omniauth-globus 0.8.7 → 0.9.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/workflows/build.yml +37 -0
- data/.github/workflows/changelog.yml +36 -0
- data/.github/workflows/release.yml +47 -0
- data/.rubocop.yml +5 -11
- data/Gemfile +3 -1
- data/Gemfile.lock +59 -44
- data/README.md +1 -0
- data/codemeta.json +38 -0
- data/lib/omniauth-globus.rb +3 -1
- data/lib/omniauth/globus.rb +1 -1
- data/lib/omniauth/globus/version.rb +1 -1
- data/lib/omniauth/strategies/globus.rb +71 -71
- data/omniauth-globus.gemspec +1 -1
- data/spec/omniauth/strategies/globus_spec.rb +199 -198
- data/spec/rubocop_spec.rb +4 -4
- metadata +10 -11
data/omniauth-globus.gemspec
CHANGED
@@ -23,7 +23,7 @@ Gem::Specification.new do |s|
|
|
23
23
|
|
24
24
|
# Declary dependencies here, rather than in the Gemfile
|
25
25
|
s.add_dependency "jwt", "~> 2.0"
|
26
|
-
s.add_dependency "omniauth", "
|
26
|
+
s.add_dependency "omniauth", ">= 1.9"
|
27
27
|
s.add_dependency "omniauth-oauth2", "~> 1.6"
|
28
28
|
s.add_development_dependency "bundler", "~> 1.0"
|
29
29
|
s.add_development_dependency "codeclimate-test-reporter", "~> 1.0", ">= 1.0.9"
|
@@ -1,20 +1,20 @@
|
|
1
1
|
# frozen_string_literal: true
|
2
2
|
|
3
|
-
require
|
4
|
-
require
|
5
|
-
require
|
6
|
-
require
|
3
|
+
require "spec_helper"
|
4
|
+
require "json"
|
5
|
+
require "omniauth-globus"
|
6
|
+
require "stringio"
|
7
7
|
|
8
8
|
describe OmniAuth::Strategies::Globus do
|
9
|
-
let(:request) { double(
|
9
|
+
let(:request) { double("Request", params: {}, cookies: {}, env: {}) }
|
10
10
|
let(:app) do
|
11
11
|
lambda do
|
12
|
-
[200, {}, [
|
12
|
+
[200, {}, ["Hello."]]
|
13
13
|
end
|
14
14
|
end
|
15
15
|
|
16
16
|
subject do
|
17
|
-
OmniAuth::Strategies::Globus.new(app,
|
17
|
+
OmniAuth::Strategies::Globus.new(app, "appid", "secret", @options || {}).tap do |strategy|
|
18
18
|
allow(strategy).to receive(:request) do
|
19
19
|
request
|
20
20
|
end
|
@@ -29,252 +29,253 @@ describe OmniAuth::Strategies::Globus do
|
|
29
29
|
OmniAuth.config.test_mode = false
|
30
30
|
end
|
31
31
|
|
32
|
-
describe
|
33
|
-
it
|
34
|
-
expect(subject.client.site).to eq(
|
32
|
+
describe "#client_options" do
|
33
|
+
it "has correct site" do
|
34
|
+
expect(subject.client.site).to eq("https://auth.globus.org")
|
35
35
|
end
|
36
36
|
|
37
|
-
it
|
38
|
-
expect(subject.client.options[:authorize_url]).to eq(
|
37
|
+
it "has correct authorize_url" do
|
38
|
+
expect(subject.client.options[:authorize_url]).to eq("https://auth.globus.org/v2/oauth2/authorize")
|
39
39
|
end
|
40
40
|
|
41
|
-
it
|
42
|
-
expect(subject.client.options[:token_url]).to eq(
|
41
|
+
it "has correct token_url" do
|
42
|
+
expect(subject.client.options[:token_url]).to eq("https://auth.globus.org/v2/oauth2/token")
|
43
43
|
end
|
44
44
|
|
45
|
-
describe
|
46
|
-
context
|
47
|
-
it
|
48
|
-
@options = { client_options: {
|
49
|
-
expect(subject.client.site).to eq(
|
45
|
+
describe "overrides" do
|
46
|
+
context "as strings" do
|
47
|
+
it "should allow overriding the site" do
|
48
|
+
@options = { client_options: { "site" => "https://example.com" } }
|
49
|
+
expect(subject.client.site).to eq("https://example.com")
|
50
50
|
end
|
51
51
|
|
52
|
-
it
|
53
|
-
@options = { client_options: {
|
54
|
-
expect(subject.client.options[:authorization_endpoint]).to eq(
|
52
|
+
it "should allow overriding the authorization_endpoint" do
|
53
|
+
@options = { client_options: { "authorization_endpoint" => "https://example.com" } }
|
54
|
+
expect(subject.client.options[:authorization_endpoint]).to eq("https://example.com")
|
55
