omniauth-google-oauth2 0.4.1 → 0.5.0

data/examples/omni_auth.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # Google's OAuth2 docs. Make sure you are familiar with all the options
 # before attempting to configure this gem.
 # https://developers.google.com/accounts/docs/OAuth2Login
@@ -6,40 +8,26 @@ Rails.application.config.middleware.use OmniAuth::Builder do
   # Default usage, this will give you offline access and a refresh token
   # using default scopes 'email' and 'profile'
   #
-  provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], {
-    :scope => 'email,profile'
-  }
+  provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], scope: 'email,profile'
 
   # Manual setup for offline access with a refresh token.
   #
-  # provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], {
-  #   :access_type => 'offline',
-  # }
+  # provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], access_type: 'offline'
 
   # Custom scope supporting youtube. If you are customizing scopes, remember
   # to include the default scopes 'email' and 'profile'
   #
-  # provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], {
-  #   :scope => 'http://gdata.youtube.com,email,profile,plus.me'
-  # }
+  # provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], scope: 'http://gdata.youtube.com,email,profile,plus.me'
 
   # Custom scope for users only using Google for account creation/auth and do not require a refresh token.
   #
-  # provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], {
-  #   :access_type => 'online',
-  #   :prompt => ''
-  # }
+  # provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], access_type: 'online', prompt: ''
 
   # To include information about people in your circles you must include the 'plus.login' scope.
   #
-  # provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], {
-  #   :skip_friends => false,
-  #   :scope => "email,profile,plus.login"
-  # }
+  # provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], skip_friends: false, scope: 'email,profile,plus.login'
 
   # If you need to acquire whether user picture is a default one or uploaded by user.
   #
-  # provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], {
-  #   :skip_image_info => false
-  # }
+  # provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], skip_image_info: false
 end

data/lib/omniauth-google-oauth2.rb

@@ -1 +1,3 @@
-require File.join('omniauth', 'google_oauth2')
+# frozen_string_literal: true
+
+require 'omniauth/google_oauth2'

data/lib/omniauth/google_oauth2.rb

@@ -1 +1,3 @@
-require File.join('omniauth', 'strategies', 'google_oauth2')
+# frozen_string_literal: true
+
+require 'omniauth/strategies/google_oauth2'

data/lib/omniauth/google_oauth2/version.rb

@@ -1,5 +1,7 @@
+# frozen_string_literal: true
+
 module OmniAuth
   module GoogleOauth2
-    VERSION = "0.4.1"
+    VERSION = '0.5.0'
   end
 end

data/lib/omniauth/strategies/google_oauth2.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'multi_json'
 require 'jwt'
 require 'omniauth/strategies/oauth2'
@@ -5,23 +7,24 @@ require 'uri'
 
 module OmniAuth
   module Strategies
+    # Main class for Google OAuth2 strategy.
     class GoogleOauth2 < OmniAuth::Strategies::OAuth2
-      BASE_SCOPE_URL = "https://www.googleapis.com/auth/"
-      BASE_SCOPES = %w[profile email openid]
-      DEFAULT_SCOPE = "email,profile"
+      BASE_SCOPE_URL = 'https://www.googleapis.com/auth/'
+      BASE_SCOPES = %w[profile email openid].freeze
+      DEFAULT_SCOPE = 'email,profile'
 
       option :name, 'google_oauth2'
       option :skip_friends, true
       option :skip_image_info, true
       option :skip_jwt, false
       option :jwt_leeway, 60
-      option :authorize_options, [:access_type, :hd, :login_hint, :prompt, :request_visible_actions, :scope, :state, :redirect_uri, :include_granted_scopes, :openid_realm]
+      option :authorize_options, %i[access_type hd login_hint prompt request_visible_actions scope state redirect_uri include_granted_scopes openid_realm]
+      option :authorized_client_ids, []
 
-      option :client_options, {
-        :site          => 'https://accounts.google.com',
-        :authorize_url => '/o/oauth2/auth',
-        :token_url     => '/o/oauth2/token'
-      }
+      option :client_options,
+             site: 'https://accounts.google.com',
+             authorize_url: '/o/oauth2/auth',
+             token_url: '/o/oauth2/token'
 
       def authorize_params
         super.tap do |params|
@@ -29,30 +32,27 @@ module OmniAuth
             params[k] = request.params[k.to_s] unless [nil, ''].include?(request.params[k.to_s])
           end
 
-          raw_scope = params[:scope] || DEFAULT_SCOPE
-          scope_list = raw_scope.split(" ").map {|item| item.split(",")}.flatten
-          scope_list.map! { |s| s =~ /^https?:\/\// || BASE_SCOPES.include?(s) ? s : "#{BASE_SCOPE_URL}#{s}" }
-          params[:scope] = scope_list.join(" ")
+          params[:scope] = get_scope(params)
           params[:access_type] = 'offline' if params[:access_type].nil?
           params['openid.realm'] = params.delete(:openid_realm) unless params[:openid_realm].nil?
 
