omniauth-google2 1.0.2 → 1.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +5 -2
- data/lib/omniauth/google2/version.rb +1 -1
- data/lib/omniauth/google2.rb +2 -2
- data/lib/omniauth/strategies/google2.rb +46 -46
- data/lib/omniauth-google2.rb +1 -1
- data/omniauth-google2.gemspec +22 -22
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: ff2d6d6fe710bb806e341d2b2f432389f407f1f100724c522189862321f1e318
|
|
4
|
+
data.tar.gz: e533968db114b023d3ea76cb4e6229aa3eb7f192379fa84b7ca36c3bbc4fd686
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 7a8849d96087b7f2be41c5995eb3492c63a34dab3541b1b655432df6df0335da0132594c8b3de96c9ef12252a4001822d053c0428aa377811f016510ab3a509a
|
|
7
|
+
data.tar.gz: 4f0c893cd4aa9942ebfde4cc44b1ff9c9b6213e03664bb8dbb7bd4faec7d6028137666b234bff79abcbf5aff3802e329635cc4ffaa6b570c20f64de7a61e8557
|
data/README.md
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
# OmniAuth
|
|
1
|
+
# OmniAuth Google Strategy
|
|
2
2
|
|
|
3
3
|
[](https://github.com/icoretech/omniauth-google2/actions/workflows/test.yml?query=branch%3Amain)
|
|
4
4
|
[](https://badge.fury.io/rb/omniauth-google2)
|
|
@@ -44,11 +44,12 @@ end
|
|
|
44
44
|
## Provider App Setup
|
|
45
45
|
|
|
46
46
|
- Google Cloud Console: <https://console.cloud.google.com/apis/credentials>
|
|
47
|
-
- Register callback URL (example): `https://your-app.example.com/auth/
|
|
47
|
+
- Register callback URL (example): `https://your-app.example.com/auth/google2/callback` (or `google_oauth2` if using compat provider)
|
|
48
48
|
|
|
49
49
|
## Options
|
|
50
50
|
|
|
51
51
|
Supported request options include:
|
|
52
|
+
|
|
52
53
|
- `scope` (default: `openid email profile`)
|
|
53
54
|
- `access_type` (default: `offline`)
|
|
54
55
|
- `include_granted_scopes`
|
|
@@ -131,6 +132,7 @@ RAILS_VERSION='~> 8.1.0' bundle exec rake test_rails_integration
|
|
|
131
132
|
## Endpoints
|
|
132
133
|
|
|
133
134
|
This gem uses Google OpenID Connect discovery endpoints:
|
|
135
|
+
|
|
134
136
|
- `https://accounts.google.com/o/oauth2/v2/auth`
|
|
135
137
|
- `https://oauth2.googleapis.com/token`
|
|
136
138
|
- `https://openidconnect.googleapis.com/v1/userinfo`
|
|
@@ -138,6 +140,7 @@ This gem uses Google OpenID Connect discovery endpoints:
|
|
|
138
140
|
## Smoke Variants
|
|
139
141
|
|
|
140
142
|
After a baseline smoke succeeds, run these extra request-phase variants:
|
|
143
|
+
|
|
141
144
|
- `?prompt=consent select_account`
|
|
142
145
|
- `?login_hint=user@example.com`
|
|
143
146
|
- `?hd=example.com`
|
data/lib/omniauth/google2.rb
CHANGED
|
@@ -1,68 +1,68 @@
|
|
|
1
1
|
# frozen_string_literal: true
|
|
2
2
|
|
|
3
|
-
require
|
|
4
|
-
require
|
|
3
|
+
require "jwt"
|
|
4
|
+
require "omniauth-oauth2"
|
|
5
5
|
|
|
6
6
|
module OmniAuth
|
|
7
7
|
module Strategies
|
|
8
8
|
# OmniAuth strategy for Google OAuth2/OpenID Connect.
|
|
9
9
|
class Google2 < OmniAuth::Strategies::OAuth2
|
|
10
|
-
BASE_SCOPE_URL =
|
|
10
|
+
BASE_SCOPE_URL = "https://www.googleapis.com/auth/"
|
|
11
11
|
BASE_SCOPES = %w[openid email profile].freeze
|
|
12
|
-
DEFAULT_SCOPE =
|
|
13
|
-
USER_INFO_URL =
|
|
12
|
+
DEFAULT_SCOPE = "openid email profile"
|
|
13
|
+
USER_INFO_URL = "https://openidconnect.googleapis.com/v1/userinfo"
|
|
14
14
|
|
|
15
|
-
option :name,
|
|
15
|
+
option :name, "google2"
|
|
16
16
|
option :authorize_options,
|
|
17
|
-
|
|
17
|
+
%i[scope state access_type include_granted_scopes prompt login_hint hd redirect_uri nonce]
|
|
18
18
|
option :scope, DEFAULT_SCOPE
|
|
19
19
|
option :skip_jwt, false
|
|
20
20
|
|
|
21
21
|
option :client_options,
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
uid { raw_info[
|
|
22
|
+
site: "https://openidconnect.googleapis.com",
|
|
23
|
+
authorize_url: "https://accounts.google.com/o/oauth2/v2/auth",
|
|
24
|
+
token_url: "https://oauth2.googleapis.com/token",
|
|
25
|
+
connection_opts: {
|
|
26
|
+
headers: {
|
|
27
|
+
user_agent: "icoretech-omniauth-google2 gem",
|
|
28
|
+
accept: "application/json",
|
|
29
|
+
content_type: "application/json"
|
|
30
|
+
}
|
|
31
|
+
}
|
|
32
|
+
|
|
33
|
+
uid { raw_info["sub"] || raw_info["id"].to_s }
|
|
34
34
|
|
|
35
35
|
info do
|
|
36
36
|
{
|
|
37
|
-
name: raw_info[
|
|
38
|
-
email: raw_info[
|
|
39
|
-
unverified_email: raw_info[
|
|
40
|
-
email_verified: raw_info[
|
|
41
|
-
first_name: raw_info[
|
|
42
|
-
last_name: raw_info[
|
|
43
|
-
image: raw_info[
|
|
44
|
-
urls: raw_info[
|
|
37
|
+
name: raw_info["name"],
|
|
38
|
+
email: raw_info["email_verified"] ? raw_info["email"] : nil,
|
|
39
|
+
unverified_email: raw_info["email"],
|
|
40
|
+
email_verified: raw_info["email_verified"],
|
|
41
|
+
first_name: raw_info["given_name"],
|
|
42
|
+
last_name: raw_info["family_name"],
|
|
43
|
+
image: raw_info["picture"],
|
|
44
|
+
urls: raw_info["profile"] ? {google: raw_info["profile"]} : nil
|
|
45
45
|
}.compact
|
|
46
46
|
end
|
|
47
47
|
|
|
48
48
|
credentials do
|
|
49
49
|
{
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
50
|
+
"token" => access_token.token,
|
|
51
|
+
"refresh_token" => access_token.refresh_token,
|
|
52
|
+
"expires_at" => access_token.expires_at,
|
|
53
|
+
"expires" => access_token.expires?,
|
|
54
|
+
"scope" => token_scope
|
|
55
55
|
}.compact
|
|
56
56
|
end
|
|
57
57
|
|
|
58
58
|
extra do
|
|
59
|
-
data = {
|
|
60
|
-
id_token = access_token[
|
|
59
|
+
data = {"raw_info" => raw_info}
|
|
60
|
+
id_token = access_token["id_token"]
|
|
61
61
|
return data if blank?(id_token)
|
|
62
62
|
|
|
63
|
-
data[
|
|
63
|
+
data["id_token"] = id_token
|
|
64
64
|
decoded = decode_id_token(id_token)
|
|
65
|
-
data[
|
|
65
|
+
data["id_info"] = decoded if decoded
|
|
66
66
|
data
|
|
67
67
|
end
|
|
68
68
|
|
|
@@ -70,7 +70,7 @@ module OmniAuth
|
|
|
70
70
|
super.tap do |params|
|
|
71
71
|
apply_request_authorize_overrides(params)
|
|
72
72
|
params[:scope] = normalize_scope(params[:scope] || options[:scope])
|
|
73
|
-
params[:access_type] ||=
|
|
73
|
+
params[:access_type] ||= "offline"
|
|
74
74
|
params[:include_granted_scopes] = normalize_include_granted_scopes(params[:include_granted_scopes])
|
|
75
75
|
persist_authorize_state(params)
|
|
76
76
|
end
|
|
@@ -87,7 +87,7 @@ module OmniAuth
|
|
|
87
87
|
|
|
88
88
|
# Prevent authorization response params from being appended to redirect_uri.
|
|
89
89
|
def query_string
|
|
90
|
-
return
|
|
90
|
+
return "" if request.params["code"]
|
|
91
91
|
|
|
92
92
|
super
|
|
93
93
|
end
|
|
@@ -96,8 +96,8 @@ module OmniAuth
|
|
|
96
96
|
|
|
97
97
|
def normalize_scope(raw_scope)
|
|
98
98
|
raw_scope.to_s.split(/[\s,]+/).reject(&:empty?).map do |scope|
|
|
99
|
-
scope.start_with?(
|
|
100
|
-
end.join(
|
|
99
|
+
(scope.start_with?("https://") || BASE_SCOPES.include?(scope)) ? scope : "#{BASE_SCOPE_URL}#{scope}"
|
|
100
|
+
end.join(" ")
|
|
101
101
|
end
|
|
102
102
|
|
|
103
103
|
def apply_request_authorize_overrides(params)
|
|
@@ -108,15 +108,15 @@ module OmniAuth
|
|
|
108
108
|
end
|
|
109
109
|
|
|
110
110
|
def normalize_include_granted_scopes(value)
|
|
111
|
-
value == true ?
|
|
111
|
+
(value == true) ? "true" : value
|
|
112
112
|
end
|
|
113
113
|
|
|
114
114
|
def persist_authorize_state(params)
|
|
115
|
-
session[
|
|
115
|
+
session["omniauth.state"] = params[:state] if params[:state]
|
|
116
116
|
end
|
|
117
117
|
|
|
118
118
|
def token_scope
|
|
119
|
-
access_token.params[
|
|
119
|
+
access_token.params["scope"] || access_token["scope"]
|
|
120
120
|
end
|
|
121
121
|
|
|
122
122
|
def decode_id_token(token)
|
|
@@ -135,10 +135,10 @@ module OmniAuth
|
|
|
135
135
|
|
|
136
136
|
# Backward-compatible strategy name for existing `google_oauth2` callback paths.
|
|
137
137
|
class GoogleOauth2 < Google2
|
|
138
|
-
option :name,
|
|
138
|
+
option :name, "google_oauth2"
|
|
139
139
|
end
|
|
140
140
|
end
|
|
141
141
|
end
|
|
142
142
|
|
|
143
|
-
OmniAuth.config.add_camelization
|
|
144
|
-
OmniAuth.config.add_camelization
|
|
143
|
+
OmniAuth.config.add_camelization "google2", "Google2"
|
|
144
|
+
OmniAuth.config.add_camelization "google_oauth2", "GoogleOauth2"
|
data/lib/omniauth-google2.rb
CHANGED
data/omniauth-google2.gemspec
CHANGED
|
@@ -1,36 +1,36 @@
|
|
|
1
1
|
# frozen_string_literal: true
|
|
2
2
|
|
|
3
|
-
lib = File.expand_path(
|
|
3
|
+
lib = File.expand_path("lib", __dir__)
|
|
4
4
|
$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
|
|
5
|
-
require
|
|
5
|
+
require "omniauth/google2/version"
|
|
6
6
|
|
|
7
7
|
Gem::Specification.new do |spec|
|
|
8
|
-
spec.name =
|
|
8
|
+
spec.name = "omniauth-google2"
|
|
9
9
|
spec.version = OmniAuth::Google2::VERSION
|
|
10
|
-
spec.authors = [
|
|
11
|
-
spec.email = [
|
|
10
|
+
spec.authors = ["Claudio Poli"]
|
|
11
|
+
spec.email = ["masterkain@gmail.com"]
|
|
12
12
|
|
|
13
|
-
spec.summary =
|
|
13
|
+
spec.summary = "OmniAuth strategy for Google OAuth2/OpenID Connect authentication."
|
|
14
14
|
spec.description =
|
|
15
|
-
|
|
16
|
-
spec.homepage =
|
|
17
|
-
spec.license =
|
|
18
|
-
spec.required_ruby_version =
|
|
15
|
+
"OAuth2/OpenID Connect strategy for OmniAuth that authenticates users with Google and exposes profile metadata."
|
|
16
|
+
spec.homepage = "https://github.com/icoretech/omniauth-google2"
|
|
17
|
+
spec.license = "MIT"
|
|
18
|
+
spec.required_ruby_version = ">= 3.2"
|
|
19
19
|
|
|
20
|
-
spec.metadata[
|
|
21
|
-
spec.metadata[
|
|
22
|
-
spec.metadata[
|
|
23
|
-
spec.metadata[
|
|
20
|
+
spec.metadata["source_code_uri"] = "https://github.com/icoretech/omniauth-google2"
|
|
21
|
+
spec.metadata["bug_tracker_uri"] = "https://github.com/icoretech/omniauth-google2/issues"
|
|
22
|
+
spec.metadata["changelog_uri"] = "https://github.com/icoretech/omniauth-google2/releases"
|
|
23
|
+
spec.metadata["rubygems_mfa_required"] = "true"
|
|
24
24
|
|
|
25
25
|
spec.files = Dir[
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
26
|
+
"lib/**/*.rb",
|
|
27
|
+
"README*",
|
|
28
|
+
"LICENSE*",
|
|
29
|
+
"*.gemspec"
|
|
30
30
|
]
|
|
31
|
-
spec.require_paths = [
|
|
31
|
+
spec.require_paths = ["lib"]
|
|
32
32
|
|
|
33
|
-
spec.add_dependency
|
|
34
|
-
spec.add_dependency
|
|
35
|
-
spec.add_dependency
|
|
33
|
+
spec.add_dependency "cgi", ">= 0.3.6"
|
|
34
|
+
spec.add_dependency "jwt", ">= 2.9.2"
|
|
35
|
+
spec.add_dependency "omniauth-oauth2", ">= 1.8", "< 2.0"
|
|
36
36
|
end
|