omniauth-oauth2 1.9.0 → 1.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a61f10acb3f0765bd7f4e3eea6b6fa3cf4a0a882c5e2a09e37d17417050e9ff2
-  data.tar.gz: c558846dc4e8313e580b5ac32705da006227287ef5a0e20df63cf30df4bb8150
+  metadata.gz: 56ea3a5f282231d2b4dbfc7393ab753608e47be23a5759dbe2b0bb5865a04b30
+  data.tar.gz: e3ed45d971bafe000603a58ef6221be463d08b6649065c6a6bb1de908d87fb64
 SHA512:
-  metadata.gz: e6fe7535a2b86388f19ff959bed28ec44582e6994bca1442e775c7cdbcb61158a6133a72d2fa86a60252432f05eb12080aa4fb78f01d5de1ae2137f97f07d25a
-  data.tar.gz: e2aadabef58d24f214bd83bcdb15426c1a93ac3e8009823285c304467168cfbe9de3ad3a51c6756bd382dadc129d57ab0fef00d0a218d1c5c1d27b19ce958d8d
+  metadata.gz: 7b326c3f87b4fdee92bcf1bd41c36378f91a3a9a6678461c16f9dcec95f995eaebd40808e1d9262d485ced7cfab49007476becdc3a94e49cb1b1411f884f6723
+  data.tar.gz: b847b133de1f64cf23bae72b92e5453c0fc9846248bdd8eee71b9197632cdbdbaaaab36bc6f7792a257d20132205206619227dfc4accdc0e869bf8a4edb16c07

data/LICENSE.md

@@ -1,4 +1,4 @@
-Copyright (C) 2014 Michael Bleigh, Erik Michaels-Ober and Intridea, Inc.
+Copyright (c) 2011-2026 Michael Bleigh, Erik Berlin and Intridea, Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

data/README.md

@@ -1,13 +1,14 @@
 # OmniAuth OAuth2
 
 [![Gem Version](http://img.shields.io/gem/v/omniauth-oauth2.svg)][gem]
-[![Code Climate](http://img.shields.io/codeclimate/maintainability/intridea/omniauth-oauth2.svg)][codeclimate]
-[![Coverage Status](http://img.shields.io/coveralls/intridea/omniauth-oauth2.svg)][coveralls]
-[![Security](https://hakiri.io/github/omniauth/omniauth-oauth2/master.svg)](https://hakiri.io/github/omniauth/omniauth-oauth2/master)
+[![Ruby](https://github.com/omniauth/omniauth-oauth2/actions/workflows/main.yml/badge.svg)][githubactions]
+[![Maintainability](https://qlty.sh/gh/omniauth/projects/omniauth-oauth2/maintainability.svg)][qlty]
+[![Coverage Status](http://img.shields.io/coveralls/omniauth/omniauth-oauth2.svg)][coveralls]
 
 [gem]: https://rubygems.org/gems/omniauth-oauth2
-[codeclimate]: https://codeclimate.com/github/intridea/omniauth-oauth2
-[coveralls]: https://coveralls.io/r/intridea/omniauth-oauth2
+[githubactions]: https://github.com/omniauth/omniauth-oauth2/actions/workflows/main.yml
+[qlty]: https://qlty.sh/gh/omniauth/projects/omniauth-oauth2
+[coveralls]: https://coveralls.io/r/omniauth/omniauth-oauth2
 
 This gem contains a generic OAuth2 strategy for OmniAuth. It is meant to serve
 as a building block strategy for other strategies and not to be used
@@ -65,12 +66,7 @@ end
 
 That's pretty much it!
 
-## OmniAuth-OAuth2 for Enterprise
-
-Available as part of the Tidelift Subscription.
-
-The maintainers of OmniAuth-OAuth2 and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use. [Learn more.](https://tidelift.com/subscription/pkg/rubygems-omniauth-oauth2?utm_source=undefined&utm_medium=referral&utm_campaign=enterprise)
-
 ## Supported Ruby Versions
 
-OmniAuth is tested under 2.5, 2.6, 2.7, 3.0, 3.1, 3.2, truffleruby, and JRuby.
+OmniAuth OAuth2 is tested on Ruby 2.5 through 4.0, JRuby, and TruffleRuby,
+on Linux and macOS.

data/SECURITY.md

@@ -2,16 +2,10 @@
 
 ## Supported Versions
 
-Use this section to tell people about which versions of your project are
-currently being supported with security updates.
-
-| Version  | Supported          |
-| -------  | ------------------ |
-| 1.7.x    | :white_check_mark: |
-| <= 1.6.x | :x:                |
+Only the most recent release of omniauth-oauth2 receives security updates.
 
