omniauth-shipbob 0.0.2 → 0.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c6c4df1a2ed0e54d50053ec4c16044628289af2485eae44b10f95b3a7538f271
-  data.tar.gz: 3b60031b3d80f56a4101f783db6c69fa7229dd58f50934931f686520d54998c4
+  metadata.gz: add429b715eade981bc48e54a292d7faab824797c1da4c1bab33fa8400e7fa3b
+  data.tar.gz: c3d8f06da521066571d7999402ce7f1025af46d8c252054c22ac2ef634515e91
 SHA512:
-  metadata.gz: d37936c44401fcd7c769a8364464fbca3e1c3148c79853afec1a9e97328940e0507cb4b55dd205fa2d57f0acb8c28c11c7659b68d9c49b232a25b59b6add98dc
-  data.tar.gz: 47072c6175ac5c3d7d11f29fa7262ed29fd28380794d309878e5ada2fdecf180dede98ee13d899b4d6bc620559d330d352ebc5f58857c7123473953fd4a1757d
+  metadata.gz: 7ef0cd947dbfe468eccc504c1aa32f7b4fbfe9432a5d1aae08a101d39bad3b65fa85f810e2da1ecbbff65e8a86c5b8cefe48d5508dfc586b4285e0fd87a64c65
+  data.tar.gz: 83e449907e6c4f23f8e7a83452aaf5090db62444c01885f58eb3ce5a3bf278b79b030a77abf40efb76cfbbdd4cddd0efac0c9b897c37735335645973b9925569

data/CHANGELOG.md

@@ -0,0 +1,48 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+## [0.1.0] - 2026-08-19
+
+### Changed
+
+- **Breaking:** requires `omniauth ~> 2.0` and `omniauth-oauth2 ~> 1.9` (previously
+  unpinned, which resolved to `omniauth 1.9` / `oauth2 1.4`). Host applications must
+  upgrade to OmniAuth 2.x; Rails apps also need
+  [`omniauth-rails_csrf_protection`](https://github.com/cookpad/omniauth-rails_csrf_protection)
+  because OmniAuth 2 only accepts `POST` for the request phase.
+- Pinned the token endpoint to `auth_scheme: :request_body`. `oauth2 2.0` changed its
+  default to `:basic_auth`, which would have moved `client_id`/`client_secret` out of
+  the token request body and changed what ShipBob receives.
+- Requires Ruby >= 3.2 (the modern `oauth2` dependency chain requires it).
+- Development toolchain: Bundler 4.x, `rake ~> 13.0`, `rspec ~> 3.13`.
+- Replaced Travis CI with GitHub Actions, testing Ruby 3.2 through 3.4.
+- Releases are now cut by pushing a `v*` tag: the `Release` workflow reruns the matrix,
+  checks the tag against `version.rb`, publishes to RubyGems.org via trusted publishing
+  (OIDC, no stored API key), and opens a GitHub release from this changelog.
+
+### Added
+
+- `LICENSE.txt` (MIT), now declared in the gemspec.
+- `channel_url`, which builds the channel endpoint from `api_url` and tolerates a
+  trailing slash on the configured value.
+- Integration specs covering the request phase, the token exchange, the `redirect_uri`
+  override and the auth hash (including `channel_id`), against both the production and
+  sandbox hosts.
+
+### Fixed
+
+- Channel lookup failures are now logged instead of being silently discarded.
+- `bin/console` required a non-existent `omniauth/fdc` file.
+- Development scripts in `bin/` are no longer packaged as gem executables.
+
+## [0.0.3]
+
+- `api_url` is now a strategy option, defaulting to `https://api.shipbob.com/1.0`, so
+  the channel lookup can point at ShipBob's sandbox (#10).
+- `callback_url` is overridden so query params from a configured `redirect_uri` are not
+  sent to ShipBob (#7).
+
+## [0.0.2]
+
+- Initial published strategy.

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2019-2026 Dropstream
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -1,6 +1,8 @@
 # Omniauth::Shipbob
 
-This is an OmniAuth strategy for authenticating to ShipBob. 
+This is an OmniAuth strategy for authenticating to ShipBob.
+
+Requires Ruby >= 3.2, OmniAuth 2.x and `omniauth-oauth2` 1.9.x.
 