-          session['omniauth.state'] = params[:state] if params['state']
+          session['omniauth.state'] = params[:state] if params[:state]
         end
       end
 
-      uid { raw_info['sub'] || verified_email }
+      uid { raw_info['sub'] }
 
       info do
-        prune!({
-          :name       => raw_info['name'],
-          :email      => verified_email,
-          :first_name => raw_info['given_name'],
-          :last_name  => raw_info['family_name'],
-          :image      => image_url,
-          :urls => {
-            'Google' => raw_info['profile']
+        prune!(
+          name: raw_info['name'],
+          email: verified_email,
+          first_name: raw_info['given_name'],
+          last_name: raw_info['family_name'],
+          image: image_url,
+          urls: {
+            google: raw_info['profile']
           }
-        })
+        )
       end
 
       extra do
@@ -60,18 +60,17 @@ module OmniAuth
         hash[:id_token] = access_token['id_token']
         if !options[:skip_jwt] && !access_token['id_token'].nil?
           hash[:id_info] = JWT.decode(
-            access_token['id_token'], nil, false, {
-              :verify_iss => true,
-              'iss' => 'accounts.google.com',
-              :verify_aud => true,
-              'aud' => options.client_id,
-              :verify_sub => false,
-              :verify_expiration => true,
-              :verify_not_before => true,
-              :verify_iat => true,
-              :verify_jti => false,
-              :leeway => options[:jwt_leeway]
-            }).first
+            access_token['id_token'], nil, false, verify_iss: true,
+                                                  iss: 'accounts.google.com',
+                                                  verify_aud: true,
+                                                  aud: options.client_id,
+                                                  verify_sub: false,
+                                                  verify_expiration: true,
+                                                  verify_not_before: true,
+                                                  verify_iat: true,
+                                                  verify_jti: false,
+                                                  leeway: options[:jwt_leeway]
+          ).first
         end
         hash[:raw_info] = raw_info unless skip_info?
         hash[:raw_friend_info] = raw_friend_info(raw_info['sub']) unless skip_info? || options[:skip_friends]
@@ -92,10 +91,24 @@ module OmniAuth
       end
 
       def custom_build_access_token
-        access_token =
+        access_token = get_access_token(request)
+
+        verify_hd(access_token)
+        access_token
+      end
+      alias build_access_token custom_build_access_token
+
+      private
+
+      def callback_url
+        options[:redirect_uri] || (full_host + script_name + callback_path)
+      end
+
+      def get_access_token(request)
         if request.xhr? && request.params['code']
           verifier = request.params['code']
-          client.auth_code.get_token(verifier, get_token_options('postmessage'), deep_symbolize(options.auth_token_params || {}))
+          redirect_uri = request.params['redirect_uri'] || 'postmessage'
+          client.auth_code.get_token(verifier, get_token_options(redirect_uri), deep_symbolize(options.auth_token_params || {}))
         elsif request.params['code'] && request.params['redirect_uri']
           verifier = request.params['code']
           redirect_uri = request.params['redirect_uri']
@@ -103,23 +116,20 @@ module OmniAuth
         elsif verify_token(request.params['access_token'])
           ::OAuth2::AccessToken.from_hash(client, request.params.dup)
         else
-          verifier = request.params["code"]
+          verifier = request.params['code']
           client.auth_code.get_token(verifier, get_token_options(callback_url), deep_symbolize(options.auth_token_params))
         end
-
-        verify_hd(access_token)
-        access_token
       end
-      alias_method :build_access_token, :custom_build_access_token
 
-      private
-
-      def callback_url
-        options[:redirect_uri] || (full_host + script_name + callback_path)
+      def get_scope(params)
+        raw_scope = params[:scope] || DEFAULT_SCOPE
+        scope_list = raw_scope.split(' ').map { |item| item.split(',') }.flatten
+        scope_list.map! { |s| s =~ %r{^https?://} || BASE_SCOPES.include?(s) ? s : "#{BASE_SCOPE_URL}#{s}" }
+        scope_list.join(' ')
       end
 
       def get_token_options(redirect_uri)
-        { :redirect_uri => redirect_uri }.merge(token_params.to_hash(:symbolize_keys => true))
+        { redirect_uri: redirect_uri }.merge(token_params.to_hash(symbolize_keys: true))
       end
 
       def prune!(hash)
@@ -151,7 +161,7 @@ module OmniAuth
       end
 
       def image_size_opts_passed?
-        !!(options[:image_size] || options[:image_aspect_ratio])
+        options[:image_size] || options[:image_aspect_ratio]
       end
 
       def image_params
@@ -172,7 +182,7 @@ module OmniAuth
         return nil if query_parameters.nil?
 
         params = CGI.parse(query_parameters)
-        stripped_params = params.delete_if { |key| key == "sz" }
+        stripped_params = params.delete_if { |key| key == 'sz' }
 
         # don't return an empty Hash since that would result
         # in URLs with a trailing ? character: http://image.url?
@@ -185,15 +195,17 @@ module OmniAuth
         return false unless access_token
         raw_response = client.request(:get, 'https://www.googleapis.com/oauth2/v3/tokeninfo',
                                       params: { access_token: access_token }).parsed
-        raw_response['aud'] == options.client_id
+        raw_response['aud'] == options.client_id || options.authorized_client_ids.include?(raw_response['aud'])
       end
 
       def verify_hd(access_token)
         return true unless options.hd
         @raw_info ||= access_token.get('https://www.googleapis.com/plus/v1/people/me/openIdConnect').parsed
+
+        options.hd = options.hd.call if options.hd.is_a? Proc
         allowed_hosted_domains = Array(options.hd)
 
-        raise CallbackError.new(:invalid_hd, "Invalid Hosted Domain") unless allowed_hosted_domains.include? @raw_info['hd']
+        raise CallbackError.new(:invalid_hd, 'Invalid Hosted Domain') unless allowed_hosted_domains.include? @raw_info['hd']
         true
       end
     end

data/omniauth-google-oauth2.gemspec

@@ -1,26 +1,32 @@
 # -*- encoding: utf-8 -*-
-require File.expand_path(File.join('..', 'lib', 'omniauth', 'google_oauth2', 'version'), __FILE__)
+# frozen_string_literal: true
+
+require File.expand_path(
+  File.join('..', 'lib', 'omniauth', 'google_oauth2', 'version'),
+  __FILE__
+)
 