 ## Security contact information
 
-To report a security vulnerability, please use the
-[Tidelift security contact](https://tidelift.com/security).
-Tidelift will coordinate the fix and disclosure.
+To report a security vulnerability, please use GitHub's
+[private vulnerability reporting](https://github.com/omniauth/omniauth-oauth2/security/advisories/new)
+rather than opening a public issue.

data/lib/omniauth/strategies/oauth2.rb

@@ -15,9 +15,14 @@ module OmniAuth
       include OmniAuth::Strategy
 
       def self.inherited(subclass)
-        OmniAuth::Strategy.included(subclass)
+        Strategy.included(subclass)
       end
 
+      # How many sign-ins can be in progress at once, for example in several
+      # tabs. Starting another drops the oldest. Each one adds about 300
+      # bytes to the session, which may be a 4 KB cookie.
+      MAX_STORED_SIGN_INS = 5
+
       args %i[client_id client_secret]
 
       option :client_id, nil
@@ -30,7 +35,6 @@ module OmniAuth
       option :auth_token_params, {}
       option :provider_ignores_state, false
       option :pkce, false
-      option :pkce_verifier, nil
       option :pkce_options, {
         :code_challenge => proc { |verifier|
           Base64.urlsafe_encode64(
@@ -48,48 +52,67 @@ module OmniAuth
       end
 
       credentials do
-        hash = {"token" => access_token.token}
-        hash["refresh_token"] = access_token.refresh_token if access_token.expires? && access_token.refresh_token
+        hash = {"token" => access_token.token} #: Hash[String, String | Integer | bool | nil]
+        hash["refresh_token"] = access_token.refresh_token if access_token.refresh_token
         hash["expires_at"] = access_token.expires_at if access_token.expires?
         hash["expires"] = access_token.expires?
         hash
       end
 
       def request_phase
+        # The provider can't do anything with an authorize request that has no
+        # client ID, so fail here, where the cause is clear.
+        return fail!(:missing_client_id, Error.new("client_id is missing")) if client.id.to_s.empty?
+
         redirect client.auth_code.authorize_url({:redirect_uri => callback_url}.merge(authorize_params))
       end
 
-      def authorize_params # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+      def authorize_params
         options.authorize_params[:state] = SecureRandom.hex(24)
 
         if OmniAuth.config.test_mode
-          @env ||= {}
-          @env["rack.session"] ||= {}
+          test_env = (@env ||= {}) #: Rack::env
+          test_env["rack.session"] ||= {}
         end
 
         params = options.authorize_params
                         .merge(options_for("authorize"))
                         .merge(pkce_authorize_params)
 
-        session["omniauth.pkce.verifier"] = options.pkce_verifier if options.pkce
-        session["omniauth.state"] = params[:state]
+        state = params.fetch(:state)
+        # Reused in the token request, which must send the same redirect_uri.
+        # oauth2 gives a client_options redirect_uri precedence in the
+        # authorize URL, so it does here too.
+        redirect_uri = client.options[:redirect_uri] || params[:redirect_uri] || callback_url
+        session["omniauth.state"] = state
+        session["omniauth.redirect_uri"] = redirect_uri
+        store_sign_in(state.to_s, redirect_uri)
+        # Lets OmniAuth give the callback this sign-in's origin and params.
+        remember_sign_in(state.to_s)
 
         params
       end
 
+      # The state the provider sends back, which OmniAuth uses to find the
+      # origin and params that remember_sign_in stored.
+      def callback_sign_in_key
+        request.params["state"]
+      end
+
       def token_params
         options.token_params.merge(options_for("token")).merge(pkce_token_params)
       end
 
-      def callback_phase # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+      def callback_phase
+        # Take what the request phase stored, even if the callback fails.
+        stored_sign_in
         error = request.params["error_reason"] || request.params["error"]
-        if !options.provider_ignores_state && (request.params["state"].to_s.empty? || !secure_compare(request.params["state"], session.delete("omniauth.state")))
+        if csrf_detected?
           fail!(:csrf_detected, CallbackError.new(:csrf_detected, "CSRF detected"))
         elsif error
           fail!(error, CallbackError.new(request.params["error"], request.params["error_description"] || request.params["error_reason"], request.params["error_uri"]))
         else
-          self.access_token = build_access_token
-          self.access_token = access_token.refresh! if access_token.expired?
+          self.access_token = fetch_access_token
           super
         end
       rescue ::OAuth2::Error, CallbackError => e
@@ -102,57 +125,111 @@ module OmniAuth
 
