omniauth-openai 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: c4510db682d5cc881cd21ff66a13b91f19c59e70f2c34e23c38e24b9b7d954d4
+  data.tar.gz: 8e4c7ae32887385fc221e700af78787e87b017369eb5de1acb1f0e5efa5c2806
+SHA512:
+  metadata.gz: 73c540a83c85e9fa03f71d1be70d1ea2c811273cc1d9c8e744b66b60a3d81e9b3de17649509a998042e5de63dae8656c3828d2a68143695d635e4a6dc0ca9cbc
+  data.tar.gz: 73a11709ac1f2366346b311a2ce2c8c6e26a9cbfd6eb5d2e837bc7cbb871522c0d59d3b3ac7346ab84319e3e1a3a23a4a0e33534d85a605b38bf0e9a4baf6540

data/CHANGELOG.md

@@ -0,0 +1,6 @@
+# Changelog
+
+## 0.1.0 - 2026-10-01
+
+First release: Sign in with ChatGPT for OmniAuth and Devise, with PKCE, a
+nonce, and full ID token verification against OpenAI's published keys.

data/LICENSE

@@ -0,0 +1,18 @@
+MIT License
+
+Copyright (c) 2026 ajaynomics
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and 
+associated documentation files (the "Software"), to deal in the Software without restriction, including 
+without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 
+copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the 
+following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial 
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT 
+LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO 
+EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER 
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE 
+USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,110 @@
+# omniauth-openai
+
+An [OmniAuth](https://github.com/omniauth/omniauth) strategy for
+[Sign in with ChatGPT](https://developers.openai.com/siwc/website), OpenAI's
+OpenID Connect sign-in.
+
+It runs the authorization code flow with PKCE and a nonce, then verifies the
+ID token's signature, issuer, audience, expiry, and nonce against OpenAI's
+published keys before your application sees an identity. It makes no userinfo
+call and hands your application no OpenAI tokens: sign-in proves who someone
+is, nothing more.
+
+Unofficial. Not affiliated with or endorsed by OpenAI.
+
+## Before you start
+
+Sign in with ChatGPT is in limited access. Request it through
+[OpenAI's interest form](https://openai.com/form/sign-in-with-chatgpt-interest/).
+OpenAI then issues a client ID (`oaiapp_…`), and a client secret if you ask for
+a confidential client, and registers your exact callback URL, for example
+`https://example.com/users/auth/openai/callback`.
+
+## Install
+
+```ruby
+gem "omniauth-openai"
+gem "omniauth-rails_csrf_protection" # Rails: sign-in must start with a POST
+```
+
+## Use
+
+### Devise
+
+```ruby
+# config/initializers/devise.rb
+config.omniauth :openai, ENV["OPENAI_CLIENT_ID"], ENV["OPENAI_CLIENT_SECRET"]
+```
+
+```ruby
+# app/models/user.rb
+devise :omniauthable, omniauth_providers: %i[openai]
+```
+
+```erb
+<%= button_to "Continue with ChatGPT", user_openai_omniauth_authorize_path, data: { turbo: false } %>
+```
+
+### Plain Rack or Rails without Devise
+
+```ruby
+use OmniAuth::Builder do
+  provider :openai, ENV["OPENAI_CLIENT_ID"], ENV["OPENAI_CLIENT_SECRET"]
+end
+```
+
+A public client has no secret: pass `nil` and the strategy sends only its
+client ID.
+
+### The auth hash
+
+```ruby
+{
+  "provider" => "openai",
+  "uid" => "user-…",            # the ID token's sub: key accounts on this
+  "info" => {
+    "email" => "person@example.com", # present only when email_verified is true
+    "name" => "Chat Person",
+    "image" => "https://…"
+  },
+  "credentials" => {},
+  "extra" => { "raw_info" => { … all verified ID token claims … } }
+}
+```
+
+Key accounts on `provider` and `uid`, not email: one email can belong to more
+than one OpenAI account. If you link to an existing account by email, link only
+to one whose email your application has itself confirmed, or an attacker who
+registers the address first gains the real owner's sign-in.
+
+## Options
+
+| Option | Default | Meaning |
+| --- | --- | --- |
+| `scope` | `"openid profile email"` | Requested scopes. |
+| `client_auth_method` | `:basic` with a secret, `:none` without | `:basic` (client_secret_basic), `:post` (client_secret_post), or `:none`. |
+| `redirect_uri` | the callback URL | Set it when a proxy changes the host the app sees. Must match the registered URL exactly. |
+| `leeway` | `5` | Seconds of clock skew allowed on `exp` and `iat`. |
+| `issuer`, `jwks_uri`, `client_options` | OpenAI's | Endpoints from `https://auth.openai.com/.well-known/openid-configuration`. |
+
+Signing keys are cached per process for an hour. A token signed with a key the
+cache lacks triggers one fresh download, at most once every five minutes.
+
+## Failures
+
+Every verification failure ends in OmniAuth's failure path with
+`:invalid_credentials`, so a bad token never reaches your callback. A forged or
+missing `state` fails as `:csrf_detected`; a person who declines consent fails
+as `:access_denied`.
+
+## Development
+
+```sh
+bundle install
+bundle exec rake test
+JWT_VERSION="~> 2.10" bundle update jwt && bundle exec rake test
+```
+
+## License
+
+MIT

