omniauth-line-oidc 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 8f26151039d5a4335bc74e131925ce65064ab85e8d82597d1944bad71c22b283
+  data.tar.gz: bb091bb1368f5efbfceb229914c646b89a2945cb7441f7be00c7815c1efa1490
+SHA512:
+  metadata.gz: 3e63eee133d0243a9369dc39883a7ea09e8aa6eccaac857c03a4c15215bb9863c1ab62f08e0e72f3de60098969ae79f329409c7996d33771a953ed84fa2b24be
+  data.tar.gz: bdb9da23b3657c86127991e2e81acd67a301bd006aa2bbda12e2639937a216ede80919351afe3ef3e1f0c5dd305fafc0b8af339b8c47770e2efd76267d06a5a2

data/CHANGELOG.md

@@ -0,0 +1,54 @@
+# Changelog
+
+All notable changes to this gem are recorded here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the gem follows
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [1.0.0] - 2026-11-12
+
+First release under the name `omniauth-line-oidc`. The gem continues the
+`omniauth-line` strategy (last released as 0.1.0 in 2021) and keeps its
+provider name, `:line`, so an app can switch by changing its Gemfile.
+
+### Added
+
+- A `nonce` is generated for every authorization request that asks for an
+  ID token, kept in the session under the request's `state`, and sent to
+  LINE's verify endpoint with the ID token on the callback.
+- The sign-in fails with `invalid_credentials` when LINE rejects the ID
+  token, for its nonce or anything else.
+- PKCE (`S256`) is on by default. Turn it off with `pkce: false`.
+- `extra[:id_token_claims]`: the ID token's claims as LINE's verify
+  endpoint returned them, including `amr`. Present only for a verified
+  token.
+- `extra[:raw_info]`: the profile API response.
+- `extra[:friendship_status_changed]`, when LINE reports it on the callback
+  (`bot_prompt`).
+- The sign-in fails with `invalid_credentials` when the verified ID token
+  names a different user than the profile.
+
+### Changed since `omniauth-line` 0.1.0
+
+- Token exchange sends the channel secret in the request body, one of the
+  two client authentication methods LINE documents.
+- The authorization URL and the API calls use their own hosts
+  (`access.line.me` and `api.line.me`) from fixed settings; nothing is
+  rewritten per request.
+- `info[:email]` is read from the ID token through LINE's verify endpoint.
+  When the endpoint cannot be reached, times out or answers with a server
+  error, the email is `nil` and the sign-in carries on.
+- The verify call has timeouts (5 s to open, 10 s to read), configurable
+  through `verify_options`.
+- LINE's authorization options are forwarded when set: `prompt`, `max_age`,
+  `ui_locales`, `bot_prompt`, `initial_amr_display`, `switch_amr`,
+  `disable_auto_login`, `disable_ios_auto_login`. A `nonce` option is
+  ignored; the strategy generates one per sign-in.
+- The callback URL override is the `redirect_uri` option. `callback_url`,
+  the name `omniauth-line` 0.1.0 used, is still accepted.
+- A profile response that is not JSON, or names no user, fails the sign-in
+  with `invalid_credentials`.
+- Requires Ruby 3.1 or newer, `omniauth` 2.3.1 or newer and
+  `omniauth-oauth2` 1.10 or newer. The `json` gem is no longer a declared
+  dependency.

