omniauth-gov 0.1.1 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2c9a9ae0696ab3fb7d9222da4661a679b1bc42066249a45b6afc6a1afde776bc
-  data.tar.gz: bbf1941d7543a850a32ca0866123b72d458a5a9219cba7111b4b867d6772a14d
+  metadata.gz: 4382955c4f28a771ef8edfbd054972b94f0dbd4158e739c2db9d75c9d16b2752
+  data.tar.gz: e142eddcfbb8cd54009c5c89a4e01d83d17f4c313b396b5251ffb90a101654a7
 SHA512:
-  metadata.gz: f6b50defa7d35e5a31a071e4a01a3ef57d739757d87a261b3a6b00a77a62c2b9816cad787b54de8f1b5c60b640c873b22734b5e54b7c0e940a2c6bb4fd5991c7
-  data.tar.gz: 672a6a0cdaeaa2c1274a698918f667f65816a3db2f0382e8d0d0e1ef50e96c9d5cd8ffcc4a5703a9b964b1d49cc1b9c59deb4f34b4bd532c3f4c8456d0ac1ac3
+  metadata.gz: '097c8c434da9ca2adde612b779846a2866de394e7ea44219c52aababbac2039d4d757dcded9dce6900a91b420f715a6db82d95ffe7a81776542e85a87c4499db'
+  data.tar.gz: f57cd09fb38f19707ea336b6576cde37608bf750a897be5884010df9fddc3ea582156e28ace70ddd452b93ba9d559e6528d28327738bc6a1d886009e58aa4c36

data/README.md

@@ -2,72 +2,128 @@
 
 # OmniAuth Gov
 
-This is the official OmniAuth strategy for authenticating to GitHub. To
-use it, you'll need to sign up for an OAuth2 Application ID and Secret
-on the [GitHub OAuth Apps Page](https://github.com/settings/developers).
+Estratégia omniauth para integração do Login Único do governo brasileiro ao autentiador devise.
 
-## Installation
+## Instalação
 
 ```ruby
-gem 'omniauth-gov', '~> 0.1.0'
+gem 'omniauth', '1.9.1'
+gem "omniauth-rails_csrf_protection", '0.1.2'
+gem 'omniauth-oauth2'
+gem 'omniauth-gov', '~> 0.1.3'
 ```
 
-## Basic Usage
+## Configuração devise
+
+Em `config/initializers/devise.rb.rb`
 
 ```ruby
-use OmniAuth::Builder do
-  provider :gov, ENV['GOV_KEY'], ENV['GOV_SECRET']
-end
+  Devise.setup do |config|
+    # ...
+    config.omniauth :gov, 
+      ENV['client_id'], 
+      ENV['client_secret'], 
+    scope: 'openid+email+profile+govbr_confiabilidades+', 
+    callback_path: '/callback-da-aplicacao'
+
+    config.omniauth_path_prefix = '/prefixo-devise/prefixo-omniauth'
+  end
 ```
 
+## Initializer
+Em `config/initializer/omniauth.rb`
 
-## Basic Usage Rails
-
-In `config/initializers/gov.rb`
+```ruby 
+OmniAuth.config.full_host = "<host-da-aplicacao-com-protocolo>"
+OmniAuth.config.logger = Rails.logger
+```
 
+## Route
+Em `config/routes.rb`
 ```ruby
-  Rails.application.config.middleware.use OmniAuth::Builder do
-    provider :gov, ENV['GOV_KEY'], ENV['GOV_SECRET']
+  # ...
+  devise_for :users, controllers: {
+    # ...
+    :omniauth_callbacks => 'auth/omniauth_callbacks'
+  }
+
+  # opcional: redirecionar url de callback para o callback do devise
+  devise_scope :user do
+    get 'url-de-callback', to: 'auth/omniauth_callbacks#gov'
   end
-```
 
+```
 
-## Gov Enterprise Usage
+## Controller
+Em `controllers/auth/omniauth_callbacks_controller.rb`
 
 ```ruby
-provider :gov, ENV['GOV_KEY'], ENV['GOV_SECRET'],
-    {
-      :client_options => {
-        :site => 'https://YOURDOMAIN.com/api/v3',
-        :authorize_url => 'https://YOURDOMAIN.com/login/oauth/authorize',
-        :token_url => 'https://YOURDOMAIN.com/login/oauth/access_token',
-      }
-    }
-```
+# frozen_string_literal: true
 
-## Scopes
+class Auth::OmniauthCallbacksController < Devise::OmniauthCallbacksController
+	skip_before_action :verify_authenticity_token
 
-GitHub API v3 lets you set scopes to provide granular access to different types of data: 
+	def gov
+		@user = User.from_gov_br_omniauth(request.env["omniauth.auth"]["info"])
+
+		if @user.id.present?
+			sign_in_and_redirect @user, :event => :authentication
+			set_flash_message(:notice, :success, :kind => "Login Unico") if is_navigational_format?	  
+		else
+		end
+	end
+	
+	def failure
+    redirect_to root_path
+	end
 
