54 @@ class UidTest < StrategyTestCase
 end
 
 class InfoTest < StrategyTestCase
-  def setup
-    super
-    @access_token = stub('OAuth2::AccessToken')
-    @access_token.stubs(:token).returns('test_access_token')
-  end
-
   test 'returns the secure facebook avatar url when `secure_image_url` option is set to true' do
     @options = { secure_image_url: true }
     raw_info = { 'name' => 'Fred Smith', 'id' => '321' }
     strategy.stubs(:raw_info).returns(raw_info)
-    strategy.stubs(:access_token).returns(@access_token)
-    assert_equal "https://graph.facebook.com/#{@facebook_api_version}/321/picture?access_token=test_access_token", strategy.info['image']
+    assert_equal "https://graph.facebook.com/#{@facebook_api_version}/321/picture", strategy.info['image']
   end
 
   test 'returns the non-ssl facebook avatar url when `secure_image_url` option is set to false' do
     @options = { secure_image_url: false }
     raw_info = { 'name' => 'Fred Smith', 'id' => '321' }
     strategy.stubs(:raw_info).returns(raw_info)
-    strategy.stubs(:access_token).returns(@access_token)
-    assert_equal "http://graph.facebook.com/#{@facebook_api_version}/321/picture?access_token=test_access_token", strategy.info['image']
+    assert_equal "http://graph.facebook.com/#{@facebook_api_version}/321/picture", strategy.info['image']
   end
 
   test 'returns the secure facebook avatar url when `secure_image_url` option is omitted' do
     raw_info = { 'name' => 'Fred Smith', 'id' => '321' }
     strategy.stubs(:raw_info).returns(raw_info)
-    strategy.stubs(:access_token).returns(@access_token)
-    assert_equal "https://graph.facebook.com/#{@facebook_api_version}/321/picture?access_token=test_access_token", strategy.info['image']
+    assert_equal "https://graph.facebook.com/#{@facebook_api_version}/321/picture", strategy.info['image']
   end
 
   test 'returns the image_url based of the client site' do
     @options = { secure_image_url: true, client_options: {site: "https://blah.facebook.com/v2.2"}}
     raw_info = { 'name' => 'Fred Smith', 'id' => '321' }
     strategy.stubs(:raw_info).returns(raw_info)
-    strategy.stubs(:access_token).returns(@access_token)
-    assert_equal "https://blah.facebook.com/v2.2/321/picture?access_token=test_access_token", strategy.info['image']
+    assert_equal "https://blah.facebook.com/v2.2/321/picture", strategy.info['image']
   end
 
   test 'returns the image with size specified in the `image_size` option' do
     @options = { image_size: 'normal' }
     raw_info = { 'name' => 'Fred Smith', 'id' => '321' }
     strategy.stubs(:raw_info).returns(raw_info)
-    strategy.stubs(:access_token).returns(@access_token)
-    assert_equal "https://graph.facebook.com/#{@facebook_api_version}/321/picture?access_token=test_access_token&type=normal", strategy.info['image']
+    assert_equal "https://graph.facebook.com/#{@facebook_api_version}/321/picture?type=normal", strategy.info['image']
   end
 
   test 'returns the image with size specified as a symbol in the `image_size` option' do
     @options = { image_size: :normal }
     raw_info = { 'name' => 'Fred Smith', 'id' => '321' }
     strategy.stubs(:raw_info).returns(raw_info)
-    strategy.stubs(:access_token).returns(@access_token)
-    assert_equal "https://graph.facebook.com/#{@facebook_api_version}/321/picture?access_token=test_access_token&type=normal", strategy.info['image']
+    assert_equal "https://graph.facebook.com/#{@facebook_api_version}/321/picture?type=normal", strategy.info['image']
   end
 
   test 'returns the image with width and height specified in the `image_size` option' do
     @options = { image_size: { width: 123, height: 987 } }
     raw_info = { 'name' => 'Fred Smith', 'id' => '321' }
     strategy.stubs(:raw_info).returns(raw_info)
-    strategy.stubs(:access_token).returns(@access_token)
     assert_match 'width=123', strategy.info['image']
     assert_match 'height=987', strategy.info['image']
-    assert_match "https://graph.facebook.com/#{@facebook_api_version}/321/picture?access_token=test_access_token", strategy.info['image']
+    assert_match "https://graph.facebook.com/#{@facebook_api_version}/321/picture", strategy.info['image']
   end
 end
 
