omniauth-proconnect 0.1.2 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 86b51a87f8ac06c3c00f81ce18d9819420c4a77b8301a61251b2098f1c87565c
-  data.tar.gz: 9b6973f0b6e425220af7f797b274ae1a2c238d4cbb824baaead6f72077bd277a
+  metadata.gz: 3798432d91f891378bd3a61ac701ed300d262613b961c9d2e7c6ef9e7f72d8bd
+  data.tar.gz: a13a4a55b57569fbb93907b35966aa6855beb6002f73a66088d19dcd0f4a00b9
 SHA512:
-  metadata.gz: 9bba6185dbbb6b95054c928243f1c6e24ed1a618673b221530dd02da1c6ad3999338f92537aa814ba60a3a2677afec85580580a76ef7eca57a9df3449c5fdd21
-  data.tar.gz: 804977671bf4054b1482f2f8d4e0c10f634dc92bdeaa0491d4bff42e17c1412d87e6fcc3730f5297f1d84da19b76b884774e8f659b8b599d0fa3c468a0e29a50
+  metadata.gz: 6bc5467a0edef737742ed477ec0ddb175e45e58298ffde705bb3162a214cc802cf52f98568e5c20ffc98d4a6a2812fab98840a185d0d0ddc9b1e9b37cb464bfe
+  data.tar.gz: d68e03e9eb2e796da1f68d270eb322f52b2e429c1ab0554e78f040bfa768a20c70e09dc89a62d701fd9053cb1f99060e3e16f9c04aa9a15c71e97e7b2bb8c471

data/README.md

@@ -17,6 +17,13 @@ qui malgré son degré de maturité supérieure semble à l'abandon aussi.
 
 ## Utilisation
 
+Une fois que vous avez créé votre application sur [l'espace
+partenaires de
+ProConnect](https://partenaires.proconnect.gouv.fr/apps) et identifié
+vos endpoints grâce à leur [documentation
+technique](https://partenaires.proconnect.gouv.fr/docs/fournisseur-service/implementation_technique))
+:
+
 1. installer la gem `bundle add omniauth-proconnect` ;
 2. configurer une nouvelle stratégie pour OmniAuth :
 
@@ -24,7 +31,7 @@ qui malgré son degré de maturité supérieure semble à l'abandon aussi.
 # config/omniauth.rb
 Rails.application.config.middleware.use OmniAuth::Builder do
   provider(
-    :pro_connect,
+    :proconnect,
     {
       client_id: ENV.fetch("YOUR_APP_PC_CLIENT_ID"),
       client_secret: ENV.fetch("YOUR_APP_PC_CLIENT_SECRET"),

data/lib/omniauth/proconnect/version.rb

@@ -2,6 +2,6 @@
 
 module Omniauth
   class Proconnect
-    VERSION = "0.1.2"
+    VERSION = "0.3.0"
   end
 end

data/lib/omniauth/proconnect.rb

@@ -1,152 +1,155 @@
 # frozen_string_literal: true
 
+require "faraday"
 require "omniauth"
+require "json/jwt"
 
 require_relative "proconnect/version"
 
-module Omniauth
-  class Proconnect
-    class Error < StandardError; end
+module OmniAuth
+  module Strategies
+    class Proconnect
+      class Error < StandardError; end
 
-    include OmniAuth::Strategy
+      include OmniAuth::Strategy
 
-    option :name, "proconnect"
-    option :client_id
-    option :client_secret
-    option :proconnect_domain
-    option :redirect_uri
-    option :post_logout_redirect_uri
-    option :scope, "openid email given_name usual_name"
+      option :name, "proconnect"
+      option :client_id
+      option :client_secret
+      option :proconnect_domain
+      option :redirect_uri
+      option :post_logout_redirect_uri
+      option :scope, "openid email given_name usual_name"
 
-    def setup_phase
-      discover_endpoint!
-    end
+      def setup_phase
+        discover_endpoint!
+      end
 
-    def request_phase
-      redirect(authorization_uri)
-    end
+      def request_phase
+        redirect(authorization_uri)
+      end
 
-    def callback_phase
-      verify_state!(request.params["state"])
+      def callback_phase
+        verify_state!(request.params["state"])
 
-      exchange_authorization_code!(request.params["code"])
-        .then { |response| store_tokens!(response) }
-        .then { |response| get_userinfo!(response) }
-        .then { |response| @userinfo = JSON::JWT.decode(response.body, :skip_verification) }
-        .then { super }
-    end
+        exchange_authorization_code!(request.params["code"])
+          .then { |response| store_tokens!(response) }
+          .then { get_userinfo! }
+          .then { |response| @userinfo = JSON::JWT.decode(response.body, :skip_verification) }
+          .then { super }
+      end
 
-    def other_phase
-      if on_logout_path?
-        engage_logout!
-      else
-        @app.call(env)
+      def other_phase
+        if on_logout_path?
+          engage_logout!
+        else
+          call_app!
+        end
       end
-    end
 
-    def uid
-      session["omniauth.pc.id_token"]["sub"]
-    end
+      def uid
+        session["omniauth.pc.id_token"]["sub"]
+      end
 
-    def info
-      {
-        email: @userinfo["email"]
-      }
-    end
+      def info
+        {
+          email: @userinfo["email"]
+        }
+      end
 
-    private
+      private
 
-    def connection
-      @connection ||= Faraday.new(url: options[:proconnect_domain]) do |c|
-        c.response :json
-        c.response :raise_error
+      def connection
+        @connection ||= Faraday.new(url: options[:proconnect_domain]) do |c|
+          c.response :json
+          c.response :raise_error
+        end
       end
-    end
 