data/lib/omniauth/openai/key_set.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module OmniAuth
+  module OpenAI
+    # The issuer's signing keys, shared by every request in the process.
+    #
+    # Keys are kept for +ttl+ seconds. When a token names a key the set lacks,
+    # ruby-jwt asks again with +kid_not_found+, and the set downloads afresh so
+    # a rotated key is picked up at once. Those forced downloads happen at most
+    # once per +refresh_interval+, so a stream of bad tokens cannot turn into a
+    # stream of requests to the issuer.
+    class KeySet
+      def initialize(ttl: 3600, refresh_interval: 300, clock: -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) })
+        @ttl = ttl
+        @refresh_interval = refresh_interval
+        @clock = clock
+        @lock = Mutex.new
+        @keys = nil
+        @fetched_at = nil
+      end
+
+      # Returns the JWKS hash, calling the block to download it when needed.
+      def fetch(kid_not_found: false)
+        @lock.synchronize do
+          if stale? || (kid_not_found && refreshable?)
+            @keys = yield
+            @fetched_at = now
+          end
+          @keys
+        end
+      end
+
+      private
+
+      def stale?
+        @keys.nil? || now - @fetched_at >= @ttl
+      end
+
+      def refreshable?
+        now - @fetched_at >= @refresh_interval
+      end
+
+      def now
+        @clock.call
+      end
+    end
+  end
+end

data/lib/omniauth/openai/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module OmniAuth
+  module OpenAI
+    VERSION = "0.1.0"
+  end
+end

data/lib/omniauth/openai.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+require "omniauth/openai/version"
+require "omniauth/strategies/openai"