 Gem::Specification.new do |gem|
-  gem.name          = "omniauth-google-oauth2"
+  gem.name          = 'omniauth-google-oauth2'
   gem.version       = OmniAuth::GoogleOauth2::VERSION
   gem.license       = 'MIT'
-  gem.summary       = %q{A Google OAuth2 strategy for OmniAuth 1.x}
-  gem.description   = %q{A Google OAuth2 strategy for OmniAuth 1.x}
-  gem.authors       = ["Josh Ellithorpe", "Yury Korolev"]
-  gem.email         = ["quest@mac.com"]
-  gem.homepage      = "https://github.com/zquestz/omniauth-google-oauth2"
+  gem.summary       = %(A Google OAuth2 strategy for OmniAuth 1.x)
+  gem.description   = %(A Google OAuth2 strategy for OmniAuth 1.x. This allows you to login to Google with your ruby app.)
+  gem.authors       = ['Josh Ellithorpe', 'Yury Korolev']
+  gem.email         = ['quest@mac.com']
+  gem.homepage      = 'https://github.com/zquestz/omniauth-google-oauth2'
 
   gem.files         = `git ls-files`.split("\n")
-  gem.require_paths = ["lib"]
+  gem.require_paths = ['lib']
 
   gem.required_ruby_version = '>= 2.0'
 
   gem.add_runtime_dependency 'omniauth', '>= 1.1.1'
   gem.add_runtime_dependency 'omniauth-oauth2', '>= 1.3.1'
-  gem.add_runtime_dependency 'jwt', '~> 1.5.2'
+  gem.add_runtime_dependency 'jwt', '~> 1.5'
   gem.add_runtime_dependency 'multi_json', '~> 1.3'
 
-  gem.add_development_dependency 'rspec', '>= 2.14.0'
-  gem.add_development_dependency 'rake'
+  gem.add_development_dependency 'rspec', '~> 3.6'
+  gem.add_development_dependency 'rake', '~> 12.0'
+  gem.add_development_dependency 'rubocop', '~> 0.49'
 end

data/spec/omniauth/strategies/google_oauth2_spec.rb

@@ -1,19 +1,21 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 require 'omniauth-google-oauth2'
 
 describe OmniAuth::Strategies::GoogleOauth2 do
-  let(:request) { double('Request', :params => {}, :cookies => {}, :env => {}) }
-  let(:app) {
+  let(:request) { double('Request', params: {}, cookies: {}, env: {}) }
+  let(:app) do
     lambda do
-      [200, {}, ["Hello."]]
+      [200, {}, ['Hello.']]
     end
-  }
+  end
 
   subject do
     OmniAuth::Strategies::GoogleOauth2.new(app, 'appid', 'secret', @options || {}).tap do |strategy|
-      allow(strategy).to receive(:request) {
+      allow(strategy).to receive(:request) do
         request
-      }
+      end
     end
   end
 
@@ -38,40 +40,59 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       expect(subject.client.options[:token_url]).to eq('/o/oauth2/token')
     end
 
-    describe "overrides" do
-      it 'should allow overriding the site' do
-        @options = {:client_options => {'site' => 'https://example.com'}}
-        expect(subject.client.site).to eq('https://example.com')
-      end
+    describe 'overrides' do
+      context 'as strings' do
+        it 'should allow overriding the site' do
+          @options = { client_options: { 'site' => 'https://example.com' } }
+          expect(subject.client.site).to eq('https://example.com')
+        end
+
+        it 'should allow overriding the authorize_url' do
+          @options = { client_options: { 'authorize_url' => 'https://example.com' } }
+          expect(subject.client.options[:authorize_url]).to eq('https://example.com')
+        end
 
-      it 'should allow overriding the authorize_url' do
-        @options = {:client_options => {'authorize_url' => 'https://example.com'}}
-        expect(subject.client.options[:authorize_url]).to eq('https://example.com')
+        it 'should allow overriding the token_url' do
+          @options = { client_options: { 'token_url' => 'https://example.com' } }
+          expect(subject.client.options[:token_url]).to eq('https://example.com')
+        end
       end
 
-      it 'should allow overriding the token_url' do
-        @options = {:client_options => {'token_url' => 'https://example.com'}}
-        expect(subject.client.options[:token_url]).to eq('https://example.com')
+      context 'as symbols' do
+        it 'should allow overriding the site' do
+          @options = { client_options: { site: 'https://example.com' } }
+          expect(subject.client.site).to eq('https://example.com')
+        end
+
+        it 'should allow overriding the authorize_url' do
+          @options = { client_options: { authorize_url: 'https://example.com' } }
+          expect(subject.client.options[:authorize_url]).to eq('https://example.com')
+        end
+
+        it 'should allow overriding the token_url' do
+          @options = { client_options: { token_url: 'https://example.com' } }
+          expect(subject.client.options[:token_url]).to eq('https://example.com')
+        end
       end
     end
   end
 
-  describe "#authorize_options" do
-    [:access_type, :hd, :login_hint, :prompt, :scope, :state].each do |k|
+  describe '#authorize_options' do
+    %i[access_type hd login_hint prompt scope state].each do |k|
       it "should support #{k}" do
-        @options = {k => 'http://someval'}
+        @options = { k => 'http://someval' }
         expect(subject.authorize_params[k.to_s]).to eq('http://someval')
       end
     end
 
