omniauth-shopify-oauth2 1.1.11 → 1.1.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4983dd45c4c7df37fa58540d63025ae4843b67b0
-  data.tar.gz: 109aa26f248b774657725c8908aeb6c4b224c998
+  metadata.gz: 753ea51893552576c2eebc375147568613694af8
+  data.tar.gz: a2c1d077db0e9f08bba5a4626247467ce41d0145
 SHA512:
-  metadata.gz: 7d19445d82627ba563846393c24f55cd4b26e63d940ef468ea178b1afa24d180bc3b2e6054fee2d037429ec10ac895b7e64270af900dd60ccd445648c41ec406
-  data.tar.gz: 9bbc58ac9a92c621fb6859d133a0ac16b12b86f2fc633ce36600a9480d21434cb2bd4e04aafaee0ccd5906e155800fe769eda5ce9b0cef3ab9f24d41e8a9f778
+  metadata.gz: 3b9f5917e02733e066f6f83a253ffc45bf2ad48b0b77c1ee1645451d171cdcb4cf1f7ec546030042690259411e04d406208a398bf58b733a2d37244a80edf616
+  data.tar.gz: 76c7448c74383acb722f98759f9a0762f3b3955f4eb91bbf610ae4c2da2a2b128065faaafa1e004ce5a06f5864c171594e58147478bb64c4ff27ee1f2609daaf

data/.travis.yml

@@ -1,4 +1,4 @@
 language: ruby
 rvm:
-  - 1.9.3
   - 2.1.0
+  - 2.2.2

data/lib/omniauth/shopify/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module Shopify
-    VERSION = "1.1.11"
+    VERSION = "1.1.12"
   end
 end

data/lib/omniauth/strategies/shopify.rb

@@ -17,6 +17,10 @@ module OmniAuth
       option :callback_url
       option :myshopify_domain, 'myshopify.com'
 
+      # When `true`, the authorization phase will fail if the granted scopes
+      # mismatch the requested scopes.
+      option :validate_granted_scopes, true
+
       option :setup, proc { |env|
         request = Rack::Request.new(env)
         env['omniauth.strategy'].options[:client_options][:site] = "https://#{request.GET['shop']}"
@@ -42,6 +46,12 @@ module OmniAuth
         Rack::Utils.secure_compare(calculated_signature, signature)
       end
 
+      def valid_scope?(token)
+        params = options.authorize_params.merge(options_for("authorize"))
+        return false unless token && params[:scope] && token['scope']
+        (params[:scope].split(',').sort == token['scope'].split(',').sort)
+      end
+
       def self.encoded_params_for_signature(params)
         params = params.dup
         params.delete('hmac')
@@ -71,11 +81,21 @@ module OmniAuth
       end
 
       def callback_phase
-        return fail!(:invalid_site) unless valid_site?
-        return fail!(:invalid_signature) unless valid_signature?
+        return fail!(:invalid_site, CallbackError.new(:invalid_site, "OAuth endpoint is not a myshopify site.")) unless valid_site?
+        return fail!(:invalid_signature, CallbackError.new(:invalid_signature, "Signature does not match, it may have been tampered with.")) unless valid_signature?
+
+        token = build_access_token
+        unless valid_scope?(token)
+          return fail!(:invalid_scope, CallbackError.new(:invalid_scope, "Scope does not match, it may have been tampered with."))
+        end
+
         super
       end
 
+      def build_access_token
+        @built_access_token ||= super
+      end
+
       def authorize_params
         super.tap do |params|
           params[:scope] ||= DEFAULT_SCOPE

data/test/integration_test.rb

@@ -2,7 +2,7 @@ require_relative 'test_helper'
 
 class IntegrationTest < Minitest::Test
   def setup
-    build_app
+    build_app(scope: OmniAuth::Strategies::Shopify::DEFAULT_SCOPE)
   end
 
   def teardown
@@ -51,7 +51,7 @@ class IntegrationTest < Minitest::Test
   def test_callback
     access_token = SecureRandom.hex(16)
     code = SecureRandom.hex(16)
-    expect_access_token_request(access_token)
+    expect_access_token_request(access_token, OmniAuth::Strategies::Shopify::DEFAULT_SCOPE)
 
     response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
 
@@ -59,9 +59,10 @@ class IntegrationTest < Minitest::Test
   end
 
   def test_callback_with_legacy_signature
+    build_app scope: OmniAuth::Strategies::Shopify::DEFAULT_SCOPE
     access_token = SecureRandom.hex(16)
     code = SecureRandom.hex(16)
-    expect_access_token_request(access_token)
+    expect_access_token_request(access_token, OmniAuth::Strategies::Shopify::DEFAULT_SCOPE)
 
     response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]).merge(signature: 'ignored'))
 
