omniauth-humanid 0.0.15

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 32a28f75ea3b1c0cc7c2feb636f7bfa2df28328f1f327e84bfb00d5782f52bc3
+  data.tar.gz: ff1b440841f70b10667b2d675a11f58196998f277a3d829bfe419b4d74918876
+SHA512:
+  metadata.gz: 95eb05f588a3d876740c16bc96dd834b04ff4e669c723a236fe82f25f7ab07f89ff1d152bd6dbcfef8d2bd6b143267ab21dce836ebab41303ccd127bfafcd441
+  data.tar.gz: 3a74040881260644db1df2f758b04110147eb4482a565632fa73d36a51ae411272495917f1f8c3014821f88c694cf0c5776ee2a308035c4a99a3555a13eaf554

data/.gitignore

@@ -0,0 +1,8 @@
+/.bundle/
+/.yardoc
+/_yardoc/
+/coverage/
+/doc/
+/pkg/
+/spec/reports/
+/tmp/

data/CODE_OF_CONDUCT.md

@@ -0,0 +1,74 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, gender identity and expression, level of experience,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team over github, twitter, or email. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at [https://contributor-covenant.org/version/1/4][version]
+
+[homepage]: https://contributor-covenant.org
+[version]: https://contributor-covenant.org/version/1/4/

data/Gemfile

@@ -0,0 +1,6 @@
+source "https://rubygems.org"
+
+# Specify your gem's dependencies in omniauth-humanid.gemspec
+gemspec
+
+gem "rake"

data/Gemfile.lock

@@ -0,0 +1,19 @@
+PATH
+  remote: .
+  specs:
+    omniauth-humanid (0.0.15)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    rake (13.0.6)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  omniauth-humanid!
+  rake
+
+BUNDLED WITH
+   2.1.4