data/LICENSE.txt

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2015 kazasiki and the omniauth-line contributors
+Copyright (c) 2026 the omniauth-line-oidc contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,221 @@
+# omniauth-line-oidc
+
+[![CI](https://github.com/momiji-rs/omniauth-line-oidc/actions/workflows/ci.yml/badge.svg)](https://github.com/momiji-rs/omniauth-line-oidc/actions/workflows/ci.yml)
+
+LINE Login v2.1 (OAuth 2.0 / OpenID Connect) strategy for OmniAuth.
+
+See the LINE Login docs for details:
+https://developers.line.biz/en/docs/line-login/integrate-line-login/
+
+This gem continues the `omniauth-line` strategy, which has had no release
+since 2021. It registers the same provider name, `:line`.
+
+## Using This Strategy
+
+First start by adding this gem to your Gemfile:
+
+```ruby
+gem 'omniauth-line-oidc'
+```
+
+### Switching from `omniauth-line`
+
+Replace the gem in your Gemfile; the provider name, the callback path
+(`/auth/line/callback`) and the auth hash keys are the same. Things to
+check:
+
+- PKCE is on by default. It needs nothing from you unless your callback is
+  handled without the session that started the sign-in; see
+  [Callbacks handled by another session](#callbacks-handled-by-another-session).
+- A sign-in started before the deploy and finished after it has no PKCE
+  verifier or nonce in its session, and may be refused by LINE; the user
+  signs in again.
+- A sign-in now fails when LINE rejects the ID token. `omniauth-line`
+  ignored the rejection and returned no email.
+- `extra` now also carries `raw_info`, and `id_token_claims` when the ID
+  token was verified.
+- Do not keep both gems in one bundle: both define
+  `OmniAuth::Strategies::Line`. If you require the gem by name, the file
+  is `omniauth-line-oidc`.
+- Requires `omniauth-oauth2` 1.10 or newer.
+
+See the [changelog](CHANGELOG.md) for everything that differs from
+`omniauth-line` 0.1.0.
+
+Next, tell OmniAuth about this provider. For a Rails app, your
+`config/initializers/omniauth.rb` file should look like this:
+
+```ruby
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider :line, ENV['LINE_CHANNEL_ID'], ENV['LINE_CHANNEL_SECRET']
+end
+```
+
+Register your callback URL (e.g. `https://your.app/auth/line/callback`)
+under "LINE Login > Callback URL" in the
+[LINE Developers console](https://developers.line.biz/console/), or the
+authorization request will fail with "Invalid redirect_uri value".
+
+### Scopes and email
+
+The default scope is `profile openid`. To receive the user's email
+address, apply for the "OpenID Connect email" permission in the LINE
+Developers console and request the `email` scope:
+
+```ruby
+provider :line, ENV['LINE_CHANNEL_ID'], ENV['LINE_CHANNEL_SECRET'],
+         scope: 'profile openid email'
+```
+
+LINE only exposes the email inside the ID token, never through the
+profile API. When the `email` scope is not granted, `info[:email]` is
+`nil`.
+
+### Options
+
+Besides the standard OmniAuth options, the strategy forwards these to
+LINE's authorization URL when you set them: `prompt`, `max_age`,
+`ui_locales`, `bot_prompt`, `initial_amr_display`, `switch_amr`,
+`disable_auto_login`, `disable_ios_auto_login`. There is no `nonce`
+option: the strategy generates a fresh one for every sign-in.
+
+```ruby
+provider :line, ENV['LINE_CHANNEL_ID'], ENV['LINE_CHANNEL_SECRET'],
+         bot_prompt: 'normal', ui_locales: 'ja'
+```
+
+| Option | Default | Meaning |
+|---|---|---|
+| `scope` | `'profile openid'` | Add `email` once the channel has the permission |
+| `pkce` | `true` | Send a PKCE challenge (`S256`, the only method LINE accepts) |
+| `redirect_uri` | built from the request | The callback URL registered with LINE. `callback_url`, the name `omniauth-line` used, is accepted too |
+| `verify_options` | `{ open_timeout: 5, read_timeout: 10 }` | Timeouts for the ID token verify call, in seconds |
+
+`response_mode` is not supported: the strategy reads the callback from
+the query string, which is LINE's default.
+
+## How the ID token is used
+
+The user is identified by LINE's profile API, called with the access
+token the sign-in was just issued. The ID token adds what the profile
+API does not have, the email above all.
+
+- The strategy sends a `nonce` with every authorization request that
+  asks for an ID token, and keeps it in the session under the request's
+  `state`.
+- On the callback it sends the ID token, the channel ID and that nonce
+  to LINE's [verify endpoint](https://developers.line.biz/en/reference/line-login/#verify-id-token).
+  LINE checks the signature, issuer, audience, expiry and nonce.
+- If LINE rejects the token (HTTP 400, which is also its answer to a
+  wrong nonce), the sign-in fails with `invalid_credentials`.
+- If the verified token names a different user than the profile, the
+  sign-in fails with `invalid_credentials`.
+- If LINE cannot be asked (the call times out, the connection fails, or
+  LINE answers with a server error), the sign-in continues without the
+  claims: `info[:email]` is `nil` and `extra[:id_token_claims]` is
+  absent. A warning is logged. Handle a `nil` email as you already must
+  for a user who declines the `email` scope.
+
+The raw `extra[:id_token]` is passed through as LINE issued it. Do not
+read claims out of it yourself; use `extra[:id_token_claims]`, which is
+only present after verification.
+
+The strategy keeps one nonce for each sign-in a browser session has
+under way, up to five, next to what `omniauth-oauth2` stores for state
+and PKCE. Five unfinished sign-ins come to about 2.5 KB of session data,
+which matters if your sessions live in a 4 KB cookie that is already
+well filled.
+
+### Callbacks handled by another session
+
+The nonce and the PKCE verifier live in the session that started the
+sign-in. If your callback arrives in a different session (for example a
+front end on another domain relays it to your API), the strategy cannot
+find them:
+
+- Set `pkce: false`, or the token exchange is sent without a verifier
+  and LINE rejects it.
+- The ID token is then verified without a nonce. Everything else about
+  it is still checked.
+- You will also need `provider_ignores_state: true`, which gives up the
+  CSRF protection `state` provides. Prefer carrying the session across
+  if you can.
+
+## Authentication Hash
+
+An example auth hash available in `request.env['omniauth.auth']`:
+
+```ruby
+{
+  provider: "line",
+  uid: "U1234567890abcdef1234567890abcdef",
+  info: {
+    name: "yamada tarou",
+    image: "https://profile.line-scdn.net/xxxxx",
+    description: nil,            # the user's status message, may be nil
+    email: "user@example.com"    # nil unless the email scope is granted
+  },
+  credentials: {
+    token: "a1b2c3d4...",        # OAuth 2.0 access token
+    refresh_token: "e5f6g7h8...",
+    expires_at: 1789266388,
+    expires: true
+  },
+  extra: {
+    raw_info: {                  # the profile API response
+      "userId" => "U1234567890abcdef1234567890abcdef",
+      "displayName" => "yamada tarou",
+      "pictureUrl" => "https://profile.line-scdn.net/xxxxx"
+    },
+    id_token: "eyJ0eXAiOiJKV1Qi...",  # as issued; present with the openid scope
+    id_token_claims: {           # present only when LINE verified the token
+      "iss" => "https://access.line.me",
+      "sub" => "U1234567890abcdef1234567890abcdef",
+      "aud" => "1234567890",
+      "exp" => 1789266388,
+      "iat" => 1789262788,
+      "nonce" => "0f3c...",
+      "amr" => ["linesso"],      # how the user authenticated
+      "name" => "yamada tarou",
+      "email" => "user@example.com"
+    },
+    friendship_status_changed: true   # present only when bot_prompt was requested
+  }
+}
+```
+
+## Development
+
+```sh
+bundle install
+bundle exec rake   # runs the specs; every line of lib/ must be covered
+```
+
+The test suite stubs all HTTP with WebMock; no LINE credentials are
+needed. CI runs the suite on Ruby 3.1 through 4.0 and on ruby-head
+(which may fail without failing the build), and once more against the
+oldest dependency versions the gemspec admits:
+
+```sh
+BUNDLE_GEMFILE=gemfiles/minimum.gemfile bundle install
+BUNDLE_GEMFILE=gemfiles/minimum.gemfile bundle exec rake
+```
+
+## Releasing
+
+Releases are published by the `Release` workflow through RubyGems
+[trusted publishing](https://guides.rubygems.org/trusted-publishing/);
+no API key is stored in the repository. Only 1.0.0, which created the
+gem on RubyGems.org, was pushed by hand.
+
+1. Set the version in `lib/omniauth/line_oidc/version.rb` and move the
+   changelog's "Unreleased" entries under that version. Merge to `master`.
+2. Tag that commit `v<version>` and push the tag.
+3. The workflow checks that the tag matches the gem's version and that
+   the commit is on `master`, runs the specs, then builds and pushes the
+   gem.
+
+One-time setup on RubyGems.org, by an owner of the gem: a trusted
+publisher for repository `momiji-rs/omniauth-line-oidc`, workflow
+`release.yml`, environment `release`, added on the gem's "Trusted
+publishers" page.

