omniauth-gov 0.1.11 → 0.1.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0762ec72d9f4a09215996f0a976efe561ba960568728c3a803c64e141852698d
-  data.tar.gz: a7e263a4b7eeb3e2af8cdec1963e64af6f1a5d80c9c59dc099eebf642b3a17ca
+  metadata.gz: 8325c0101ce21a755e3c380a1c2ce225c8d08f3bb50a4f2e916a99bdd58c8806
+  data.tar.gz: b9a6cbfbb3910f487d981e8f254db5a02e24e5342e5aaf90e971d6718264ecaf
 SHA512:
-  metadata.gz: 620365eaf53aad3f1c1cfa3575eacd2ded1dd5f654a3ec7568a8692a450216eef63d5e8eb1286bd086421c0bf8571301fd30d56c902ed7258be990e4883d6a01
-  data.tar.gz: e4f670989eeb1448965ed10b4e11a72ca7aa67ebfc5ed32cc504e917eb4d80cade903f46111494f8856fdb948adad93a8494c5b5d76493add15e158f650fe24e
+  metadata.gz: 90107ceeee915ade2abd57738ad3e2aaab87da1ee6a95b17e055268789857875c599e18f90e4c0764b052afc6265237b4708e62491ae730b680dfe9ba1898f3a
+  data.tar.gz: 26536ae23866e074ce243110375adc42be2629952fbb9079a18843003f024ef3e291d88f755e2bc771c60d8bd6e2eb944624792d4ce5e56d08cd80103aec9ed9

data/.github/workflows/ruby.yml

@@ -0,0 +1,24 @@
+name: Ruby
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        ruby-version: ['2.4', '2.5', '2.6', '2.7', '3.0', '3.1', '3.2', 'truffleruby-head']
+
+    steps:
+    - uses: actions/checkout@v3
+    - name: Set up Ruby ${{ matrix.ruby-version }}
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: ${{ matrix.ruby-version }}
+        bundler-cache: true
+    - name: Build and test with Rake
+      run: bundle exec rake

data/.gitignore

@@ -0,0 +1,20 @@
+*.gem
+*.rbc
+.bundle
+.config
+.yardoc
+Gemfile.lock
+InstalledFiles
+_yardoc
+coverage
+doc/
+lib/bundler/man
+/pkg
+rdoc
+spec/reports
+test/tmp
+test/version_tmp
+tmp
+
+# macOS
+**/.DS_Store

data/.rspec

@@ -0,0 +1 @@
+--colour

data/Gemfile

@@ -0,0 +1,13 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in omniauth-gov.gemspec
+gemspec
+
+group :development, :test do
+  gem 'guard'
+  gem 'guard-rspec'
+  gem 'guard-bundler'
+  gem 'rb-fsevent'
+  gem 'growl'
+  gem 'rake'
+end

data/Guardfile

@@ -0,0 +1,10 @@
+guard 'rspec', :version => 2 do
+  watch(%r{^spec/.+_spec\.rb$})
+  watch(%r{^lib/(.+)\.rb$})     { |m| "spec/#{m[1]}_spec.rb" }
+  watch('spec/spec_helper.rb')  { "spec" }
+end
+
+guard 'bundler' do
+  watch('Gemfile')
+  watch('omniauth-gov.gemspec')
+end

data/LICENSE.txt

@@ -0,0 +1,7 @@
+Copyright (c) 2011 Michael Bleigh and Intridea, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,142 @@
+# OmniAuth Gov
+
+Estratégia omniauth para integração do Login Único do governo brasileiro ao autentiador devise.
+
+## Instalação
+
+```ruby
+gem 'omniauth', '1.9.1'
+gem "omniauth-rails_csrf_protection", '0.1.2'
+gem 'omniauth-oauth2'
+gem 'omniauth-gov', '~> 0.1.8'
+```
+
+## Configuração devise
+
+Em `config/initializers/devise.rb.rb`
+
+```ruby
+  Devise.setup do |config|
+    # ...
+    config.omniauth :gov, 
+      ENV['client_id'], 
+      ENV['client_secret'], 
+    scope: 'openid+email+profile+govbr_confiabilidades+', 
+    callback_path: '/callback-da-aplicacao',
+    client_options: {
+      site: 'https://sso.acesso.gov.br', # Ambiente de produção.
+      authorize_url: 'https://sso.acesso.gov.br/authorize', # Ambiente de produção.
+      token_url: 'https://sso.acesso.gov.br/token' # Ambiente de produção.
+    }
+
+    config.omniauth_path_prefix = '/prefixo-devise/prefixo-omniauth'
+  end
+```
+
+## Initializer
+Em `config/initializer/omniauth.rb`
+
+```ruby 
+OmniAuth.config.full_host = "https://endereco-do-app.gov.br"
+OmniAuth.config.logger = Rails.logger
+```
+
+## Route
+Em `config/routes.rb`
+```ruby
+  # ...
+  devise_for :users, controllers: {
+    # ...
+    :omniauth_callbacks => 'auth/omniauth_callbacks'
+  }
+
+  # opcional: redirecionar url de callback para o callback do devise
+  devise_scope :user do
+    get 'url-de-callback', to: 'auth/omniauth_callbacks#gov'
+  end
+
+```
+
+## Controller
+Em `controllers/auth/omniauth_callbacks_controller.rb`
+
+```ruby
+# frozen_string_literal: true
+
+class Auth::OmniauthCallbacksController < Devise::OmniauthCallbacksController
+	skip_before_action :verify_authenticity_token
+
+	def gov
+		@user = User.from_gov_br_omniauth(request.env["omniauth.auth"]["info"])
+
+		if @user.id.present?
+			sign_in_and_redirect @user, :event => :authentication
+			set_flash_message(:notice, :success, :kind => "Login Unico") if is_navigational_format?	  
+		else
+		end
+	end
+	
+	def failure
+    redirect_to root_path
+	end
+
+end
+```
+
+## Model User
+Em `model/user.rb`
+```ruby
+devise :database_authenticatable,
+  # ...
+  :omniauthable, omniauth_providers: %i[gov]
+
+  # ...
+  def self.from_gov_br_omniauth(info)
+    # Exemplo hash info
+    # {
+    #   "id": 1702579345,
+    #   "cpf": '99999999999',
+    #   "nome_social": 'Nome Social',
+    #   "email_verified": true,
+    #   "profile": 'https://servicos.staging.acesso.gov.br/',
+    #   "username": '99999999999',
+    #   "picture": raw_info["picture"],
+    #   "name": raw_info["name"],
+    #   "email": raw_info["email"],
+    # }    
+    user = User.find_by_email(info["email"]) # ou outra chave
+
+    unless user.nil?
+      user.update_attributes(provider: 'login-unico', uid: info["id"])
+    else
+      name = info["name"]
+      email = info["email"]
+      user = User.new do |user|
+        user.name = name
+        user.email = email
+      end
+      user.skip_confirmation!
+      user.save
+    end
+
+    return user
+  end
+
+```
+
+## View
+Em `sessions/new.html.erb`
+```ruby
+      <%= button_to omniauth_authorize_path(resource_name, :gov), class: 'gov-br-btn sign-in br-button middle sign-in w-100 is-primary mt-3 mb-3', data: { turbo: false } do %>
+        <i class="icon fa fa-user fa-lg" style="color: rgb(255, 255, 255);"></i>&nbsp;
+        <span style="font-weight: normal;">Entrar com</span>&nbsp;
+        <span style="font-size: 20px; font-weight: bold;"> gov.br</span>
+      <% end %>
+```
+
+## Licença
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/Rakefile

@@ -0,0 +1,8 @@
+#!/usr/bin/env rake
+require "bundler/gem_tasks"
+require 'rspec/core/rake_task'
+
+RSpec::Core::RakeTask.new
+
+desc 'Run specs'
+task :default => :spec