-    describe "redirect_uri" do
+    describe 'redirect_uri' do
       it 'should default to nil' do
         @options = {}
         expect(subject.authorize_params['redirect_uri']).to eq(nil)
       end
 
       it 'should set the redirect_uri parameter if present' do
-        @options = {:redirect_uri => 'https://example.com'}
+        @options = { redirect_uri: 'https://example.com' }
         expect(subject.authorize_params['redirect_uri']).to eq('https://example.com')
       end
     end
@@ -83,51 +104,56 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       end
 
       it 'should set the access_type parameter if present' do
-        @options = {:access_type => 'online'}
+        @options = { access_type: 'online' }
         expect(subject.authorize_params['access_type']).to eq('online')
       end
     end
 
     describe 'hd' do
-      it "should default to nil" do
+      it 'should default to nil' do
         expect(subject.authorize_params['hd']).to eq(nil)
       end
 
       it 'should set the hd (hosted domain) parameter if present' do
-        @options = {:hd => 'example.com'}
+        @options = { hd: 'example.com' }
         expect(subject.authorize_params['hd']).to eq('example.com')
       end
+
+      it 'should set the hd parameter and work with nil hd (gmail)' do
+        @options = { hd: nil }
+        expect(subject.authorize_params['hd']).to eq(nil)
+      end
     end
 
     describe 'login_hint' do
-      it "should default to nil" do
+      it 'should default to nil' do
         expect(subject.authorize_params['login_hint']).to eq(nil)
       end
 
       it 'should set the login_hint parameter if present' do
-        @options = {:login_hint => 'john@example.com'}
+        @options = { login_hint: 'john@example.com' }
         expect(subject.authorize_params['login_hint']).to eq('john@example.com')
       end
     end
 
     describe 'prompt' do
-      it "should default to nil" do
+      it 'should default to nil' do
         expect(subject.authorize_params['prompt']).to eq(nil)
       end
 
       it 'should set the prompt parameter if present' do
-        @options = {:prompt => 'consent select_account'}
+        @options = { prompt: 'consent select_account' }
         expect(subject.authorize_params['prompt']).to eq('consent select_account')
       end
     end
 
     describe 'request_visible_actions' do
-      it "should default to nil" do
+      it 'should default to nil' do
         expect(subject.authorize_params['request_visible_actions']).to eq(nil)
       end
 
       it 'should set the request_visible_actions parameter if present' do
-        @options = {:request_visible_actions => 'something'}
+        @options = { request_visible_actions: 'something' }
         expect(subject.authorize_params['request_visible_actions']).to eq('something')
       end
     end
@@ -138,29 +164,29 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       end
 
       it 'should set the include_granted_scopes parameter if present' do
-        @options = {:include_granted_scopes => 'true'}
+        @options = { include_granted_scopes: 'true' }
         expect(subject.authorize_params['include_granted_scopes']).to eq('true')
       end
     end
 
     describe 'scope' do
       it 'should expand scope shortcuts' do
-        @options = {:scope => 'plus.me'}
+        @options = { scope: 'plus.me' }
         expect(subject.authorize_params['scope']).to eq('https://www.googleapis.com/auth/plus.me')
       end
 
       it 'should leave base scopes as is' do
-        @options = {:scope => 'profile'}
+        @options = { scope: 'profile' }
         expect(subject.authorize_params['scope']).to eq('profile')
       end
 
       it 'should join scopes' do
-        @options = {:scope => 'profile,email'}
+        @options = { scope: 'profile,email' }
         expect(subject.authorize_params['scope']).to eq('profile email')
       end
 
       it 'should deal with whitespace when joining scopes' do
-        @options = {:scope => 'profile, email'}
+        @options = { scope: 'profile, email' }
         expect(subject.authorize_params['scope']).to eq('profile email')
       end
 
@@ -169,56 +195,58 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       end
 
       it 'should support space delimited scopes' do
-        @options = {:scope => 'profile email'}
+        @options = { scope: 'profile email' }
         expect(subject.authorize_params['scope']).to eq('profile email')
       end
 
-      it "should support extremely badly formed scopes" do
-        @options = {:scope => 'profile email,foo,steve yeah http://example.com'}
+      it 'should support extremely badly formed scopes' do
+        @options = { scope: 'profile email,foo,steve yeah http://example.com' }
         expect(subject.authorize_params['scope']).to eq('profile email https://www.googleapis.com/auth/foo https://www.googleapis.com/auth/steve https://www.googleapis.com/auth/yeah http://example.com')
       end
     end
 
     describe 'state' do
       it 'should set the state parameter' do
-        @options = {:state => 'some_state'}
+        @options = { state: 'some_state' }
         expect(subject.authorize_params['state']).to eq('some_state')
+        expect(subject.authorize_params[:state]).to eq('some_state')
         expect(subject.session['omniauth.state']).to eq('some_state')
       end
 
       it 'should set the omniauth.state dynamically' do
-        allow(subject).to receive(:request) { double('Request', {:params => {'state' => 'some_state'}, :env => {}}) }
+        allow(subject).to receive(:request) { double('Request', params: { 'state' => 'some_state' }, env: {}) }
         expect(subject.authorize_params['state']).to eq('some_state')
+        expect(subject.authorize_params[:state]).to eq('some_state')
         expect(subject.session['omniauth.state']).to eq('some_state')
       end
     end
 
-    describe "overrides" do
+    describe 'overrides' do
       it 'should include top-level options that are marked as :authorize_options' do
-        @options = {:authorize_options => [:scope, :foo, :request_visible_actions], :scope => 'http://bar', :foo => 'baz', :hd => "wow", :request_visible_actions => "something"}
+        @options = { authorize_options: %i[scope foo request_visible_actions], scope: 'http://bar', foo: 'baz', hd: 'wow', request_visible_actions: 'something' }
         expect(subject.authorize_params['scope']).to eq('http://bar')
         expect(subject.authorize_params['foo']).to eq('baz')
         expect(subject.authorize_params['hd']).to eq(nil)
         expect(subject.authorize_params['request_visible_actions']).to eq('something')
       end
 
-      describe "request overrides" do
-        [:access_type, :hd, :login_hint, :prompt, :scope, :state].each do |k|
+      describe 'request overrides' do
+        %i[access_type hd login_hint prompt scope state].each do |k|
           context "authorize option #{k}" do
-            let(:request) { double('Request', :params => {k.to_s => 'http://example.com'}, :cookies => {}, :env => {}) }
+            let(:request) { double('Request', params: { k.to_s => 'http://example.com' }, cookies: {}, env: {}) }
 
             it "should set the #{k} authorize option dynamically in the request" do
-              @options = {k => ''}
+              @options = { k: '' }
               expect(subject.authorize_params[k.to_s]).to eq('http://example.com')
             end
           end
         end
 
-        describe "custom authorize_options" do
-          let(:request) { double('Request', :params => {'foo' => 'something'}, :cookies => {}, :env => {}) }
+        describe 'custom authorize_options' do
+          let(:request) { double('Request', params: { 'foo' => 'something' }, cookies: {}, env: {}) }
 
-          it "should support request overrides from custom authorize_options" do
-            @options = {:authorize_options => [:foo], :foo => ''}
+          it 'should support request overrides from custom authorize_options' do
+            @options = { authorize_options: [:foo], foo: '' }
             expect(subject.authorize_params['foo']).to eq('something')
           end
         end
@@ -228,7 +256,7 @@ describe OmniAuth::Strategies::GoogleOauth2 do
 
   describe '#authorize_params' do
     it 'should include any authorize params passed in the :authorize_params option' do
-      @options = {:authorize_params => {:request_visible_actions => 'something', :foo => 'bar', :baz => 'zip'}, :hd => 'wow', :bad => 'not_included'}
+      @options = { authorize_params: { request_visible_actions: 'something', foo: 'bar', baz: 'zip' }, hd: 'wow', bad: 'not_included' }
       expect(subject.authorize_params['request_visible_actions']).to eq('something')
       expect(subject.authorize_params['foo']).to eq('bar')
       expect(subject.authorize_params['baz']).to eq('zip')
@@ -239,15 +267,15 @@ describe OmniAuth::Strategies::GoogleOauth2 do
 
   describe '#token_params' do
     it 'should include any token params passed in the :token_params option' do
-      @options = {:token_params => {:foo => 'bar', :baz => 'zip'}}
+      @options = { token_params: { foo: 'bar', baz: 'zip' } }
       expect(subject.token_params['foo']).to eq('bar')
       expect(subject.token_params['baz']).to eq('zip')
     end
   end
 
-  describe "#token_options" do
+  describe '#token_options' do
     it 'should include top-level options that are marked as :token_options' do
-      @options = {:token_options => [:scope, :foo], :scope => 'bar', :foo => 'baz', :bad => 'not_included'}
+      @options = { token_options: %i[scope foo], scope: 'bar', foo: 'baz', bad: 'not_included' }
       expect(subject.token_params['scope']).to eq('bar')
       expect(subject.token_params['foo']).to eq('baz')
       expect(subject.token_params['bad']).to eq(nil)
@@ -260,10 +288,9 @@ describe OmniAuth::Strategies::GoogleOauth2 do
     end
 
     it 'should set the callback_path parameter if present' do
-      @options = {:callback_path => '/auth/foo/callback'}
+      @options = { callback_path: '/auth/foo/callback' }
       expect(subject.callback_path).to eq('/auth/foo/callback')
     end
-
   end
 
   describe '#extra' do
@@ -271,9 +298,9 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       OAuth2::Client.new('abc', 'def') do |builder|
         builder.request :url_encoded
         builder.adapter :test do |stub|
-          stub.get('/plus/v1/people/me/openIdConnect') {|env| [200, {'content-type' => 'application/json'}, '{"sub": "12345"}']}
-          stub.get('/plus/v1/people/12345/people/visible') {|env| [200, {'content-type' => 'application/json'}, '[{"foo":"bar"}]']}
-          stub.get('/plus/v1/people/12345?fields=image') {|env| [200, {'content-type' => 'application/json'}, '{"image":"imageData"}']}
+          stub.get('/plus/v1/people/me/openIdConnect') { [200, { 'content-type' => 'application/json' }, '{"sub": "12345"}'] }
+          stub.get('/plus/v1/people/12345/people/visible') { [200, { 'content-type' => 'application/json' }, '[{"foo":"bar"}]'] }
+          stub.get('/plus/v1/people/12345?fields=image') { [200, { 'content-type' => 'application/json' }, '{"image":"imageData"}'] }
         end
       end
     end
@@ -290,18 +317,18 @@ describe OmniAuth::Strategies::GoogleOauth2 do
             'nbf' => Time.now.to_i - 60,
             'iat' => Time.now.to_i,
             'aud' => 'appid',
-            'iss' => 'accounts.google.com',
+            'iss' => 'accounts.google.com'
           }
         id_token = JWT.encode(token_info, 'secret')
-        let(:access_token) { OAuth2::AccessToken.from_hash(client, {'id_token' => id_token}) }
+        let(:access_token) { OAuth2::AccessToken.from_hash(client, 'id_token' => id_token) }
 
         it 'should include id_token when set on the access_token' do
-          expect(subject.extra).to include(:id_token => id_token)
+          expect(subject.extra).to include(id_token: id_token)
         end
 
         it 'should include id_info when id_token is set on the access_token and skip_jwt is false' do
           subject.options[:skip_jwt] = false
-          expect(subject.extra).to include(:id_info => token_info)
+          expect(subject.extra).to include(id_info: token_info)
         end
 
         it 'should not include id_info when id_token is set on the access_token and skip_jwt is true' do
@@ -310,7 +337,7 @@ describe OmniAuth::Strategies::GoogleOauth2 do
         end
 
         it 'should include id_info when id_token is set on the access_token by default' do
-          expect(subject.extra).to include(:id_info => token_info)
+          expect(subject.extra).to include(id_info: token_info)
         end
       end
 