55
|
end
|
56
56
|
|
57
|
-
it
|
58
|
-
@options = { client_options: {
|
59
|
-
expect(subject.client.options[:token_endpoint]).to eq(
|
57
|
+
it "should allow overriding the token_endpoint" do
|
58
|
+
@options = { client_options: { "token_endpoint" => "https://example.com" } }
|
59
|
+
expect(subject.client.options[:token_endpoint]).to eq("https://example.com")
|
60
60
|
end
|
61
61
|
end
|
62
62
|
|
63
|
-
context
|
64
|
-
it
|
65
|
-
@options = { client_options: { site:
|
66
|
-
expect(subject.client.site).to eq(
|
63
|
+
context "as symbols" do
|
64
|
+
it "should allow overriding the site" do
|
65
|
+
@options = { client_options: { site: "https://example.com" } }
|
66
|
+
expect(subject.client.site).to eq("https://example.com")
|
67
67
|
end
|
68
68
|
|
69
|
-
it
|
70
|
-
@options = { client_options: { authorization_endpoint:
|
71
|
-
expect(subject.client.options[:authorization_endpoint]).to eq(
|
69
|
+
it "should allow overriding the authorization_endpoint" do
|
70
|
+
@options = { client_options: { authorization_endpoint: "https://example.com" } }
|
71
|
+
expect(subject.client.options[:authorization_endpoint]).to eq("https://example.com")
|
72
72
|
end
|
73
73
|
|
74
|
-
it
|
75
|
-
@options = { client_options: { token_endpoint:
|
76
|
-
expect(subject.client.options[:token_endpoint]).to eq(
|
74
|
+
it "should allow overriding the token_endpoint" do
|
75
|
+
@options = { client_options: { token_endpoint: "https://example.com" } }
|
76
|
+
expect(subject.client.options[:token_endpoint]).to eq("https://example.com")
|
77
77
|
end
|
78
78
|
end
|
79
79
|
end
|
80
80
|
end
|
81
81
|
|
82
|
-
describe
|
82
|
+
describe "#authorize_options" do
|
83
83
|
%i[access_type login_hint prompt scope state device_id device_name].each do |k|
|
84
84
|
it "should support #{k}" do
|
85
|
-
@options = { k =>
|
86
|
-
expect(subject.authorize_params[k.to_s]).to eq(
|
85
|
+
@options = { k => "http://someval" }
|
86
|
+
expect(subject.authorize_params[k.to_s]).to eq("http://someval")
|
87
87
|
end
|
88
88
|
end
|
89
89
|
|
90
|
-
describe
|
91
|
-
it
|
90
|
+
describe "redirect_uri" do
|
91
|
+
it "should default to nil" do
|
92
92
|
@options = {}
|
93
|
-
expect(subject.authorize_params[
|
93
|
+
expect(subject.authorize_params["redirect_uri"]).to eq(nil)
|
94
94
|
end
|
95
95
|
|
96
|
-
it
|
97
|
-
@options = { redirect_uri:
|
98
|
-
expect(subject.authorize_params[
|
96
|
+
it "should set the redirect_uri parameter if present" do
|
97
|
+
@options = { redirect_uri: "https://example.com" }
|
98
|
+
expect(subject.authorize_params["redirect_uri"]).to eq("https://example.com")
|
99
99
|
end
|
100
100
|
end
|
101
101
|
|
102
|
-
describe
|
102
|
+
describe "access_type" do
|
103
103
|
it 'should default to "offline"' do
|
104
104
|
@options = {}
|
105
|
-
expect(subject.authorize_params[
|
105
|
+
expect(subject.authorize_params["access_type"]).to eq("offline")
|
106
106
|
end
|
107
107
|
|
108
|
-
it
|
109
|
-
@options = { access_type:
|
110
|
-
expect(subject.authorize_params[
|
108
|
+
it "should set the access_type parameter if present" do
|
109
|
+
@options = { access_type: "online" }
|
110
|
+
expect(subject.authorize_params["access_type"]).to eq("online")
|
111
111
|
end
|
112
112
|
end
|
113
113
|
|
114
|
-
describe
|
115
|
-
it
|
116
|
-
expect(subject.authorize_params[
|
114
|
+
describe "login_hint" do
|
115
|
+
it "should default to nil" do
|
116
|
+
expect(subject.authorize_params["login_hint"]).to eq(nil)
|
117
117
|
end
|
118
118
|
|
119
|
-
it
|
120
|
-
@options = { login_hint:
|
121
|
-
expect(subject.authorize_params[