     protected
 
+      # Whether the callback's state is missing or doesn't match the one the
+      # request phase stored, unless the provider ignores state.
+      def csrf_detected?
+        return false if options.provider_ignores_state
+
+        state = request.params["state"].to_s
+        state.empty? || !secure_compare(state, stored_sign_in.fetch("state").to_s)
+      end
+
+      # Stores the state, redirect URI, and PKCE verifier of a sign-in by its
+      # state, so several can be in progress at once.
+      def store_sign_in(state, redirect_uri)
+        return if state.empty?
+
+        sign_in = {"redirect_uri" => redirect_uri}
+        sign_in["pkce_verifier"] = session.fetch("omniauth.pkce.verifier") if options.pkce
+        sign_ins = stored_sign_ins
+        sign_ins.delete(state)
+        sign_ins[state] = sign_in
+        session["omniauth.oauth2"] = sign_ins.to_a.last(MAX_STORED_SIGN_INS).to_h
+      end
+
+      # What the request phase stored for this callback's state, removed from
+      # the session. Without a stored sign-in for the state, it comes from the
+      # omniauth.state and omniauth.redirect_uri keys, which hold the latest
+      # sign-in and which provider gems and tests set directly.
+      def stored_sign_in
+        @stored_sign_in ||= begin
+          fallback = {"state" => session.delete("omniauth.state"), "redirect_uri" => session.delete("omniauth.redirect_uri")}
+          state = request.params["state"]
+          sign_ins = stored_sign_ins
+          key = sign_ins.keys.detect { |stored| secure_compare(stored, state) } if state.instance_of?(String)
+          sign_in = sign_ins.delete(key)
+          if sign_in
+            session["omniauth.oauth2"] = sign_ins
+            sign_in.merge("state" => key)
+          else
+            fallback
+          end
+        end
+      end
+
+      # A copy of the stored sign-ins, which are changed by assigning the
+      # session key, not in place.
+      def stored_sign_ins
+        sign_ins = session["omniauth.oauth2"]
+        sign_ins.is_a?(Hash) ? sign_ins.dup : {}
+      end
+
       def pkce_authorize_params
         return {} unless options.pkce
 
-        options.pkce_verifier = SecureRandom.hex(64)
+        # A fresh verifier for every authorization request, as RFC 7636
+        # requires: https://tools.ietf.org/html/rfc7636#section-4.1
+        verifier = SecureRandom.hex(64)
+        session["omniauth.pkce.verifier"] = verifier
 
         # NOTE: see https://tools.ietf.org/html/rfc7636#appendix-A
         {
-          :code_challenge => options.pkce_options[:code_challenge]
-                                    .call(options.pkce_verifier),
-          :code_challenge_method => options.pkce_options[:code_challenge_method],
+          :code_challenge => options.pkce_options.fetch(:code_challenge).call(verifier),
+          :code_challenge_method => options.pkce_options.fetch(:code_challenge_method),
         }
       end
 
       def pkce_token_params
         return {} unless options.pkce
 
-        {:code_verifier => session.delete("omniauth.pkce.verifier")}
+        verifier = session.delete("omniauth.pkce.verifier")
+        {:code_verifier => stored_sign_in.fetch("pkce_verifier", verifier)}
+      end
+
+      # The access token from the callback's code, refreshed if it's already
+      # expired.
+      def fetch_access_token
+        token = build_access_token || raise(CallbackError.new(:invalid_credentials, "No access token"))
+        token.expired? ? token.refresh! : token
       end
 
       def build_access_token
         verifier = request.params["code"]
-        client.auth_code.get_token(verifier, {:redirect_uri => callback_url}.merge(token_params.to_hash(:symbolize_keys => true)), deep_symbolize(options.auth_token_params))
+        redirect_uri = stored_sign_in.fetch("redirect_uri") || callback_url
+        client.auth_code.get_token(verifier, {:redirect_uri => redirect_uri}.merge(token_params.to_hash(:symbolize_keys => true)), deep_symbolize(options.auth_token_params))
       end
 
       def deep_symbolize(options)
-        options.each_with_object({}) do |(key, value), hash|
-          hash[key.to_sym] = value.is_a?(Hash) ? deep_symbolize(value) : value
-        end
+        hash = {} #: Hash[Symbol, untyped]
+        options.each { |key, value| hash[key.to_sym] = value.is_a?(Hash) ? deep_symbolize(value) : value }
+        hash
       end
 
       def options_for(option)
-        hash = {}
-        options.send(:"#{option}_options").select { |key| options[key] }.each do |key|
-          hash[key.to_sym] = if options[key].respond_to?(:call)
-                               options[key].call(env)
+        hash = {} #: Hash[Symbol, untyped]
+        options.public_send(:"#{option}_options").select { |key| options[key] }.each do |key|
+          hash[key.to_sym] = if options.fetch(key).respond_to?(:call)
+                               options.fetch(key).call(env)
                              else
-                               options[key]
+                               options.fetch(key)
                              end
         end
         hash
       end
 
