omniauth-mlh 4.1.1 → 4.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 96ab64892eadeb5c81fd8028bd8e2e82192f776ff510410ad5e8049630e55f6d
-  data.tar.gz: e6c4b2d1de8f465a0fee954aeb48325e36a91d1e4bef3f210a73c31f2171c112
+  metadata.gz: 641588bd9aad3201d3be389098e1d2a4a53b5179cc3edaec47c70a0f3191ca81
+  data.tar.gz: 2289268a506cc1c641ef83aefe912996c041343530efe6010b17a49b261f8ea5
 SHA512:
-  metadata.gz: 80400b7ddc58bc8e6b238a0ee06501069b7f41433ed227e4c40f5cc7125e3443b07450273b6f5c15522b1fe3be9328b146f8e4c92b0d1071e9619c73b54d8133
-  data.tar.gz: 799e561814b403cf430bf540c7dd1b1f0ba2ba4d5323891e716d34030c8ce679e65f3addae6c8f7f0bca7e1f24f22d80709bed7d3324788182b8e9a7b5d9c569
+  metadata.gz: d5c441f65324cccf80c23cd39ab2d043c3e5ea4f93d08a009aeb2f6e3af1213f1281307692ef162d71af99d42de16defbd0fadfe46422b955b8136be770d45b0
+  data.tar.gz: cdcab860ce4e891fa4a92fc8f448e3464031ba0b9ba3eb221756606ad66763c717265234085b7441267dbf449ba95228ac6ef64c65715c95d55e4e37d59e7e2b

data/lib/omniauth/strategies/mlh.rb

@@ -33,9 +33,14 @@ module OmniAuth
         site: 'https://www.mlh.com',
         authorize_url: '/oauth/authorize',
         token_url: 'https://api.mlh.com/v4/oauth/token',
+        api_site: 'https://api.mlh.com',
         auth_scheme: :request_body # Change from basic auth to request body
       }
 
+      option :pkce, true
+
+      option :persist_credentials, true
+
       # Support expandable fields through options
       option :expand_fields, []
 
@@ -65,7 +70,8 @@ module OmniAuth
 
       def data
         @data ||= fetch_and_process_data.compact
-      rescue StandardError
+      rescue ::OAuth2::Error, JSON::ParserError => e
+        OmniAuth.logger.warn("OmniAuth MLH: failed to load user data (#{e.class})")
         {}
       end
 
@@ -79,8 +85,21 @@ module OmniAuth
         symbolize_nested_arrays(data)
       end
 
+      # Preserve the OmniAuth credential shape without exposing bearer material.
+      def credentials
+        return super if options.persist_credentials
+
+        OmniAuth::AuthHash.new(
+          token: '',
+          refresh_token: nil,
+          secret: '',
+          expires: false
+        )
+      end
+
       def build_api_url
-        url = 'https://api.mlh.com/v4/users/me'
+        base = (options.dig(:client_options, :api_site) || 'https://api.mlh.com').to_s.chomp('/')
+        url = "#{base}/v4/users/me"
         expand_fields = options[:expand_fields] || []
         return url if expand_fields.empty?
 

data/lib/omniauth-mlh/version.rb

@@ -2,6 +2,6 @@
 
 module OmniAuth
   module MLH
-    VERSION = '4.1.1'
+    VERSION = '4.2.0'
   end
 end

data/spec/omni_auth/mlh_spec.rb

@@ -5,7 +5,7 @@ require 'spec_helper'
 RSpec.describe OmniAuth::MLH do
   it 'has a version number' do
     expect(OmniAuth::MLH::VERSION).not_to be_nil
-    expect(OmniAuth::MLH::VERSION).to eq('4.1.1')
+    expect(OmniAuth::MLH::VERSION).to eq('4.2.0')
   end
 
   it 'loads the MLH strategy' do

data/spec/omni_auth/strategies/mlh_spec.rb

@@ -17,6 +17,31 @@ RSpec.describe OmniAuth::Strategies::MLH do
       expect(strategy.options.client_options.authorize_url).to eq('/oauth/authorize')
       expect(strategy.options.client_options.token_url).to eq('https://api.mlh.com/v4/oauth/token')
     end
+
+    context 'with only api_site overridden' do
+      let(:strategy) do
+        described_class.new(app, 'client_id', 'client_secret',
+                            client_options: { api_site: 'https://api.mlh.test' })
+      end
+
+      let(:token_request) do
+        stub_request(:post, 'https://api.mlh.com/v4/oauth/token')
+          .with(body: hash_including('client_id' => 'client_id', 'client_secret' => 'client_secret',
+                                     'code' => 'authorization-code', 'grant_type' => 'authorization_code'))
+          .to_return(body: { access_token: 'test-token', token_type: 'Bearer' }.to_json,
+                     headers: { 'Content-Type' => 'application/json' })
+      end
+
+      it 'preserves the OAuth authorization endpoint' do
+        expect(strategy.client.authorize_url).to eq('https://www.mlh.com/oauth/authorize')
+      end
+
+      it 'exchanges a code at the default token endpoint with credentials in the request body' do
+        token_request
+        expect(strategy.client.auth_code.get_token('authorization-code').token).to eq('test-token')
+        expect(token_request).to have_been_requested
+      end
+    end
   end
 
   shared_context 'with oauth response' do |response_data|
@@ -25,6 +50,7 @@ RSpec.describe OmniAuth::Strategies::MLH do
                       body: response_data.to_json,
                       parsed: response_data)
     end
+
     before do
       allow(access_token).to receive(:get)
         .with('https://api.mlh.com/v4/users/me')
@@ -33,6 +59,21 @@ RSpec.describe OmniAuth::Strategies::MLH do
   end
 
   describe '#data' do
+    [nil, false].each do |expand_fields|
+      context "with expand_fields set to #{expand_fields.inspect}" do
+        let(:strategy) do
+          described_class.new(app, 'client_id', 'client_secret', expand_fields: expand_fields)
+        end
+
+        include_context 'with oauth response', { 'id' => 'core-user-1' }
+
+        it 'fetches user data without expansion parameters' do
+          expect(strategy.data).to eq(id: 'core-user-1')
+          expect(access_token).to have_received(:get).with('https://api.mlh.com/v4/users/me')
+        end
+      end
+    end
+
     context 'with expandable fields' do
       let(:response) do
         instance_double(OAuth2::Response, body: {}.to_json, parsed: {})
@@ -81,6 +122,30 @@ RSpec.describe OmniAuth::Strategies::MLH do
       end
     end
 
+    context 'with a custom api_site client option' do
+      let(:custom_strategy) do
+        described_class.new(app, 'client_id', 'client_secret',
+                            client_options: { api_site: 'https://api.mlh.test' })
+      end
+
+      let(:response) do
+        instance_double(OAuth2::Response, body: { 'id' => 'core-user-1' }.to_json)
+      end
+
+      before do
+        allow(custom_strategy).to receive(:access_token).and_return(access_token)
+        allow(access_token).to receive(:get)
+          .with('https://api.mlh.test/v4/users/me')
+          .and_return(response)
+      end
+
+      it 'fetches user data from the configured API base' do
+        custom_strategy.data
+
+        expect(access_token).to have_received(:get).with('https://api.mlh.test/v4/users/me')
+      end
+    end
+
     context 'with v4 API complex data structures' do
       include_context 'with oauth response', {
         'id' => 'test-id',
@@ -149,13 +214,68 @@ RSpec.describe OmniAuth::Strategies::MLH do
       end
     end
 
-    context 'with API error' do
-      it 'returns empty hash on error' do
-        allow(access_token).to receive(:get).and_raise(StandardError)
+    context 'with OAuth2::Error' do
+      let(:error_response) do
+        instance_double(OAuth2::Response,
+                        status: 500,
+                        headers: {},
+                        body: '{"error": "server_error"}')
+      end
+
+      before do
+        allow(access_token).to receive(:get).and_raise(OAuth2::Error.new(error_response))
+      end
+
+      it 'returns empty payload for OAuth2 errors' do
+        expect(strategy.data).to eq({})
+      end
+    end
+
+    context 'with malformed JSON' do
+      before do
+        allow(access_token).to receive(:get)
+          .and_return(instance_double(OAuth2::Response, body: '<html>not json</html>'))
+      end
 
+      it 'returns empty payload for JSON parse failures' do
         expect(strategy.data).to eq({})
       end
     end
+
+    context 'with unexpected error' do
+      let(:unexpected_error_class) { Class.new(StandardError) }
+
+      before do
+        allow(access_token).to receive(:get).and_raise(unexpected_error_class, 'boom')
+      end
+
+      it 'propagates unexpected errors' do
+        expect { strategy.data }.to raise_error(unexpected_error_class)
+      end
+    end
+  end
+
+  describe '#auth_hash' do
+    let(:strategy) do
+      described_class.new(app, 'client_id', 'client_secret', persist_credentials: false)
+    end
+
+    let(:empty_credentials) do
+      {
+        'token' => '',
+        'refresh_token' => nil,
+        'secret' => '',
+        'expires' => false
+      }
+    end
+
+    before do
+      allow(strategy).to receive(:data).and_return(id: 'core-user-1')
+    end
+
+    it 'omits bearer credentials when persistence is disabled' do
+      expect(strategy.auth_hash['credentials']).to eq(empty_credentials)
+    end
   end
 
   describe '#uid' do
@@ -200,4 +320,25 @@ RSpec.describe OmniAuth::Strategies::MLH do
       expect(strategy.info[:roles]).to eq(['hacker'])
     end
   end
+
+  describe 'PKCE authorization' do
+    before { OmniAuth.config.test_mode = true }
+
+    after { OmniAuth.config.test_mode = false }
+
+    it 'uses S256 by default and sends the verifier only in token params' do
+      params = strategy.authorize_params
+
+      expect(params).to include(code_challenge: be_present, code_challenge_method: 'S256')
+      expect(params).not_to have_key(:code_verifier)
+      expect(strategy.token_params[:code_verifier]).to eq(strategy.options.pkce_verifier).and be_present
+    end
+
+    it 'can be disabled via the pkce option' do
+      disabled_strategy = described_class.new(app, 'client_id', 'client_secret', pkce: false)
+
+      expect(disabled_strategy.authorize_params).not_to include(:code_challenge, :code_challenge_method)
+      expect(disabled_strategy.token_params).not_to have_key(:code_verifier)
+    end
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-mlh
 version: !ruby/object:Gem::Version
-  version: 4.1.1
+  version: 4.2.0
 platform: ruby
 authors:
 - Major League Hacking (MLH)
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-20 00:00:00.000000000 Z
+date: 2026-09-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: oauth2