|
119
|
+
it "should set the login_hint parameter if present" do
|
120
|
+
@options = { login_hint: "john@example.com" }
|
121
|
+
expect(subject.authorize_params["login_hint"]).to eq("john@example.com")
|
122
122
|
end
|
123
123
|
end
|
124
124
|
|
125
|
-
describe
|
126
|
-
it
|
127
|
-
expect(subject.authorize_params[
|
125
|
+
describe "prompt" do
|
126
|
+
it "should default to nil" do
|
127
|
+
expect(subject.authorize_params["prompt"]).to eq(nil)
|
128
128
|
end
|
129
129
|
|
130
|
-
it
|
131
|
-
@options = { prompt:
|
132
|
-
expect(subject.authorize_params[
|
130
|
+
it "should set the prompt parameter if present" do
|
131
|
+
@options = { prompt: "consent select_account" }
|
132
|
+
expect(subject.authorize_params["prompt"]).to eq("consent select_account")
|
133
133
|
end
|
134
134
|
end
|
135
135
|
|
136
|
-
describe
|
137
|
-
it
|
138
|
-
expect(subject.authorize_params[
|
136
|
+
describe "request_visible_actions" do
|
137
|
+
it "should default to nil" do
|
138
|
+
expect(subject.authorize_params["request_visible_actions"]).to eq(nil)
|
139
139
|
end
|
140
140
|
|
141
|
-
it
|
142
|
-
@options = { request_visible_actions:
|
143
|
-
expect(subject.authorize_params[
|
141
|
+
it "should set the request_visible_actions parameter if present" do
|
142
|
+
@options = { request_visible_actions: "something" }
|
143
|
+
expect(subject.authorize_params["request_visible_actions"]).to eq("something")
|
144
144
|
end
|
145
145
|
end
|
146
146
|
|
147
|
-
describe
|
148
|
-
it
|
149
|
-
expect(subject.authorize_params[
|
147
|
+
describe "include_granted_scopes" do
|
148
|
+
it "should default to nil" do
|
149
|
+
expect(subject.authorize_params["include_granted_scopes"]).to eq(nil)
|
150
150
|
end
|
151
151
|
|
152
|
-
it
|
153
|
-
@options = { include_granted_scopes:
|
154
|
-
expect(subject.authorize_params[
|
152
|
+
it "should set the include_granted_scopes parameter if present" do
|
153
|
+
@options = { include_granted_scopes: "true" }
|
154
|
+
expect(subject.authorize_params["include_granted_scopes"]).to eq("true")
|
155
155
|
end
|
156
156
|
end
|
157
157
|
|
158
|
-
describe
|
159
|
-
it
|
160
|
-
@options = { scope:
|
161
|
-
expect(subject.authorize_params[
|
158
|
+
describe "scope" do
|
159
|
+
it "should leave base scopes as is" do
|
160
|
+
@options = { scope: "profile" }
|
161
|
+
expect(subject.authorize_params["scope"]).to eq("profile")
|
162
162
|
end
|
163
163
|
|
164
|
-
it
|
165
|
-
@options = { scope:
|
166
|
-
expect(subject.authorize_params[
|
164
|
+
it "should join scopes" do
|
165
|
+
@options = { scope: "profile,email" }
|
166
|
+
expect(subject.authorize_params["scope"]).to eq("profile email")
|
167
167
|
end
|
168
168
|
|
169
|
-
it
|
170
|
-
@options = { scope:
|
171
|
-
expect(subject.authorize_params[
|
169
|
+
it "should deal with whitespace when joining scopes" do
|
170
|
+
@options = { scope: "profile, email" }
|
171
|
+
expect(subject.authorize_params["scope"]).to eq("profile email")
|
172
172
|
end
|
173
173
|
|
174
|
-
it
|
175
|
-
expect(subject.authorize_params[
|
174
|
+
it "should set default scope to openid, profile, email" do
|
175
|
+
expect(subject.authorize_params["scope"]).to eq("openid profile email")
|
176
176
|
end
|
177
177
|
|
178
|
-
it
|
179
|
-
@options = { scope:
|
180
|
-
expect(subject.authorize_params[
|
178
|
+
it "should support space delimited scopes" do
|
179
|
+
@options = { scope: "profile email" }
|
180
|
+
expect(subject.authorize_params["scope"]).to eq("profile email")
|
181
181
|
end
|
182
182
|
|
183
|
-
it
|
184
|
-
@options = { scope:
|
185
|
-