@@ -171,10 +158,6 @@ class InfoTestOptionalDataPresent < StrategyTestCase
     super
     @raw_info ||= { 'name' => 'Fred Smith' }
     strategy.stubs(:raw_info).returns(@raw_info)
-
-    access_token = stub('OAuth2::AccessToken')
-    access_token.stubs(:token).returns('test_access_token')
-    strategy.stubs(:access_token).returns(access_token)
   end
 
   test 'returns the name' do
@@ -213,7 +196,7 @@ class InfoTestOptionalDataPresent < StrategyTestCase
 
   test 'returns the facebook avatar url' do
     @raw_info['id'] = '321'
-    assert_equal "https://graph.facebook.com/#{@facebook_api_version}/321/picture?access_token=test_access_token", strategy.info['image']
+    assert_equal "https://graph.facebook.com/#{@facebook_api_version}/321/picture", strategy.info['image']
   end
 
   test 'returns the Facebook link as the Facebook url' do
@@ -252,10 +235,6 @@ class InfoTestOptionalDataNotPresent < StrategyTestCase
     super
     @raw_info ||= { 'name' => 'Fred Smith' }
     strategy.stubs(:raw_info).returns(@raw_info)
-
-    access_token = stub('OAuth2::AccessToken')
-    access_token.stubs(:token).returns('test_access_token')
-    strategy.stubs(:access_token).returns(access_token)
   end
 
   test 'has no email key' do

data/test/support/shared_examples.rb

@@ -8,10 +8,10 @@ module OAuth2StrategyTests
       include TokenParamsTests
     end
   end
-  
+
   module ClientTests
     extend BlockTestHelper
-    
+
     test 'should be initialized with symbolized client_options' do
       @options = { client_options: { 'authorize_url' => 'https://example.com' } }
       assert_equal 'https://example.com', strategy.client.options[:authorize_url]
@@ -20,7 +20,7 @@ module OAuth2StrategyTests
 
   module AuthorizeParamsTests
     extend BlockTestHelper
-    
+
     test 'should include any authorize params passed in the :authorize_params option' do
       @options = { authorize_params: { foo: 'bar', baz: 'zip' } }
       assert_equal 'bar', strategy.authorize_params['foo']
@@ -32,7 +32,7 @@ module OAuth2StrategyTests
       assert_equal 'bar', strategy.authorize_params['scope']
       assert_equal 'baz', strategy.authorize_params['foo']
     end
-    
+
     test 'should exclude top-level options that are not passed' do
       @options = { authorize_options: [:bar] }
       refute_has_key :bar, strategy.authorize_params
@@ -69,7 +69,7 @@ module OAuth2StrategyTests
 
   module TokenParamsTests
     extend BlockTestHelper
-    
+
     test 'should include any authorize params passed in the :token_params option' do
       @options = { token_params: { foo: 'bar', baz: 'zip' } }
       assert_equal 'bar', strategy.token_params['foo']

metadata

@@ -1,15 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-facebook
 version: !ruby/object:Gem::Version
-  version: 10.0.0
+  version: 11.0.0
 platform: ruby
 authors:
 - Mark Dodwell
 - Josef Šimánek
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-05-22 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-oauth2
@@ -87,7 +86,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description:
 email:
 - mark@madeofcode.com
 - retro@ballgag.cz
@@ -95,6 +93,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/dependabot.yml"
 - ".github/workflows/ci.yml"
 - ".github/workflows/stale.yml"
 - ".gitignore"
@@ -102,10 +101,6 @@ files:
 - Gemfile
 - README.md
 - Rakefile
-- example/Gemfile
-- example/Gemfile.lock
-- example/app.rb
-- example/config.ru
 - lib/omniauth-facebook.rb
 - lib/omniauth/facebook.rb
 - lib/omniauth/facebook/signed_request.rb
@@ -122,7 +117,6 @@ homepage: https://github.com/simi/omniauth-facebook
 licenses:
 - MIT
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -137,8 +131,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.0.dev
-signing_key:
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Facebook OAuth2 Strategy for OmniAuth
 test_files:

data/example/Gemfile

@@ -1,5 +0,0 @@
-source 'https://rubygems.org'
-
-gem 'sinatra'
-gem 'sinatra-reloader'
-gem 'omniauth-facebook', path: '../'

