omniauth-gov 0.1.11 → 0.1.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0762ec72d9f4a09215996f0a976efe561ba960568728c3a803c64e141852698d
-  data.tar.gz: a7e263a4b7eeb3e2af8cdec1963e64af6f1a5d80c9c59dc099eebf642b3a17ca
+  metadata.gz: c8265c888e68097f0365602aded836833501a2d28d0a31458e6349f12a2388c1
+  data.tar.gz: 8a1fa392ec58679497e184d918b8e2ed174f902f95c8ad1950f6393042213e34
 SHA512:
-  metadata.gz: 620365eaf53aad3f1c1cfa3575eacd2ded1dd5f654a3ec7568a8692a450216eef63d5e8eb1286bd086421c0bf8571301fd30d56c902ed7258be990e4883d6a01
-  data.tar.gz: e4f670989eeb1448965ed10b4e11a72ca7aa67ebfc5ed32cc504e917eb4d80cade903f46111494f8856fdb948adad93a8494c5b5d76493add15e158f650fe24e
+  metadata.gz: f055d36ad468a15d02625f0b57c15cdc7f370b6cf889baa7bfb7e3c32503d54a0c9158bc08e24c373a600e34cd81fce541d1e77f783e0b67445317a9117dfd7f
+  data.tar.gz: 68f49eca1cf822ad808877620c5a63bfcc4c276a6c465b98390afda97e41c223bda5be585484017506038927b69c0b852327f8c3513a592891d3a50a6cb9c257

data/LICENSE.txt

@@ -0,0 +1,7 @@
+Copyright (c) 2011 Michael Bleigh and Intridea, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,144 @@
+![Ruby](https://github.com/omniauth/omniauth-gov/workflows/Ruby/badge.svg?branch=main)
+
+# OmniAuth Gov
+
+Estratégia omniauth para integração do Login Único do governo brasileiro ao autentiador devise.
+
+## Instalação
+
+```ruby
+gem 'omniauth', '1.9.1'
+gem "omniauth-rails_csrf_protection", '0.1.2'
+gem 'omniauth-oauth2'
+gem 'omniauth-gov', '~> 0.1.5'
+```
+
+## Configuração devise
+
+Em `config/initializers/devise.rb.rb`
+
+```ruby
+  Devise.setup do |config|
+    # ...
+    config.omniauth :gov, 
+      ENV['client_id'], 
+      ENV['client_secret'], 
+    scope: 'openid+email+profile+govbr_confiabilidades+', 
+    callback_path: '/callback-da-aplicacao',
+    client_options: {
+      site: 'https://sso.acesso.gov.br', # Ambiente de produção.
+      authorize_url: 'https://sso.acesso.gov.br/authorize', # Ambiente de produção.
+      token_url: 'https://sso.acesso.gov.br/token' # Ambiente de produção.
+    }
+
+    config.omniauth_path_prefix = '/prefixo-devise/prefixo-omniauth'
+  end
+```
+
+## Initializer
+Em `config/initializer/omniauth.rb`
+
+```ruby 
+OmniAuth.config.full_host = "https://endereco-do-app.gov.br"
+OmniAuth.config.logger = Rails.logger
+```
+
+## Route
+Em `config/routes.rb`
+```ruby
+  # ...
+  devise_for :users, controllers: {
+    # ...
+    :omniauth_callbacks => 'auth/omniauth_callbacks'
+  }
+
+  # opcional: redirecionar url de callback para o callback do devise
+  devise_scope :user do
+    get 'url-de-callback', to: 'auth/omniauth_callbacks#gov'
+  end
+
+```
+
+## Controller
+Em `controllers/auth/omniauth_callbacks_controller.rb`
+
+```ruby
+# frozen_string_literal: true
+
+class Auth::OmniauthCallbacksController < Devise::OmniauthCallbacksController
+	skip_before_action :verify_authenticity_token
+
+	def gov
+		@user = User.from_gov_br_omniauth(request.env["omniauth.auth"]["info"])
+
+		if @user.id.present?
+			sign_in_and_redirect @user, :event => :authentication
+			set_flash_message(:notice, :success, :kind => "Login Unico") if is_navigational_format?	  
+		else
+		end
+	end
+	
+	def failure
+    redirect_to root_path
+	end
+
+end
+```
+
+## Model User
+Em `model/user.rb`
+```ruby
+devise :database_authenticatable,
+  # ...
+  :omniauthable, omniauth_providers: %i[gov]
+
+  # ...
+  def self.from_gov_br_omniauth(info)
+    # Exemplo hash info
+    # {
+    #   "id": 1702579345,
+    #   "cpf": '99999999999',
+    #   "nome_social": 'Nome Social',
+    #   "email_verified": true,
+    #   "profile": 'https://servicos.staging.acesso.gov.br/',
+    #   "username": '99999999999',
+    #   "picture": raw_info["picture"],
+    #   "name": raw_info["name"],
+    #   "email": raw_info["email"],
+    # }    
+    user = User.find_by_email(info["email"]) # ou outra chave
+
+    unless user.nil?
+      user.update_attributes(provider: 'login-unico', uid: info["id"])
+    else
+      name = info["name"]
+      email = info["email"]
+      user = User.new do |user|
+        user.name = name
+        user.email = email
+      end
+      user.skip_confirmation!
+      user.save
+    end
+
+    return user
+  end
+
+```
+
+## View
+Em `sessions/new.html.erb`
+```ruby
+      <%= button_to omniauth_authorize_path(resource_name, :gov), class: 'gov-br-btn sign-in br-button middle sign-in w-100 is-primary mt-3 mb-3', data: { turbo: false } do %>
+        <i class="icon fa fa-user fa-lg" style="color: rgb(255, 255, 255);"></i>&nbsp;
+        <span style="font-weight: normal;">Entrar com</span>&nbsp;
+        <span style="font-size: 20px; font-weight: bold;"> gov.br</span>
+      <% end %>
+```
+
+## Licença
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/lib/gov_br/params_encoder.rb