expect(subject.authorize_params[
|
183
|
+
it "should support extremely badly formed scopes" do
|
184
|
+
@options = { scope: "profile email,foo,steve yeah" }
|
185
|
+
expect(subject.authorize_params["scope"]).to eq("profile email foo steve yeah")
|
186
186
|
end
|
187
187
|
end
|
188
188
|
|
189
|
-
describe
|
190
|
-
it
|
191
|
-
@options = { state:
|
192
|
-
expect(subject.authorize_params[
|
193
|
-
expect(subject.authorize_params[:state]).to eq(
|
194
|
-
expect(subject.session[
|
189
|
+
describe "state" do
|
190
|
+
it "should set the state parameter" do
|
191
|
+
@options = { state: "some_state" }
|
192
|
+
expect(subject.authorize_params["state"]).to eq("some_state")
|
193
|
+
expect(subject.authorize_params[:state]).to eq("some_state")
|
194
|
+
expect(subject.session["omniauth.state"]).to eq("some_state")
|
195
195
|
end
|
196
196
|
|
197
|
-
it
|
198
|
-
allow(subject).to receive(:request) { double(
|
199
|
-
expect(subject.authorize_params[
|
200
|
-
expect(subject.authorize_params[:state]).to eq(
|
201
|
-
expect(subject.session[
|
197
|
+
it "should set the omniauth.state dynamically" do
|
198
|
+
allow(subject).to receive(:request) { double("Request", params: { "state" => "some_state" }, env: {}) }
|
199
|
+
expect(subject.authorize_params["state"]).to eq("some_state")
|
200
|
+
expect(subject.authorize_params[:state]).to eq("some_state")
|
201
|
+
expect(subject.session["omniauth.state"]).to eq("some_state")
|
202
202
|
end
|
203
203
|
end
|
204
204
|
|
205
|
-
describe
|
206
|
-
it
|
207
|
-
@options = { authorize_options: %i[scope foo request_visible_actions], scope:
|
208
|
-
expect(subject.authorize_params[
|
209
|
-
expect(subject.authorize_params[
|
210
|
-
expect(subject.authorize_params[
|
205
|
+
describe "overrides" do
|
206
|
+
it "should include top-level options that are marked as :authorize_options" do
|
207
|
+
@options = { authorize_options: %i[scope foo request_visible_actions], scope: "http://bar", foo: "baz", request_visible_actions: "something" }
|
208
|
+
expect(subject.authorize_params["scope"]).to eq("http://bar")
|
209
|
+
expect(subject.authorize_params["foo"]).to eq("baz")
|
210
|
+
expect(subject.authorize_params["request_visible_actions"]).to eq("something")
|
211
211
|
end
|
212
212
|
|
213
|
-
describe
|
213
|
+
describe "request overrides" do
|
214
214
|
%i[access_type login_hint prompt scope state].each do |k|
|
215
215
|
context "authorize option #{k}" do
|
216
|
-
let(:request) { double(
|
216
|
+
let(:request) { double("Request", params: { k.to_s => "http://example.com" }, cookies: {}, env: {}) }
|
217
217
|
|
218
218
|
it "should set the #{k} authorize option dynamically in the request" do
|
219
|
-
@options = { k:
|
220
|
-
expect(subject.authorize_params[k.to_s]).to eq(
|
219
|
+
@options = { k: "" }
|
220
|
+
expect(subject.authorize_params[k.to_s]).to eq("http://example.com")
|
221
221
|
end
|
222
222
|
end
|
223
223
|
end
|
224
224
|
|
225
|
-
describe
|
226
|
-
let(:request) { double(
|
225
|
+
describe "custom authorize_options" do
|
226
|
+
let(:request) { double("Request", params: { "foo" => "something" }, cookies: {}, env: {}) }
|
227
227
|
|
228
|
-
it
|
229
|
-
@options = { authorize_options: [:foo], foo:
|
230
|
-
expect(subject.authorize_params[
|
228
|
+
it "should support request overrides from custom authorize_options" do
|
229
|
+
@options = { authorize_options: [:foo], foo: "" }
|
230
|
+
expect(subject.authorize_params["foo"]).to eq("something")
|
231
231
|
end
|
232
232
|
end
|
233
233
|
end
|
234
234
|
end
|
235
235
|
end
|
236
236
|
|
237
|
-
describe
