omniauth-feishu-jh 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 84aa16a984a8f3c30b03739f118ce06699e956e37dedf18c43ab16af922af686
+  data.tar.gz: e6f19b86a79387f19616d68982a4e665deaf82c62e2b2d3084ca31ceb45b6933
+SHA512:
+  metadata.gz: f03123e678d8ba78ed1fc45bb9e87e60c0eb7c326391a6acfc1a3a489753be39373648187780f2ad3e4f2247d374594a386f976e811719ca81260758df70583a
+  data.tar.gz: a697cf874071fe42fe29459eb1dfc88e41e1b29e3b5d72a0d2a7f8592f8e67d55f1e6a7bbfd3f68edb705a15e27606c6a471ca1c1b8fb7d083da485e55863741

data/CHANGELOG.md

@@ -0,0 +1,10 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+## 0.1.0 (2026-09-14)
+
+- Extract the Feishu OmniAuth strategy from the JiHu GitLab monolith into a standalone gem named `omniauth-feishu-jh`.
+- Add standalone tests, linting, gem packaging, and contributor documentation.
+
+The strategy was introduced in [MR 3841](https://jihulab.com/gitlab-cn/gitlab/-/merge_requests/3841) for [work item 5317](https://jihulab.com/gitlab-cn/gitlab/-/work_items/5317).

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 JiHu GitLab contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,77 @@
+# omniauth-feishu-jh
+
+`omniauth-feishu-jh` is an [OmniAuth](https://github.com/omniauth/omniauth) OAuth 2.0 strategy for signing in with a Feishu enterprise (self-built) application. JiHu GitLab contributors maintain it for the JiHu GitLab distribution.
+
+The gem is named `omniauth-feishu-jh` because `omniauth-feishu` on RubyGems is an unrelated project. Both gems define `OmniAuth::Strategies::Feishu`, so do not install them in the same bundle.
+
+## Installation
+
+Add the gem to your `Gemfile`:
+
+```ruby
+gem 'omniauth-feishu-jh', '~> 0.1.0'
+```
+
+Then run `bundle install`.
+
+The gem supports Ruby 3.2 or later and OmniAuth 2.
+
+## Usage
+
+```ruby
+use OmniAuth::Builder do
+  provider :feishu,
+    ENV.fetch('FEISHU_APP_ID'),
+    ENV.fetch('FEISHU_APP_SECRET'),
+    tenant_key: ENV.fetch('FEISHU_TENANT_KEY')
+end
+```
+
+The `tenant_key` option is required. The strategy rejects a callback when Feishu returns a different `tenant_key`, or when the configured tenant, application, or user identifiers contain characters other than letters, digits, `_`, and `-`.
+
+The default endpoints are:
+
+| Option | Default |
+| --- | --- |
+| `client_options.site` | `https://open.feishu.cn` |
+| `client_options.authorize_url` | `https://accounts.feishu.cn/open-apis/authen/v1/authorize` |
+| `client_options.token_url` | `https://accounts.feishu.cn/oauth/v3/token` |
+
+Override all three `client_options` values when a deployment uses another Feishu-compatible region.
+
+The host application must follow OmniAuth 2's integration requirements: start authentication with `POST`, preserve the session from the request phase through the callback, and keep request validation and CSRF protection enabled.
+
+PKCE is disabled because the Feishu token endpoint currently rejects valid S256 code verifiers with error `20049` ([larksuite/oapi-sdk-go#230](https://github.com/larksuite/oapi-sdk-go/issues/230)). The OAuth `state` check still protects the callback against CSRF.
+
+## Authentication data
+
+The OmniAuth UID has this format:
+
+```plaintext
+<tenant_key>:<app_id>:<open_id>
+```
+
+The `info` hash contains only `name` and `nickname`. The nickname is the Feishu `open_id`. The strategy does not return an email address because Feishu documents email and mobile values as administrator-imported contact data that has not been verified with the user in real time.
+
+The `credentials` hash is empty. The strategy uses the user access token only to request the current user profile during the callback. It does not expose the token through the OmniAuth authentication hash.
+
+Failures are reported as `csrf_detected`, `access_denied`, or `invalid_credentials`, with a generic message so that provider responses do not leak into logs.
+
+## Host integration hooks
+
+The strategy provides protected hooks so a host application can use its own HTTP client and JSON parser:
+
+- `request_token(params)` returns `[status, response_body]` for the OAuth token request.
+- `request_user_info` returns `[status, response_body]` for the current user profile request.
+- `parse_json(raw)` parses a response body and returns the decoded object.
+- `parse_response(status, raw)` checks the HTTP status and Feishu response code, then uses `parse_json`.
+
+A host can override these methods in a subclass or prepend a module to the strategy. Overrides must keep the method signatures and return values described above. The default implementation uses the HTTP connection from `omniauth-oauth2` and Ruby `JSON`.
+
+The GitLab-specific overrides (`Gitlab::HTTP`, `Gitlab::Json::SafeParser`, and disabling sign-in on GitLab.com) remain in the JiHu GitLab monolith and are not part of this gem.
+
+## Development
+
+See [CONTRIBUTING.md](CONTRIBUTING.md). This project is licensed under the MIT License; see [LICENSE](LICENSE).
+
+The strategy was introduced in [MR 3841](https://jihulab.com/gitlab-cn/gitlab/-/merge_requests/3841) for [work item 5317](https://jihulab.com/gitlab-cn/gitlab/-/work_items/5317).