-```ruby
-use OmniAuth::Builder do
-  provider :gov, ENV['GOV_KEY'], ENV['GOV_SECRET'], scope: "openid+email+profile+govbr_confiabilidades"
 end
 ```
 
-More info on [Scopes](https://docs.github.com/en/developers/apps/scopes-for-oauth-apps).
-
-
-## Semver
-This project adheres to Semantic Versioning 2.0.0. Any violations of this scheme are considered to be bugs. 
-All changes will be tracked [here](https://github.com/omniauth/omniauth-gov/releases).
-
-## License
+## Model User
+Em `model/user.rb`
+```ruby
+devise :database_authenticatable,
+  # ...
+  :omniauthable, omniauth_providers: %i[gov]
+
+  # ...
+  def self.from_gov_br_omniauth(info)
+    # Exemplo hash info
+    # {
+    #   "id": 1702579345,
+    #   "cpf": '99999999999',
+    #   "nome_social": 'Nome Social',
+    #   "email_verified": true,
+    #   "profile": 'https://servicos.staging.acesso.gov.br/',
+    #   "username": '99999999999',
+    #   "picture": raw_info["picture"],
+    #   "name": raw_info["name"],
+    #   "email": raw_info["email"],
+    # }    
+    user = User.find_by_email(info["email"]) # ou outra chave
+
+    unless user.nil?
+      user.update_attributes(provider: 'login-unico', uid: info["id"])
+    else
+      name = info["name"]
+      email = info["email"]
+      user = User.new do |user|
+        user.name = name
+        user.email = email
+      end
+      user.skip_confirmation!
+      user.save
+    end
+
+    return user
+  end
 
-Copyright (c) 2011 Michael Bleigh and Intridea, Inc.
+```
 
+## Licença
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 
 The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/lib/omniauth/strategies/gov.rb

@@ -1,50 +1,82 @@
 require 'omniauth-oauth2'
 
-module OmniAuth
+module Omniauth
   module Strategies
     class Gov < OmniAuth::Strategies::OAuth2
       option :client_options, {
-        site: 'https://sso.staging.acesso.gov.br',
-        authorize_url: 'https://sso.staging.acesso.gov.br/authorize',
-        token_url: 'https://sso.staging.acesso.gov.br/token'
+        site: 'https://sso.acesso.gov.br',
+        authorize_url: 'https://sso.acesso.gov.br/authorize',
+        token_url: 'https://sso.acesso.gov.br/token'
       }
-      
       option :pkce, true
 
-      option :pkce_options, {
-        :code_challenge => proc { |verifier|
-          Base64.urlsafe_encode64(
-            Digest::SHA2.digest(verifier),
-            :padding => false,
-          )
-        },
-        :code_challenge_method => "S256",
-      }
-
-      uid{ raw_info['id'] }
+      credentials do
+        hash = {"access_token" => access_token.token}
+        hash["id_token"] = access_token.params["id_token"]
+        hash["refresh_token"] = access_token.refresh_token if access_token.expires? && access_token.refresh_token
+        hash["expires_at"] = access_token.expires_at if access_token.expires?
+        hash["expires"] = access_token.expires?        
+        hash
+      end
 
       info do
-        {
-          :name => raw_info['name'],
-          :email => raw_info['email'],
-          :cpf => raw_info['sub']
-        }
+        prune!({
+          "id": raw_info['auth_time'],
+          "cpf": raw_info["sub"],
+          "nome_social": raw_info["social_name"],
+          "email_verified": raw_info["email_verified"],
+          "profile": raw_info["profile"],
+          "username": raw_info["preferred_username"],
+          "picture": raw_info["picture"],
+          "name": raw_info["name"],
+          "email": raw_info["email"],
+        })
       end
 
+      uid { raw_info['auth_time'] }
+
       extra do
         {
-          'raw_info' => raw_info, 'uid' => uid
+          'raw_info': raw_info
         }
       end
-
+      
       def raw_info
-        @raw_info ||= access_token.get('id_token').parsed
+        @raw_info ||= JWT.decode(credentials["id_token"], nil, false)[0]
       end
 
-      def uid
-        @uid ||= access_token.get('access_token/jti').parsed
+      def prune!(hash)
+        hash.delete_if do |_, value|
+          prune!(value) if value.is_a?(Hash)
+          value.nil? || (value.respond_to?(:empty?) && value.empty?)
+        end
       end
 
+      def authorize_params # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+        options.authorize_params[:state] = SecureRandom.hex(24)
+        options.authorize_params[:client_id] = options[:client_id]
+        options.authorize_params[:scope] = options[:scope]
+        options.authorize_params[:response_type] = 'code'
+        options.authorize_params[:nonce] = SecureRandom.hex[0..11]
+        params = options.authorize_params
+          .merge(options_for("authorize"))
+          .merge(pkce_authorize_params)
+
+        session["omniauth.pkce.verifier"] = options.pkce_verifier if options.pkce
+        session["omniauth.state"] = params[:state]
+
+        params
+      end   
+
+      def build_access_token
+        verifier = request.params["code"]
+        
+        atoken = client.auth_code.get_token(
+          verifier, 
+          {"grant_type": "authorization_code", "code": verifier, "redirect_uri": OmniAuth.config.full_host+options.callback_path, "code_verifier": session["omniauth.pkce.verifier"]}, 
+          {"Content-Type"  => "application/x-www-form-urlencoded", "Authorization" => "Basic #{Base64.strict_encode64(Settings.reload!.omniauth.client_id+":"+Settings.reload!.omniauth.client_secret)}" })
+        atoken
+      end  
     end
   end
 end

data/lib/omniauth-gov/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module Gov
-    VERSION = "0.1.1"
+    VERSION = "0.1.3"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-gov
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.3
 platform: ruby
 authors:
 - Jonas Ricardo
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-12-08 00:00:00.000000000 Z
+date: 2024-03-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth