omniauth-mlh 4.1.0 → 4.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8e92f4278cc436382318b94bdac74133f166b1b7f9382e0920d03917c781ad2b
-  data.tar.gz: ced9efbd0c899c448bf511dca3250ce6741a73f76af4b5fc57d009824bad1e26
+  metadata.gz: 641588bd9aad3201d3be389098e1d2a4a53b5179cc3edaec47c70a0f3191ca81
+  data.tar.gz: 2289268a506cc1c641ef83aefe912996c041343530efe6010b17a49b261f8ea5
 SHA512:
-  metadata.gz: 1fba79bb10779ad12ee4b83a3230980fcb7431a82c10aa63274fc0ebf12b5df47d3914f077fc84e05738f0f60bb3e36fb4968b53ba3b1d2fa71a4fa3d73f4968
-  data.tar.gz: 6035b246c632882bc231356f6d9500b79276252de689bd0f8660adc1fe5ef6abecc83210c9b1bbe1c57d22b8849276c03e37265a6f53edd1b0cf5f85a1e43bc3
+  metadata.gz: d5c441f65324cccf80c23cd39ab2d043c3e5ea4f93d08a009aeb2f6e3af1213f1281307692ef162d71af99d42de16defbd0fadfe46422b955b8136be770d45b0
+  data.tar.gz: cdcab860ce4e891fa4a92fc8f448e3464031ba0b9ba3eb221756606ad66763c717265234085b7441267dbf449ba95228ac6ef64c65715c95d55e4e37d59e7e2b

data/.gitignore

@@ -1,4 +1,5 @@
 /.bundle/
+/vendor/bundle/
 /.yardoc
 /Gemfile.lock
 /_yardoc/

data/lib/omniauth/strategies/mlh.rb

@@ -30,12 +30,17 @@ module OmniAuth
       option :name, :mlh
 
       option :client_options, {
-        site: 'https://my.mlh.io',
-        authorize_url: 'oauth/authorize',
-        token_url: 'oauth/token',
+        site: 'https://www.mlh.com',
+        authorize_url: '/oauth/authorize',
+        token_url: 'https://api.mlh.com/v4/oauth/token',
+        api_site: 'https://api.mlh.com',
         auth_scheme: :request_body # Change from basic auth to request body
       }
 
+      option :pkce, true
+
+      option :persist_credentials, true
+
       # Support expandable fields through options
       option :expand_fields, []
 
@@ -65,7 +70,8 @@ module OmniAuth
 
       def data
         @data ||= fetch_and_process_data.compact
-      rescue StandardError
+      rescue ::OAuth2::Error, JSON::ParserError => e
+        OmniAuth.logger.warn("OmniAuth MLH: failed to load user data (#{e.class})")
         {}
       end
 
@@ -79,8 +85,21 @@ module OmniAuth
         symbolize_nested_arrays(data)
       end
 
+      # Preserve the OmniAuth credential shape without exposing bearer material.
+      def credentials
+        return super if options.persist_credentials
+
+        OmniAuth::AuthHash.new(
+          token: '',
+          refresh_token: nil,
+          secret: '',
+          expires: false
+        )
+      end
+
       def build_api_url
-        url = 'https://api.mlh.com/v4/users/me'
+        base = (options.dig(:client_options, :api_site) || 'https://api.mlh.com').to_s.chomp('/')
+        url = "#{base}/v4/users/me"
         expand_fields = options[:expand_fields] || []
         return url if expand_fields.empty?
 

data/lib/omniauth-mlh/version.rb

@@ -2,6 +2,6 @@
 
 module OmniAuth
   module MLH
-    VERSION = '4.1.0'
+    VERSION = '4.2.0'
   end
 end

data/spec/omni_auth/mlh_spec.rb

@@ -5,7 +5,7 @@ require 'spec_helper'
 RSpec.describe OmniAuth::MLH do
   it 'has a version number' do
     expect(OmniAuth::MLH::VERSION).not_to be_nil
-    expect(OmniAuth::MLH::VERSION).to eq('4.1.0')
+    expect(OmniAuth::MLH::VERSION).to eq('4.2.0')
   end
 
   it 'loads the MLH strategy' do

data/spec/omni_auth/strategies/mlh_spec.rb

@@ -12,12 +12,45 @@ RSpec.describe OmniAuth::Strategies::MLH do
     allow(strategy).to receive(:access_token).and_return(access_token)
   end
 
+  describe 'client options' do
+    it 'uses the current MLH OAuth authorize and token endpoints' do
+      expect(strategy.options.client_options.authorize_url).to eq('/oauth/authorize')
+      expect(strategy.options.client_options.token_url).to eq('https://api.mlh.com/v4/oauth/token')
+    end
+
+    context 'with only api_site overridden' do
+      let(:strategy) do
+        described_class.new(app, 'client_id', 'client_secret',
+                            client_options: { api_site: 'https://api.mlh.test' })
+      end
+
+      let(:token_request) do
+        stub_request(:post, 'https://api.mlh.com/v4/oauth/token')
+          .with(body: hash_including('client_id' => 'client_id', 'client_secret' => 'client_secret',
+                                     'code' => 'authorization-code', 'grant_type' => 'authorization_code'))
+          .to_return(body: { access_token: 'test-token', token_type: 'Bearer' }.to_json,
+                     headers: { 'Content-Type' => 'application/json' })
+      end
+
+      it 'preserves the OAuth authorization endpoint' do
+        expect(strategy.client.authorize_url).to eq('https://www.mlh.com/oauth/authorize')
+      end
+
+      it 'exchanges a code at the default token endpoint with credentials in the request body' do
+        token_request
+        expect(strategy.client.auth_code.get_token('authorization-code').token).to eq('test-token')
+        expect(token_request).to have_been_requested
+      end
+    end
+  end
+
   shared_context 'with oauth response' do |response_data|
     let(:oauth_response) do
       instance_double(OAuth2::Response,
                       body: response_data.to_json,
                       parsed: response_data)
     end
+
     before do
       allow(access_token).to receive(:get)
         .with('https://api.mlh.com/v4/users/me')
@@ -26,6 +59,21 @@ RSpec.describe OmniAuth::Strategies::MLH do
   end
 
   describe '#data' do
+    [nil, false].each do |expand_fields|
+      context "with expand_fields set to #{expand_fields.inspect}" do
+        let(:strategy) do
+          described_class.new(app, 'client_id', 'client_secret', expand_fields: expand_fields)
+        end
+
+        include_context 'with oauth response', { 'id' => 'core-user-1' }
+
+        it 'fetches user data without expansion parameters' do
+          expect(strategy.data).to eq(id: 'core-user-1')
+          expect(access_token).to have_received(:get).with('https://api.mlh.com/v4/users/me')
+        end
+      end
+    end
+
     context 'with expandable fields' do
       let(:response) do
         instance_double(OAuth2::Response, body: {}.to_json, parsed: {})
@@ -74,6 +122,30 @@ RSpec.describe OmniAuth::Strategies::MLH do
       end
     end
 
+    context 'with a custom api_site client option' do
+      let(:custom_strategy) do
+        described_class.new(app, 'client_id', 'client_secret',
+                            client_options: { api_site: 'https://api.mlh.test' })
+      end
+
+      let(:response) do
+        instance_double(OAuth2::Response, body: { 'id' => 'core-user-1' }.to_json)
+      end
+
+      before do
+        allow(custom_strategy).to receive(:access_token).and_return(access_token)
+        allow(access_token).to receive(:get)
+          .with('https://api.mlh.test/v4/users/me')
+          .and_return(response)
+      end
+
+      it 'fetches user data from the configured API base' do
+        custom_strategy.data
+
+        expect(access_token).to have_received(:get).with('https://api.mlh.test/v4/users/me')
+      end
+    end
+
     context 'with v4 API complex data structures' do
       include_context 'with oauth response', {
         'id' => 'test-id',
@@ -142,13 +214,68 @@ RSpec.describe OmniAuth::Strategies::MLH do
       end
     end
 
-    context 'with API error' do
-      it 'returns empty hash on error' do
-        allow(access_token).to receive(:get).and_raise(StandardError)
+    context 'with OAuth2::Error' do
+      let(:error_response) do
+        instance_double(OAuth2::Response,
+                        status: 500,
+                        headers: {},
+                        body: '{"error": "server_error"}')
+      end
+
+      before do
+        allow(access_token).to receive(:get).and_raise(OAuth2::Error.new(error_response))
+      end
 
+      it 'returns empty payload for OAuth2 errors' do
         expect(strategy.data).to eq({})
       end
     end
+
+    context 'with malformed JSON' do
+      before do
+        allow(access_token).to receive(:get)
+          .and_return(instance_double(OAuth2::Response, body: '<html>not json</html>'))
+      end
+
+      it 'returns empty payload for JSON parse failures' do
+        expect(strategy.data).to eq({})
+      end
+    end
+
+    context 'with unexpected error' do
+      let(:unexpected_error_class) { Class.new(StandardError) }
+
+      before do
+        allow(access_token).to receive(:get).and_raise(unexpected_error_class, 'boom')
+      end
+
+      it 'propagates unexpected errors' do
+        expect { strategy.data }.to raise_error(unexpected_error_class)
+      end
+    end
+  end
+
+  describe '#auth_hash' do
+    let(:strategy) do
+      described_class.new(app, 'client_id', 'client_secret', persist_credentials: false)
+    end
+
+    let(:empty_credentials) do
+      {
+        'token' => '',
+        'refresh_token' => nil,
+        'secret' => '',
+        'expires' => false
+      }
+    end
+
+    before do
+      allow(strategy).to receive(:data).and_return(id: 'core-user-1')
+    end
+
+    it 'omits bearer credentials when persistence is disabled' do
+      expect(strategy.auth_hash['credentials']).to eq(empty_credentials)
+    end
   end
 
   describe '#uid' do
@@ -193,4 +320,25 @@ RSpec.describe OmniAuth::Strategies::MLH do
       expect(strategy.info[:roles]).to eq(['hacker'])
     end
   end
+
+  describe 'PKCE authorization' do
+    before { OmniAuth.config.test_mode = true }
+
+    after { OmniAuth.config.test_mode = false }
+
+    it 'uses S256 by default and sends the verifier only in token params' do
+      params = strategy.authorize_params
+
+      expect(params).to include(code_challenge: be_present, code_challenge_method: 'S256')
+      expect(params).not_to have_key(:code_verifier)
+      expect(strategy.token_params[:code_verifier]).to eq(strategy.options.pkce_verifier).and be_present
+    end
+
+    it 'can be disabled via the pkce option' do
+      disabled_strategy = described_class.new(app, 'client_id', 'client_secret', pkce: false)
+
+      expect(disabled_strategy.authorize_params).not_to include(:code_challenge, :code_challenge_method)
+      expect(disabled_strategy.token_params).not_to have_key(:code_verifier)
+    end
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-mlh
 version: !ruby/object:Gem::Version
-  version: 4.1.0
+  version: 4.2.0
 platform: ruby
 authors:
 - Major League Hacking (MLH)
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-11-19 00:00:00.000000000 Z
+date: 2026-09-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: oauth2
@@ -194,7 +194,7 @@ homepage: http://github.com/mlh/omniauth-mlh
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -210,7 +210,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.4.19
-signing_key: 
+signing_key:
 specification_version: 4
 summary: Official OmniAuth strategy for MyMLH.
 test_files: []