data/example/Gemfile.lock

@@ -1,63 +0,0 @@
-PATH
-  remote: ..
-  specs:
-    omniauth-facebook (8.0.0)
-      omniauth-oauth2 (~> 1.2)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    backports (3.15.0)
-    faraday (1.1.0)
-      multipart-post (>= 1.2, < 3)
-      ruby2_keywords
-    hashie (4.1.0)
-    jwt (2.2.2)
-    multi_json (1.14.1)
-    multi_xml (0.6.0)
-    multipart-post (2.1.1)
-    mustermann (1.1.1)
-      ruby2_keywords (~> 0.0.1)
-    oauth2 (1.4.4)
-      faraday (>= 0.8, < 2.0)
-      jwt (>= 1.0, < 3.0)
-      multi_json (~> 1.3)
-      multi_xml (~> 0.5)
-      rack (>= 1.2, < 3)
-    omniauth (1.9.1)
-      hashie (>= 3.4.6)
-      rack (>= 1.6.2, < 3)
-    omniauth-oauth2 (1.7.0)
-      oauth2 (~> 1.4)
-      omniauth (~> 1.9)
-    rack (2.2.3)
-    rack-protection (2.0.8.1)
-      rack
-    ruby2_keywords (0.0.2)
-    sinatra (2.0.8.1)
-      mustermann (~> 1.0)
-      rack (~> 2.0)
-      rack-protection (= 2.0.8.1)
-      tilt (~> 2.0)
-    sinatra-contrib (2.0.8.1)
-      backports (>= 2.8.2)
-      multi_json
-      mustermann (~> 1.0)
-      rack-protection (= 2.0.8.1)
-      sinatra (= 2.0.8.1)
-      tilt (~> 2.0)
-    sinatra-reloader (1.0)
-      sinatra-contrib
-    tilt (2.0.10)
-
-PLATFORMS
-  ruby
-  x64-mingw32
-
-DEPENDENCIES
-  omniauth-facebook!
-  sinatra
-  sinatra-reloader
-
-BUNDLED WITH
-   1.17.3

data/example/app.rb

@@ -1,86 +0,0 @@
-require 'sinatra'
-require "sinatra/reloader"
-require 'yaml'
-require 'json'
-
-# configure sinatra
-set :run, false
-set :raise_errors, true
-
-# REQUEST STEP (server-side flow)
-get '/server-side' do
-  # NOTE: You would just hit this endpoint directly from the browser in a real app. The redirect is
-  #       just here to explicit declare this server-side flow.
-  redirect '/auth/facebook'
-end
-
-# REQUEST STEP (client-side flow)
-get '/client-side' do
-  content_type 'text/html'
-  # NOTE: When you enable cookie below in the FB.init call the GET request in the FB.login callback
-  #       will send a signed request in a cookie back the OmniAuth callback which will parse out the
-  #       authorization code and obtain an access_token with it.
-  <<-HTML
-    <html>
-    <head>
-      <title>Client-side Flow Example</title>
-      <script src="https://ajax.googleapis.com/ajax/libs/jquery/2.2.2/jquery.min.js" type="text/javascript"></script>
-      <script type="text/javascript">
-        window.fbAsyncInit = function() {
-          FB.init({
-            appId: '#{ENV['FACEBOOK_APP_ID']}',
-            version: 'v4.0',
-            cookie: true // IMPORTANT must enable cookies to allow the server to access the session
-          });
-          console.log("fb init");
-        };
-
-        (function(d, s, id){
-           var js, fjs = d.getElementsByTagName(s)[0];
-           if (d.getElementById(id)) {return;}
-           js = d.createElement(s); js.id = id;
-           js.src = "//connect.facebook.net/en_US/sdk.js";
-           fjs.parentNode.insertBefore(js, fjs);
-         }(document, 'script', 'facebook-jssdk'));
-      </script>
-    </head>
-    <body>
-      <div id="fb-root"></div>
-
-      <p id="connect">
-        <a href="#">Connect to FB!</a>
-      </p>
-
-      <p id="results" />
-
-      <script type="text/javascript">
-        $('a').click(function(e) {
-          e.preventDefault();
-
-          FB.login(function(response) {
-            console.log(response);
-            if (response.authResponse) {
-              $('#connect').html('Connected! Hitting OmniAuth callback (GET /auth/facebook/callback)...');
-
-              // since we have cookies enabled, this request will allow omniauth to parse
-              // out the auth code from the signed request in the fbsr_XXX cookie
-              $.getJSON('/auth/facebook/callback', function(json) {
-                $('#connect').html('Connected! Callback complete.');
-                $('#results').html(JSON.stringify(json));
-              });
-            }
-          }); // if you want custom scopes, pass them as an extra, final argument to FB.login
-        });
-      </script>
-    </body>
-    </html>
-  HTML
-end
-
-# CALLBACK STEP
-# - redirected here for server-side flow
-# - ajax request made here for client-side flow
-get '/auth/:provider/callback' do
-  content_type 'application/json'
-  JSON.dump(request.env)
-end

data/example/config.ru

@@ -1,11 +0,0 @@
-require 'bundler/setup'
-require 'omniauth-facebook'
-require './app.rb'
-
-use Rack::Session::Cookie, secret: 'abc123'
-
-use OmniAuth::Builder do
-  provider :facebook, ENV['FACEBOOK_APP_ID'], ENV['FACEBOOK_APP_SECRET']
-end
-
-run Sinatra::Application