@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+
+module GovBr
+  # FlatParamsEncoder manages URI params as a flat hash. Any Array values repeat
+  # the parameter multiple times.
+  module ParamsEncoder
+    class << self
+      extend Forwardable
+      def_delegators :'Faraday::Utils', :escape, :unescape
+    end
+
+    # Encode converts the given param into a URI querystring. Keys and values
+    # will converted to strings and appropriately escaped for the URI.
+    #
+    # @param params [Hash] query arguments to convert.
+    #
+    # @example
+    #
+    #   encode({a: %w[one two three], b: true, c: "C"})
+    #   # => 'a=one&a=two&a=three&b=true&c=C'
+    #
+    # @return [String] the URI querystring (without the leading '?')
+    def self.encode(params)
+      return nil if params.nil?
+      
+      unless params.is_a?(Array)
+        unless params.respond_to?(:to_hash)
+          raise TypeError,
+          "Can't convert #{params.class} into Hash."
+        end
+        params = params.to_hash
+        params = params.map do |key, value|
+          key = key.to_s if key.is_a?(Symbol)
+          [key, value]
+        end
+        
+        # Only to be used for non-Array inputs. Arrays should preserve order.
+        params.sort! if @sort_params
+      end
+      
+      # The params have form [['key1', 'value1'], ['key2', 'value2']].
+      buffer = +''
+      params.each do |key, value|
+        encoded_key = escape(key)
+        if value.nil?
+          buffer << "#{encoded_key}&"
+        elsif value.is_a?(Array)
+          if value.empty?
+            buffer << "#{encoded_key}=&"
+          else
+            value.each do |sub_value|
+              encoded_value = escape(sub_value)
+              buffer << "#{encoded_key}=#{encoded_value}&"
+            end
+          end
+        else
+          encoded_value = (key == 'scope') ? value : escape(value)
+          buffer << "#{encoded_key}=#{encoded_value}&"
+        end
+      end
+      buffer.chop
+    end
+
+    # Decode converts the given URI querystring into a hash.
+    #
+    # @param query [String] query arguments to parse.
+    #
+    # @example
+    #
+    #   decode('a=one&a=two&a=three&b=true&c=C')
+    #   # => {"a"=>["one", "two", "three"], "b"=>"true", "c"=>"C"}
+    #
+    # @return [Hash] parsed keys and value strings from the querystring.
+    def self.decode(query)
+      return nil if query.nil?
+
+      empty_accumulator = {}
+
+      split_query = (query.split('&').map do |pair|
+        pair.split('=', 2) if pair && !pair.empty?
+      end).compact
+      split_query.each_with_object(empty_accumulator.dup) do |pair, accu|
+        pair[0] = unescape(pair[0])
+        pair[1] = true if pair[1].nil?
+        if pair[1].respond_to?(:to_str)
+          pair[1] = unescape(pair[1].to_str.tr('+', ' '))
+        end
+        if accu[pair[0]].is_a?(Array)
+          accu[pair[0]] << pair[1]
+        elsif accu[pair[0]]
+          accu[pair[0]] = [accu[pair[0]], pair[1]]
+        else
+          accu[pair[0]] = pair[1]
+        end
+      end
+    end
+
+    class << self
+      attr_accessor :sort_params
+    end
+
+    # Useful default for OAuth and caching.
+    @sort_params = true
+  end
+end

data/lib/omniauth/strategies/gov.rb

@@ -0,0 +1,134 @@
+# lib/omniauth/strategies/gov.rb
+require 'omniauth-oauth2'
+require "uri"
+
+module OmniAuth
+  module Strategies
+    class Gov < OmniAuth::Strategies::OAuth2
+      option :name, 'gov'
+      option :pkce, true
+
+      credentials do
+        hash = {"access_token" => access_token.token}
+        hash["id_token"] = access_token.params["id_token"]
+        hash["refresh_token"] = access_token.refresh_token if access_token.expires? && access_token.refresh_token
+        hash["expires_at"] = access_token.expires_at if access_token.expires?
+        hash["expires"] = access_token.expires?        
+        hash
+      end
+
+      info do
+        prune!({
+          "id": raw_info['auth_time'],
+          "cpf": raw_info["sub"],
+          "nome_social": raw_info["social_name"],
+          "email_verified": raw_info["email_verified"],
+          "profile": raw_info["profile"],
+          "username": raw_info["preferred_username"],
+          "picture": raw_info["picture"],
+          "name": raw_info["name"],
+          "email": raw_info["email"],
+        })
+      end
+
+      uid { raw_info['auth_time'] }
+
+      extra do
+        {
+          'raw_info': raw_info
+        }
+      end
+
+      def client
+        options.client_options.merge!({connection_opts: {request: {params_encoder: GovBr::ParamsEncoder}}})
+        ::OAuth2::Client.new(options.client_id, options.client_secret, deep_symbolize(options.client_options))
+      end
+      
+      def request_phase
+        redirect client.auth_code.authorize_url({:redirect_uri => callback_url}.merge(authorize_params))
+      end 
+
+      def raw_info
+        @raw_info ||= JWT.decode(credentials["id_token"], nil, false)[0]
+      end
+
+      def prune!(hash)
+        hash.delete_if do |_, value|
+          prune!(value) if value.is_a?(Hash)
+          value.nil? || (value.respond_to?(:empty?) && value.empty?)
+        end
+      end
+
+      def authorize_params # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+        options.authorize_params[:state] = SecureRandom.hex(24)
+        options.authorize_params[:client_id] = options[:client_id]
+        options.authorize_params[:scope] = options[:scope]
+        options.authorize_params[:response_type] = 'code'
+        options.authorize_params[:nonce] = SecureRandom.hex[0..11]
+        params = options.authorize_params
+          .merge(options_for("authorize"))
+          .merge(pkce_authorize_params)
+
+        session["omniauth.pkce.verifier"] = options.pkce_verifier if options.pkce
+        session["omniauth.state"] = params[:state]
+
+        params
+      end   
+
+      def callback_url
+        full_host = OmniAuth.config.full_host
+        callback_path = options.callback_path
+        normalize_url(full_host+callback_path)
+      end
+
+      def normalize_url(url, force_https: true, strip_trailing_slash: true)
+        url = url.strip
+
+        # Adiciona protocolo se não existir
+        url = "http://#{url}" unless url =~ %r{^https?://}i
+
+        begin
+          uri = URI.parse(url)
+
+          # Força HTTPS se habilitado
+          uri.scheme = force_https ? "https" : (uri.scheme || "http")
+
+          # Normaliza host
+          uri.host = uri.host.downcase if uri.host
+
+          # Normaliza path:
+          if uri.path
+            # Troca // repetidos por /
+            uri.path = uri.path.gsub(%r{/+}, "/")
+            # Remove barra final se configurado (mas não no caso de root "/")
+            if strip_trailing_slash && uri.path != "/" && uri.path.end_with?("/")
+              uri.path = uri.path.chomp("/")
+            end
+          end
+
+          # Ordena query params (se houver)
+          if uri.query
+            query_params = URI.decode_www_form(uri.query).uniq.sort
+            uri.query = URI.encode_www_form(query_params)
+          end
+
+          uri.to_s
+        rescue URI::InvalidURIError
+          nil
+        end
+      end
+
+      def build_access_token
+        verifier = request.params["code"]
+        
+        atoken = client.auth_code.get_token(
+          verifier, 
+          {"grant_type": "authorization_code", "code": verifier, "redirect_uri": callback_url, "code_verifier": session["omniauth.pkce.verifier"]}, 
+          {"Content-Type"  => "application/x-www-form-urlencoded", "Authorization" => "Basic #{Base64.strict_encode64(options.client_id+":"+options.client_secret)}" })
+        atoken
+      end  
+    end
+  end
+end
+
+OmniAuth.config.add_camelization 'gov', 'Gov'

data/lib/omniauth-gov/version.rb

@@ -0,0 +1,5 @@
+module OmniAuth
+  module Gov
+    VERSION = "0.1.12"
+  end
+end

data/lib/omniauth-gov.rb

@@ -0,0 +1,3 @@
+require "omniauth-gov/version"
+require 'gov_br/params_encoder'
+require 'omniauth/strategies/gov'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-gov
 version: !ruby/object:Gem::Version
-  version: 0.1.11
+  version: 0.1.12
 platform: ruby
 authors:
 - Jonas Ricardo
@@ -137,7 +137,13 @@ email:
 executables: []
 extensions: []
 extra_rdoc_files: []
-files: []
+files:
+- LICENSE.txt
+- README.md
+- lib/gov_br/params_encoder.rb
+- lib/omniauth-gov.rb
+- lib/omniauth-gov/version.rb
+- lib/omniauth/strategies/gov.rb
 homepage: https://github.com/jonasrscampos/omniauth-gov
 licenses:
 - MIT