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2022 TODO: Write your name
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,152 @@
+# Ruby/Rails OmniAuth for HumanID Alpha
+
+Omniauth for humanID, a platform that prevents bots and increases privacy. HumanID is run by Human Internet,
+a non-profit that is currently financed by organizations such as Harvard and the Mozilla Foundation (I love the Mozilla
+Developer Network (MDN) which gives great javascript information).
+
+HumanID works best when used as the only sign-up solution, due to this HumanID has to be highly trusted. This is where their
+non-profit status steps in. HumanID has many benifits:
+
+1. Increased privacy for users through both technical innovations and legal responsibilities.
+2. Making bots inconvienient by requiring phone verification.
+3. 'One voice one vote' type benefits by making it difficult to have multiple accounts.
+4. Dont have to deal with users putting in "password123" as a password.
+5. Dont have to deal with email/password registration generally (my signup process became way less complicated, there was all this stuff which to be honest I just didn't really get).
+6. Much better look than "sign up with [tech monopoly here]" buttons.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'omniauth-humanid'
+```
+
+And then execute:
+
+    $ bundle install
+
+Or install it yourself as:
+
+    $ gem install omniauth-humanid
+    
+Update as normal.
+
+## Configuration
+
+1. Make an account at humanID, and get appropriate credentials
+2. You will need to set credentials for client-id and client-secret, for both development and production. This can be done using the rails:credentials method or Enviroment Variables. These both have various advantage/disadvantages.
+3. do some configuration in your initializers, for devise the steps are:
+    - open config/initializers/devise.rb
+    - enter the below code within the "Devise.setup" area
+    ```ruby
+    Devise.setup do |config|
+        id = Rails.application.credentials.omniauth_humanid_client_id
+	    secret = Rails.application.credentials.omniauth_humanid_client_secret
+	    config.omniauth :humanid, client_secret: secret, client_id: id
+    end
+    ```
+4. Make your signup button
+    - I use html which is a bit diffrent than what was provided to allow for CSRF concerns raised in [this gem](https://github.com/cookpad/omniauth-rails_csrf_protection). To follow these instructions, first install and setup that gem
+    - Next your going to want to put this button code in a partial since you will be using it semi-regularly in your code base (convert to irb if needed):
+    ```ruby
+    .btn.common-sign-up-with-btn
+	= form_with url: user_humanid_omniauth_authorize_path, method: :post do
+		%input{type: :image, src: image_pack_path("icons/sign_in_logos/humanID.svg"), alt: "Anonymous Login with humanID"}
+    ```
+5. Create your callback area (still in development)
+    - This area is generally supposed to be customizable, as you might have a diffrent model name, want to attach some validations, etc, etc. So it is not included in the gem, but is here as a how-to.
+    - TBD
+
+## Additional configuration
+
+### Omniauth options
+
+additional configuration can be set in your initializer file at the same area and in the same method as your client-secret and client-id. Additional configuration is as follows: 
+- lang: default language code. Defaults to 'en' (english). Set to nil to remove from url.
+- humanid_version: version string that goes in the url. Defaults to 'v0.0.3'. If humanid updates this may need to be updated aswell.
+- priority_country: not sure exactly what this does or how to use it, but it was in the docs so i added it as an option. Defaults to nil.
+- external_signup_url: the web login url. Defaults to: "https://core.human-id.org/[HUMANID_VERSION]/server/users/web-login". [HUMANID_VERSION] gets substituted by humanid_version above.
+
+### Devise without emails/passwords
+
+Once again, humanID is better when used alone bue to bot mitigation. This section is how to remove email/password authentication.
+
+Although Devise is easier to deal with without usernames / passwords, it takes a bit to get there. This is out of the gem scope, but here are some pointers below. You may run into other hurdles depending on your setup.
+1. In your user.rb (or similar) model, in your devise config line, remove all of the following:
+	- confirmable
+	- database_authenticatable
+	- recoverable
+	- confirmable
+	- lockable
+2. In your devise.rb initializer file, make sure to set authentication_keys to []
+3. delete or comment out the selections in devise.rb related to number 1.
+4. I had to add back the route below:
+```ruby
+as :user do
+	delete "/users/sign_out" => "users/sessions#destroy"
+end
+```
+5. For development you may have to create a seperate way to login/signup for testing purposes. You can do this by sending a form that implements the method 'sign_in_and_redirect user, event: :authentication', or that sets fake values for signup. MAKE SURE THIS METHOD IS ONLY ACTIVE DURING DEVELOPMENT. I have a version of this below:
+	- in my routes.rb:
+	```ruby
+	as :user do
+		if Rails.env.development?
+			post '/users/override' => 'users/omniauth_callbacks#callback_override'
+		end
+	end
+	```
+	- in my OmniauthCallbacksController override (see devise documentation):
+	```ruby
+	def callback_common(provider, uid)
+		user = User.from_omniauth(provider, uid)
+		if user
+			#allready have an account, sign them in
+			sign_in_and_redirect user, event: :authentication # this will throw if user is not activated
+		else
+			request.session['signup'] ||= {}
+			request.session["signup"]["provider"] = provider
+			request.session["signup"]["uid"] = uid
+			raise StandardError.new("REPLACE THIS ERROR WITH A REDIRECT TO FINISH SIGNUP")
+		end
+	end
+	if Rails.env.development?
+		def callback_override
+			raise StandardError.new("nope") unless Rails.env.development?
+			provider = 'override'
+			uid = params['uid']
+			callback_common provider, uid
+		end
+	end
+	```
+	- my form (hidden in a dropdown menu)
+	```ruby
+		- if Rails.env.development?
+			.dropdown-item
+				= form_with url: users_override_path, method: :post do
+					%p put username below to bypass the humanID in development
+					= text_field_tag :uid, '', class: 'form-control'
+					= submit_tag "GO", class: "btn btn-primary"
+	```
+
+## Development of the Gem (Gem usage info stops here)
+
+After checking out the repo, run `bin/setup` to install dependencies.
+
+To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in the gemspec file, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+
+When developing the Gem, for minor updates while debugging etc, we have a custom script to update the gem
+- in the root folder of the gem run ./bin/update. This will bump the version number by one in the gemspec, commit all changes with a generic message, and then install this minor version on your machine.
+- For more information see the ./bin/update file.
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/LukeClancy/omniauth-humanid. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [code of conduct](https://github.com/LukeClancy/omniauth-humanid/blob/master/CODE_OF_CONDUCT.md).
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
+
+## Code of Conduct
+
+Everyone interacting in the Omniauth::Humanid project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/LukeClancy/omniauth-humanid/blob/master/CODE_OF_CONDUCT.md).

