omniauth-google-oauth2 0.6.1 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e633bd99de4feaaec8203e3b664d43ca00b563a45858897689cb62260c3d07fd
-  data.tar.gz: b79241160e8c0c120d66d1ace4c3b526849b391b43c4d1c877b5b2c11914ef0f
+  metadata.gz: 3e6a13824c53382f0ba9ef0738e26744d1881dc83726c57cf576ff208423a3a3
+  data.tar.gz: 5c0c037b8c85418901d4ce360d5f4efb125f5c825ffec83ab71e50cf1b413e81
 SHA512:
-  metadata.gz: efd075314aa4b5b0960d71bd130eaccb78c943391543e2da1b935b4645ab138aacf21010f1e36b9008d1cf026bd3e6aa6707cde9386e835adede30b54ae72535
-  data.tar.gz: 18649f5ca21e01243d07625b3802edc18b08a97edb3eb874454f38e511711d96e7d5f28fb1c981206c2f8096a40e9b14363b9ba6288b7f28522626072d1670a6
+  metadata.gz: a62de5fa4553b5ae6c89811458cf8887017834a1790f4df4348ffae9c09a8172b407c04ea86f8c5030273b5586286580b0d2eae7d6857f62aee6729abf1549ff
+  data.tar.gz: d74ef22fa65b892268a779e3e426610bea245db91519964bf03eadc5a5b5951bc42b29dcc2ab2a11c228610ea7dcf5173a2cc07d83569dcce6178e21dc6a160d

data/CHANGELOG.md

@@ -1,6 +1,20 @@
 # Changelog
 All notable changes to this project will be documented in this file.
 
+## 0.7.0 - 2019-06-03
+
+### Added
+- Ensure `info[:email]` is always verified, and include `unverified_email`
+
+### Deprecated
+- Nothing.
+
+### Removed
+- Nothing.
+
+### Fixed
+- Nothing.
+
 ## 0.6.1 - 2019-03-07
 
 ### Added

data/README.md

@@ -54,10 +54,10 @@ You can configure several options, which you pass in to the `provider` method vi
 
 * `prompt`: A space-delimited list of string values that determines whether the user is re-prompted for authentication and/or consent. Possible values are:
   * `none`: No authentication or consent pages will be displayed; it will return an error if the user is not already authenticated and has not pre-configured consent for the requested scopes. This can be used as a method to check for existing authentication and/or consent.
-  * `consent`: The user will always be prompted for consent, even if he has previously allowed access a given set of scopes.
+  * `consent`: The user will always be prompted for consent, even if they have previously allowed access a given set of scopes.
   * `select_account`: The user will always be prompted to select a user account. This allows a user who has multiple current account sessions to select one amongst them.
 
-  If no value is specified, the user only sees the authentication page if he is not logged in and only sees the consent page the first time he authorizes a given set of scopes.
+  If no value is specified, the user only sees the authentication page if they are not logged in and only sees the consent page the first time they authorize a given set of scopes.
 
 * `image_aspect_ratio`: The shape of the user's profile picture. Possible values are:
   * `original`: Picture maintains its original aspect ratio.
@@ -83,7 +83,7 @@ You can configure several options, which you pass in to the `provider` method vi
 
 * `openid_realm`: Set the OpenID realm value, to allow upgrading from OpenID based authentication to OAuth 2 based authentication. When this is set correctly an `openid_id` value will be set in `[:extra][:id_info]` in the authentication hash with the value of the user's OpenID ID URL.
 
