omniauth-fdc 0.1.1 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2975bc483d12b4b7a724e5b3f1c8ed5b6704c96668cbd462220c1d7a5a219463
-  data.tar.gz: ab0cdd65d0018c9ef9f7033a751efc6800ddfbf637b6aeaf93bb4db0fb1b48ea
+  metadata.gz: 03f3f116f55ffd9ff8f27f64a0a0945fc493bab63561e232c384987c17609995
+  data.tar.gz: 2b6e24afd77dc0942302dc2b1b0a68bd2652d5c3e2f61f1eee6ac7d25194927f
 SHA512:
-  metadata.gz: 8568de1e5f98a4d9651cb84222ca37966c4e9b3d695fdf14b8b4d094306957eac2053c99e377c5578dc000ebc7de273079b81693d173afc25c3fc426b2871e78
-  data.tar.gz: e0c0b89584e44a2605eea3b1fcd2e0e03d32a96e75e26e2150b81481f0d9cdc0a053d9aa9058aa1f257a5988a39e49a810908b9be823f82b5b04a53c93cbba48
+  metadata.gz: 4fe125a86dfaba2fe9083e5ee748eb444cd20e7d7ca62d55d257f5a6e7ae7638983200c693f54dc8bcae14a747dcf5589ff3f426a2245186b5a235f69d3104df
+  data.tar.gz: 47e6adc2d699e8495c63db3c86e4d15196c118b435169a0cea59a5bfd61f546af7dfbd385170057b9377b072b1b670409945b9c03b076d85d7eaf893f9ef0226

data/CHANGELOG.md

@@ -0,0 +1,63 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+## [0.2.0] - 2026-08-26
+
+### Changed
+
+- **Breaking:** requires `omniauth ~> 2.0` and `omniauth-oauth2 ~> 1.9` (previously an
+  unpinned `omniauth-oauth2`, which resolved to `omniauth 1.9` / `oauth2 1.4`). Host
+  applications must upgrade to OmniAuth 2.x; Rails apps also need
+  [`omniauth-rails_csrf_protection`](https://github.com/cookpad/omniauth-rails_csrf_protection)
+  because OmniAuth 2 only accepts `POST` for the request phase.
+- Pinned the token endpoint to `auth_scheme: :request_body`. `oauth2 2.0` changed its
+  default to `:basic_auth`, which would have moved `client_id`/`client_secret` out of
+  the token request body and changed what Fulfillment.com receives.
+- Requires Ruby >= 3.2 (the modern `oauth2` dependency chain requires it).
+- Development toolchain: Bundler 4.x, `rake ~> 13.0`, `rspec ~> 3.13`.
+- Replaced Travis CI with GitHub Actions, testing Ruby 3.2 through 3.4.
+- Releases are now cut from the GitHub Releases UI: publishing a `vX.Y.Z` release reruns
+  the matrix, checks the tag against `version.rb`, and publishes to RubyGems.org via
+  trusted publishing (OIDC, no stored API key).
+
+### Added
+
+- `LICENSE.txt` (MIT), now declared in the gemspec.
+- A default `client_options[:site]` of `https://auth.fulfillment.com`, so the strategy
+  works without a `setup` lambda. Overriding `client_options[:site]` still wins.
+- Integration specs covering the request phase, the token exchange, the `redirect_uri`
+  override and the auth hash.
+- A weekly `bundle-audit` run, so a new advisory against the locked `oauth2`/`rack`
+  chain surfaces here rather than in a consuming app.
+
+### Fixed
+
+- `callback_url` no longer doubles a mount prefix. The override added `script_name` to
+  `callback_path`, but OmniAuth 2 moved `script_name` into `callback_path` itself, so a
+  strategy mounted under a prefix (for example Devise's `/users`) would have sent
+  `redirect_uri=http://host/users/users/auth/fdc/callback`.
+- Resolved 39 advisories carried by the old locked dependency tree, including
+  `omniauth` CVE-2015-9284 and CVE-2020-36599, `oauth2` CVE-2026-54603, `jwt`
+  CVE-2026-45363, `faraday` CVE-2026-54297, and 30 against `rack 2.2.3`.
+- `bin/console` required a non-existent `omniauth/fdc` file.
+- Development scripts in `bin/` are no longer packaged as gem executables, and the
+  committed `.gem` build artifacts are gone from the repo.
+
+## [0.1.2] - 2020-06-29
+
+- `callback_url` is overridden so query params from a configured `redirect_uri` are not
+  sent to Fulfillment.com (#4).
+
+## [0.1.1] - 2020-05-20
+
+- Raised the `omniauth-oauth2` floor to 1.6 and dropped the upper version constraint.
+
+## [0.1.0] - 2018-10-15
+
+- Initial published strategy.
+
+[0.2.0]: https://github.com/dropstream/omniauth-fdc/releases/tag/v0.2.0
+[0.1.2]: https://rubygems.org/gems/omniauth-fdc/versions/0.1.2
+[0.1.1]: https://rubygems.org/gems/omniauth-fdc/versions/0.1.1
+[0.1.0]: https://rubygems.org/gems/omniauth-fdc/versions/0.1.0