|
238
|
-
it
|
239
|
-
@options = { authorize_params: { request_visible_actions:
|
240
|
-
expect(subject.authorize_params[
|
241
|
-
expect(subject.authorize_params[
|
242
|
-
expect(subject.authorize_params[
|
243
|
-
expect(subject.authorize_params[
|
237
|
+
describe "#authorize_params" do
|
238
|
+
it "should include any authorize params passed in the :authorize_params option" do
|
239
|
+
@options = { authorize_params: { request_visible_actions: "something", foo: "bar", baz: "zip" }, bad: "not_included" }
|
240
|
+
expect(subject.authorize_params["request_visible_actions"]).to eq("something")
|
241
|
+
expect(subject.authorize_params["foo"]).to eq("bar")
|
242
|
+
expect(subject.authorize_params["baz"]).to eq("zip")
|
243
|
+
expect(subject.authorize_params["bad"]).to eq(nil)
|
244
244
|
end
|
245
245
|
end
|
246
246
|
|
247
|
-
describe
|
248
|
-
it
|
249
|
-
@options = { token_params: { foo:
|
250
|
-
expect(subject.token_params[
|
251
|
-
expect(subject.token_params[
|
247
|
+
describe "#token_params" do
|
248
|
+
it "should include any token params passed in the :token_params option" do
|
249
|
+
@options = { token_params: { foo: "bar", baz: "zip" } }
|
250
|
+
expect(subject.token_params["foo"]).to eq("bar")
|
251
|
+
expect(subject.token_params["baz"]).to eq("zip")
|
252
252
|
end
|
253
253
|
end
|
254
254
|
|
255
|
-
describe
|
256
|
-
it
|
257
|
-
@options = { token_options: %i[scope foo], scope:
|
258
|
-
expect(subject.token_params[
|
259
|
-
expect(subject.token_params[
|
260
|
-
expect(subject.token_params[
|
255
|
+
describe "#token_options" do
|
256
|
+
it "should include top-level options that are marked as :token_options" do
|
257
|
+
@options = { token_options: %i[scope foo], scope: "bar", foo: "baz", bad: "not_included" }
|
258
|
+
expect(subject.token_params["scope"]).to eq("bar")
|
259
|
+
expect(subject.token_params["foo"]).to eq("baz")
|
260
|
+
expect(subject.token_params["bad"]).to eq(nil)
|
261
261
|
end
|
262
262
|
end
|
263
263
|
|
264
|
-
describe
|
265
|
-
it
|
264
|
+
describe "#callback_path" do
|
265
|
+
it "has the correct default callback path" do
|
266
|
+
@options = { callback_path: "/auth/globus/callback" }
|
266
267
|
expect(subject.callback_path).to eq("/auth/globus/callback")
|
267
268
|
end
|
268
269
|
|
269
|
-
it
|
270
|
-
@options = { callback_path:
|
271
|
-
expect(subject.callback_path).to eq(
|
270
|
+
it "should set the callback_path parameter if present" do
|
271
|
+
@options = { callback_path: "/auth/foo/callback" }
|
272
|
+
expect(subject.callback_path).to eq("/auth/foo/callback")
|
272
273
|
end
|
273
274
|
end
|
274
275
|
|
275
|
-
describe
|
276
|
+
describe "#info" do
|
276
277
|
let(:client) do
|
277
|
-
OAuth2::Client.new(
|
278
|
+
OAuth2::Client.new("abc", "def") do |builder|
|
278
279
|
builder.request :url_encoded
|
279
280
|
builder.adapter :test do |stub|
|
280
281
|
stub.get("/v2/oauth2/userinfo") { [200, { "content-type" => "application/json" }, response_hash.to_json] }
|
@@ -284,23 +285,23 @@ describe OmniAuth::Strategies::Globus do
|
|
284
285
|
let(:access_token) { OAuth2::AccessToken.from_hash(client, {}) }
|
285
286
|
before { allow(subject).to receive(:access_token).and_return(access_token) }
|
286
287
|
|
287
|
-
context
|
288
|
+
context "with email" do
|
288
289
|
let(:response_hash) do
|
289
|
-
{ email:
|
290
|
+
{ email: "something@domain.invalid" }
|
290
291
|
end
|
291
292
|
|
292
|
-
it
|
293
|
-
expect(subject.info[:email]).to eq(
|
293
|
+
it "should return email" do
|
294
|
+
expect(subject.info[:email]).to eq("something@domain.invalid")