data/lib/omniauth/strategies/openai.rb

@@ -0,0 +1,178 @@
+# frozen_string_literal: true
+
+require "json"
+require "jwt"
+require "omniauth-oauth2"
+require "omniauth/openai/key_set"
+require "rack/utils"
+require "securerandom"
+require "uri"
+
+module OmniAuth
+  module Strategies
+    # Sign in with ChatGPT: OpenID Connect over the authorization code flow,
+    # with PKCE and a nonce. See https://developers.openai.com/siwc/website.
+    #
+    # The strategy establishes who the person is and nothing more. It trusts
+    # only the ID token, after checking its signature, issuer, audience,
+    # expiry, and nonce. It makes no userinfo call and returns no OpenAI
+    # tokens, because identity sign-in needs none.
+    #
+    # The endpoints come from https://auth.openai.com/.well-known/openid-configuration.
+    # They are fixed options rather than discovered at boot, so a slow
+    # discovery request cannot hold up an application starting.
+    class OpenAI < OmniAuth::Strategies::OAuth2
+      ISSUER = "https://auth.openai.com"
+      KEY_SETS = Hash.new { |sets, uri| sets[uri] = OmniAuth::OpenAI::KeySet.new }
+      KEY_SETS_LOCK = Mutex.new
+
+      option :name, "openai"
+      option :scope, "openid profile email"
+      option :pkce, true
+      option :issuer, ISSUER
+      option :jwks_uri, "#{ISSUER}/.well-known/jwks.json"
+      # :basic (client_secret_basic), :post (client_secret_post), or :none for
+      # a public client, the three methods OpenAI's discovery document lists.
+      # Left nil, a client with a secret uses :basic, the OpenID Connect
+      # default, and one without uses :none.
+      option :client_auth_method, nil
+      option :leeway, 5
+      option :client_options, {
+        site: ISSUER,
+        authorize_url: "/api/accounts/authorize",
+        token_url: "/api/accounts/oauth/token"
+      }
+
+      uid { id_token_claims.fetch("sub") }
+
+      # Applications commonly match accounts by email, so the email is
+      # included only when OpenAI says the person verified it.
+      info do
+        {
+          email: (id_token_claims["email"] if id_token_claims["email_verified"] == true),
+          name: id_token_claims["name"],
+          first_name: id_token_claims["given_name"],
+          last_name: id_token_claims["family_name"],
+          nickname: id_token_claims["preferred_username"],
+          image: id_token_claims["picture"]
+        }.compact
+      end
+
+      extra do
+        { "raw_info" => id_token_claims }
+      end
+
+      # OmniAuth merges credentials blocks down the class chain, so the
+      # parent's token keys can only be dropped by overriding the method.
+      def credentials
+        {}
+      end
+
+      # The token request carries client_id in the body for every method.
+      # oauth2's :tls_client_auth scheme does exactly that and nothing more;
+      # the secret, if any, is added by #token_params.
+      def client
+        ::OAuth2::Client.new(options.client_id, options.client_secret,
+                             deep_symbolize(options.client_options).merge(auth_scheme: :tls_client_auth))
+      end
+
+      # OAuth2 appends the callback's query string, but OpenAI compares
+      # redirect_uri exactly with the one sent to the authorize endpoint.
+      def callback_url
+        options.redirect_uri || (full_host + callback_path)
+      end
+
+      def authorize_params
+        super.tap do |params|
+          params[:nonce] = session[nonce_session_key] = SecureRandom.urlsafe_base64(32)
+        end
+      end
+
+      def token_params
+        params = super
+        case client_auth_method
+        when :basic then params.merge(headers: { "Authorization" => basic_authorization })
+        when :post then params.merge(client_secret: options.client_secret)
+        else params
+        end
+      end
+
+      private
+
+      attr_reader :id_token_claims
+
+      # Runs inside OAuth2#callback_phase, which turns a CallbackError into an
+      # :invalid_credentials failure. A token that fails verification never
+      # reaches uid, info, or the application.
+      def build_access_token
+        expected_nonce = session.delete(nonce_session_key)
+        super.tap do |token|
+          @id_token_claims = verify_id_token(token.response.parsed["id_token"], expected_nonce)
+        end
+      end
+
+      def verify_id_token(id_token, expected_nonce)
+        raise CallbackError.new(:invalid_id_token, "The token response carried no ID token") if id_token.to_s.empty?
+
+        claims, = ::JWT.decode(
+          id_token, nil, true,
+          algorithms: [ "RS256" ],
+          jwks: ->(loader_options) { signing_keys(**loader_options.slice(:kid_not_found)) },
+          iss: options.issuer, verify_iss: true,
+          aud: options.client_id, verify_aud: true,
+          required_claims: %w[sub exp iat],
+          verify_iat: true,
+          leeway: options.leeway
+        )
+
+        verify_authorized_party(claims)
+        verify_nonce(claims, expected_nonce)
+        claims
+      rescue ::JWT::DecodeError, ::OAuth2::Error, ::Faraday::Error, ::JSON::ParserError => e
+        raise CallbackError.new(:invalid_id_token, e.message)
+      end
+
+      # OpenID Connect Core 3.1.3.7: a token for several audiences must name
+      # this client as the party it was issued to.
+      def verify_authorized_party(claims)
+        audiences = Array(claims["aud"])
+        return if audiences.one? || claims["azp"] == options.client_id
+
+        raise CallbackError.new(:invalid_id_token, "The ID token was issued to another party")
+      end
+
+      def verify_nonce(claims, expected_nonce)
+        return if expected_nonce && Rack::Utils.secure_compare(claims["nonce"].to_s, expected_nonce)
+
+        raise CallbackError.new(:invalid_id_token, "The ID token nonce did not match")
+      end
+
+      def signing_keys(kid_not_found: false)
+        key_set.fetch(kid_not_found: kid_not_found) do
+          client.request(:get, options.jwks_uri).parsed
+        end
+      end
+
+      def key_set
+        KEY_SETS_LOCK.synchronize { KEY_SETS[options.jwks_uri] }
+      end
+
+      def client_auth_method
+        method = options.client_auth_method&.to_sym
+        method || (options.client_secret.to_s.empty? ? :none : :basic)
+      end
+
+      # RFC 6749 2.3.1: both halves are form-encoded before Base64.
+      def basic_authorization
+        pair = [ options.client_id, options.client_secret ].map { |part| URI.encode_www_form_component(part.to_s) }.join(":")
+        "Basic #{[ pair ].pack("m0")}"
+      end
+
+      def nonce_session_key
+        "omniauth.#{name}.nonce"
+      end
+    end
+  end
+end
+
+OmniAuth.config.add_camelization "openai", "OpenAI"