data/Rakefile

@@ -0,0 +1,2 @@
+require "bundler/gem_tasks"
+task :default => :spec

data/bin/console

@@ -0,0 +1,14 @@
+#!/usr/bin/env ruby
+
+require "bundler/setup"
+require "omniauth/humanid"
+
+# You can add fixtures and/or initialization code here to make experimenting
+# with your gem easier. You can also use a different console, if you like.
+
+# (If you use this, don't forget to add pry to your Gemfile!)
+# require "pry"
+# Pry.start
+
+require "irb"
+IRB.start(__FILE__)

data/bin/setup

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+IFS=$'\n\t'
+set -vx
+
+bundle install
+
+# Do any other automated setup that you need to do here

data/bin/update

@@ -0,0 +1,33 @@
+#!/bin/env ruby
+#this is for local development and should not be for actual updates,
+#   I just got annoyed with the number of things you had to do to get the updated
+#   version on your machine. Even after this you have to update the and restart your website...
+#   you can one-line that with './bin/bundle update && ../bin rails s' though. Just
+#   make sure you use ~> in the gemfile and your first 2 version numbers are correct.
+
+x = File.read('./omniauth-humanid.gemspec')
+x = x.split("\n")
+puts x.class
+puts x.length
+puts x
+puts "_______________________________________________"
+version = eval(x[0])
+puts "version: #{version}"
+puts "_______________________________________________"
+version = version.split('.')
+version[-1] = ((version[-1].to_i) + 1).to_s
+version_new = version.join('.')
+puts "version_new: #{version_new}"
+puts "_______________________________________________"
+x[0] = "version = '#{version_new}'"
+puts "x[0] => #{x[0]}"
+puts "_______________________________________________"
+x = x.join("\n")
+puts x
+File.write('./omniauth-humanid.gemspec', x)
+puts "_______________________________________________"
+puts `git add *`
+puts "_______________________________________________"
+puts `git commit -m 'minor changes to version #{version_new}'`
+puts "_______________________________________________"
+puts `bundle exec rake install`

data/changelog.md

@@ -0,0 +1 @@
+## This page will have proper updates when it is functional enough to warrent that

data/lib/omniauth-humanid.rb

@@ -0,0 +1,99 @@
+require 'json'
+
+module OmniAuth
+	module Strategies
+		class Humanid
+			include OmniAuth::Strategy
+			#Omniauth strategy creation guide be useful
+			#https://github.com/omniauth/omniauth/wiki/Strategy-Contribution-Guide
+
+			#then this guy created another useful blog 🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥
+			#🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥
+			#https://dev.to/vvo/devise-create-a-local-omniauth-strategy-for-slack-4066
+
+			#note the image in the below documentation, I will try to reference back to it below
+			#https://docs.human-id.org/web-sdk-integration-guide#api-request-web-log-in-session
+
+			#options :login_button_path, '[LOGIN_BUTTON_PATH]'
+			option :humanid_version, 'v0.0.3'
+			#options :local_sign_up_url, "/auth/humanid"
+			option :external_signup_url, "https://core.human-id.org/[HUMANID_VERSION]/server/users/web-login"
+			option :lang, :en
+            option :priority_country, nil #this is an option in the docs, but they dont give an example value (otherwise I would set to united_states, or us, or 1)
+			option :client_secret, nil
+			option :client_id, nil
+
+			# def self.humanid_button
+			# 	#see https://docs.human-id.org/web-sdk-integration-guide
+			# 	%Q{<a href="#{options.local_sign_up_url}">
+    		# 		<img src="#{options.login_button_path}" alt="Anonymous Login with humanID" height="27"/>
+			# 	<a>}
+			# end
+
+			def get_client_id
+			#basic check for client_id
+				return options.client_id unless options.client_id.nil?
+				raise StandardError.new("Please set omniauth-humanid client id")
+			end
+			def get_client_secret
+			#basic check for client_secret
+				return options.client_secret unless options.client_secret.nil?
+				raise StandardError.new("Set omniauth-humanid client secret")
+			end
+			def get_external_signup_uri
+				uri = URI(options.external_signup_url.gsub('[HUMANID_VERSION]', options.humanid_version))
+				query = [
+					['lang', options.lang],
+					['priority_country', options.priority_country]
+				].select{|a| not a[1].nil?}
+				uri.query = URI.encode_www_form(query)
+				return uri
+			end
+			def request_phase_err(res)
+				raise StandardError.new("Issue with the request phase of humanid omniauth, response from human id has code: #{res.code}, and body: #{res.body}")
+			end
+			#request phase
+			def request_phase
+				# In the humanid web-sdk-integration-guide, this would be the "[1] login" step. We need to get the redirect url
+				# through a post request, and then send that to the user.
+
+				#see more on Net::HTTP here:
+				#	https://ruby-doc.org/stdlib-2.4.1/libdoc/net/http/rdoc/Net/HTTP.html
+
+				#get uri
+				uri = get_external_signup_uri
+				Rails.logger.debug "HUMANID_OMNIAUTH URI: #{uri.to_s}"
+				#make a post request (but dont send it yet)
+				post_request = Net::HTTP::Post.new(uri)
+				#set the headers as per docs.
+				post_request['client-id'] = get_client_id
+				post_request['client-secret'] = get_client_secret
+				post_request['Content-Type'] = 'application/json'
+				#send the request using a weirdly 🤷‍♂️ overcomplicated 🤷‍♂️ method 🤷‍♂️ and 🤷‍♂️ block 🤷‍♂️ blame Net::HTTP
+				res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true){|http| http.request(post_request)}
+				Rails.logger.info(res)
+				if res.code == "200"
+					body = JSON.parse(res.body)
+					# they have five diffrent metrics for success:
+					#	1. the response code 200
+					#	2. body["success"] == true
+					#	3. body["code"] == "OK"
+					#	4. body["message"] == "success"
+					#	5. body["data"]["webLoginUrl"] is actually there
+					# I check 1 and 5 since the others seem supplimentary
+					
+					#get the redirect url
+					Rails.logger.info(body)
+					redirect_url = body.dig("data", "webLoginUrl")
+					#check it, throw an error if nil or an int or something random.
+					request_phase_err(res) unless redirect_url.kind_of? String
+					#redirect (everything is working!)
+					Rails.logger.info(redirect_url)
+					redirect redirect_url
+				else
+					request_phase_err(res)
+				end
+			end
+		end
+	end
+end

data/omniauth-humanid.gemspec

@@ -0,0 +1,32 @@
+version = '0.0.15'
+#version must be on the first line for the update script
+
+Gem::Specification.new do |spec|
+  spec.name          = "omniauth-humanid"
+  spec.version       = version
+  spec.authors       = ["Luke Clancy"]
+  spec.email         = ["lukeclancy@hotmail.com"]
+
+  spec.summary       = %q{omniauth-humanid is an omniauth strategy for humanID, a company that provides bot-adverse and private signup functionality. Tested with the devise and omniauth gem}
+  spec.homepage      = "https://github.com/LukeClancy/omniauth-humanid/blob/master/README.md"
+  spec.license       = "MIT"
+  spec.required_ruby_version = Gem::Requirement.new(">= 2.3.0")
+
+  spec.metadata["allowed_push_host"] = "https://rubygems.org"
+
+  spec.metadata["homepage_uri"] = spec.homepage
+  spec.metadata["source_code_uri"] = "https://github.com/LukeClancy/omniauth-humanid"
+  spec.metadata["changelog_uri"] = "https://github.com/LukeClancy/omniauth-humanid/blob/master/changelog.md"
+
+  # Specify which files should be added to the gem when it is released.
+  # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
+  
+  #Note: is this magic?
+
+  spec.files         = Dir.chdir(File.expand_path('..', __FILE__)) do
+    `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
+  end
+  spec.bindir        = "exe"
+  spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
+  spec.require_paths = ["lib"]
+end

metadata

@@ -0,0 +1,62 @@
+--- !ruby/object:Gem::Specification
+name: omniauth-humanid
+version: !ruby/object:Gem::Version
+  version: 0.0.15
+platform: ruby
+authors:
+- Luke Clancy
+autorequire: 
+bindir: exe
+cert_chain: []
+date: 2022-08-22 00:00:00.000000000 Z
+dependencies: []
+description: 
+email:
+- lukeclancy@hotmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- CODE_OF_CONDUCT.md
+- Gemfile
+- Gemfile.lock
+- LICENSE.txt
+- README.md
+- Rakefile
+- bin/console
+- bin/setup
+- bin/update
+- changelog.md
+- lib/omniauth-humanid.rb
+- omniauth-humanid.gemspec
+homepage: https://github.com/LukeClancy/omniauth-humanid/blob/master/README.md
+licenses:
+- MIT
+metadata:
+  allowed_push_host: https://rubygems.org
+  homepage_uri: https://github.com/LukeClancy/omniauth-humanid/blob/master/README.md
+  source_code_uri: https://github.com/LukeClancy/omniauth-humanid
+  changelog_uri: https://github.com/LukeClancy/omniauth-humanid/blob/master/changelog.md
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.3.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.1.6
+signing_key: 
+specification_version: 4
+summary: omniauth-humanid is an omniauth strategy for humanID, a company that provides
+  bot-adverse and private signup functionality. Tested with the devise and omniauth
+  gem
+test_files: []