data/lib/omniauth/feishu_jh/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module OmniAuth
+  module FeishuJh
+    VERSION = '0.1.0'
+  end
+end

data/lib/omniauth/strategies/feishu.rb

@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+require 'omniauth-oauth2'
+require 'json'
+
+module OmniAuth
+  module Strategies
+    class Feishu < OAuth2
+      API_SITE = 'https://open.feishu.cn'
+      AUTHORIZE_URL = 'https://accounts.feishu.cn/open-apis/authen/v1/authorize'
+      TOKEN_URL = 'https://accounts.feishu.cn/oauth/v3/token'
+      USER_INFO_PATH = '/open-apis/authen/v1/user_info'
+
+      option :name, 'feishu'
+      option :tenant_key, nil
+      # Feishu accepts code_challenge but rejects every S256 token exchange with 20049, so PKCE stays off
+      # until upstream fixes it. This drops code-injection protection only; the state check still stops CSRF.
+      # https://github.com/larksuite/oapi-sdk-go/issues/230
+      option :pkce, false
+      option :client_options, site: API_SITE, authorize_url: AUTHORIZE_URL, token_url: TOKEN_URL
+
+      uid { [raw_info.fetch('tenant_key'), options.client_id, raw_info.fetch('open_id')].join(':') }
+      info { { name: raw_info['name'], nickname: raw_info['open_id'] } }
+
+      def credentials
+        {}
+      end
+
+      def raw_info
+        @raw_info ||= begin
+          body = parse_response(*request_user_info)
+          data = body['data']
+          unless data.is_a?(Hash) && identifier?(data['open_id']) && identifier?(options.client_id) &&
+                 identifier?(options.tenant_key) && data['tenant_key'] == options.tenant_key
+            raise CallbackError.new(:invalid_credentials, 'Feishu identity does not match the configured tenant')
+          end
+
+          data.slice('name', 'open_id', 'tenant_key')
+        end
+      end
+
+      def callback_url
+        full_host + script_name + callback_path
+      end
+
+      def fail!(message_key, _exception = nil)
+        key = %i[csrf_detected access_denied].include?(message_key.to_sym) ? message_key.to_sym : :invalid_credentials
+        super(key, CallbackError.new(key, 'Feishu authentication failed'))
+      end
+
+      protected
+
+      def build_access_token
+        params = token_params.to_hash.merge(
+          'grant_type' => 'authorization_code', 'client_id' => options.client_id,
+          'client_secret' => options.client_secret, 'code' => request.params['code'], 'redirect_uri' => callback_url
+        )
+        body = parse_response(*request_token(params))
+        unless body['access_token'].is_a?(String) && !body['access_token'].empty? &&
+               body['expires_in'].is_a?(Integer) && body['expires_in'] > 0
+          raise CallbackError.new(:invalid_credentials, 'Feishu returned an invalid token')
+        end
+
+        ::OAuth2::AccessToken.new(client, body['access_token'], expires_in: body['expires_in'])
+      end
+
+      def request_token(params)
+        response = client.connection.post(client.token_url, URI.encode_www_form(params),
+          'Content-Type' => 'application/x-www-form-urlencoded')
+        [response.status, response.body]
+      end
+
+      def request_user_info
+        response = client.connection.get(USER_INFO_PATH, nil, 'Authorization' => "Bearer #{access_token.token}")
+        [response.status, response.body]
+      end
+
+      def parse_json(raw)
+        JSON.parse(raw)
+      end
+
+      def parse_response(status, raw)
+        raise CallbackError.new(:invalid_credentials, 'Feishu request failed') unless status == 200
+
+        body = parse_json(raw)
+        unless body.is_a?(Hash) && body['code'].is_a?(Integer) && body['code'] == 0
+          raise CallbackError.new(:invalid_credentials, 'Feishu rejected the request')
+        end
+
+        body
+      rescue JSON::ParserError
+        raise CallbackError.new(:invalid_credentials, 'Feishu returned an invalid response')
+      end
+
+      def identifier?(value)
+        value.is_a?(String) && value.match?(/\A[A-Za-z0-9_-]+\z/)
+      end
+    end
+  end
+end

data/lib/omniauth-feishu-jh.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+require 'omniauth/feishu_jh/version'
+require 'omniauth/strategies/feishu'

metadata

@@ -0,0 +1,78 @@
+--- !ruby/object:Gem::Specification
+name: omniauth-feishu-jh
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- JiHu GitLab contributors
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: omniauth
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: omniauth-oauth2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.8'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.8'
+description: OmniAuth OAuth 2.0 strategy for signing in with a Feishu enterprise (self-built)
+  application.
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE
+- README.md
+- lib/omniauth-feishu-jh.rb
+- lib/omniauth/feishu_jh/version.rb
+- lib/omniauth/strategies/feishu.rb
+homepage: https://gitlab.com/gitlab-jh/jh-team/omniauth-feishu-jh
+licenses:
+- MIT
+metadata:
+  source_code_uri: https://gitlab.com/gitlab-jh/jh-team/omniauth-feishu-jh
+  bug_tracker_uri: https://gitlab.com/gitlab-jh/jh-team/omniauth-feishu-jh/-/issues
+  changelog_uri: https://gitlab.com/gitlab-jh/jh-team/omniauth-feishu-jh/-/blob/main/CHANGELOG.md
+  allowed_push_host: https://rubygems.org
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.2'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.13
+specification_version: 4
+summary: OmniAuth strategy for Feishu enterprise applications
+test_files: []