omniauth-openai 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c4510db682d5cc881cd21ff66a13b91f19c59e70f2c34e23c38e24b9b7d954d4
-  data.tar.gz: 8e4c7ae32887385fc221e700af78787e87b017369eb5de1acb1f0e5efa5c2806
+  metadata.gz: 318769cec5741c9c2399dffa5a35a3dc46472dfcf52cd4eef37ed4374fdf2d92
+  data.tar.gz: d18f557f18208db6170317f7097aba09d47a5719c68c70f16fe5ed92c570fba8
 SHA512:
-  metadata.gz: 73c540a83c85e9fa03f71d1be70d1ea2c811273cc1d9c8e744b66b60a3d81e9b3de17649509a998042e5de63dae8656c3828d2a68143695d635e4a6dc0ca9cbc
-  data.tar.gz: 73a11709ac1f2366346b311a2ce2c8c6e26a9cbfd6eb5d2e837bc7cbb871522c0d59d3b3ac7346ab84319e3e1a3a23a4a0e33534d85a605b38bf0e9a4baf6540
+  metadata.gz: a355610041faf896eb6f2cda99499536300ffe84cc8debcd1ce2837f2024a8e8130963b9d60e3921502937a1f63b4cac7ff2b20d5425b4f18e82e6749521ea39
+  data.tar.gz: 57fc775c74251b55bcb0ae6aa88c559090d7b9ff376ee2bf3c130289e6a4676d8594a4839309829527733a130523570dc88b6b8379ba7f35dbc5e7f898215f95

data/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.1.1 - 2026-10-02
+
+### Fixed
+
+- A key set response that is not a JSON Web Key Set (an HTML error page
+  served with 200, say) fails the sign-in without being cached, so one bad
+  answer from the issuer no longer breaks sign-in until the cache expires.
+- Reject an ID token whose `sub` is empty or not a string; ruby-jwt's
+  required-claims check only confirms the claim exists.
+
+### Verified
+
+- A full sign-in against the live `auth.openai.com` (public client, PKCE,
+  nonce): OpenAI accepts the authorize request, returns the nonce in the ID
+  token, sends `aud` as a one-item list without `azp`, and marks the email
+  verified.
+
 ## 0.1.0 - 2026-10-01
 
 First release: Sign in with ChatGPT for OmniAuth and Devise, with PKCE, a

data/README.md

@@ -105,6 +105,17 @@ bundle exec rake test
 JWT_VERSION="~> 2.10" bundle update jwt && bundle exec rake test
 ```
 
+## Releasing
+
+Bump `OmniAuth::OpenAI::VERSION`, add a `CHANGELOG.md` entry, then:
+
+```sh
+bundle exec rake test
+gem build omniauth-openai.gemspec
+gem push omniauth-openai-X.Y.Z.gem --otp CODE
+git tag -a vX.Y.Z -m "omniauth-openai X.Y.Z" && git push github main vX.Y.Z
+```
+
 ## License
 
 MIT

data/lib/omniauth/openai/version.rb

@@ -2,6 +2,6 @@
 
 module OmniAuth
   module OpenAI
-    VERSION = "0.1.0"
+    VERSION = "0.1.1"
   end
 end

data/lib/omniauth/strategies/openai.rb

@@ -125,6 +125,7 @@ module OmniAuth
           leeway: options.leeway
         )
 
+        verify_subject(claims)
         verify_authorized_party(claims)
         verify_nonce(claims, expected_nonce)
         claims
@@ -132,6 +133,14 @@ module OmniAuth
         raise CallbackError.new(:invalid_id_token, e.message)
       end
 
+      # ruby-jwt's required_claims checks only that sub is present. Accounts are
+      # keyed on it, so it must be a real identifier.
+      def verify_subject(claims)
+        return if claims["sub"].is_a?(String) && !claims["sub"].strip.empty?
+
+        raise CallbackError.new(:invalid_id_token, "The ID token has no subject")
+      end
+
       # OpenID Connect Core 3.1.3.7: a token for several audiences must name
       # this client as the party it was issued to.
       def verify_authorized_party(claims)
@@ -147,9 +156,16 @@ module OmniAuth
         raise CallbackError.new(:invalid_id_token, "The ID token nonce did not match")
       end
 
+      # A response that is not a key set raises before KeySet stores it, so
+      # one bad answer from the issuer cannot be cached as the keys.
       def signing_keys(kid_not_found: false)
         key_set.fetch(kid_not_found: kid_not_found) do
-          client.request(:get, options.jwks_uri).parsed
+          jwks = client.request(:get, options.jwks_uri).parsed
+          unless jwks.is_a?(Hash) && jwks["keys"].is_a?(Array)
+            raise CallbackError.new(:invalid_id_token, "The issuer's key set is not a JSON Web Key Set")
+          end
+
+          jwks
         end
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-openai
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Ajay Krishnan