-    def discovered_configuration
-      @discovered_configuration ||= discover_endpoint!
-    end
+      def discovered_configuration
+        @discovered_configuration ||= discover_endpoint!
+      end
 
-    def discover_endpoint!
-      connection
-        .get(".well-known/openid-configuration")
-        .body
-    end
+      def discover_endpoint!
+        connection
+          .get(".well-known/openid-configuration")
+          .body
+      end
 
-    def authorization_uri
-      URI(discovered_configuration["authorization_endpoint"]).tap do |endpoint|
-        endpoint.query = URI.encode_www_form(
-          response_type: "code",
-          client_id: options[:client_id],
-          redirect_uri: options[:redirect_uri],
-          scope: options[:scope],
-          state: store_new_state!,
-          nonce: store_new_nonce!
-        )
+      def authorization_uri
+        URI(discovered_configuration["authorization_endpoint"]).tap do |endpoint|
+          endpoint.query = URI.encode_www_form(
+            response_type: "code",
+            client_id: options[:client_id],
+            redirect_uri: options[:redirect_uri],
+            scope: options[:scope],
+            state: store_new_state!,
+            nonce: store_new_nonce!
+          )
+        end
       end
-    end
 
-    def end_session_uri
-      URI(discovered_configuration["end_session_endpoint"]).tap do |endpoint|
-        endpoint.query = URI.encode_www_form(
-          id_token_hint: session["omniauth.pc.id_token"],
-          state: current_state,
-          post_logout_redirect_uri: options[:post_logout_redirect_uri]
-        )
+      def end_session_uri
+        URI(discovered_configuration["end_session_endpoint"]).tap do |endpoint|
+          endpoint.query = URI.encode_www_form(
+            id_token_hint: session["omniauth.pc.id_token"],
+            state: current_state,
+            post_logout_redirect_uri: options[:post_logout_redirect_uri]
+          )
+        end
       end
-    end
 
-    def exchange_authorization_code!(code)
-      connection.post(URI(discovered_configuration["token_endpoint"]),
-                      URI.encode_www_form(
-                        grant_type: "authorization_code",
-                        client_id: options[:client_id],
-                        client_secret: options[:client_secret],
-                        redirect_uri: options[:redirect_uri],
-                        code: code,
-                        scope: options[:scope]
-                      ))
-    end
+      def exchange_authorization_code!(code)
+        connection.post(URI(discovered_configuration["token_endpoint"]),
+                        URI.encode_www_form(
+                          grant_type: "authorization_code",
+                          client_id: options[:client_id],
+                          client_secret: options[:client_secret],
+                          redirect_uri: options[:redirect_uri],
+                          code: code
+                        ))
+      end
 
-    def store_tokens!(response)
-      response.tap do |res|
-        %w[access id refresh].each do |name|
-          session["omniauth.pc.#{name}_token"] = res.body["#{name}_token"]
+      def store_tokens!(response)
+        response.tap do |res|
+          %w[access id refresh].each do |name|
+            session["omniauth.pc.#{name}_token"] = res.body["#{name}_token"]
+          end
         end
       end
-    end
 
-    def get_userinfo!
-      endpoint = URI(discovered_configuration["userinfo_endpoint"])
-      token = session["omniauth.pc.access_token"]
+      def get_userinfo!
+        endpoint = URI(discovered_configuration["userinfo_endpoint"])
+        token = session["omniauth.pc.access_token"]
 
-      connection.get(endpoint, {}, "Authorization" => "Bearer #{token}")
-    end
+        connection.get(endpoint, {}, "Authorization" => "Bearer #{token}")
+      end
 
-    def engage_logout!
-      redirect end_session_uri
-    end
+      def engage_logout!
+        redirect end_session_uri
+      end
 
-    def on_logout_path?
-      # FIXME: maybe don't hardcode this
-      request.path.end_with?("#{request_path}/logout")
-    end
+      def on_logout_path?
+        # FIXME: maybe don't hardcode this
+        request.path.end_with?("#{request_path}/logout")
+      end
 
-    def store_new_state!
-      session["omniauth.state"] = SecureRandom.hex(16)
-    end
+      def store_new_state!
+        session["omniauth.state"] = SecureRandom.hex(16)
+      end
 
-    def current_state
-      session["omniauth.state"]
-    end
+      def current_state
+        session["omniauth.state"]
+      end
 
-    def store_new_nonce!
-      session["omniauth.nonce"] = SecureRandom.hex(16)
-    end
+      def store_new_nonce!
+        session["omniauth.nonce"] = SecureRandom.hex(16)
+      end
 
-    def verify_state!(other_state)
-      if other_state != current_state
-        raise "a request came back with a different 'state' parameter than what we had last stored."
+      def verify_state!(other_state)
+        if other_state != current_state
+          raise "a request came back with a different 'state' parameter than what we had last stored."
+        end
       end
     end
   end

metadata

@@ -1,42 +1,56 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-proconnect
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.3.0
 platform: ruby
 authors:
 - Stéphane Maniaci
 bindir: exe
 cert_chain: []
-date: 2025-04-30 00:00:00.000000000 Z
+date: 2025-05-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: omniauth
+  name: faraday
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '2'
 - !ruby/object:Gem::Dependency
-  name: faraday
+  name: json-jwt
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2'
+        version: '1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2'
+        version: '1'
+- !ruby/object:Gem::Dependency
+  name: omniauth
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: An OmniAuth strategy for ProConnect, an official OIDC solution for French
   professionnals to login.
 email: