omniauth-google-oauth2 1.1.0 → 1.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f1ed28b1b51bd66946f8a20796e451090685c868c6923e18e38fd2476f398989
-  data.tar.gz: ee9023b2fd1e74bea632aa12d50d411be6d5738bf91da56293470db5cc339720
+  metadata.gz: adbd87cbf3dc07abbc3f14d2923a655b78cae9701432c0f0866e959eeb946606
+  data.tar.gz: f4b975b570dd5b96032402766be88e8537f419ea361564275b2e84b97bd2cdb9
 SHA512:
-  metadata.gz: 0cf127deee1596814c94521433300e88f965ee762a93f085a07dcf38307a48bdb803f40b6f35bb3611b29aa3349ac0f209ac6da64facb6733620ad820f4f1911
-  data.tar.gz: 72ce107f30e80fc5564e0fcdea2de7a813f4962ea202aa5076b364cc561d9890e91f2dd1f25736df2238709910cefe800fba6854200e2320a149d596aaec8ef0
+  metadata.gz: 0445f4e07feba58d9b850dcf6d0a45e256a9e6557de6f5a248b0ac8e42004446eb9bc31cfa3dd3f61cb0baab276b3d85b17f302863f81f0560c4532f58a05115
+  data.tar.gz: 4a7c65a13c017c7da47d8a82e86615e51af46c32d20dcf25d4fcc6451b81299a63c291b78b3b956ddc4c015d97e2d2c855efa6647ad29f7cda25171746231e4a

data/.github/workflows/ci.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        ruby-version: ['2.3', '2.4', '2.5', '2.6', '2.7', '3.0', '3.1']
+        ruby-version: ['2.3', '2.4', '2.5', '2.6', '2.7', '3.0', '3.1', '3.2', truffleruby-head]
 
     steps:
     - uses: actions/checkout@v2

data/CHANGELOG.md

@@ -1,6 +1,34 @@
 # Changelog
 All notable changes to this project will be documented in this file.
 
+## 1.1.2 - 2024-03-28
+
+### Added
+- Add support for enable_granular_consent option (#455)
+
+### Deprecated
+- Nothing.
+
+### Removed
+- Nothing.
+
+### Fixed
+- Nothing.
+
+## 1.1.1 - 2022-09-05
+
+### Added
+- Nothing.
+
+### Deprecated
+- Nothing.
+
+### Removed
+- Nothing.
+
+### Fixed
+- Fixed JWT decoding issue. (Invalid segment encoding) [#431](https://github.com/zquestz/omniauth-google-oauth2/pull/431)
+
 ## 1.1.0 - 2022-09-03
 
 ### Added

data/README.md

@@ -40,6 +40,8 @@ You can now access the OmniAuth Google OAuth2 URL: `/auth/google_oauth2`
 
 For more examples please check out `examples/omni_auth.rb`
 
+[Using Devise? Skip the above and jump down to the Devise section!](#devise) After setting up the provider via Devise, you can reference the confdiurations below.
+
 NOTE: While developing your application, if you change the scope in the initializer you will need to restart your app server. Remember that either the 'email' or 'profile' scope is required!
 
 ## Configuration
@@ -81,6 +83,8 @@ You can configure several options, which you pass in to the `provider` method vi
 
 * `include_granted_scopes`: If this is provided with the value true, and the authorization request is granted, the authorization will include any previous authorizations granted to this user/application combination for other scopes. See Google's [Incremental Authorization](https://developers.google.com/accounts/docs/OAuth2WebServer#incrementalAuth) for additional details.
 
+* `enable_granular_consent`: If this is provided with the value true, users can choose to only grant access to specific data. See Google's [How to handle granular permissions](https://developers.google.com/identity/protocols/oauth2/resources/granular-permissions) guide for additional details.
+
 * `openid_realm`: Set the OpenID realm value, to allow upgrading from OpenID based authentication to OAuth 2 based authentication. When this is set correctly an `openid_id` value will be set in `['extra']['id_info']` in the authentication hash with the value of the user's OpenID ID URL.
 
 * `provider_ignores_state`: You will need to set this to `true` when using the `One-time Code Flow` below. In this flow there is no server side redirect that would set the state.

data/examples/Gemfile

@@ -2,7 +2,7 @@
 
 source 'https://rubygems.org'
 
-gem 'omniauth-google-oauth2', '~> 0.8.1'
+gem 'omniauth-google-oauth2', '~> 1.1.2'
 gem 'rubocop'
 gem 'sinatra', '~> 1.4'
 gem 'webrick'

data/examples/config.ru

@@ -19,6 +19,19 @@ OpenSSL::SSL::VERIFY_PEER = OpenSSL::SSL::VERIFY_NONE
 
 # Main example app for omniauth-google-oauth2
 class App < Sinatra::Base
+  configure do
+    set :sessions, true
+    set :inline_templates, true
+  end
+
+  use Rack::Session::Cookie, secret: ENV['RACK_COOKIE_SECRET']
+
+  use OmniAuth::Builder do
+    # For additional provider examples please look at 'omni_auth.rb'
+    # The key provider_ignores_state is only for AJAX flows. It is not recommended for normal logins.
+    provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], access_type: 'offline', prompt: 'consent', provider_ignores_state: true, scope: 'email,profile,calendar'
+  end
+
   get '/' do
     <<-HTML
     <!DOCTYPE html>
@@ -73,7 +86,12 @@ class App < Sinatra::Base
       </head>
       <body>
       <ul>
-        <li><a href='/auth/google_oauth2'>Sign in with Google</a></li>
+        <li>
+          <form method='post' action='/auth/google_oauth2'>
+            <input type="hidden" name="authenticity_token" value="#{request.env['rack.session']['csrf']}">
+            <button type='submit'>Login with Google</button>
+          </form>
+        </li>
         <li><a href='#' class="googleplus-login">Sign in with Google via AJAX</a></li>
       </ul>
       </body>
@@ -109,12 +127,4 @@ class App < Sinatra::Base
   end
 end
 
-use Rack::Session::Cookie, secret: ENV['RACK_COOKIE_SECRET']
-
-use OmniAuth::Builder do
-  # For additional provider examples please look at 'omni_auth.rb'
-  # The key provider_ignores_state is only for AJAX flows. It is not recommended for normal logins.
-  provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], access_type: 'offline', prompt: 'consent', provider_ignores_state: true, scope: 'email,profile,calendar'
-end
-
 run App.new

data/examples/omni_auth.rb

@@ -8,11 +8,11 @@ Rails.application.config.middleware.use OmniAuth::Builder do
   # Default usage, this will give you offline access and a refresh token
   # using default scopes 'email' and 'profile'
   #
-  provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], scope: 'email,profile'
+  provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], scope: 'email, profile'
 
   # Custom redirect_uri
   #
-  # provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], scope: 'email,profile', redirect_uri: 'https://localhost:3000/redirect'
+  # provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], scope: 'email, profile', redirect_uri: 'https://localhost:3000/redirect'
 
   # Manual setup for offline access with a refresh token.
   #
@@ -21,7 +21,7 @@ Rails.application.config.middleware.use OmniAuth::Builder do
   # Custom scope supporting youtube. If you are customizing scopes, remember
   # to include the default scopes 'email' and 'profile'
   #
-  # provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], scope: 'http://gdata.youtube.com,email,profile,plus.me'
+  # provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], scope: 'http://gdata.youtube.com, email, profile, plus.me'
 
   # Custom scope for users only using Google for account creation/auth and do not require a refresh token.
   #
@@ -29,7 +29,7 @@ Rails.application.config.middleware.use OmniAuth::Builder do
 
   # To include information about people in your circles you must include the 'plus.login' scope.
   #
-  # provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], skip_friends: false, scope: 'email,profile,plus.login'
+  # provider :google_oauth2, ENV['GOOGLE_KEY'], ENV['GOOGLE_SECRET'], skip_friends: false, scope: 'email, profile, plus.login'
 
   # If you need to acquire whether user picture is a default one or uploaded by user.
   #

data/lib/omniauth/google_oauth2/version.rb

@@ -2,6 +2,6 @@
 
 module OmniAuth
   module GoogleOauth2
-    VERSION = '1.1.0'
+    VERSION = '1.1.2'
   end
 end

data/lib/omniauth/strategies/google_oauth2.rb

@@ -15,7 +15,7 @@ module OmniAuth
       DEFAULT_SCOPE = 'email,profile'
       USER_INFO_URL = 'https://www.googleapis.com/oauth2/v3/userinfo'
       IMAGE_SIZE_REGEXP = /(s\d+(-c)?)|(w\d+-h\d+(-c)?)|(w\d+(-c)?)|(h\d+(-c)?)|c/
-      AUTHORIZE_OPTIONS = %i[access_type hd login_hint prompt request_visible_actions scope state redirect_uri include_granted_scopes openid_realm device_id device_name]
+      AUTHORIZE_OPTIONS = %i[access_type hd login_hint prompt request_visible_actions scope state redirect_uri include_granted_scopes enable_granular_consent openid_realm device_id device_name]
 
       option :name, 'google_oauth2'
       option :skip_friends, true
@@ -69,9 +69,10 @@ module OmniAuth
 
       extra do
         hash = {}
-        hash[:id_token] = access_token.token
-        if !options[:skip_jwt] && !nil_or_empty(access_token.token)
-          decoded = ::JWT.decode(access_token.token, nil, false).first
+        token = nil_or_empty?(access_token['id_token']) ? access_token.token : access_token['id_token']
+        hash[:id_token] = token
+        if !options[:skip_jwt] && !nil_or_empty?(token)
+          decoded = ::JWT.decode(token, nil, false).first
 
           # We have to manually verify the claims because the third parameter to
           # JWT.decode is false since no verification key is provided.
@@ -108,7 +109,7 @@ module OmniAuth
 
       private
 
-      def nil_or_empty(obj)
+      def nil_or_empty?(obj)
         obj.is_a?(String) ? obj.empty? : obj.nil?
       end
 

data/omniauth-google-oauth2.gemspec

@@ -21,9 +21,9 @@ Gem::Specification.new do |gem|
   gem.required_ruby_version = '>= 2.2'
 
   gem.add_runtime_dependency 'jwt', '>= 2.0'
-  gem.add_runtime_dependency 'oauth2', '~> 2.0.6'
+  gem.add_runtime_dependency 'oauth2', '~> 2.0'
   gem.add_runtime_dependency 'omniauth', '~> 2.0'
-  gem.add_runtime_dependency 'omniauth-oauth2', '~> 1.8.0'
+  gem.add_runtime_dependency 'omniauth-oauth2', '~> 1.8'
 
   gem.add_development_dependency 'rake', '~> 12.0'
   gem.add_development_dependency 'rspec', '~> 3.6'

data/spec/omniauth/strategies/google_oauth2_spec.rb

@@ -176,6 +176,17 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       end
     end
 
+    describe 'enable_granular_consent' do
+      it 'should default to nil' do
+        expect(subject.authorize_params['enable_granular_consent']).to eq(nil)
+      end
+
+      it 'should set the enable_granular_consent parameter if present' do
+        @options = { enable_granular_consent: 'true' }
+        expect(subject.authorize_params['enable_granular_consent']).to eq('true')
+      end
+    end
+
     describe 'scope' do
       it 'should expand scope shortcuts' do
         @options = { scope: 'calendar' }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-google-oauth2
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.1.2
 platform: ruby
 authors:
 - Josh Ellithorpe
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-09-04 00:00:00.000000000 Z
+date: 2024-03-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt
@@ -31,14 +31,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.0.6
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.0.6
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: omniauth
   requirement: !ruby/object:Gem::Requirement
@@ -59,14 +59,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.8.0
+        version: '1.8'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.8.0
+        version: '1.8'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -120,7 +120,6 @@ files:
 - ".github/workflows/ci.yml"
 - ".gitignore"
 - ".rubocop.yml"
-- ".travis.yml"
 - CHANGELOG.md
 - Gemfile
 - README.md

data/.travis.yml

@@ -1,9 +0,0 @@
-language: ruby
-cache: bundler
-rvm:
-  - '2.3.8'
-  - '2.4.10'
-  - '2.5.8'
-  - '2.6.6'
-  - '2.7.2'
-  - '3.0.0'