-       # constant-time comparison algorithm to prevent timing attacks
-       def secure_compare(string_a, string_b)
-        return false unless string_a.bytesize == string_b.bytesize
-
-        l = string_a.unpack "C#{string_a.bytesize}"
-
-        res = 0
-        string_b.each_byte { |byte| res |= byte ^ l.shift }
-        res.zero?
+      # constant-time comparison algorithm to prevent timing attacks
+      def secure_compare(string_a, string_b)
+        Rack::Utils.secure_compare(string_a, string_b)
       end
 
       # An error that is indicated in the OAuth 2.0 callback.

data/lib/omniauth-oauth2/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module OAuth2
-    VERSION = "1.9.0".freeze
+    VERSION = "1.10.0".freeze
   end
 end

data/sig/omniauth-oauth2.rbs

@@ -0,0 +1,127 @@
+module OmniAuth
+  module OAuth2
+    VERSION: String
+  end
+
+  module Strategies
+    # An abstract OAuth 2.0 strategy. Provider strategies subclass it and
+    # set client_options (site, authorize_url, and token_url) for their
+    # provider.
+    class OAuth2
+      include Strategy
+      extend Strategy::ClassMethods
+
+      # The options this strategy adds to OmniAuth's. Strategy::Options
+      # answers them through Hashie::Mash's method_missing.
+      interface _Options
+        def client_id: () -> String?
+        def client_secret: () -> String?
+        def client_options: () -> Strategy::Options
+        def authorize_params: () -> Strategy::Options
+        # The options copied into the authorize params, when set
+        def authorize_options: () -> Array[Symbol | String]
+        def token_params: () -> Strategy::Options
+        # The options copied into the token params, when set
+        def token_options: () -> Array[Symbol | String]
+        def auth_token_params: () -> Strategy::Options
+        def provider_ignores_state: () -> bool
+        def pkce: () -> bool
+        # :code_challenge, a callable that takes the verifier, and
+        # :code_challenge_method
+        def pkce_options: () -> Strategy::Options
+      end
+
+      # Gives each subclass the class-level strategy DSL.
+      def self.inherited: (singleton(OAuth2) subclass) -> void
+
+      # The fetcher blocks run with the strategy instance as self.
+      def self.uid: () { () [self: instance] -> untyped } -> Proc
+                  | () -> Proc?
+
+      def self.info: () { () [self: instance] -> Hash[untyped, untyped]? } -> Proc
+                   | () -> Proc?
+
+      def self.extra: () { () [self: instance] -> Hash[untyped, untyped]? } -> Proc
+                    | () -> Proc?
+
+      def self.credentials: () { () [self: instance] -> Hash[untyped, untyped]? } -> Proc
+                          | () -> Proc?
+
+      def options: () -> (Strategy::Options & _Options)
+
+      # Set by the callback phase, which runs before the fetcher blocks that
+      # read it.
+      attr_accessor access_token: ::OAuth2::AccessToken
+
+      # How many sign-ins can be in progress at once. Starting another drops
+      # the oldest.
+      MAX_STORED_SIGN_INS: Integer
+
+      # What the request phase stored for a sign-in: "state",
+      # "redirect_uri", and, with PKCE, "pkce_verifier"
+      type sign_in = Hash[String, String?]
+
+      # The sign-in the callback phase took from the session.
+      @stored_sign_in: sign_in?
+
+      def client: () -> ::OAuth2::Client
+
+      def request_phase: () -> rack_response
+
+      def authorize_params: () -> Strategy::Options
+
+      # The state the provider sends back to the callback.
+      def callback_sign_in_key: () -> String?
+
+      def token_params: () -> Strategy::Options
+
+      def callback_phase: () -> rack_response
+
+      # These are protected in Ruby, which RBS has no way to say.
+      private
+
+      # Whether the callback's state is missing or doesn't match the one the
+      # request phase stored, unless the provider ignores state.
+      def csrf_detected?: () -> bool
+
+      # Stores the redirect URI and PKCE verifier of a sign-in by its state.
+      def store_sign_in: (String state, String redirect_uri) -> void
+
+      # What the request phase stored for the callback's state, removed from
+      # the session, or else the latest sign-in's state and redirect URI.
+      def stored_sign_in: () -> sign_in
+
+      # The sign-ins in progress, by state, oldest first.
+      def stored_sign_ins: () -> Hash[String, sign_in]
+
+      def pkce_authorize_params: () -> Hash[Symbol, untyped]
+
+      def pkce_token_params: () -> Hash[Symbol, String?]
+
+      def fetch_access_token: () -> ::OAuth2::AccessToken
+
+      # Nil when oauth2's raise_errors is off and the token response has no
+      # token.
+      def build_access_token: () -> ::OAuth2::AccessToken?
+
+      def deep_symbolize: (Hash[untyped, untyped] options) -> Hash[Symbol, untyped]
+
+      def options_for: (String option) -> Hash[Symbol, untyped]
+
+      # Compares two strings in constant time, to prevent timing attacks.
+      def secure_compare: (String string_a, String string_b) -> bool
+
+      # An error that is indicated in the OAuth 2.0 callback, such as a
+      # redirect_uri_mismatch.
+      class CallbackError < StandardError
+        attr_accessor error: String | Symbol
+        attr_accessor error_reason: String?
+        attr_accessor error_uri: String?
+
+        def initialize: (String | Symbol error, ?String? error_reason, ?String? error_uri) -> void
+
+        def message: () -> String
+      end
+    end
+  end
+end

metadata

@@ -1,16 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-oauth2
 version: !ruby/object:Gem::Version
-  version: 1.9.0
+  version: 1.10.0
 platform: ruby
 authors:
+- Erik Berlin
 - Michael Bleigh
-- Erik Michaels-Ober
 - Tom Milewski
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-12-11 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: oauth2
@@ -38,59 +37,42 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.3'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.3.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
-- !ruby/object:Gem::Dependency
-  name: bundler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
+        version: '2.3'
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: 2.3.1
 description: An abstract OAuth2 strategy for OmniAuth.
 email:
-- michael@intridea.com
 - sferik@gmail.com
+- michael@intridea.com
 - tmilewski@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".github/FUNDING.yml"
-- ".github/workflows/main.yml"
-- ".gitignore"
-- ".rspec"
-- ".rubocop.yml"
-- CHANGELOG.md
-- Gemfile
 - LICENSE.md
 - README.md
-- Rakefile
 - SECURITY.md
 - lib/omniauth-oauth2.rb
 - lib/omniauth-oauth2/version.rb
 - lib/omniauth/strategies/oauth2.rb
-- omniauth-oauth2.gemspec
-- spec/helper.rb
-- spec/omniauth/strategies/oauth2_spec.rb
+- sig/omniauth-oauth2.rbs
 homepage: https://github.com/omniauth/omniauth-oauth2
 licenses:
 - MIT
-metadata: {}
-post_install_message:
+metadata:
+  changelog_uri: https://github.com/omniauth/omniauth-oauth2/blob/master/CHANGELOG.md
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -98,17 +80,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '2.5'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.11
-signing_key:
+rubygems_version: 4.0.20
 specification_version: 4
 summary: An abstract OAuth2 strategy for OmniAuth.
-test_files:
-- spec/helper.rb
-- spec/omniauth/strategies/oauth2_spec.rb
+test_files: []

data/.github/FUNDING.yml

@@ -1,2 +0,0 @@
-github: bobbymcwho
-tidelift: rubygems/omniauth-oauth2

data/.github/workflows/main.yml

@@ -1,47 +0,0 @@
-name: Ruby
-
-on:
-  push:
-    branches: [ master ]
-  pull_request:
-    branches: [ master ]
-
-jobs:
-  test:
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest]
-        ruby: [2.5, 2.6, 2.7, '3.0', 3.1, 3.2, head, debug, truffleruby, truffleruby-head, jruby, jruby-head]
-    steps:
-    - uses: actions/checkout@v3
-    - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
-      with:
-        ruby-version: ${{ matrix.ruby }}
-        bundler-cache: true
-    - name: Set JRUBY_OPTS environment variable
-      run: echo "JRUBY_OPTS=--debug" >> "$GITHUB_ENV"
-      if: ${{ startsWith(matrix.ruby, 'jruby') }}
-    - name: Run tests
-      run: bundle exec rake
-    - uses: actions/upload-artifact@v3
-      if: ${{ matrix.os == 'ubuntu-latest' && matrix.ruby == '3.0' }}
-      with:
-        name: coverage
-        path: coverage/
-        retention-days: 1
-
-  coveralls:
-    needs: test
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-    - uses: actions/download-artifact@v3
-      with:
-        name: coverage
-        path: coverage/
-    - name: Coveralls GitHub Action
-      uses: coverallsapp/github-action@v2

data/.gitignore

@@ -1,18 +0,0 @@
-*.gem
-*.rbc
-.bundle
-.config
-.yardoc
-Gemfile.lock
-InstalledFiles
-_yardoc
-coverage
-doc/
-lib/bundler/man
-pkg
-rdoc
-spec/reports
-test/tmp
-test/version_tmp
-tmp
-*.swp

data/.rspec

@@ -1,2 +0,0 @@
---colour
---format=progress

data/.rubocop.yml

@@ -1,80 +0,0 @@
-AllCops:
-  NewCops: enable
-
-Gemspec/RequiredRubyVersion:
-  Enabled: false
-
-Layout/AccessModifierIndentation:
-  EnforcedStyle: outdent
-
-Layout/LineLength:
-  AllowURI: true
-  Enabled: false
-
-Layout/SpaceInsideHashLiteralBraces:
-  EnforcedStyle: no_space
-
-Lint/MissingSuper:
-  Enabled: false
-
-Metrics/AbcSize:
-  Max: 18
-
-Metrics/BlockLength:
-  Exclude:
-    - spec/omniauth/strategies/oauth2_spec.rb
-
-Metrics/BlockNesting:
-  Max: 2
-
-Metrics/ClassLength:
-  Max: 110
-
-Metrics/MethodLength:
-  CountComments: false
-  Max: 10
-
-Metrics/ParameterLists:
-  Max: 4
-  CountKeywordArgs: true
-
-Naming/FileName:
-  Exclude:
-    - lib/omniauth-oauth2.rb
-
-Style/CollectionMethods:
-  PreferredMethods:
-    map:      'collect'
-    reduce:   'inject'
-    find:     'detect'
-    find_all: 'select'
-
-Style/Documentation:
-  Enabled: false
-
-Style/DoubleNegation:
-  Enabled: false
-
-Style/ExpandPathArguments:
-  Enabled: false
-
-Style/FrozenStringLiteralComment:
-  Enabled: false
-
-Style/HashSyntax:
-  EnforcedStyle: hash_rockets
-
-Style/StderrPuts:
-  Enabled: false
-
-Style/StringLiterals:
-  EnforcedStyle: double_quotes
-
-Style/TrailingCommaInArguments:
-  EnforcedStyleForMultiline: comma
-
-Style/TrailingCommaInHashLiteral:
-  EnforcedStyleForMultiline: comma
-
-Style/TrailingCommaInArrayLiteral:
-  EnforcedStyleForMultiline: comma

data/CHANGELOG.md

@@ -1,9 +0,0 @@
-## [v1.9.0](https://github.com/omniauth/omniauth-oauth2/releases/tag/v1.9.0)
-- Prevent timing attacks [#174](https://github.com/omniauth/omniauth-oauth2/pull/174)
-- Rescue OAuth2 timeouts [#169](https://github.com/omniauth/omniauth-oauth2/pull/169)
-
-## [v1.8.0](https://github.com/omniauth/omniauth-oauth2/releases/tag/v1.8.0)
-- Relaxes allowed versions of the oauth2 gem. [#146](https://github.com/omniauth/omniauth-oauth2/pull/146)
-- Requires omniauth `~> 2.0` [#152](https://github.com/omniauth/omniauth-oauth2/pull/152) 
-
-Please see https://github.com/omniauth/omniauth-oauth2/releases for changelog prior to 1.8.0

data/Gemfile

@@ -1,20 +0,0 @@
-source "https://rubygems.org"
-
-gem "rake", "~> 13.0"
-
-group :test do
-  gem "addressable", "~> 2.3.8", :platforms => %i[jruby ruby_18]
-  gem 'coveralls_reborn', '~> 0.19.0', require: false
-  gem "json", :platforms => %i[jruby ruby_18 ruby_19]
-  gem "mime-types", "~> 1.25", :platforms => %i[jruby ruby_18]
-  gem "rack-test"
-  gem "rest-client", "~> 1.8.0", :platforms => %i[jruby ruby_18]
-  gem "rspec", "~> 3.2"
-  gem "rubocop", ">= 0.51", :platforms => %i[ruby_19 ruby_20 ruby_21 ruby_22 ruby_23 ruby_24]
-  gem 'simplecov-lcov'
-  gem 'tins', '~> 1.13', :platforms => %i[jruby_18 jruby_19 ruby_19]
-  gem "webmock", "~> 3.0"
-end
-
-# Specify your gem's dependencies in omniauth-oauth2.gemspec
-gemspec

data/Rakefile

@@ -1,19 +0,0 @@
-#!/usr/bin/env rake
-
-require "bundler/gem_tasks"
-require "rspec/core/rake_task"
-
-RSpec::Core::RakeTask.new
-
-task :test => :spec
-
-begin
-  require "rubocop/rake_task"
-  RuboCop::RakeTask.new
-rescue LoadError
-  task :rubocop do
-    $stderr.puts "RuboCop is disabled"
-  end
-end
-
-task :default => %i[spec rubocop]

data/omniauth-oauth2.gemspec

@@ -1,24 +0,0 @@
-lib = File.expand_path("../lib", __FILE__)
-$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
-require "omniauth-oauth2/version"
-
-Gem::Specification.new do |gem|
-  gem.add_dependency "oauth2",  [">= 2.0.2", "< 3"]
-  gem.add_dependency "omniauth", "~> 2.0"
-
-  gem.add_development_dependency "bundler", "~> 2.0"
-
-  gem.authors       = ["Michael Bleigh", "Erik Michaels-Ober", "Tom Milewski"]
-  gem.email         = ["michael@intridea.com", "sferik@gmail.com", "tmilewski@gmail.com"]
-  gem.description   = "An abstract OAuth2 strategy for OmniAuth."
-  gem.summary       = gem.description
-  gem.homepage      = "https://github.com/omniauth/omniauth-oauth2"
-  gem.licenses      = %w[MIT]
-
-  gem.executables   = `git ls-files -- bin/*`.split("\n").collect { |f| File.basename(f) }
-  gem.files         = `git ls-files`.split("\n")
-  gem.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
-  gem.name          = "omniauth-oauth2"
-  gem.require_paths = %w[lib]
-  gem.version       = OmniAuth::OAuth2::VERSION
-end

data/spec/helper.rb

@@ -1,35 +0,0 @@
-$LOAD_PATH.unshift File.expand_path("..", __FILE__)
-$LOAD_PATH.unshift File.expand_path("../../lib", __FILE__)
-
-if RUBY_VERSION >= "1.9"
-  require "simplecov"
-  require "simplecov-lcov"
-  require "coveralls"
-
-  SimpleCov::Formatter::LcovFormatter.config.report_with_single_file = true
-
-  SimpleCov.formatters = [
-    SimpleCov::Formatter::HTMLFormatter,
-    SimpleCov::Formatter::LcovFormatter,
-    Coveralls::SimpleCov::Formatter
-  ]
-
-  SimpleCov.start do
-    minimum_coverage(78.48)
-  end
-end
-
-require "rspec"
-require "rack/test"
-require "webmock/rspec"
-require "omniauth"
-require "omniauth-oauth2"
-
-RSpec.configure do |config|
-  config.expect_with :rspec do |c|
-    c.syntax = :expect
-  end
-  config.extend OmniAuth::Test::StrategyMacros, :type => :strategy
-  config.include Rack::Test::Methods
-  config.include WebMock::API
-end

data/spec/omniauth/strategies/oauth2_spec.rb

@@ -1,198 +0,0 @@
-require "helper"
-
-describe OmniAuth::Strategies::OAuth2 do
-  def app
-    lambda do |_env|
-      [200, {}, ["Hello."]]
-    end
-  end
-  let(:fresh_strategy) { Class.new(OmniAuth::Strategies::OAuth2) }
-
-  before do
-    OmniAuth.config.test_mode = true
-  end
-
-  after do
-    OmniAuth.config.test_mode = false
-  end
-
-  describe "Subclassing Behavior" do
-    subject { fresh_strategy }
-
-    it "performs the OmniAuth::Strategy included hook" do
-      expect(OmniAuth.strategies).to include(OmniAuth::Strategies::OAuth2)
-      expect(OmniAuth.strategies).to include(subject)
-    end
-  end
-
-  describe "#client" do
-    subject { fresh_strategy }
-
-    it "is initialized with symbolized client_options" do
-      instance = subject.new(app, :client_options => {"authorize_url" => "https://example.com"})
-      expect(instance.client.options[:authorize_url]).to eq("https://example.com")
-    end
-
-    it "sets ssl options as connection options" do
-      instance = subject.new(app, :client_options => {"ssl" => {"ca_path" => "foo"}})
-      expect(instance.client.options[:connection_opts][:ssl]).to eq(:ca_path => "foo")
-    end
-  end
-
-  describe "#authorize_params" do
-    subject { fresh_strategy }
-
-    it "includes any authorize params passed in the :authorize_params option" do
-      instance = subject.new("abc", "def", :authorize_params => {:foo => "bar", :baz => "zip"})
-      expect(instance.authorize_params["foo"]).to eq("bar")
-      expect(instance.authorize_params["baz"]).to eq("zip")
-    end
-
-    it "includes top-level options that are marked as :authorize_options" do
-      instance = subject.new("abc", "def", :authorize_options => %i[scope foo state], :scope => "bar", :foo => "baz")
-      expect(instance.authorize_params["scope"]).to eq("bar")
-      expect(instance.authorize_params["foo"]).to eq("baz")
-      expect(instance.authorize_params["state"]).not_to be_empty
-    end
-
-    it "includes random state in the authorize params" do
-      instance = subject.new("abc", "def")
-      expect(instance.authorize_params.keys).to eq(["state"])
-      expect(instance.session["omniauth.state"]).not_to be_empty
-    end
-
-    it "includes custom state in the authorize params" do
-      instance = subject.new("abc", "def", :state => proc { "qux" })
-      expect(instance.authorize_params.keys).to eq(["state"])
-      expect(instance.session["omniauth.state"]).to eq("qux")
-    end
-
-    it "includes PKCE parameters if enabled" do
-      instance = subject.new("abc", "def", :pkce => true)
-      expect(instance.authorize_params[:code_challenge]).to be_a(String)
-      expect(instance.authorize_params[:code_challenge_method]).to eq("S256")
-      expect(instance.session["omniauth.pkce.verifier"]).to be_a(String)
-    end
-  end
-
-  describe "#token_params" do
-    subject { fresh_strategy }
-
-    it "includes any authorize params passed in the :authorize_params option" do
-      instance = subject.new("abc", "def", :token_params => {:foo => "bar", :baz => "zip"})
-      expect(instance.token_params).to eq("foo" => "bar", "baz" => "zip")
-    end
-
-    it "includes top-level options that are marked as :authorize_options" do
-      instance = subject.new("abc", "def", :token_options => %i[scope foo], :scope => "bar", :foo => "baz")
-      expect(instance.token_params).to eq("scope" => "bar", "foo" => "baz")
-    end
-
-    it "includes the PKCE code_verifier if enabled" do
-      instance = subject.new("abc", "def", :pkce => true)
-      # setup session
-      instance.authorize_params
-      expect(instance.token_params[:code_verifier]).to be_a(String)
-    end
-  end
-
-  describe "#callback_phase" do
-    subject(:instance) { fresh_strategy.new("abc", "def") }
-
-    let(:params) { {"error_reason" => "user_denied", "error" => "access_denied", "state" => state} }
-    let(:state) { "secret" }
-
-    before do
-      allow(instance).to receive(:request) do
-        double("Request", :params => params)
-      end
-
-      allow(instance).to receive(:session) do
-        double("Session", :delete => state)
-      end
-    end
-
-    it "calls fail with the error received" do
-      expect(instance).to receive(:fail!).with("user_denied", anything)
-
-      instance.callback_phase
-    end
-
-    it "calls fail with the error received if state is missing and CSRF verification is disabled" do
-      params["state"] = nil
-      instance.options.provider_ignores_state = true
-
-      expect(instance).to receive(:fail!).with("user_denied", anything)
-
-      instance.callback_phase
-    end
-
-    it "calls fail with a CSRF error if the state is missing" do
-      params["state"] = nil
-
-      expect(instance).to receive(:fail!).with(:csrf_detected, anything)
-      instance.callback_phase
-    end
-
-    it "calls fail with a CSRF error if the state is invalid" do
-      params["state"] = "invalid"
-
-      expect(instance).to receive(:fail!).with(:csrf_detected, anything)
-      instance.callback_phase
-    end
-
-    describe 'exception handlings' do
-      let(:params) do
-        {"code" => "code", "state" => state}
-      end
-
-      before do
-        allow_any_instance_of(OmniAuth::Strategies::OAuth2).to receive(:build_access_token).and_raise(exception)
-      end
-
-      {
-        :invalid_credentials => [OAuth2::Error, OmniAuth::Strategies::OAuth2::CallbackError],
-        :timeout => [Timeout::Error, Errno::ETIMEDOUT, OAuth2::TimeoutError, OAuth2::ConnectionError],
-        :failed_to_connect => [SocketError]
-      }.each do |error_type, exceptions|
-        exceptions.each do |klass|
-          context "when #{klass}" do
-            let(:exception) { klass.new 'error' }
-
-            it do
-              expect(instance).to receive(:fail!).with(error_type, exception)
-              instance.callback_phase
-            end
-          end
-        end
-      end
-    end
-  end
-
-  describe "#secure_compare" do
-    subject { fresh_strategy }
-
-    it "returns true when the two inputs are the same and false otherwise" do
-      instance = subject.new("abc", "def")
-      expect(instance.send(:secure_compare, "a", "a")).to be true
-      expect(instance.send(:secure_compare, "b", "a")).to be false
-    end
-  end
-end
-
-describe OmniAuth::Strategies::OAuth2::CallbackError do
-  let(:error) { Class.new(OmniAuth::Strategies::OAuth2::CallbackError) }
-  describe "#message" do
-    subject { error }
-    it "includes all of the attributes" do
-      instance = subject.new("error", "description", "uri")
-      expect(instance.message).to match(/error/)
-      expect(instance.message).to match(/description/)
-      expect(instance.message).to match(/uri/)
-    end
-    it "includes all of the attributes" do
-      instance = subject.new(nil, :symbol)
-      expect(instance.message).to eq("symbol")
-    end
-  end
-end