|
294
295
|
end
|
295
296
|
end
|
296
297
|
end
|
297
298
|
|
298
|
-
describe
|
299
|
+
describe "#extra" do
|
299
300
|
let(:client) do
|
300
|
-
OAuth2::Client.new(
|
301
|
+
OAuth2::Client.new("abc", "def") do |builder|
|
301
302
|
builder.request :url_encoded
|
302
303
|
builder.adapter :test do |stub|
|
303
|
-
stub.get(
|
304
|
+
stub.get("/v2/oauth2/userinfo") { [200, { "content-type" => "application/json" }, '{"sub": "12345"}'] }
|
304
305
|
end
|
305
306
|
end
|
306
307
|
end
|
@@ -308,9 +309,9 @@ describe OmniAuth::Strategies::Globus do
|
|
308
309
|
|
309
310
|
before { allow(subject).to receive(:access_token).and_return(access_token) }
|
310
311
|
|
311
|
-
describe
|
312
|
-
shared_examples
|
313
|
-
context
|
312
|
+
describe "id_token" do
|
313
|
+
shared_examples "id_token issued by valid issuer" do |issuer| # rubocop:disable Metrics/BlockLength
|
314
|
+
context "when the id_token is passed into the access token" do
|
314
315
|
let(:token_info) do
|
315
316
|
{
|
316
317
|
identity_provider_display_name: "ORCID",
|
@@ -324,18 +325,18 @@ describe OmniAuth::Strategies::Globus do
|
|
324
325
|
iss: "https://auth.globus.org"
|
325
326
|
}
|
326
327
|
end
|
327
|
-
let(:id_token) { JWT.encode(token_info,
|
328
|
-
let(:access_token) { OAuth2::AccessToken.from_hash(client,
|
328
|
+
let(:id_token) { JWT.encode(token_info, "secret") }
|
329
|
+
let(:access_token) { OAuth2::AccessToken.from_hash(client, "id_token" => id_token) }
|
329
330
|
|
330
|
-
it
|
331
|
+
it "should include id_token when set on the access_token" do
|
331
332
|
expect(subject.extra).to include(id_token: id_token)
|
332
333
|
end
|
333
334
|
end
|
334
335
|
end
|
335
336
|
|
336
|
-
it_behaves_like
|
337
|
+
it_behaves_like "id_token issued by valid issuer", "https://auth.globus.org"
|
337
338
|
|
338
|
-
context
|
339
|
+
context "when the id_token is issued by an invalid issuer" do
|
339
340
|
let(:token_info) do
|
340
341
|
{
|
341
342
|
identity_provider_display_name: "ORCID",
|
@@ -349,138 +350,138 @@ describe OmniAuth::Strategies::Globus do
|
|
349
350
|
iss: "https://fake.globus.org"
|
350
351
|
}
|
351
352
|
end
|
352
|
-
let(:id_token) { JWT.encode(token_info,
|
353
|
-
let(:access_token) { OAuth2::AccessToken.from_hash(client,
|
353
|
+
let(:id_token) { JWT.encode(token_info, "secret") }
|
354
|
+
let(:access_token) { OAuth2::AccessToken.from_hash(client, "id_token" => id_token) }
|
354
355
|
|
355
|
-
it
|
356
|
+
it "raises JWT::InvalidIssuerError" do
|
356
357
|
expect { subject.extra }.to raise_error(JWT::InvalidIssuerError)
|
357
358
|
end
|
358
359
|
end
|
359
360
|
|
360
|
-
context
|
361
|
-
it
|
361
|
+
context "when the id_token is missing" do
|
362
|
+
it "should not include id_token" do
|
362
363
|
expect(subject.extra).not_to have_key(:id_token)
|
363
364
|
end
|
364
365
|
|
365
|
-
it
|
366
|
+
it "should not include id_info" do
|
366
367
|
expect(subject.extra).not_to have_key(:id_info)
|
367
368
|
end
|
368
369
|
end
|
369
370
|
end
|
370
371
|
|
371
|
-
describe
|
372
|
-
context
|
372
|
+
describe "raw_info" do
|
373
|
+
context "when skip_info is true" do
|
373
374
|
before { subject.options[:skip_info] = true }
|
374
375
|
|
375
|
-
it
|
376
|
+
it "should not include raw_info" do
|
376
377
|
expect(subject.extra).not_to have_key(:raw_info)
|
377
378
|
end
|
378
379
|
end
|
379
380
|
|
380
|
-
context
|
381
|
+
context "when skip_info is false" do
|
381
382
|
before { subject.options[:skip_info] = false }
|
382
383
|
|
383
|
-
it
|
384
|
-
expect(subject.extra[:raw_info]).to eq(
|
384
|
+
it "should include raw_info" do
|
385
|
+
expect(subject.extra[:raw_info]).to eq("sub" => "12345")
|
385
386
|
end
|
386
387
|
end
|
387
388
|
end
|
388
389
|
end
|
389
390
|
|
390
|
-
describe
|
391
|
-
it
|
391
|
+
describe "build_access_token" do
|
392
|
+
it "should use a hybrid authorization request_uri if this is an AJAX request with a code parameter" do
|
392
393
|
allow(request).to receive(:xhr?).and_return(true)
|
393
|
-
allow(request).to receive(:params).and_return(
|
394
|
+
allow(request).to receive(:params).and_return("code" => "valid_code")
|
394
395
|
|
395
396
|
client = double(:client)
|
396
397
|
auth_code = double(:auth_code)
|
397
398
|
allow(client).to receive(:auth_code).and_return(auth_code)
|
398
399
|
expect(subject).to receive(:client).and_return(client)
|
399
|
-
expect(auth_code).to receive(:get_token).with(
|
400
|
+
expect(auth_code).to receive(:get_token).with("valid_code", { redirect_uri: "postmessage" }, {})
|
400
401
|
|
401
402
|
expect(subject).not_to receive(:orig_build_access_token)
|
402
403
|
subject.build_access_token
|
403
404
|
end
|
404
405
|
|
405
|
-
it
|
406
|
+
it "should use a hybrid authorization request_uri if this is an AJAX request (mobile) with a code parameter" do
|
406
407
|
allow(request).to receive(:xhr?).and_return(true)
|
407
|
-
allow(request).to receive(:params).and_return(
|
408
|
+
allow(request).to receive(:params).and_return("code" => "valid_code", "redirect_uri" => "")
|
408
409
|
|
409
410
|
client = double(:client)
|
410
411
|
auth_code = double(:auth_code)
|
411
412
|
allow(client).to receive(:auth_code).and_return(auth_code)
|
412
413
|
expect(subject).to receive(:client).and_return(client)
|
413
|
-
expect(auth_code).to receive(:get_token).with(
|
414
|
+
expect(auth_code).to receive(:get_token).with("valid_code", { redirect_uri: "" }, {})
|
414
415
|
|
415
416
|
expect(subject).not_to receive(:orig_build_access_token)
|
416
417
|
subject.build_access_token
|
417
418
|
end
|
418
419
|
|
419
|
-
it
|
420
|
+
it "should use the request_uri from params if this not an AJAX request (request from installed app) with a code parameter" do
|
420
421
|
allow(request).to receive(:xhr?).and_return(false)
|
421
|
-
allow(request).to receive(:params).and_return(
|
422
|
+
allow(request).to receive(:params).and_return("code" => "valid_code", "redirect_uri" => "redirect_uri")
|
422
423
|
|
423
424
|
client = double(:client)
|
424
425
|
auth_code = double(:auth_code)
|
425
426
|
allow(client).to receive(:auth_code).and_return(auth_code)
|
426
427
|
expect(subject).to receive(:client).and_return(client)
|
427
|
-
expect(auth_code).to receive(:get_token).with(
|
428
|
+
expect(auth_code).to receive(:get_token).with("valid_code", { redirect_uri: "redirect_uri" }, {})
|
428
429
|
|
429
430
|
expect(subject).not_to receive(:orig_build_access_token)
|
430
431
|
subject.build_access_token
|
431
432
|
end
|
432
433
|
|
433
|
-
it
|
434
|
+
it "should read access_token from hash if this is not an AJAX request with a code parameter" do
|
434
435
|
allow(request).to receive(:xhr?).and_return(false)
|
435
|
-
allow(request).to receive(:params).and_return(
|
436
|
-
expect(subject).to receive(:verify_token).with(
|
436
|
+
allow(request).to receive(:params).and_return("access_token" => "valid_access_token")
|
437
|
+
expect(subject).to receive(:verify_token).with("valid_access_token").and_return true
|
437
438
|
expect(subject).to receive(:client).and_return(:client)
|
438
439
|
|
439
440
|
token = subject.build_access_token
|
440
441
|
expect(token).to be_instance_of(::OAuth2::AccessToken)
|
441
|
-
expect(token.token).to eq(
|
442
|
+
expect(token.token).to eq("valid_access_token")
|
442
443
|
expect(token.client).to eq(:client)
|
443
444
|
end
|
444
445
|
|
445
|
-
it
|
446
|
+
it "reads the code from a json request body" do
|
446
447
|
body = StringIO.new(%({"code":"json_access_token"}))
|
447
448
|
client = double(:client)
|
448
449
|
auth_code = double(:auth_code)
|
449
450
|
|
450
451
|
allow(request).to receive(:xhr?).and_return(false)
|
451
|
-
allow(request).to receive(:content_type).and_return(
|
452
|
+
allow(request).to receive(:content_type).and_return("application/json")
|
452
453
|
allow(request).to receive(:body).and_return(body)
|
453
454
|
allow(client).to receive(:auth_code).and_return(auth_code)
|
454
455
|
expect(subject).to receive(:client).and_return(client)
|
455
456
|
|
456
|
-
expect(auth_code).to receive(:get_token).with(
|
457
|
+
expect(auth_code).to receive(:get_token).with("json_access_token", { redirect_uri: "postmessage" }, {})
|
457
458
|
|
458
459
|
subject.build_access_token
|
459
460
|
end
|
460
461
|
|
461
|
-
it
|
462
|
+
it "should use callback_url without query_string if this is not an AJAX request" do
|
462
463
|
allow(request).to receive(:xhr?).and_return(false)
|
463
|
-
allow(request).to receive(:params).and_return(
|
464
|
-
allow(request).to receive(:content_type).and_return(
|
464
|
+
allow(request).to receive(:params).and_return("code" => "valid_code")
|
465
|
+
allow(request).to receive(:content_type).and_return("application/x-www-form-urlencoded")
|
465
466
|
|
466
467
|
client = double(:client)
|
467
468
|
auth_code = double(:auth_code)
|
468
469
|
allow(client).to receive(:auth_code).and_return(auth_code)
|
469
|
-
allow(subject).to receive(:callback_url).and_return(
|
470
|
+
allow(subject).to receive(:callback_url).and_return("redirect_uri_without_query_string")
|
470
471
|
|
471
472
|
expect(subject).to receive(:client).and_return(client)
|
472
|
-
expect(auth_code).to receive(:get_token).with(
|
473
|
+
expect(auth_code).to receive(:get_token).with("valid_code", { redirect_uri: "redirect_uri_without_query_string" }, {})
|
473
474
|
subject.build_access_token
|
474
475
|
end
|
475
476
|
end
|
476
477
|
|
477
|
-
describe
|
478
|
+
describe "verify_token" do
|
478
479
|
before(:each) do
|
479
480
|
subject.options.client_options[:connection_build] = proc do |builder|
|
480
481
|
builder.request :url_encoded
|
481
482
|
builder.adapter :test do |stub|
|
482
|
-
stub.get(
|
483
|
-
[200, {
|
483
|
+
stub.get("/v2/oauth2/userinfo?access_token=valid_access_token") do
|
484
|
+
[200, { "Content-Type" => "application/json; charset=UTF-8" }, JSON.dump(
|
484
485
|
{
|
485
486
|
identity_provider_display_name: "ORCID",
|
486
487
|
sub: "abc",
|
@@ -494,8 +495,8 @@ describe OmniAuth::Strategies::Globus do
|
|
494
495
|
}
|
495
496
|
)]
|
496
497
|
end
|
497
|
-
stub.get(
|
498
|
-
[400, {
|
498
|
+
stub.get("/v2/oauth2/userinfo?access_token=invalid_access_token") do
|
499
|
+
[400, { "Content-Type" => "application/json; charset=UTF-8" }, JSON.dump(error_description: "Invalid Value")]
|
499
500
|
end
|
500
501
|
end
|
501
502
|
end
|
@@ -505,9 +506,9 @@ describe OmniAuth::Strategies::Globus do
|
|
505
506
|
# expect(subject.send(:verify_token, 'valid_access_token')).to eq(true)
|
506
507
|
# end
|
507
508
|
|
508
|
-
it
|
509
|
+
it "should raise error if access_token is invalid" do
|
509
510
|
expect do
|
510
|
-
subject.send(:verify_token,
|
511
|
+
subject.send(:verify_token, "invalid_access_token")
|
511
512
|
end.to raise_error(OAuth2::Error)
|
512
513
|
end
|
513
514
|
end
|