data/lib/omniauth/line_oidc/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module OmniAuth
+  module LineOidc
+    VERSION = '1.0.0'
+  end
+end

data/lib/omniauth/strategies/line.rb

@@ -0,0 +1,227 @@
+# frozen_string_literal: true
+
+require 'omniauth-oauth2'
+require 'json'
+require 'net/http'
+require 'openssl'
+require 'securerandom'
+
+module OmniAuth
+  module Strategies
+    # LINE Login v2.1.
+    #
+    # The user is identified by the profile API, called with the access token
+    # this sign-in was just issued. The ID token adds claims the profile API
+    # does not have (the email above all). Its claims are used only after
+    # LINE's verify endpoint has accepted the token, together with the nonce
+    # this strategy sent. A token LINE rejects fails the sign-in; a verify
+    # endpoint that cannot be reached leaves the sign-in working without the
+    # claims.
+    class Line < OmniAuth::Strategies::OAuth2
+      VERIFY_URL = 'https://api.line.me/oauth2/v2.1/verify'
+      NONCE_SESSION_KEY = 'omniauth.line.nonces'
+      # Sign-ins a browser session can have under way at once, each with its
+      # own nonce; the oldest is dropped beyond this.
+      MAX_STORED_NONCES = 5
+
+      # Failures that say nothing about the token: LINE was not reached, or
+      # did not answer.
+      VERIFY_UNREACHABLE = [
+        ::Timeout::Error, ::SystemCallError, ::SocketError, ::IOError, ::OpenSSL::SSL::SSLError
+      ].freeze
+
+      option :name, 'line'
+      option :scope, 'profile openid'
+
+      # LINE supports PKCE with S256 only, which is what omniauth-oauth2 sends.
+      # Set `pkce: false` when the callback is handled without the session
+      # that started the sign-in, since the verifier lives in that session.
+      option :pkce, true
+
+      # omniauth-oauth2 only forwards options named here to the authorize
+      # URL; anything else set on the strategy is silently dropped. `nonce` is
+      # absent on purpose: a nonce configured once would be the same for every
+      # sign-in, so the strategy always generates its own.
+      option :authorize_options, %i[
+        scope state prompt max_age ui_locales bot_prompt
+        initial_amr_display switch_amr disable_auto_login
+        disable_ios_auto_login
+      ]
+
+      # The verify call runs inside the user-facing callback request, so a
+      # slow LINE API must fail fast rather than hold the login hostage.
+      DEFAULT_VERIFY_TIMEOUTS = { open_timeout: 5, read_timeout: 10 }.freeze
+      option :verify_options, DEFAULT_VERIFY_TIMEOUTS.dup
+
+      # Authorization lives on access.line.me while every API call
+      # (token exchange, profile, verify) lives on api.line.me.
+      option :client_options, {
+        site: 'https://api.line.me',
+        authorize_url: 'https://access.line.me/oauth2/v2.1/authorize',
+        token_url: '/oauth2/v2.1/token',
+        auth_scheme: :request_body
+      }
+
+      uid do
+        ensure_id_token_is_for_this_user!
+        raw_info['userId']
+      end
+
+      info do
+        {
+          name: raw_info['displayName'],
+          image: raw_info['pictureUrl'],
+          description: raw_info['statusMessage'],
+          email: email
+        }
+      end
+
+      extra do
+        hash = { raw_info: raw_info }
+        hash[:id_token] = id_token if id_token
+        hash[:id_token_claims] = id_token_claims unless id_token_claims.empty?
+        hash[:friendship_status_changed] = friendship_status_changed unless friendship_status_changed.nil?
+        hash
+      end
+
+      # A nonce ties the ID token to this sign-in: it is sent with the
+      # authorization request, LINE copies it into the ID token, and the
+      # verify call later states which nonce the token must carry.
+      def authorize_params
+        super.tap do |params|
+          next unless openid_scope?(params[:scope])
+
+          params[:nonce] = SecureRandom.hex(16)
+          remember_nonce(params[:state], params[:nonce])
+        end
+      end
+
+      # The nonce is taken before anything can fail, so a callback that is
+      # refused or carries an error leaves none behind.
+      def callback_phase
+        @nonce = take_nonce
+        super
+      end
+
+      # LINE returns the email claim only inside the ID token (email scope),
+      # never from the profile endpoint.
+      def email
+        id_token_claims['email']
+      end
+
+      # The ID token's claims as LINE's verify endpoint returned them, or an
+      # empty hash when there is no ID token or LINE could not be asked.
+      def id_token_claims
+        @id_token_claims ||= id_token ? verified_claims : {}
+      end
+
+      # Require: Access token with PROFILE permission issued.
+      def raw_info
+        @raw_info ||= fetch_profile
+      end
+
+      # `callback_url` is the option name omniauth-line 0.1.0 used.
+      def callback_url
+        options[:redirect_uri] || options[:callback_url] || (full_host + script_name + callback_path)
+      end
+
+      private
+
+      def id_token
+        access_token['id_token']
+      end
+
+      # Set by LINE on the callback only when `bot_prompt` was requested.
+      def friendship_status_changed
+        value = request.params['friendship_status_changed']
+        value.nil? ? nil : value.to_s == 'true'
+      end
+
+      def openid_scope?(scope)
+        scope.to_s.split(/[\s,]+/).include?('openid')
+      end
+
+      def fetch_profile
+        profile = parse_json(access_token.get('v2/profile').body)
+        return profile if profile.is_a?(Hash) && profile['userId']
+
+        raise CallbackError.new(:invalid_credentials, 'the profile response names no user')
+      end
+
+      # The profile comes from the access token and the claims from the ID
+      # token; both were issued by the same token response, so they name the
+      # same user unless something is badly wrong.
+      def ensure_id_token_is_for_this_user!
+        subject = id_token_claims['sub']
+        return if subject.nil? || subject == raw_info['userId']
+
+        raise CallbackError.new(:invalid_credentials, 'the ID token and the profile name different users')
+      end
+
+      def verified_claims
+        response = verify_id_token
+        payload = parse_json(response.body)
+
+        if response.is_a?(Net::HTTPSuccess)
+          return payload if payload.is_a?(Hash) && payload['sub']
+
+          log :warn, 'ID token verify returned no claims'
+        elsif response.is_a?(Net::HTTPBadRequest)
+          # LINE's answer for a token that fails a check, the nonce included.
+          description = payload['error_description'] || payload['error'] if payload.is_a?(Hash)
+          raise CallbackError.new(:invalid_credentials, "LINE rejected the ID token: #{description}")
+        else
+          log :warn, "ID token verify unavailable (HTTP #{response.code})"
+        end
+        {}
+      rescue *VERIFY_UNREACHABLE => e
+        log :warn, "ID token verify could not be reached (#{e.class})"
+        {}
+      end
+
+      def verify_id_token
+        uri = URI(VERIFY_URL)
+        request = Net::HTTP::Post.new(uri)
+        form = { id_token: id_token, client_id: client.id }
+        form[:nonce] = @nonce if @nonce
+        request.set_form_data(form)
+        timeouts = options.verify_options || {}
+        Net::HTTP.start(uri.host, uri.port,
+                        use_ssl: true,
+                        open_timeout: timeouts[:open_timeout] || DEFAULT_VERIFY_TIMEOUTS[:open_timeout],
+                        read_timeout: timeouts[:read_timeout] || DEFAULT_VERIFY_TIMEOUTS[:read_timeout]) do |http|
+          http.request(request)
+        end
+      end
+
+      def parse_json(body)
+        JSON.parse(body.to_s)
+      rescue JSON::ParserError
+        nil
+      end
+
+      # Nonces are kept per `state`, so two sign-ins started in one browser
+      # session each verify against their own.
+      def remember_nonce(state, nonce)
+        nonces = stored_nonces
+        nonces.delete(state.to_s)
+        nonces[state.to_s] = nonce.to_s
+        session[NONCE_SESSION_KEY] = nonces.to_a.last(MAX_STORED_NONCES).to_h
+      end
+
+      # nil when this callback's session did not start the sign-in; the
+      # verify call then checks everything about the token except the nonce.
+      def take_nonce
+        nonces = stored_nonces
+        nonce = nonces.delete(request.params['state'].to_s)
+        session[NONCE_SESSION_KEY] = nonces if nonce
+        nonce
+      end
+
+      def stored_nonces
+        nonces = session[NONCE_SESSION_KEY]
+        nonces.is_a?(Hash) ? nonces.dup : {}
+      end
+    end
+  end
+end