@@ -71,9 +72,8 @@ class IntegrationTest < Minitest::Test
   def test_callback_custom_params
     access_token = SecureRandom.hex(16)
     code = SecureRandom.hex(16)
-    FakeWeb.register_uri(:post, "https://snowdevil.myshopify.com/admin/oauth/access_token",
-                         body: JSON.dump(access_token: access_token),
-                         content_type: 'application/json')
+
+    expect_access_token_request(access_token, OmniAuth::Strategies::Shopify::DEFAULT_SCOPE)
 
     now = Time.now.to_i
     params = { shop: 'snowdevil.myshopify.com', code: code, timestamp: now, next: '/products?page=2&q=red%20shirt', state: opts["rack.session"]["omniauth.state"] }
@@ -136,18 +136,78 @@ class IntegrationTest < Minitest::Test
     assert_equal 'read_products,read_orders,write_content', redirect_params['scope']
     assert_equal 'https://app.example.com/admin/auth/legacy/callback', redirect_params['redirect_uri']
   end
+
   def test_callback_with_invalid_state_fails
     access_token = SecureRandom.hex(16)
     code = SecureRandom.hex(16)
-    FakeWeb.register_uri(:post, "https://snowdevil.myshopify.com/admin/oauth/access_token",
-                         body: JSON.dump(access_token: access_token),
-                         content_type: 'application/json')
+    expect_access_token_request(access_token, OmniAuth::Strategies::Shopify::DEFAULT_SCOPE)
 
     response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: 'invalid'))
 
     assert_equal 302, response.status
     assert_equal '/auth/failure?message=csrf_detected&strategy=shopify', response.location
   end
+
+  def test_callback_with_mismatching_scope_fails
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'some_invalid_scope')
+
+    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+
+    assert_equal 302, response.status
+    assert_equal '/auth/failure?message=invalid_scope&strategy=shopify', response.location
+  end
+
+  def test_callback_with_no_scope_fails
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, nil)
+
+    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+
+    assert_equal 302, response.status
+    assert_equal '/auth/failure?message=invalid_scope&strategy=shopify', response.location
+  end
+
+  def test_callback_with_missing_access_scope_fails
+    build_app scope: 'first_scope,second_scope'
+
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'first_scope')
+
+    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+
+    assert_equal 302, response.status
+    assert_equal '/auth/failure?message=invalid_scope&strategy=shopify', response.location
+  end
+
+  def test_callback_with_extra_access_scope_fails
+    build_app scope: 'first_scope,second_scope'
+
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'second_scope,first_scope,third_scope')
+
+    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+
+    assert_equal 302, response.status
+    assert_equal '/auth/failure?message=invalid_scope&strategy=shopify', response.location
+  end
+
+  def test_callback_with_scopes_out_of_order_works
+    build_app scope: 'first_scope,second_scope'
+
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'second_scope,first_scope')
+
+    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+
+    assert_callback_success(response, access_token, code)
+  end
+
   private
 
   def sign_params(params)
@@ -160,9 +220,9 @@ class IntegrationTest < Minitest::Test
     params
   end
 
-  def expect_access_token_request(access_token)
+  def expect_access_token_request(access_token, scope)
     FakeWeb.register_uri(:post, "https://snowdevil.myshopify.com/admin/oauth/access_token",
-                         body: JSON.dump(access_token: access_token),
+                         body: JSON.dump(access_token: access_token, scope: scope),
                          content_type: 'application/json')
   end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-shopify-oauth2
 version: !ruby/object:Gem::Version
-  version: 1.1.11
+  version: 1.1.12
 platform: ruby
 authors:
 - Denis Odorcic
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-11-16 00:00:00.000000000 Z
+date: 2016-02-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-oauth2