@@ -367,7 +394,7 @@ describe OmniAuth::Strategies::GoogleOauth2 do
           before { subject.options[:skip_friends] = false }
 
           it 'should not include raw_friend_info' do
-            expect(subject.extra[:raw_friend_info]).to eq([{'foo' => 'bar'}])
+            expect(subject.extra[:raw_friend_info]).to eq([{ 'foo' => 'bar' }])
           end
         end
       end
@@ -397,7 +424,7 @@ describe OmniAuth::Strategies::GoogleOauth2 do
           before { subject.options[:skip_image_info] = false }
 
           it 'should include raw_image_info' do
-            expect(subject.extra[:raw_image_info]).to eq({'image' => 'imageData'})
+            expect(subject.extra[:raw_image_info]).to eq('image' => 'imageData')
           end
         end
       end
@@ -406,92 +433,92 @@ describe OmniAuth::Strategies::GoogleOauth2 do
 
   describe 'populate auth hash urls' do
     it 'should populate url map in auth hash if link present in raw_info' do
-      allow(subject).to receive(:raw_info) { {'name' => 'Foo', 'profile' => 'https://plus.google.com/123456'} }
-      expect(subject.info[:urls]['Google']).to eq('https://plus.google.com/123456')
+      allow(subject).to receive(:raw_info) { { 'name' => 'Foo', 'profile' => 'https://plus.google.com/123456' } }
+      expect(subject.info[:urls][:google]).to eq('https://plus.google.com/123456')
     end
 
     it 'should not populate url map in auth hash if no link present in raw_info' do
-      allow(subject).to receive(:raw_info) { {'name' => 'Foo'} }
+      allow(subject).to receive(:raw_info) { { 'name' => 'Foo' } }
       expect(subject.info).not_to have_key(:urls)
     end
   end
 
   describe 'image options' do
-    it "should have no image if a picture isn't present" do
-      @options = {:image_aspect_ratio => 'square'}
-      allow(subject).to receive(:raw_info) { {'name' => 'User Without Pic'} }
+    it 'should have no image if a picture is not present' do
+      @options = { image_aspect_ratio: 'square' }
+      allow(subject).to receive(:raw_info) { { 'name' => 'User Without Pic' } }
       expect(subject.info[:image]).to be_nil
     end
 
-    describe "when a picture is returned from google" do
+    describe 'when a picture is returned from google' do
       it 'should return the image with size specified in the `image_size` option' do
-        @options = {:image_size => 50}
-        allow(subject).to receive(:raw_info) { {'picture' => 'https://lh3.googleusercontent.com/url/photo.jpg'} }
+        @options = { image_size: 50 }
+        allow(subject).to receive(:raw_info) { { 'picture' => 'https://lh3.googleusercontent.com/url/photo.jpg' } }
         expect(subject.info[:image]).to eq('https://lh3.googleusercontent.com/url/s50/photo.jpg')
       end
 
       it 'should handle a picture with too many slashes correctly' do
-        @options = {:image_size => 50}
-        allow(subject).to receive(:raw_info) { {'picture' => 'https://lh3.googleusercontent.com/url//photo.jpg'} }
+        @options = { image_size: 50 }
+        allow(subject).to receive(:raw_info) { { 'picture' => 'https://lh3.googleusercontent.com/url//photo.jpg' } }
         expect(subject.info[:image]).to eq('https://lh3.googleusercontent.com/url/s50/photo.jpg')
       end
 
       it 'should handle a picture with a size query parameter correctly' do
-        @options = {:image_size => 50}
-        allow(subject).to receive(:raw_info) { {'picture' => 'https://lh3.googleusercontent.com/url/photo.jpg?sz=50'} }
+        @options = { image_size: 50 }
+        allow(subject).to receive(:raw_info) { { 'picture' => 'https://lh3.googleusercontent.com/url/photo.jpg?sz=50' } }
         expect(subject.info[:image]).to eq('https://lh3.googleusercontent.com/url/s50/photo.jpg')
       end
 
       it 'should handle a picture with a size query parameter and other valid query parameters correctly' do
-        @options = {:image_size => 50}
-        allow(subject).to receive(:raw_info) { {'picture' => 'https://lh3.googleusercontent.com/url/photo.jpg?sz=50&hello=true&life=42'} }
+        @options = { image_size: 50 }
+        allow(subject).to receive(:raw_info) { { 'picture' => 'https://lh3.googleusercontent.com/url/photo.jpg?sz=50&hello=true&life=42' } }
         expect(subject.info[:image]).to eq('https://lh3.googleusercontent.com/url/s50/photo.jpg?hello=true&life=42')
       end
 
       it 'should handle a picture with other valid query parameters correctly' do
-        @options = {:image_size => 50}
-        allow(subject).to receive(:raw_info) { {'picture' => 'https://lh3.googleusercontent.com/url/photo.jpg?hello=true&life=42'} }
+        @options = { image_size: 50 }
+        allow(subject).to receive(:raw_info) { { 'picture' => 'https://lh3.googleusercontent.com/url/photo.jpg?hello=true&life=42' } }
         expect(subject.info[:image]).to eq('https://lh3.googleusercontent.com/url/s50/photo.jpg?hello=true&life=42')
       end
 
       it 'should return the image with width and height specified in the `image_size` option' do
-        @options = {:image_size => {:width => 50, :height => 40}}
-        allow(subject).to receive(:raw_info) { {'picture' => 'https://lh3.googleusercontent.com/url/photo.jpg'} }
+        @options = { image_size: { width: 50, height: 40 } }
+        allow(subject).to receive(:raw_info) { { 'picture' => 'https://lh3.googleusercontent.com/url/photo.jpg' } }
         expect(subject.info[:image]).to eq('https://lh3.googleusercontent.com/url/w50-h40/photo.jpg')
       end
 