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2018-2026 Dropstream
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -1,8 +1,8 @@
 # Omniauth::Fdc
 
-Welcome to your new gem! In this directory, you'll find the files you need to be able to package up your Ruby library into a gem. Put your Ruby code in the file `lib/omniauth/fdc`. To experiment with that code, run `bin/console` for an interactive prompt.
+This is an OmniAuth strategy for authenticating to [Fulfillment.com](https://www.fulfillment.com).
 
-TODO: Delete this and the text above, and describe your gem
+Requires Ruby >= 3.2, OmniAuth 2.x and `omniauth-oauth2` 1.9.x.
 
 ## Installation
 
@@ -22,14 +22,114 @@ Or install it yourself as:
 
 ## Usage
 
-TODO: Write usage instructions here
+OmniAuth 2 only accepts `POST` for the request phase. In a Rails app, add
+[`omniauth-rails_csrf_protection`](https://github.com/cookpad/omniauth-rails_csrf_protection)
+to your Gemfile and link to the provider with `button_to` or `link_to ..., method: :post`:
+
+```ruby
+gem 'omniauth-rails_csrf_protection'
+```
+
+```ruby
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider :fdc,
+           'client_id', 'client_secret',
+           :scope => 'oms'
+end
+```
+
+The auth hash carries the token under `credentials`:
+
+```ruby
+auth = request.env['omniauth.auth']
+auth['credentials']['token']
+```
+
+## Configuring
+
+### Configure the auth host
+
+`client_options[:site]` defaults to `https://auth.fulfillment.com`. Point it elsewhere to
+authenticate against a different Fulfillment.com environment:
+
+```ruby
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider :fdc,
+           'client_id', 'client_secret',
+           :scope => 'oms',
+           :client_options => { :site => 'https://auth.staging.fulfillment.com' }
+end
+```
+
+Setting it from a `setup` lambda also still works, which is how apps configured the host
+before the default existed:
+
+```ruby
+  :setup => ->(env) { env['omniauth.strategy'].options[:client_options][:site] = 'https://auth.fulfillment.com' }
+```
+
+### Configure the callback URL
+
+The strategy overrides `callback_url` to drop the query string that OmniAuth would
+otherwise append, because Fulfillment.com rejects a `redirect_uri` that does not match
+the registered one exactly. Pass `callback_url` to override it outright:
+
+```ruby
+  :callback_url => 'https://app.example.com/users/auth/fdc/callback'
+```
+
+Otherwise it is derived from the request, including the mount prefix — a strategy mounted
+under Devise's `/users` produces `https://app.example.com/users/auth/fdc/callback`.
+
+### Client credentials in the token request
+
+`client_options[:auth_scheme]` is pinned to `:request_body`, because Fulfillment.com
+expects `client_id` and `client_secret` in the token request body. This was `oauth2` 1.x's
+default; `oauth2` 2.x defaults to `:basic_auth`. Do not override it unless
+Fulfillment.com starts accepting HTTP Basic auth on the token endpoint.
 