data/lib/gov_br/params_encoder.rb

@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+
+module GovBr
+  # FlatParamsEncoder manages URI params as a flat hash. Any Array values repeat
+  # the parameter multiple times.
+  module ParamsEncoder
+    class << self
+      extend Forwardable
+      def_delegators :'Faraday::Utils', :escape, :unescape
+    end
+
+    # Encode converts the given param into a URI querystring. Keys and values
+    # will converted to strings and appropriately escaped for the URI.
+    #
+    # @param params [Hash] query arguments to convert.
+    #
+    # @example
+    #
+    #   encode({a: %w[one two three], b: true, c: "C"})
+    #   # => 'a=one&a=two&a=three&b=true&c=C'
+    #
+    # @return [String] the URI querystring (without the leading '?')
+    def self.encode(params)
+      return nil if params.nil?
+      
+      unless params.is_a?(Array)
+        unless params.respond_to?(:to_hash)
+          raise TypeError,
+          "Can't convert #{params.class} into Hash."
+        end
+        params = params.to_hash
+        params = params.map do |key, value|
+          key = key.to_s if key.is_a?(Symbol)
+          [key, value]
+        end
+        
+        # Only to be used for non-Array inputs. Arrays should preserve order.
+        params.sort! if @sort_params
+      end
+      
+      # The params have form [['key1', 'value1'], ['key2', 'value2']].
+      buffer = +''
+      params.each do |key, value|
+        encoded_key = escape(key)
+        if value.nil?
+          buffer << "#{encoded_key}&"
+        elsif value.is_a?(Array)
+          if value.empty?
+            buffer << "#{encoded_key}=&"
+          else
+            value.each do |sub_value|
+              encoded_value = escape(sub_value)
+              buffer << "#{encoded_key}=#{encoded_value}&"
+            end
+          end
+        else
+          encoded_value = (key == 'scope') ? value : escape(value)
+          buffer << "#{encoded_key}=#{encoded_value}&"
+        end
+      end
+      buffer.chop
+    end
+
+    # Decode converts the given URI querystring into a hash.
+    #
+    # @param query [String] query arguments to parse.
+    #
+    # @example
+    #
+    #   decode('a=one&a=two&a=three&b=true&c=C')
+    #   # => {"a"=>["one", "two", "three"], "b"=>"true", "c"=>"C"}
+    #
+    # @return [Hash] parsed keys and value strings from the querystring.
+    def self.decode(query)
+      return nil if query.nil?
+
+      empty_accumulator = {}
+
+      split_query = (query.split('&').map do |pair|
+        pair.split('=', 2) if pair && !pair.empty?
+      end).compact
+      split_query.each_with_object(empty_accumulator.dup) do |pair, accu|
+        pair[0] = unescape(pair[0])
+        pair[1] = true if pair[1].nil?
+        if pair[1].respond_to?(:to_str)
+          pair[1] = unescape(pair[1].to_str.tr('+', ' '))
+        end
+        if accu[pair[0]].is_a?(Array)
+          accu[pair[0]] << pair[1]
+        elsif accu[pair[0]]
+          accu[pair[0]] = [accu[pair[0]], pair[1]]
+        else
+          accu[pair[0]] = pair[1]
+        end
+      end
+    end
+
+    class << self
+      attr_accessor :sort_params
+    end
+
+    # Useful default for OAuth and caching.
+    @sort_params = true
+  end
+end

data/lib/omniauth/strategies/gov.rb

@@ -0,0 +1,134 @@
+# lib/omniauth/strategies/gov.rb
+require 'omniauth-oauth2'
+require "uri"
+
+module OmniAuth
+  module Strategies
+    class Gov < OmniAuth::Strategies::OAuth2
+      option :name, 'gov'
+      option :pkce, true
+
+      credentials do
+        hash = {"access_token" => access_token.token}
+        hash["id_token"] = access_token.params["id_token"]
+        hash["refresh_token"] = access_token.refresh_token if access_token.expires? && access_token.refresh_token
+        hash["expires_at"] = access_token.expires_at if access_token.expires?
+        hash["expires"] = access_token.expires?        
+        hash
+      end
+
+      info do
+        prune!({
+          "id": raw_info['auth_time'],
+          "cpf": raw_info["sub"],
+          "nome_social": raw_info["social_name"],
+          "email_verified": raw_info["email_verified"],
+          "profile": raw_info["profile"],
+          "username": raw_info["preferred_username"],
+          "picture": raw_info["picture"],
+          "name": raw_info["name"],
+          "email": raw_info["email"],
+        })
+      end
+
+      uid { raw_info['auth_time'] }
+
+      extra do
+        {
+          'raw_info': raw_info
+        }
+      end
+
+      def client
+        options.client_options.merge!({connection_opts: {request: {params_encoder: GovBr::ParamsEncoder}}})
+        ::OAuth2::Client.new(options.client_id, options.client_secret, deep_symbolize(options.client_options))
+      end
+      
+      def request_phase
+        redirect client.auth_code.authorize_url({:redirect_uri => callback_url}.merge(authorize_params))
+      end 
+
+      def raw_info
+        @raw_info ||= JWT.decode(credentials["id_token"], nil, false)[0]
+      end
+
+      def prune!(hash)
+        hash.delete_if do |_, value|
+          prune!(value) if value.is_a?(Hash)
+          value.nil? || (value.respond_to?(:empty?) && value.empty?)
+        end
+      end
+
+      def authorize_params # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+        options.authorize_params[:state] = SecureRandom.hex(24)
+        options.authorize_params[:client_id] = options[:client_id]
+        options.authorize_params[:scope] = options[:scope]
+        options.authorize_params[:response_type] = 'code'
+        options.authorize_params[:nonce] = SecureRandom.hex[0..11]
+        params = options.authorize_params
+          .merge(options_for("authorize"))
+          .merge(pkce_authorize_params)
+
+        session["omniauth.pkce.verifier"] = options.pkce_verifier if options.pkce
+        session["omniauth.state"] = params[:state]
+
+        params
+      end   
+
+      def callback_url
+        full_host = OmniAuth.config.full_host
+        callback_path = options.callback_path
+        normalize_url(full_host+callback_path)
+      end
+
+      def normalize_url(url, force_https: true, strip_trailing_slash: true)
+        url = url.strip
+
+        # Adiciona protocolo se não existir
+        url = "http://#{url}" unless url =~ %r{^https?://}i
+
+        begin
+          uri = URI.parse(url)
+
+          # Força HTTPS se habilitado
+          uri.scheme = force_https ? "https" : (uri.scheme || "http")
+
+          # Normaliza host
+          uri.host = uri.host.downcase if uri.host
+
+          # Normaliza path:
+          if uri.path
+            # Troca // repetidos por /
+            uri.path = uri.path.gsub(%r{/+}, "/")
+            # Remove barra final se configurado (mas não no caso de root "/")
+            if strip_trailing_slash && uri.path != "/" && uri.path.end_with?("/")
+              uri.path = uri.path.chomp("/")
+            end
+          end
+
+          # Ordena query params (se houver)
+          if uri.query
+            query_params = URI.decode_www_form(uri.query).uniq.sort
+            uri.query = URI.encode_www_form(query_params)
+          end
+
+          uri.to_s
+        rescue URI::InvalidURIError
+          nil
+        end
+      end
+
+      def build_access_token
+        verifier = request.params["code"]
+        
+        atoken = client.auth_code.get_token(
+          verifier, 
+          {"grant_type": "authorization_code", "code": verifier, "redirect_uri": callback_url, "code_verifier": session["omniauth.pkce.verifier"]}, 
+          {"Content-Type"  => "application/x-www-form-urlencoded", "Authorization" => "Basic #{Base64.strict_encode64(options.client_id+":"+options.client_secret)}" })
+        atoken
+      end  
+    end
+  end
+end
+
+OmniAuth.config.add_camelization 'gov', 'Gov'