data/lib/omniauth-line-oidc.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+require 'omniauth/line_oidc/version'
+require 'omniauth/strategies/line'

metadata

@@ -0,0 +1,84 @@
+--- !ruby/object:Gem::Specification
+name: omniauth-line-oidc
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- kazasiki
+- omniauth-line-oidc contributors
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: omniauth
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.3'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.3.1
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.3'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.3.1
+- !ruby/object:Gem::Dependency
+  name: omniauth-oauth2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.10'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.10'
+description: 'Sign in with LINE through OmniAuth: LINE Login v2.1 with OpenID Connect,
+  including the email claim and LINE-specific authorization options.'
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE.txt
+- README.md
+- lib/omniauth-line-oidc.rb
+- lib/omniauth/line_oidc/version.rb
+- lib/omniauth/strategies/line.rb
+homepage: https://github.com/momiji-rs/omniauth-line-oidc
+licenses:
+- MIT
+metadata:
+  source_code_uri: https://github.com/momiji-rs/omniauth-line-oidc/tree/master
+  changelog_uri: https://github.com/momiji-rs/omniauth-line-oidc/blob/master/CHANGELOG.md
+  bug_tracker_uri: https://github.com/momiji-rs/omniauth-line-oidc/issues
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.1'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: OmniAuth strategy for LINE Login v2.1 (OpenID Connect)
+test_files: []