 ## Installation
 
@@ -20,6 +22,14 @@ Or install it yourself as:
 
 ## Usage
 
+OmniAuth 2 only accepts `POST` for the request phase. In a Rails app, add
+[`omniauth-rails_csrf_protection`](https://github.com/cookpad/omniauth-rails_csrf_protection)
+to your Gemfile and link to the provider with `button_to` or `link_to ..., method: :post`:
+
+```ruby
+gem 'omniauth-rails_csrf_protection'
+```
+
 ```ruby
 Rails.application.config.middleware.use OmniAuth::Builder do
   provider :shipbob,
@@ -43,13 +53,64 @@ You can configure integration_name through the authorize_params hash:
 end
 ```
 
+### Configure the API endpoint
+
+`api_url` sets the host the strategy calls to look up the channel id that lands in
+`credentials['channel_id']`. It defaults to `https://api.shipbob.com/1.0`.
+
+### Configure for Sandbox ENV
+
+Configure these options to use ShipBob's [sandbox](https://developer.shipbob.com/sandbox-simulations) environment.
+
+```ruby
+  Rails.application.config.middleware.use OmniAuth::Builder do
+    provider :shipbob,
+           ...,
+           api_url: 'https://sandbox-api.shipbob.com/2.0',
+           client_options: {
+             site: 'https://authstage.shipbob.com'
+           },
+end
+```
+
 
 ## Development
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+After checking out the repo, run `bin/setup` to install dependencies. Then, run `bundle exec rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+
+To install this gem onto your local machine, run `bundle exec rake install`.
+
+## Releasing
+
+Releases are cut by pushing a tag; GitHub Actions builds and publishes the gem to
+[rubygems.org](https://rubygems.org) via
+[RubyGems trusted publishing](https://guides.rubygems.org/trusted-publishing/), so no API
+key is stored in the repo and the gemspec can keep `rubygems_mfa_required`.
 
-To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+1. Bump `VERSION` in `lib/omniauth-shipbob/version.rb` and add a `CHANGELOG.md` section
+   for it (the release notes are taken from that section).
+2. Commit both on `master`.
+3. Tag and push:
+
+   ```sh
+   git tag -a v0.1.0 -m "v0.1.0"
+   git push origin master --tags
+   ```
+
+The `Release` workflow then runs the full test matrix, refuses to continue if the tag and
+`version.rb` disagree, pushes the gem, and opens a GitHub release.
+
+### One-time RubyGems setup
+
+Before the first automated release, register this repo as a trusted publisher: on
+rubygems.org open the gem → **Trusted publishers** → **Create**, with owner
+`dropstream`, repository `omniauth-shipbob`, workflow `release.yml`, and environment
+`release`.
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/omniauth-fdc.
+Bug reports and pull requests are welcome on GitHub at https://github.com/dropstream/omniauth-shipbob.
+
+## License
+
+Available as open source under the terms of the [MIT License](LICENSE.txt).

data/lib/omniauth/strategies/shipbob.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 
 require 'omniauth-oauth2'
 require 'json'
@@ -5,15 +6,20 @@ require 'json'
 module OmniAuth
   module Strategies
     class Shipbob < OmniAuth::Strategies::OAuth2
+      DEFAULT_API_URL = 'https://api.shipbob.com/1.0'
 
       option :client_options, {
         :authorize_url => '/connect/integrate',
         :token_url => '/connect/token',
-        :site => 'https://auth.shipbob.com'
+        :site => 'https://auth.shipbob.com',
+        # oauth2 2.x defaults to :basic_auth; ShipBob expects the client
+        # credentials in the token request body, which was the oauth2 1.x default.
+        :auth_scheme => :request_body
       }
-      
+
       option :authorize_params, { :response_mode => 'form_post' }
-      
+      option :api_url, DEFAULT_API_URL
+
       credentials do
         hash = {"token" => access_token.token}
         hash["refresh_token"] = access_token.refresh_token if access_token.expires? && access_token.refresh_token
@@ -22,15 +28,25 @@ module OmniAuth
         hash['channel_id'] = get_channel_id(access_token)
         hash
       end
-      
+
       def get_channel_id(token)
         log :info, 'Calling API to get Channel Id.'
-        response = token.get('https://api.shipbob.com/1.0/channel', :headers => { 'Content-Type' => 'application/json' })
+        response = token.get(channel_url, :headers => { 'Content-Type' => 'application/json' })
         JSON.parse(response.body).dig(0, "id")
-      rescue => e
-        nil  
+      rescue StandardError => e
+        log :error, "Failed to fetch ShipBob Channel Id: #{e.class}: #{e.message}"
+        nil
+      end
+
+      # The channel endpoint on the configured API host, e.g. ShipBob's sandbox.
+      def channel_url
+        "#{options.api_url.to_s.chomp('/')}/channel"
+      end
+
+      # override callback_url to avoid sending query params along with specified redirect_uri
+      def callback_url
+        full_host + script_name + callback_path
       end
-      
     end
   end
 end