data/lib/omniauth-openai.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require "omniauth/openai"

data/omniauth-openai.gemspec

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require_relative "lib/omniauth/openai/version"
+
+Gem::Specification.new do |spec|
+  spec.name          = "omniauth-openai"
+  spec.version       = OmniAuth::OpenAI::VERSION
+  spec.authors       = [ "Ajay Krishnan" ]
+  spec.email         = [ "omniauth-openai@ajay.to" ]
+
+  spec.summary       = "OmniAuth strategy for Sign in with ChatGPT (OpenAI OpenID Connect)."
+  spec.description   = <<~DESC
+    Adds "Sign in with ChatGPT" to Rack and Rails applications through
+    OmniAuth and Devise. Authorization code flow with PKCE and a nonce; the
+    ID token's signature, issuer, audience, expiry, and nonce are verified
+    against OpenAI's published keys before the application sees an identity.
+    Unofficial; not affiliated with or endorsed by OpenAI.
+  DESC
+  spec.homepage      = "https://github.com/ajaynomics/omniauth-openai"
+  spec.license       = "MIT"
+  spec.required_ruby_version = ">= 3.2.0"
+
+  spec.metadata["source_code_uri"]       = spec.homepage
+  spec.metadata["changelog_uri"]         = "#{spec.homepage}/blob/main/CHANGELOG.md"
+  spec.metadata["bug_tracker_uri"]       = "#{spec.homepage}/issues"
+  spec.metadata["rubygems_mfa_required"] = "true"
+
+  spec.files = Dir.glob("lib/**/*.rb") + %w[README.md LICENSE CHANGELOG.md omniauth-openai.gemspec]
+  spec.require_paths = [ "lib" ]
+
+  spec.add_dependency "jwt", ">= 2.7", "< 4"
+  spec.add_dependency "omniauth-oauth2", "~> 1.8"
+
+  spec.add_development_dependency "minitest", ">= 5.20"
+  spec.add_development_dependency "rack-test", "~> 2.1"
+  spec.add_development_dependency "rake", "~> 13.0"
+  spec.add_development_dependency "webmock", "~> 3.20"
+end

metadata

@@ -0,0 +1,148 @@
+--- !ruby/object:Gem::Specification
+name: omniauth-openai
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Ajay Krishnan
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.7'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.7'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+- !ruby/object:Gem::Dependency
+  name: omniauth-oauth2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.8'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.8'
+- !ruby/object:Gem::Dependency
+  name: minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '5.20'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '5.20'
+- !ruby/object:Gem::Dependency
+  name: rack-test
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.20'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.20'
+description: |
+  Adds "Sign in with ChatGPT" to Rack and Rails applications through
+  OmniAuth and Devise. Authorization code flow with PKCE and a nonce; the
+  ID token's signature, issuer, audience, expiry, and nonce are verified
+  against OpenAI's published keys before the application sees an identity.
+  Unofficial; not affiliated with or endorsed by OpenAI.
+email:
+- omniauth-openai@ajay.to
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE
+- README.md
+- lib/omniauth-openai.rb
+- lib/omniauth/openai.rb
+- lib/omniauth/openai/key_set.rb
+- lib/omniauth/openai/version.rb
+- lib/omniauth/strategies/openai.rb
+- omniauth-openai.gemspec
+homepage: https://github.com/ajaynomics/omniauth-openai
+licenses:
+- MIT
+metadata:
+  source_code_uri: https://github.com/ajaynomics/omniauth-openai
+  changelog_uri: https://github.com/ajaynomics/omniauth-openai/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/ajaynomics/omniauth-openai/issues
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.2.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.16
+specification_version: 4
+summary: OmniAuth strategy for Sign in with ChatGPT (OpenAI OpenID Connect).
+test_files: []