omniauth-feishu-jh 0.1.0 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +5 -0
- data/README.md +7 -3
- data/lib/omniauth/feishu_jh/version.rb +1 -1
- data/lib/omniauth/strategies/feishu.rb +6 -1
- metadata +2 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 4886ad17f1b9e64b77758c9feb67ae93f58064bd2936798f794c9b7c8648d3fc
|
|
4
|
+
data.tar.gz: f3955d8ecaa2f27bf62ac48df46d5170776e9a9be0169df474f93f57a51f226f
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 642f14f2a9f86cd9d04223255c560e7baedc1d0a86d3bed4d4250234864cd0da5bb23d7ce58bea88ddce2477d793b4378a6e6f15f3340471023dd95219d21892
|
|
7
|
+
data.tar.gz: 17378961330db8a84327452afd3aa0d97ae2cb84d1574156cc9d8fc9f9cde859d71bf0875daef69206ea3c9a461510b25b3ca726df81292b468786787f5f1747
|
data/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,11 @@
|
|
|
2
2
|
|
|
3
3
|
All notable changes to this project will be documented in this file.
|
|
4
4
|
|
|
5
|
+
## 0.2.0 (2026-11-12)
|
|
6
|
+
|
|
7
|
+
- Add opt-in multi-tenant Feishu authentication with `multi_tenant: true`, using the tenant returned by Feishu in the UID.
|
|
8
|
+
- Expand test coverage for fixed-tenant compatibility and callback security.
|
|
9
|
+
|
|
5
10
|
## 0.1.0 (2026-09-14)
|
|
6
11
|
|
|
7
12
|
- Extract the Feishu OmniAuth strategy from the JiHu GitLab monolith into a standalone gem named `omniauth-feishu-jh`.
|
data/README.md
CHANGED
|
@@ -9,7 +9,7 @@ The gem is named `omniauth-feishu-jh` because `omniauth-feishu` on RubyGems is a
|
|
|
9
9
|
Add the gem to your `Gemfile`:
|
|
10
10
|
|
|
11
11
|
```ruby
|
|
12
|
-
gem 'omniauth-feishu-jh', '~> 0.
|
|
12
|
+
gem 'omniauth-feishu-jh', '~> 0.2.0'
|
|
13
13
|
```
|
|
14
14
|
|
|
15
15
|
Then run `bundle install`.
|
|
@@ -27,7 +27,11 @@ use OmniAuth::Builder do
|
|
|
27
27
|
end
|
|
28
28
|
```
|
|
29
29
|
|
|
30
|
-
|
|
30
|
+
By default, `tenant_key` is required and the strategy rejects a callback when Feishu returns a different tenant.
|
|
31
|
+
For a multi-tenant application, explicitly set `multi_tenant: true` instead of configuring a fixed tenant.
|
|
32
|
+
The strategy then uses the tenant returned by Feishu's authenticated user-info endpoint in the UID.
|
|
33
|
+
Tenant, application, and user identifiers must contain only letters, digits, `_`, and `-` in either mode.
|
|
34
|
+
This option does not change the application's availability in Feishu: a self-built application still only serves its permitted enterprise users.
|
|
31
35
|
|
|
32
36
|
The default endpoints are:
|
|
33
37
|
|
|
@@ -68,7 +72,7 @@ The strategy provides protected hooks so a host application can use its own HTTP
|
|
|
68
72
|
|
|
69
73
|
A host can override these methods in a subclass or prepend a module to the strategy. Overrides must keep the method signatures and return values described above. The default implementation uses the HTTP connection from `omniauth-oauth2` and Ruby `JSON`.
|
|
70
74
|
|
|
71
|
-
The GitLab-specific overrides (`Gitlab::HTTP`, `Gitlab::Json::SafeParser`, and
|
|
75
|
+
The GitLab-specific overrides (`Gitlab::HTTP`, `Gitlab::Json::SafeParser`, and deployment-specific login restrictions) remain in the JiHu GitLab monolith and are not part of this gem.
|
|
72
76
|
|
|
73
77
|
## Development
|
|
74
78
|
|
|
@@ -13,6 +13,7 @@ module OmniAuth
|
|
|
13
13
|
|
|
14
14
|
option :name, 'feishu'
|
|
15
15
|
option :tenant_key, nil
|
|
16
|
+
option :multi_tenant, false
|
|
16
17
|
# Feishu accepts code_challenge but rejects every S256 token exchange with 20049, so PKCE stays off
|
|
17
18
|
# until upstream fixes it. This drops code-injection protection only; the state check still stops CSRF.
|
|
18
19
|
# https://github.com/larksuite/oapi-sdk-go/issues/230
|
|
@@ -31,7 +32,7 @@ module OmniAuth
|
|
|
31
32
|
body = parse_response(*request_user_info)
|
|
32
33
|
data = body['data']
|
|
33
34
|
unless data.is_a?(Hash) && identifier?(data['open_id']) && identifier?(options.client_id) &&
|
|
34
|
-
|
|
35
|
+
valid_tenant?(data['tenant_key'])
|
|
35
36
|
raise CallbackError.new(:invalid_credentials, 'Feishu identity does not match the configured tenant')
|
|
36
37
|
end
|
|
37
38
|
|
|
@@ -50,6 +51,10 @@ module OmniAuth
|
|
|
50
51
|
|
|
51
52
|
protected
|
|
52
53
|
|
|
54
|
+
def valid_tenant?(tenant_key)
|
|
55
|
+
identifier?(tenant_key) && (options.multi_tenant == true || tenant_key == options.tenant_key)
|
|
56
|
+
end
|
|
57
|
+
|
|
53
58
|
def build_access_token
|
|
54
59
|
params = token_params.to_hash.merge(
|
|
55
60
|
'grant_type' => 'authorization_code', 'client_id' => options.client_id,
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: omniauth-feishu-jh
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.
|
|
4
|
+
version: 0.2.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- JiHu GitLab contributors
|
|
@@ -72,7 +72,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
72
72
|
- !ruby/object:Gem::Version
|
|
73
73
|
version: '0'
|
|
74
74
|
requirements: []
|
|
75
|
-
rubygems_version:
|
|
75
|
+
rubygems_version: 3.6.9
|
|
76
76
|
specification_version: 4
|
|
77
77
|
summary: OmniAuth strategy for Feishu enterprise applications
|
|
78
78
|
test_files: []
|