data/lib/omniauth-gov/version.rb

@@ -0,0 +1,5 @@
+module OmniAuth
+  module Gov
+    VERSION = "0.1.13"
+  end
+end

data/lib/omniauth-gov.rb

@@ -0,0 +1,3 @@
+require "omniauth-gov/version"
+require 'gov_br/params_encoder'
+require 'omniauth/strategies/gov'

data/omniauth-gov.gemspec

@@ -0,0 +1,26 @@
+# -*- encoding: utf-8 -*-
+require File.expand_path('../lib/omniauth-gov/version', __FILE__)
+
+Gem::Specification.new do |gem|
+  gem.authors       = ["Jonas Ricardo", "Renato de Souza"]
+  gem.email         = ["jonas.campos@yahoo.com.br", "renatocdesouza@gmail.com"]
+  gem.description   = %q{OmniAuth strategy for Gov.br (login.gov.br / govbr).}
+  gem.summary       = %q{OmniAuth strategy for Gov.br (login.gov.br / govbr).}
+  gem.homepage      = "https://github.com/jonasrscampos/omniauth-gov"
+  gem.license       = "MIT"
+
+  gem.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
+  gem.files         = `git ls-files`.split("\n")
+  gem.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
+  gem.name          = "omniauth-gov"
+  gem.require_paths = ["lib"]
+  gem.version       = OmniAuth::Gov::VERSION
+
+  gem.add_dependency 'omniauth', '>= 1.9.1', '< 3.0'
+  gem.add_dependency 'omniauth-oauth2', '>= 1.7'
+  gem.add_development_dependency 'rspec', '~> 3.5'
+  gem.add_development_dependency 'faraday', '~> 2.9'
+  gem.add_development_dependency 'rack-test'
+  gem.add_development_dependency 'simplecov'
+  gem.add_development_dependency 'webmock'
+end

metadata

@@ -1,15 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-gov
 version: !ruby/object:Gem::Version
-  version: 0.1.11
+  version: 0.1.13
 platform: ruby
 authors:
 - Jonas Ricardo
 - Renato de Souza
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-09-23 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth
@@ -17,34 +16,34 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: 1.9.1
     - - "<"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: 1.9.1
     - - "<"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: omniauth-oauth2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.7'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.7'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -115,34 +114,31 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: uri
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-description: OmniAuth strategy for integrating authentication with Brazilian Gov.br
-  using OmniAuth and OAuth2.
+description: OmniAuth strategy for Gov.br (login.gov.br / govbr).
 email:
 - jonas.campos@yahoo.com.br
 - renatocdesouza@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []
-files: []
+files:
+- ".github/workflows/ruby.yml"
+- ".gitignore"
+- ".rspec"
+- Gemfile
+- Guardfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- lib/gov_br/params_encoder.rb
+- lib/omniauth-gov.rb
+- lib/omniauth-gov/version.rb
+- lib/omniauth/strategies/gov.rb
+- omniauth-gov.gemspec
 homepage: https://github.com/jonasrscampos/omniauth-gov
 licenses:
 - MIT
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -157,8 +153,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.20
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
-summary: Official OmniAuth strategy for GitHub.
+summary: OmniAuth strategy for Gov.br (login.gov.br / govbr).
 test_files: []