       it 'should return square image when `image_aspect_ratio` is specified' do
-        @options = {:image_aspect_ratio => 'square'}
-        allow(subject).to receive(:raw_info) { {'picture' => 'https://lh3.googleusercontent.com/url/photo.jpg'} }
+        @options = { image_aspect_ratio: 'square' }
+        allow(subject).to receive(:raw_info) { { 'picture' => 'https://lh3.googleusercontent.com/url/photo.jpg' } }
         expect(subject.info[:image]).to eq('https://lh3.googleusercontent.com/url/c/photo.jpg')
       end
 
       it 'should return square sized image when `image_aspect_ratio` and `image_size` is set' do
-        @options = {:image_aspect_ratio => 'square', :image_size => 50}
-        allow(subject).to receive(:raw_info) { {'picture' => 'https://lh3.googleusercontent.com/url/photo.jpg'} }
+        @options = { image_aspect_ratio: 'square', image_size: 50 }
+        allow(subject).to receive(:raw_info) { { 'picture' => 'https://lh3.googleusercontent.com/url/photo.jpg' } }
         expect(subject.info[:image]).to eq('https://lh3.googleusercontent.com/url/s50-c/photo.jpg')
       end
 
       it 'should return square sized image when `image_aspect_ratio` and `image_size` has height and width' do
-        @options = {:image_aspect_ratio => 'square', :image_size => {:width => 50, :height => 40}}
-        allow(subject).to receive(:raw_info) { {'picture' => 'https://lh3.googleusercontent.com/url/photo.jpg'} }
+        @options = { image_aspect_ratio: 'square', image_size: { width: 50, height: 40 } }
+        allow(subject).to receive(:raw_info) { { 'picture' => 'https://lh3.googleusercontent.com/url/photo.jpg' } }
         expect(subject.info[:image]).to eq('https://lh3.googleusercontent.com/url/w50-h40-c/photo.jpg')
       end
 
       it 'should return original image if image url does not end in `photo.jpg`' do
-        @options = {:image_size => 50}
-        allow(subject).to receive(:raw_info) { {'picture' => 'https://lh3.googleusercontent.com/url/photograph.jpg'} }
+        @options = { image_size: 50 }
+        allow(subject).to receive(:raw_info) { { 'picture' => 'https://lh3.googleusercontent.com/url/photograph.jpg' } }
         expect(subject.info[:image]).to eq('https://lh3.googleusercontent.com/url/photograph.jpg')
       end
     end
 
     it 'should return original image if no options are provided' do
-      allow(subject).to receive(:raw_info) { {'picture' => 'https://lh3.googleusercontent.com/url/photo.jpg'} }
+      allow(subject).to receive(:raw_info) { { 'picture' => 'https://lh3.googleusercontent.com/url/photo.jpg' } }
       expect(subject.info[:image]).to eq('https://lh3.googleusercontent.com/url/photo.jpg')
     end
 
     it 'should return correct image if google image url has double https' do
-      allow(subject).to receive(:raw_info) { {'picture' => 'https:https://lh3.googleusercontent.com/url/photo.jpg'} }
+      allow(subject).to receive(:raw_info) { { 'picture' => 'https:https://lh3.googleusercontent.com/url/photo.jpg' } }
       expect(subject.info[:image]).to eq('https://lh3.googleusercontent.com/url/photo.jpg')
     end
   end
@@ -505,7 +532,21 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       auth_code = double(:auth_code)
       allow(client).to receive(:auth_code).and_return(auth_code)
       expect(subject).to receive(:client).and_return(client)
-      expect(auth_code).to receive(:get_token).with('valid_code', { :redirect_uri => 'postmessage'}, {})
+      expect(auth_code).to receive(:get_token).with('valid_code', { redirect_uri: 'postmessage' }, {})
+
+      expect(subject).not_to receive(:orig_build_access_token)
+      subject.build_access_token
+    end
+
+    it 'should use a hybrid authorization request_uri if this is an AJAX request (mobile) with a code parameter' do
+      allow(request).to receive(:xhr?).and_return(true)
+      allow(request).to receive(:params).and_return('code' => 'valid_code', 'redirect_uri' => '')
+
+      client = double(:client)
+      auth_code = double(:auth_code)
+      allow(client).to receive(:auth_code).and_return(auth_code)
+      expect(subject).to receive(:client).and_return(client)
+      expect(auth_code).to receive(:get_token).with('valid_code', { redirect_uri: '' }, {})
 
       expect(subject).not_to receive(:orig_build_access_token)
       subject.build_access_token
@@ -519,7 +560,7 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       auth_code = double(:auth_code)
       allow(client).to receive(:auth_code).and_return(auth_code)
       expect(subject).to receive(:client).and_return(client)
-      expect(auth_code).to receive(:get_token).with('valid_code', { :redirect_uri => 'redirect_uri'}, {})
+      expect(auth_code).to receive(:get_token).with('valid_code', { redirect_uri: 'redirect_uri' }, {})
 
       expect(subject).not_to receive(:orig_build_access_token)
       subject.build_access_token
@@ -547,7 +588,7 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       allow(subject).to receive(:callback_url).and_return('redirect_uri_without_query_string')
 
       expect(subject).to receive(:client).and_return(client)
-      expect(auth_code).to receive(:get_token).with('valid_code', { :redirect_uri => 'redirect_uri_without_query_string'}, {})
+      expect(auth_code).to receive(:get_token).with('valid_code', { redirect_uri: 'redirect_uri_without_query_string' }, {})
       subject.build_access_token
     end
   end
@@ -557,19 +598,19 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       subject.options.client_options[:connection_build] = proc do |builder|
         builder.request :url_encoded
         builder.adapter :test do |stub|
-          stub.get('/oauth2/v3/tokeninfo?access_token=valid_access_token') do |env|
-            [200, {'Content-Type' => 'application/json; charset=UTF-8'}, MultiJson.encode(
-              :aud => "000000000000.apps.googleusercontent.com",
-              :sub => "123456789",
-              :email_verified => "true",
-              :email => "example@example.com",
-              :access_type => "offline",
-              :scope => "profile email",
-              :expires_in => 436
+          stub.get('/oauth2/v3/tokeninfo?access_token=valid_access_token') do
+            [200, { 'Content-Type' => 'application/json; charset=UTF-8' }, MultiJson.encode(
+              aud: '000000000000.apps.googleusercontent.com',
+              sub: '123456789',
+              email_verified: 'true',
+              email: 'example@example.com',
+              access_type: 'offline',
+              scope: 'profile email',
+              expires_in: 436
             )]
           end
-          stub.get('/oauth2/v3/tokeninfo?access_token=invalid_access_token') do |env|
-            [400, {'Content-Type' => 'application/json; charset=UTF-8'}, MultiJson.encode(:error_description => 'Invalid Value')]
+          stub.get('/oauth2/v3/tokeninfo?access_token=invalid_access_token') do
+            [400, { 'Content-Type' => 'application/json; charset=UTF-8' }, MultiJson.encode(error_description: 'Invalid Value')]
           end
         end
       end
@@ -580,14 +621,19 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       expect(subject.send(:verify_token, 'valid_access_token')).to eq(true)
     end
 
+    it 'should verify token if access_token is valid and app_id authorized' do
+      subject.options.authorized_client_ids = ['000000000000.apps.googleusercontent.com']
+      expect(subject.send(:verify_token, 'valid_access_token')).to eq(true)
+    end
+
     it 'should not verify token if access_token is valid but app_id is false' do
       expect(subject.send(:verify_token, 'valid_access_token')).to eq(false)
     end
 
     it 'should raise error if access_token is invalid' do
-      expect {
+      expect do
         subject.send(:verify_token, 'invalid_access_token')
-      }.to raise_error(OAuth2::Error)
+      end.to raise_error(OAuth2::Error)
     end
   end
 
@@ -596,9 +642,9 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       OAuth2::Client.new('abc', 'def') do |builder|
         builder.request :url_encoded
         builder.adapter :test do |stub|
-          stub.get('/plus/v1/people/me/openIdConnect') do |env|
-            [200, {'Content-Type' => 'application/json; charset=UTF-8'}, MultiJson.encode(
-              :hd => 'example.com',
+          stub.get('/plus/v1/people/me/openIdConnect') do
+            [200, { 'Content-Type' => 'application/json; charset=UTF-8' }, MultiJson.encode(
+              hd: 'example.com'
             )]
           end
         end
@@ -606,6 +652,36 @@ describe OmniAuth::Strategies::GoogleOauth2 do
     end
     let(:access_token) { OAuth2::AccessToken.from_hash(client, {}) }
 
+    context 'when domain is nil' do
+      let(:client) do
+        OAuth2::Client.new('abc', 'def') do |builder|
+          builder.request :url_encoded
+          builder.adapter :test do |stub|
+            stub.get('/plus/v1/people/me/openIdConnect') do
+              [200, { 'Content-Type' => 'application/json; charset=UTF-8' }, MultiJson.encode({})]
+            end
+          end
+        end
+      end
+
+      it 'should verify hd if options hd is set and correct' do
+        subject.options.hd = nil
+        expect(subject.send(:verify_hd, access_token)).to eq(true)
+      end
+
+      it 'should verify hd if options hd is set as an array and is correct' do
+        subject.options.hd = ['example.com', 'example.co', nil]
+        expect(subject.send(:verify_hd, access_token)).to eq(true)
+      end
+
+      it 'should raise an exception if nil is not included' do
+        subject.options.hd = ['example.com', 'example.co']
+        expect do
+          subject.send(:verify_hd, access_token)
+        end.to raise_error(OmniAuth::Strategies::OAuth2::CallbackError)
+      end
+    end
+
     it 'should verify hd if options hd is not set' do
       expect(subject.send(:verify_hd, access_token)).to eq(true)
     end
@@ -616,22 +692,32 @@ describe OmniAuth::Strategies::GoogleOauth2 do
     end
 
     it 'should verify hd if options hd is set as an array and is correct' do
-      subject.options.hd = ['example.com', 'example.co']
+      subject.options.hd = ['example.com', 'example.co', nil]
+      expect(subject.send(:verify_hd, access_token)).to eq(true)
+    end
+
+    it 'should verify hd if options hd is set as an Proc and is correct' do
+      subject.options.hd = proc { 'example.com' }
+      expect(subject.send(:verify_hd, access_token)).to eq(true)
+    end
+
+    it 'should verify hd if options hd is set as an Proc returning an array and is correct' do
+      subject.options.hd = proc { ['example.com', 'example.co'] }
       expect(subject.send(:verify_hd, access_token)).to eq(true)
     end
 
     it 'should raise error if options hd is set and wrong' do
       subject.options.hd = 'invalid.com'
-      expect {
+      expect do
         subject.send(:verify_hd, access_token)
-      }.to raise_error(OmniAuth::Strategies::GoogleOauth2::CallbackError)
+      end.to raise_error(OmniAuth::Strategies::GoogleOauth2::CallbackError)
     end
 
     it 'should raise error if options hd is set as an array and is not correct' do
       subject.options.hd = ['invalid.com', 'invalid.co']
-      expect {
+      expect do
         subject.send(:verify_hd, access_token)
-      }.to raise_error(OmniAuth::Strategies::GoogleOauth2::CallbackError)
+      end.to raise_error(OmniAuth::Strategies::GoogleOauth2::CallbackError)
     end
   end
 end