omniauth-google-id-token 1.0.1 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e2aa2b59a31980084c88b9763e1b35e9565fc2f5f7044a69f861bcccdd0d3c0a
-  data.tar.gz: 7888b2347ab53535c57a0db496117901c758f7da25db48170eea2b1885af4483
+  metadata.gz: c02ed8f51100b53f1a10ffd42db64294c227301291cd80560b03bed96e1c6e23
+  data.tar.gz: e79e6c4ce22a9f3b7a7eb7ab83df37f337208e2e76675c37b23089a90c81e1fe
 SHA512:
-  metadata.gz: d4134c38ef5de2525a362b0e7de15649cad1a233ea5e1c122355492e9798ce4f7d3e6342054a9b2a63961abd4a72a8f6618b868319f169c4c81031056b06f37e
-  data.tar.gz: 699c484111f7f4e985e5653c0a2c569d95ee3bbe16cb33868bc222529ae52822d688895b883a40971ee03d3395f6d73e23b670eaca8fa8ee2790e405897a4ead
+  metadata.gz: 2f429d86224146727b18ea4b462c81eadfefe070e971e92c099572030a8bacd4d73be63d296b8730e9628e6b075709a3cea6ea3c093fb31abf4b3721b8ab94ee
+  data.tar.gz: 43672c465cf5ed00ac25ca7f94e3fc0d555d22dca99a97af5a19b043fd89863d5e4ac63d0189a300df38a7e94ce6c1bd764556ab0da89b2a10babf43feac8fdf

data/Gemfile

@@ -4,7 +4,6 @@ source 'https://rubygems.org'
 gemspec
 
 group :test, :development do
-  gem 'googleauth'
   gem 'jwt' # For testing
   gem 'multi_json' # For testing
   gem 'omniauth'

data/lib/omniauth/google_id_token/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module GoogleIdToken
-    VERSION = '1.0.1'.freeze
+    VERSION = '1.1.1'.freeze
   end
 end

data/lib/omniauth/strategies/google_id_token.rb

@@ -11,15 +11,13 @@ module OmniAuth
         OmniAuth::Strategy.included(subclass)
       end
 
-      BASE_SCOPES = %w[profile email openid].freeze
       RESPONSE_TYPES = %w[token id_token].freeze
 
       option :name, 'google_id_token'
-      option :uid_claim, 'sub'
       option :client_id, nil # Required for request_phase e.g. redirect to auth page
-      option :aud_claim, nil
-      option :azp_claim, nil
+      option :uid_claim, 'sub'
       option :required_claims, %w[email]
+      option :scope, %w[profile email openid].freeze
       option :info_map, { 'name' => 'name', 'email' => 'email' }
 
       def request_phase
@@ -30,7 +28,7 @@ module OmniAuth
 
       def authorize_params # rubocop:disable Metrics/AbcSize
         params = {}
-        params[:scope] = BASE_SCOPES.join(' ')
+        params[:scope] = options.scope.join(' ')
         params[:access_type] = 'offline'
         params[:include_granted_scopes] = true
         params[:state] = SecureRandom.hex(24)
@@ -41,10 +39,10 @@ module OmniAuth
         params
       end
 
-      def decoded # rubocop:disable Metrics/AbcSize,Metrics/MethodLength
+      def decoded # rubocop:disable Metrics/MethodLength
         unless @decoded
           begin
-            @decoded = validator.verify_oidc(request.params['id_token'], aud: options.aud_claim, azp: options.azp_claim)
+            @decoded = validator.verify_oidc(request.params['id_token'], aud: options.client_id)
           rescue StandardError => e
             raise ClaimInvalid, e.message
           end
@@ -79,7 +77,7 @@ module OmniAuth
       private
 
       def validator
-        ::Google::Auth::IDTokens::Verifier
+        ::Google::Auth::IDTokens
       end
 
       def uid_lookup

data/spec/lib/omniauth/strategies/google_id_token_spec.rb

@@ -11,7 +11,7 @@ describe OmniAuth::Strategies::GoogleIdToken do # rubocop:disable Metrics/BlockL
   let(:payload) do
     { 'iss' => 'https://accounts.google.com',
       'nbf' => 161_803_398_874,
-      'aud' => 'http://example.com',
+      'aud' => 'test_client_id',
       'sub' => '3141592653589793238',
       'hd' => 'gmail.com',
       'email' => 'bob@example.com',
@@ -25,16 +25,16 @@ describe OmniAuth::Strategies::GoogleIdToken do # rubocop:disable Metrics/BlockL
       'exp' => 1_596_477_600,
       'jti' => 'abc161803398874def' }
   end
-  let(:aud_claim) { payload[:aud] }
+  let(:client_id) { payload[:aud] }
   let(:azp_claim) { payload[:azp] }
 
-  let(:client_id) { 'test_client_id' }
   let(:args) do
     [
       {
         aud_claim: payload[:aud],
         azp_claim: payload[:azp],
-        client_id: client_id
+        client_id: client_id,
+        provider_ignores_state: true
       }
     ]
   end
@@ -59,6 +59,9 @@ describe OmniAuth::Strategies::GoogleIdToken do # rubocop:disable Metrics/BlockL
   end
 
   describe 'request phase' do
+    before do
+      OmniAuth::AuthenticityTokenProtection.default_options(key: 'csrf.token', authenticity_param: '_csrf')
+    end
     it 'should redirect to the configured login url' do
       post api_url
       expect(last_response.status).to eq(302)
@@ -70,8 +73,8 @@ describe OmniAuth::Strategies::GoogleIdToken do # rubocop:disable Metrics/BlockL
 
   context 'callback phase' do
     it 'should decode the response' do
-      allow(::Google::Auth::IDTokens::Verifier).to receive(:verify_oidc)
-        .with(id_token, aud: aud_claim, azp: azp_claim)
+      allow(::Google::Auth::IDTokens).to receive(:verify_oidc)
+        .with(id_token, aud: client_id)
         .and_return(payload)
 
       post "#{api_url}/callback", id_token: id_token
@@ -80,8 +83,8 @@ describe OmniAuth::Strategies::GoogleIdToken do # rubocop:disable Metrics/BlockL
 
     it 'should not work without required fields' do
       payload.delete('email')
-      allow(::Google::Auth::IDTokens::Verifier).to receive(:verify_oidc)
-        .with(id_token, aud: aud_claim, azp: azp_claim)
+      allow(::Google::Auth::IDTokens).to receive(:verify_oidc)
+        .with(id_token, aud: client_id)
         .and_return(payload)
 
       post "#{api_url}/callback", id_token: id_token
@@ -89,8 +92,8 @@ describe OmniAuth::Strategies::GoogleIdToken do # rubocop:disable Metrics/BlockL
     end
 
     it 'should assign the uid' do
-      allow(::Google::Auth::IDTokens::Verifier).to receive(:verify_oidc)
-        .with(id_token, aud: aud_claim, azp: azp_claim)
+      allow(::Google::Auth::IDTokens).to receive(:verify_oidc)
+        .with(id_token, aud: client_id)
         .and_return(payload)
       post "#{api_url}/callback", id_token: id_token
       expect(response_json['uid']).to eq('3141592653589793238')

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-google-id-token
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.1.1
 platform: ruby
 authors:
 - Joshua Morris