 ## Development
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+After checking out the repo, run `bin/setup` to install dependencies. Then, run `bundle exec rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
 
-To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+To install this gem onto your local machine, run `bundle exec rake install`.
+
+Run `bundle exec bundle-audit check --update` to check the locked dependency tree against
+the advisory database; CI runs the same check weekly.
+
+## Releasing
+
+Releases are cut from the [GitHub Releases UI](https://github.com/dropstream/omniauth-fdc/releases/new);
+GitHub Actions builds and publishes the gem to [rubygems.org](https://rubygems.org) via
+[RubyGems trusted publishing](https://guides.rubygems.org/trusted-publishing/), so no API
+key is stored in the repo and the gemspec can keep `rubygems_mfa_required`.
+
+1. Bump `VERSION` in `lib/omniauth-fdc/version.rb` and add a `CHANGELOG.md` section
+   for it, along with a link definition for the new heading at the bottom of that file.
+   Commit both on `master`.
+2. Draft a new release with the target set to `master` and the tag set to the version
+   prefixed with `v` — `v0.2.0`, not `0.2.0`. The prefix is stripped before comparing
+   against `version.rb`; the gem version itself carries no `v`.
+3. Click **Generate release notes** — the preferred method — then publish. The generated
+   notes list the merged pull requests; `CHANGELOG.md` carries the curated prose and
+   links back to each release.
+
+Publishing creates the tag, which fires the `Release` workflow: it reruns the full test
+matrix, refuses to continue if the tag and `version.rb` disagree, and pushes the gem.
+Note that RubyGems versions are immutable — a bad release can be yanked, never replaced,
+so the version bump has to be committed before the release is published.
+
+### One-time RubyGems setup
+
+Needed before the first release from CI, and again only if the gem is renamed or moved:
+on rubygems.org open the gem -> **Trusted publishers** -> **Create**, with owner
+`dropstream`, repository `omniauth-fdc`, workflow `release.yml`, and environment
+`release`. The repo also needs an environment named `release`.
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/omniauth-fdc.
+Bug reports and pull requests are welcome on GitHub at https://github.com/dropstream/omniauth-fdc.
+
+## License
+
+Available as open source under the terms of the [MIT License](LICENSE.txt).

data/lib/omniauth/strategies/fdc.rb

@@ -1,13 +1,28 @@
+# frozen_string_literal: true
+
 require 'omniauth-oauth2'
 
 module OmniAuth
   module Strategies
     class Fdc < OmniAuth::Strategies::OAuth2
+      DEFAULT_SITE = 'https://auth.fulfillment.com'
 
       option :client_options, {
+        :site => DEFAULT_SITE,
         :authorize_url => '/oauth/authorize',
         :token_url => '/oauth/access_token',
-      }        
+        # oauth2 2.x defaults to :basic_auth; Fulfillment.com expects the client
+        # credentials in the token request body, which was the oauth2 1.x default.
+        :auth_scheme => :request_body
+      }
+
+      # OmniAuth::Strategy#callback_url appends the callback request's own query
+      # string, which would send those params to Fulfillment.com as part of
+      # redirect_uri and break the exchange. Note that omniauth 2's `callback_path`
+      # already carries SCRIPT_NAME, so mount prefixes must not be added again.
+      def callback_url
+        options[:callback_url] || (full_host + callback_path)
+      end
     end
   end
 end

data/lib/omniauth-fdc/version.rb

@@ -1,5 +1,7 @@
+# frozen_string_literal: true
+
 module Omniauth
   module Fdc
-    VERSION = "0.1.1"
+    VERSION = "0.2.0"
   end
 end

data/lib/omniauth-fdc.rb

@@ -1,2 +1,4 @@
+# frozen_string_literal: true
+
 require "omniauth-fdc/version"
 require 'omniauth/strategies/fdc'

data/omniauth-fdc.gemspec

@@ -1,5 +1,6 @@
+# frozen_string_literal: true
 
-lib = File.expand_path("../lib", __FILE__)
+lib = File.expand_path("lib", __dir__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 require "omniauth-fdc/version"
 
@@ -9,31 +10,27 @@ Gem::Specification.new do |spec|
   spec.authors       = ["Sreejith Pillai"]
   spec.email         = ["sreejith.gp@icloud.com"]
 
-  spec.summary       = %q{OmniAuth strategy for Fulfillment.com}
-  spec.description   = %q{In this gem you will find an OmniAuth Fdc strategy}
+  spec.summary       = "OmniAuth strategy for Fulfillment.com"
+  spec.description   = "In this gem you will find an OmniAuth Fdc strategy"
   spec.homepage      = "https://github.com/dropstream/omniauth-fdc"
+  spec.license       = "MIT"
 
-  # Prevent pushing this gem to RubyGems.org. To allow pushes either set the 'allowed_push_host'
-  # to allow pushing to a single host or delete this section to allow pushing to any host.
-  if spec.respond_to?(:metadata)
-    spec.metadata["allowed_push_host"] = "https://rubygems.org"
-  else
-    raise "RubyGems 2.0 or newer is required to protect against " \
-      "public gem pushes."
-  end
+  spec.required_ruby_version = ">= 3.2"
+
+  spec.metadata["allowed_push_host"] = "https://rubygems.org"
+  spec.metadata["homepage_uri"]      = spec.homepage
+  spec.metadata["changelog_uri"]     = "#{spec.homepage}/blob/master/CHANGELOG.md"
+  spec.metadata["rubygems_mfa_required"] = "true"
 
-  # Specify which files should be added to the gem when it is released.
-  # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
-  spec.files         = Dir.chdir(File.expand_path('..', __FILE__)) do
-    `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
+  # Ship only the library itself; development scaffolding stays out of the gem.
+  spec.files = Dir.chdir(__dir__) do
+    `git ls-files -z`.split("\x0").reject do |f|
+      f.match(%r{\A(?:spec|bin|pkg|\.github)/}) ||
+        f.match(%r{\A(?:\.gitignore|\.rspec|\.ruby-version|\.ruby-gemset|Gemfile|Gemfile\.lock|Rakefile)\z})
+    end
   end
-  spec.bindir        = "exe"
-  spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_runtime_dependency 'omniauth-oauth2'
-
-  spec.add_development_dependency "bundler", "~> 1.16"
-  spec.add_development_dependency "rake", "~> 10.0"
-  spec.add_development_dependency "rspec", "~> 3.0"
+  spec.add_dependency "omniauth", "~> 2.0"
+  spec.add_dependency "omniauth-oauth2", "~> 1.9"
 end

metadata

@@ -1,71 +1,42 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-fdc
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.2.0
 platform: ruby
 authors:
 - Sreejith Pillai
-autorequire: 
-bindir: exe
+bindir: bin
 cert_chain: []
-date: 2020-05-21 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: omniauth-oauth2
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: bundler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.16'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.16'
-- !ruby/object:Gem::Dependency
-  name: rake
+  name: omniauth
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
-  type: :development
+        version: '2.0'
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '2.0'
 - !ruby/object:Gem::Dependency
-  name: rspec
+  name: omniauth-oauth2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
-  type: :development
+        version: '1.9'
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '1.9'
 description: In this gem you will find an OmniAuth Fdc strategy
 email:
 - sreejith.gp@icloud.com
@@ -73,26 +44,21 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".gitignore"
-- ".rspec"
-- ".ruby-gemset"
-- ".ruby-version"
-- ".travis.yml"
-- Gemfile
-- Gemfile.lock
+- CHANGELOG.md
+- LICENSE.txt
 - README.md
-- Rakefile
-- bin/console
-- bin/setup
 - lib/omniauth-fdc.rb
 - lib/omniauth-fdc/version.rb
 - lib/omniauth/strategies/fdc.rb
 - omniauth-fdc.gemspec
 homepage: https://github.com/dropstream/omniauth-fdc
-licenses: []
+licenses:
+- MIT
 metadata:
   allowed_push_host: https://rubygems.org
-post_install_message: 
+  homepage_uri: https://github.com/dropstream/omniauth-fdc
+  changelog_uri: https://github.com/dropstream/omniauth-fdc/blob/master/CHANGELOG.md
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -100,15 +66,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.6
-signing_key: 
+rubygems_version: 3.6.9
 specification_version: 4
 summary: OmniAuth strategy for Fulfillment.com
 test_files: []

data/.gitignore

@@ -1,11 +0,0 @@
-/.bundle/
-/.yardoc
-/_yardoc/
-/coverage/
-/doc/
-/pkg/
-/spec/reports/
-/tmp/
-
-# rspec failure tracking
-.rspec_status

data/.rspec

@@ -1,3 +0,0 @@
---format documentation
---color
---require spec_helper

data/.ruby-gemset

@@ -1 +0,0 @@
-omniauth-fdc

data/.ruby-version

@@ -1 +0,0 @@
-2.4.4

data/.travis.yml

@@ -1,7 +0,0 @@
----
-sudo: false
-language: ruby
-cache: bundler
-rvm:
-  - 2.4.4
-before_install: gem install bundler -v 1.16.6

data/Gemfile

@@ -1,6 +0,0 @@
-source "https://rubygems.org"
-
-git_source(:github) {|repo_name| "https://github.com/#{repo_name}" }
-
-# Specify your gem's dependencies in omniauth-fdc.gemspec
-gemspec

data/Gemfile.lock

@@ -1,56 +0,0 @@
-PATH
-  remote: .
-  specs:
-    omniauth-fdc (0.1.0)
-      omniauth-oauth2
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    diff-lcs (1.3)
-    faraday (1.0.1)
-      multipart-post (>= 1.2, < 3)
-    hashie (4.1.0)
-    jwt (2.2.1)
-    multi_json (1.14.1)
-    multi_xml (0.6.0)
-    multipart-post (2.1.1)
-    oauth2 (1.4.4)
-      faraday (>= 0.8, < 2.0)
-      jwt (>= 1.0, < 3.0)
-      multi_json (~> 1.3)
-      multi_xml (~> 0.5)
-      rack (>= 1.2, < 3)
-    omniauth (1.9.1)
-      hashie (>= 3.4.6)
-      rack (>= 1.6.2, < 3)
-    omniauth-oauth2 (1.6.0)
-      oauth2 (~> 1.1)
-      omniauth (~> 1.9)
-    rack (2.2.2)
-    rake (10.5.0)
-    rspec (3.8.0)
-      rspec-core (~> 3.8.0)
-      rspec-expectations (~> 3.8.0)
-      rspec-mocks (~> 3.8.0)
-    rspec-core (3.8.0)
-      rspec-support (~> 3.8.0)
-    rspec-expectations (3.8.2)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.8.0)
-    rspec-mocks (3.8.0)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.8.0)
-    rspec-support (3.8.0)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  bundler (~> 1.16)
-  omniauth-fdc!
-  rake (~> 10.0)
-  rspec (~> 3.0)
-
-BUNDLED WITH
-   1.17.3

data/Rakefile

@@ -1,6 +0,0 @@
-require "bundler/gem_tasks"
-require "rspec/core/rake_task"
-
-RSpec::Core::RakeTask.new(:spec)
-
-task :default => :spec

data/bin/console

@@ -1,14 +0,0 @@
-#!/usr/bin/env ruby
-
-require "bundler/setup"
-require "omniauth/fdc"
-
-# You can add fixtures and/or initialization code here to make experimenting
-# with your gem easier. You can also use a different console, if you like.
-
-# (If you use this, don't forget to add pry to your Gemfile!)
-# require "pry"
-# Pry.start
-
-require "irb"
-IRB.start(__FILE__)

data/bin/setup

@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-IFS=$'\n\t'
-set -vx
-
-bundle install
-
-# Do any other automated setup that you need to do here