omniauth-google-id-token 1.0.1 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e2aa2b59a31980084c88b9763e1b35e9565fc2f5f7044a69f861bcccdd0d3c0a
-  data.tar.gz: 7888b2347ab53535c57a0db496117901c758f7da25db48170eea2b1885af4483
+  metadata.gz: 4b756f006ad3cc0cf614b043370928fd7847e757c5466e5f649828251dba82c8
+  data.tar.gz: 1faaa945a752d1b9d9cecc7db14bf0eba54383c494134a44e48ed52ae2dde598
 SHA512:
-  metadata.gz: d4134c38ef5de2525a362b0e7de15649cad1a233ea5e1c122355492e9798ce4f7d3e6342054a9b2a63961abd4a72a8f6618b868319f169c4c81031056b06f37e
-  data.tar.gz: 699c484111f7f4e985e5653c0a2c569d95ee3bbe16cb33868bc222529ae52822d688895b883a40971ee03d3395f6d73e23b670eaca8fa8ee2790e405897a4ead
+  metadata.gz: a03ae591d4d6bfde18fe0649912364a1f80c54a98659f5e0bfd6c317dc9ef1017d9bc0e3e268ac4251e2cedce2e8598645cfa726ad9480100cc11603b0f68c66
+  data.tar.gz: 755bfe3610a24e8c31a4fa8ce20ade00eff3ef192d8345652574d21868922675dec7625484beaca2d66f7d22cd0d92c80fbfdb557aca3465f74ad164a9150065

data/lib/omniauth/google_id_token/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module GoogleIdToken
-    VERSION = '1.0.1'.freeze
+    VERSION = '1.1.0'.freeze
   end
 end

data/lib/omniauth/strategies/google_id_token.rb

@@ -11,15 +11,13 @@ module OmniAuth
         OmniAuth::Strategy.included(subclass)
       end
 
-      BASE_SCOPES = %w[profile email openid].freeze
       RESPONSE_TYPES = %w[token id_token].freeze
 
       option :name, 'google_id_token'
-      option :uid_claim, 'sub'
       option :client_id, nil # Required for request_phase e.g. redirect to auth page
-      option :aud_claim, nil
-      option :azp_claim, nil
+      option :uid_claim, 'sub'
       option :required_claims, %w[email]
+      option :scope, %w[profile email openid].freeze
       option :info_map, { 'name' => 'name', 'email' => 'email' }
 
       def request_phase
@@ -30,7 +28,7 @@ module OmniAuth
 
       def authorize_params # rubocop:disable Metrics/AbcSize
         params = {}
-        params[:scope] = BASE_SCOPES.join(' ')
+        params[:scope] = options.scope.join(' ')
         params[:access_type] = 'offline'
         params[:include_granted_scopes] = true
         params[:state] = SecureRandom.hex(24)
@@ -41,10 +39,10 @@ module OmniAuth
         params
       end
 
-      def decoded # rubocop:disable Metrics/AbcSize,Metrics/MethodLength
+      def decoded # rubocop:disable Metrics/MethodLength
         unless @decoded
           begin
-            @decoded = validator.verify_oidc(request.params['id_token'], aud: options.aud_claim, azp: options.azp_claim)
+            @decoded = validator.verify_oidc(request.params['id_token'], aud: options.client_id)
           rescue StandardError => e
             raise ClaimInvalid, e.message
           end

data/spec/lib/omniauth/strategies/google_id_token_spec.rb

@@ -11,7 +11,7 @@ describe OmniAuth::Strategies::GoogleIdToken do # rubocop:disable Metrics/BlockL
   let(:payload) do
     { 'iss' => 'https://accounts.google.com',
       'nbf' => 161_803_398_874,
-      'aud' => 'http://example.com',
+      'aud' => 'test_client_id',
       'sub' => '3141592653589793238',
       'hd' => 'gmail.com',
       'email' => 'bob@example.com',
@@ -25,10 +25,9 @@ describe OmniAuth::Strategies::GoogleIdToken do # rubocop:disable Metrics/BlockL
       'exp' => 1_596_477_600,
       'jti' => 'abc161803398874def' }
   end
-  let(:aud_claim) { payload[:aud] }
+  let(:client_id) { payload[:aud] }
   let(:azp_claim) { payload[:azp] }
 
-  let(:client_id) { 'test_client_id' }
   let(:args) do
     [
       {
@@ -59,6 +58,9 @@ describe OmniAuth::Strategies::GoogleIdToken do # rubocop:disable Metrics/BlockL
   end
 
   describe 'request phase' do
+    before do
+      OmniAuth::AuthenticityTokenProtection.default_options(key: 'csrf.token', authenticity_param: '_csrf')
+    end
     it 'should redirect to the configured login url' do
       post api_url
       expect(last_response.status).to eq(302)
@@ -71,7 +73,7 @@ describe OmniAuth::Strategies::GoogleIdToken do # rubocop:disable Metrics/BlockL
   context 'callback phase' do
     it 'should decode the response' do
       allow(::Google::Auth::IDTokens::Verifier).to receive(:verify_oidc)
-        .with(id_token, aud: aud_claim, azp: azp_claim)
+        .with(id_token, aud: client_id)
         .and_return(payload)
 
       post "#{api_url}/callback", id_token: id_token
@@ -81,7 +83,7 @@ describe OmniAuth::Strategies::GoogleIdToken do # rubocop:disable Metrics/BlockL
     it 'should not work without required fields' do
       payload.delete('email')
       allow(::Google::Auth::IDTokens::Verifier).to receive(:verify_oidc)
-        .with(id_token, aud: aud_claim, azp: azp_claim)
+        .with(id_token, aud: client_id)
         .and_return(payload)
 
       post "#{api_url}/callback", id_token: id_token
@@ -90,7 +92,7 @@ describe OmniAuth::Strategies::GoogleIdToken do # rubocop:disable Metrics/BlockL
 
     it 'should assign the uid' do
       allow(::Google::Auth::IDTokens::Verifier).to receive(:verify_oidc)
-        .with(id_token, aud: aud_claim, azp: azp_claim)
+        .with(id_token, aud: client_id)
         .and_return(payload)
       post "#{api_url}/callback", id_token: id_token
       expect(response_json['uid']).to eq('3141592653589793238')

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-google-id-token
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.1.0
 platform: ruby
 authors:
 - Joshua Morris