data/lib/omniauth-shipbob/version.rb

@@ -1,5 +1,5 @@
 module Omniauth
   module Shipbob
-    VERSION = "0.0.2"
+    VERSION = "0.1.0"
   end
 end

data/omniauth-shipbob.gemspec

@@ -1,5 +1,6 @@
+# frozen_string_literal: true
 
-lib = File.expand_path("../lib", __FILE__)
+lib = File.expand_path("lib", __dir__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 require "omniauth-shipbob/version"
 
@@ -9,31 +10,27 @@ Gem::Specification.new do |spec|
   spec.authors       = ["Venkata Kishor"]
   spec.email         = ["kishore.venkat@getdropstream.com"]
 
-  spec.summary       = %q{OmniAuth strategy for ShipBob}
-  spec.description   = %q{In this gem you will find an OmniAuth ShipBob strategy}
+  spec.summary       = "OmniAuth strategy for ShipBob"
+  spec.description   = "In this gem you will find an OmniAuth ShipBob strategy"
   spec.homepage      = "https://github.com/dropstream/omniauth-shipbob"
+  spec.license       = "MIT"
 
-  # Prevent pushing this gem to RubyGems.org. To allow pushes either set the 'allowed_push_host'
-  # to allow pushing to a single host or delete this section to allow pushing to any host.
-  if spec.respond_to?(:metadata)
-    spec.metadata["allowed_push_host"] = "https://rubygems.org"
-  else
-    raise "RubyGems 2.0 or newer is required to protect against " \
-      "public gem pushes."
-  end
+  spec.required_ruby_version = ">= 3.2"
+
+  spec.metadata["allowed_push_host"] = "https://rubygems.org"
+  spec.metadata["homepage_uri"]      = spec.homepage
+  spec.metadata["changelog_uri"]     = "#{spec.homepage}/blob/master/CHANGELOG.md"
+  spec.metadata["rubygems_mfa_required"] = "true"
 
-  # Specify which files should be added to the gem when it is released.
-  # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
-  spec.files         = Dir.chdir(File.expand_path('..', __FILE__)) do
-    `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
+  # Ship only the library itself; development scaffolding stays out of the gem.
+  spec.files = Dir.chdir(__dir__) do
+    `git ls-files -z`.split("\x0").reject do |f|
+      f.match(%r{\A(?:spec|bin|pkg|\.github)/}) ||
+        f.match(%r{\A(?:\.gitignore|\.rspec|\.ruby-version|\.ruby-gemset|Gemfile|Gemfile\.lock|Rakefile)\z})
+    end
   end
-  spec.bindir        = "exe"
-  spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_runtime_dependency 'omniauth-oauth2'
-
-  spec.add_development_dependency "bundler", "~> 1.16"
-  spec.add_development_dependency "rake", "~> 10.0"
-  spec.add_development_dependency "rspec", "~> 3.0"
+  spec.add_dependency "omniauth", "~> 2.0"
+  spec.add_dependency "omniauth-oauth2", "~> 1.9"
 end

metadata

@@ -1,71 +1,42 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-shipbob
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.1.0
 platform: ruby
 authors:
 - Venkata Kishor
-autorequire: 
-bindir: exe
+bindir: bin
 cert_chain: []
-date: 2020-05-21 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: omniauth-oauth2
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: bundler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.16'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.16'
-- !ruby/object:Gem::Dependency
-  name: rake
+  name: omniauth
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
-  type: :development
+        version: '2.0'
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '2.0'
 - !ruby/object:Gem::Dependency
-  name: rspec
+  name: omniauth-oauth2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
-  type: :development
+        version: '1.9'
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '1.9'
 description: In this gem you will find an OmniAuth ShipBob strategy
 email:
 - kishore.venkat@getdropstream.com
@@ -73,26 +44,21 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".gitignore"
-- ".rspec"
-- ".ruby-gemset"
-- ".ruby-version"
-- ".travis.yml"
-- Gemfile
-- Gemfile.lock
+- CHANGELOG.md
+- LICENSE.txt
 - README.md
-- Rakefile
-- bin/console
-- bin/setup
 - lib/omniauth-shipbob.rb
 - lib/omniauth-shipbob/version.rb
 - lib/omniauth/strategies/shipbob.rb
 - omniauth-shipbob.gemspec
 homepage: https://github.com/dropstream/omniauth-shipbob
-licenses: []
+licenses:
+- MIT
 metadata:
   allowed_push_host: https://rubygems.org
-post_install_message: 
+  homepage_uri: https://github.com/dropstream/omniauth-shipbob
+  changelog_uri: https://github.com/dropstream/omniauth-shipbob/blob/master/CHANGELOG.md
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -100,15 +66,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.6
-signing_key: 
+rubygems_version: 3.6.9
 specification_version: 4
 summary: OmniAuth strategy for ShipBob
 test_files: []

data/.gitignore

@@ -1,11 +0,0 @@
-/.bundle/
-/.yardoc
-/_yardoc/
-/coverage/
-/doc/
-/pkg/
-/spec/reports/
-/tmp/
-
-# rspec failure tracking
-.rspec_status

data/.rspec

@@ -1,3 +0,0 @@
---format documentation
---color
---require spec_helper

data/.ruby-gemset

@@ -1 +0,0 @@
-omniauth-shipbob

data/.ruby-version

@@ -1 +0,0 @@
-2.4.4

data/.travis.yml

@@ -1,7 +0,0 @@
----
-sudo: false
-language: ruby
-cache: bundler
-rvm:
-  - 2.4.4
-before_install: gem install bundler -v 1.16.6

data/Gemfile

@@ -1,4 +0,0 @@
-source "https://rubygems.org"
-
-# Specify your gem's dependencies in omniauth-fdc.gemspec
-gemspec

data/Gemfile.lock

@@ -1,56 +0,0 @@
-PATH
-  remote: .
-  specs:
-    omniauth-shipbob (0.0.1)
-      omniauth-oauth2
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    diff-lcs (1.3)
-    faraday (1.0.1)
-      multipart-post (>= 1.2, < 3)
-    hashie (4.1.0)
-    jwt (2.2.1)
-    multi_json (1.14.1)
-    multi_xml (0.6.0)
-    multipart-post (2.1.1)
-    oauth2 (1.4.4)
-      faraday (>= 0.8, < 2.0)
-      jwt (>= 1.0, < 3.0)
-      multi_json (~> 1.3)
-      multi_xml (~> 0.5)
-      rack (>= 1.2, < 3)
-    omniauth (1.9.1)
-      hashie (>= 3.4.6)
-      rack (>= 1.6.2, < 3)
-    omniauth-oauth2 (1.6.0)
-      oauth2 (~> 1.1)
-      omniauth (~> 1.9)
-    rack (2.2.2)
-    rake (10.5.0)
-    rspec (3.9.0)
-      rspec-core (~> 3.9.0)
-      rspec-expectations (~> 3.9.0)
-      rspec-mocks (~> 3.9.0)
-    rspec-core (3.9.0)
-      rspec-support (~> 3.9.0)
-    rspec-expectations (3.9.0)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-mocks (3.9.0)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-support (3.9.0)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  bundler (~> 1.16)
-  omniauth-shipbob!
-  rake (~> 10.0)
-  rspec (~> 3.0)
-
-BUNDLED WITH
-   1.17.3

data/Rakefile

@@ -1,6 +0,0 @@
-require "bundler/gem_tasks"
-require "rspec/core/rake_task"
-
-RSpec::Core::RakeTask.new(:spec)
-
-task :default => :spec

data/bin/console

@@ -1,14 +0,0 @@
-#!/usr/bin/env ruby
-
-require "bundler/setup"
-require "omniauth/fdc"
-
-# You can add fixtures and/or initialization code here to make experimenting
-# with your gem easier. You can also use a different console, if you like.
-
-# (If you use this, don't forget to add pry to your Gemfile!)
-# require "pry"
-# Pry.start
-
-require "irb"
-IRB.start(__FILE__)

data/bin/setup

@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-IFS=$'\n\t'
-set -vx
-
-bundle install
-
-# Do any other automated setup that you need to do here