omniauth-google-id-token 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 425802e1587c5e8afa16a3e4b61d535dcd330eb359160c57208b5ab888e3cf8b
-  data.tar.gz: 3e31bc2a0abd6ba90fc88f5b2cff2bbbca22343ca7e89e281f42020aa9de3665
+  metadata.gz: 4b756f006ad3cc0cf614b043370928fd7847e757c5466e5f649828251dba82c8
+  data.tar.gz: 1faaa945a752d1b9d9cecc7db14bf0eba54383c494134a44e48ed52ae2dde598
 SHA512:
-  metadata.gz: fbf39583b5f0ee0570d4cef96349168ee8884c9179a48c5f35260a34c22f223382fab9fa7223eef9729a6eb8e37b0e8659f4514e3f7a053e5a022a1c7919b31a
-  data.tar.gz: f18ed904fe16a8aaa6636a1c5ae31412e1824de327aebe38ea632c9170d7db65819905cf69ab8d6d16cc68eca55b4638a3f93dee32d91099932fd3ccc8ad7efb
+  metadata.gz: a03ae591d4d6bfde18fe0649912364a1f80c54a98659f5e0bfd6c317dc9ef1017d9bc0e3e268ac4251e2cedce2e8598645cfa726ad9480100cc11603b0f68c66
+  data.tar.gz: 755bfe3610a24e8c31a4fa8ce20ade00eff3ef192d8345652574d21868922675dec7625484beaca2d66f7d22cd0d92c80fbfdb557aca3465f74ad164a9150065

data/lib/omniauth/google_id_token/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module GoogleIdToken
-    VERSION = '1.0.0'.freeze
+    VERSION = '1.1.0'.freeze
   end
 end

data/lib/omniauth/strategies/google_id_token.rb

@@ -11,16 +11,13 @@ module OmniAuth
         OmniAuth::Strategy.included(subclass)
       end
 
-      BASE_SCOPES = %w[profile email openid].freeze
       RESPONSE_TYPES = %w[token id_token].freeze
 
       option :name, 'google_id_token'
-      option :uid_claim, 'sub'
       option :client_id, nil # Required for request_phase e.g. redirect to auth page
-      option :aud_claim, nil
-      option :azp_claim, nil
-      option :iss_claim, nil
+      option :uid_claim, 'sub'
       option :required_claims, %w[email]
+      option :scope, %w[profile email openid].freeze
       option :info_map, { 'name' => 'name', 'email' => 'email' }
 
       def request_phase
@@ -31,7 +28,7 @@ module OmniAuth
 
       def authorize_params # rubocop:disable Metrics/AbcSize
         params = {}
-        params[:scope] = BASE_SCOPES.join(' ')
+        params[:scope] = options.scope.join(' ')
         params[:access_type] = 'offline'
         params[:include_granted_scopes] = true
         params[:state] = SecureRandom.hex(24)
@@ -42,10 +39,10 @@ module OmniAuth
         params
       end
 
-      def decoded # rubocop:disable Metrics/AbcSize,Metrics/MethodLength
+      def decoded # rubocop:disable Metrics/MethodLength
         unless @decoded
           begin
-            @decoded = validator.verify_oidc(request.params['id_token'], aud: options.aud_claim, azp: options.azp_claim)
+            @decoded = validator.verify_oidc(request.params['id_token'], aud: options.client_id)
           rescue StandardError => e
             raise ClaimInvalid, e.message
           end

data/omniauth-google-id-token.gemspec

@@ -24,5 +24,5 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'rspec', '~> 3.7'
 
   spec.add_runtime_dependency 'googleauth', '~> 1.8.1'
-  spec.add_runtime_dependency 'omniauth', '~> 1.9.2'
+  spec.add_runtime_dependency 'omniauth', '~> 2.1.1'
 end

data/spec/lib/omniauth/strategies/google_id_token_spec.rb

@@ -11,7 +11,7 @@ describe OmniAuth::Strategies::GoogleIdToken do # rubocop:disable Metrics/BlockL
   let(:payload) do
     { 'iss' => 'https://accounts.google.com',
       'nbf' => 161_803_398_874,
-      'aud' => 'http://example.com',
+      'aud' => 'test_client_id',
       'sub' => '3141592653589793238',
       'hd' => 'gmail.com',
       'email' => 'bob@example.com',
@@ -25,10 +25,9 @@ describe OmniAuth::Strategies::GoogleIdToken do # rubocop:disable Metrics/BlockL
       'exp' => 1_596_477_600,
       'jti' => 'abc161803398874def' }
   end
-  let(:aud_claim) { payload[:aud] }
+  let(:client_id) { payload[:aud] }
   let(:azp_claim) { payload[:azp] }
 
-  let(:client_id) { 'test_client_id' }
   let(:args) do
     [
       {
@@ -59,6 +58,9 @@ describe OmniAuth::Strategies::GoogleIdToken do # rubocop:disable Metrics/BlockL
   end
 
   describe 'request phase' do
+    before do
+      OmniAuth::AuthenticityTokenProtection.default_options(key: 'csrf.token', authenticity_param: '_csrf')
+    end
     it 'should redirect to the configured login url' do
       post api_url
       expect(last_response.status).to eq(302)
@@ -71,7 +73,7 @@ describe OmniAuth::Strategies::GoogleIdToken do # rubocop:disable Metrics/BlockL
   context 'callback phase' do
     it 'should decode the response' do
       allow(::Google::Auth::IDTokens::Verifier).to receive(:verify_oidc)
-        .with(id_token, aud: aud_claim, azp: azp_claim)
+        .with(id_token, aud: client_id)
         .and_return(payload)
 
       post "#{api_url}/callback", id_token: id_token
@@ -81,7 +83,7 @@ describe OmniAuth::Strategies::GoogleIdToken do # rubocop:disable Metrics/BlockL
     it 'should not work without required fields' do
       payload.delete('email')
       allow(::Google::Auth::IDTokens::Verifier).to receive(:verify_oidc)
-        .with(id_token, aud: aud_claim, azp: azp_claim)
+        .with(id_token, aud: client_id)
         .and_return(payload)
 
       post "#{api_url}/callback", id_token: id_token
@@ -90,7 +92,7 @@ describe OmniAuth::Strategies::GoogleIdToken do # rubocop:disable Metrics/BlockL
 
     it 'should assign the uid' do
       allow(::Google::Auth::IDTokens::Verifier).to receive(:verify_oidc)
-        .with(id_token, aud: aud_claim, azp: azp_claim)
+        .with(id_token, aud: client_id)
         .and_return(payload)
       post "#{api_url}/callback", id_token: id_token
       expect(response_json['uid']).to eq('3141592653589793238')

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-google-id-token
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Joshua Morris
@@ -115,14 +115,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: 2.1.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: 2.1.1
 description: An OmniAuth strategy to validate Google id tokens.
 email:
 - hotrungnhan29@gmail.com