-Here's an example of a possible configuration where the strategy name is changed, the user is asked for extra permissions, the user is always prompted to select his account when logging in and the user's profile picture is returned as a thumbnail:
+Here's an example of a possible configuration where the strategy name is changed, the user is asked for extra permissions, the user is always prompted to select their account when logging in and the user's profile picture is returned as a thumbnail:
 
 ```ruby
 Rails.application.config.middleware.use OmniAuth::Builder do

data/examples/Gemfile

@@ -2,6 +2,6 @@
 
 source 'https://rubygems.org'
 
-gem 'omniauth-google-oauth2', '~> 0.6'
+gem 'omniauth-google-oauth2', '~> 0.6.1'
 gem 'rubocop'
 gem 'sinatra', '~> 1.4'

data/lib/omniauth/google_oauth2/version.rb

@@ -2,6 +2,6 @@
 
 module OmniAuth
   module GoogleOauth2
-    VERSION = '0.6.1'
+    VERSION = '0.7.0'
   end
 end

data/lib/omniauth/strategies/google_oauth2.rb

@@ -46,7 +46,8 @@ module OmniAuth
       info do
         prune!(
           name: raw_info['name'],
-          email: raw_info['email'],
+          email: verified_email,
+          unverified_email: raw_info['email'],
           email_verified: raw_info['email_verified'],
           first_name: raw_info['given_name'],
           last_name: raw_info['family_name'],
@@ -112,6 +113,18 @@ module OmniAuth
           client.auth_code.get_token(verifier, get_token_options(redirect_uri), deep_symbolize(options.auth_token_params || {}))
         elsif verify_token(request.params['access_token'])
           ::OAuth2::AccessToken.from_hash(client, request.params.dup)
+        elsif request.content_type =~ /json/i
+          begin
+            body = JSON.parse(request.body.read)
+            request.body.rewind # rewind request body for downstream middlewares
+            verifier = body && body['code']
+            if verifier
+              redirect_uri = 'postmessage'
+              client.auth_code.get_token(verifier, get_token_options(redirect_uri), deep_symbolize(options.auth_token_params || {}))
+            end
+          rescue JSON::ParserError => e
+            warn "[omniauth google-oauth2] JSON parse error=#{e}"
+          end
         else
           verifier = request.params['code']
           client.auth_code.get_token(verifier, get_token_options(callback_url), deep_symbolize(options.auth_token_params))
@@ -125,6 +138,10 @@ module OmniAuth
         scope_list.join(' ')
       end
 
+      def verified_email
+        raw_info['email_verified'] ? raw_info['email'] : nil
+      end
+
       def get_token_options(redirect_uri)
         { redirect_uri: redirect_uri }.merge(token_params.to_hash(symbolize_keys: true))
       end

data/spec/omniauth/strategies/google_oauth2_spec.rb

@@ -3,6 +3,7 @@
 require 'spec_helper'
 require 'json'
 require 'omniauth-google-oauth2'
+require 'stringio'
 
 describe OmniAuth::Strategies::GoogleOauth2 do
   let(:request) { double('Request', params: {}, cookies: {}, env: {}) }
@@ -299,6 +300,41 @@ describe OmniAuth::Strategies::GoogleOauth2 do
     end
   end
 
+  describe '#info' do
+    let(:client) do
+      OAuth2::Client.new('abc', 'def') do |builder|
+        builder.request :url_encoded
+        builder.adapter :test do |stub|
+          stub.get('/oauth2/v3/userinfo') { [200, { 'content-type' => 'application/json' }, response_hash.to_json] }
+        end
+      end
+    end
+    let(:access_token) { OAuth2::AccessToken.from_hash(client, {}) }
+    before { allow(subject).to receive(:access_token).and_return(access_token) }
+
+    context 'with verified email' do
+      let(:response_hash) do
+        { email: 'something@domain.invalid', email_verified: true }
+      end
+
+      it 'should return equal email and unverified_email' do
+        expect(subject.info[:email]).to eq('something@domain.invalid')
+        expect(subject.info[:unverified_email]).to eq('something@domain.invalid')
+      end
+    end
+
+    context 'with unverified email' do
+      let(:response_hash) do
+        { email: 'something@domain.invalid', email_verified: false }
+      end
+
+      it 'should return nil email, and correct unverified email' do
+        expect(subject.info[:email]).to eq(nil)
+        expect(subject.info[:unverified_email]).to eq('something@domain.invalid')
+      end
+    end
+  end
+
   describe '#extra' do
     let(:client) do
       OAuth2::Client.new('abc', 'def') do |builder|
@@ -547,9 +583,26 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       expect(token.client).to eq(:client)
     end
 
+    it 'reads the code from a json request body' do
+      body = StringIO.new(%({"code":"json_access_token"}))
+      client = double(:client)
+      auth_code = double(:auth_code)
+
+      allow(request).to receive(:xhr?).and_return(false)
+      allow(request).to receive(:content_type).and_return('application/json')
+      allow(request).to receive(:body).and_return(body)
+      allow(client).to receive(:auth_code).and_return(auth_code)
+      expect(subject).to receive(:client).and_return(client)
+
+      expect(auth_code).to receive(:get_token).with('json_access_token', { redirect_uri: 'postmessage' }, {})
+
+      subject.build_access_token
+    end
+
     it 'should use callback_url without query_string if this is not an AJAX request' do
       allow(request).to receive(:xhr?).and_return(false)
       allow(request).to receive(:params).and_return('code' => 'valid_code')
+      allow(request).to receive(:content_type).and_return('application/x-www-form-urlencoded')
 
       client = double(:client)
       auth_code = double(:auth_code)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-google-oauth2
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 0.7.0
 platform: ruby
 authors:
 - Josh Ellithorpe
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-03-07 00:00:00.000000000 Z
+date: 2019-06-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt