omniauth-shopify-oauth2 1.1.13 → 1.1.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 302968d8c7499cf54d89ef0b5b53549911545743
-  data.tar.gz: 20b3c6e2381e5229e0a00166568426416cff46f8
+  metadata.gz: e88a21bce303e6c6d637d58c50a2bfa7d75dfe86
+  data.tar.gz: bced14c2fffa27c843425fe95dd088dbb5866c28
 SHA512:
-  metadata.gz: a99dc64abd740de41d62508b0939fa62f7b1b69f3e4fee52e40c8996440155d9f69a607cf844a915543257c751440bff2ed9d5207ea9bd00df830a7e7173f041
-  data.tar.gz: 31a0d25400a590a03f8ce4d09c5f05a7caf46480b344c856929dce9a7cf8ecaba2c2a78ec2c81d7fba8c28a022b158ecf58e14c06329834decd78b5536741bcd
+  metadata.gz: 575588b874c8c8d1774070ed66fbf55e8d70f9b82f9097c6f97e1ccb3423e792b82b400c2c3e481527eb60f5f54a69092aebd5715a5211845033bdc3a3be974c
+  data.tar.gz: 3aa7bb0263d3c262f6c93aa39ce8729d92225fe712c9f0acc46560aed468f8c9dc125b4820a20273add6d4490b424215ba89565ac8c9fd8488d74dcc4dbe0f17

data/lib/omniauth/shopify/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module Shopify
-    VERSION = "1.1.13"
+    VERSION = "1.1.14"
   end
 end

data/lib/omniauth/strategies/shopify.rb

@@ -6,6 +6,7 @@ module OmniAuth
       # Available scopes: content themes products customers orders script_tags shipping
       # read_*  or write_*
       DEFAULT_SCOPE = 'read_products'
+      SCOPE_DELIMITER = ','
       MINUTE = 60
       CODE_EXPIRES_AFTER = 10 * MINUTE
 
@@ -49,8 +50,14 @@ module OmniAuth
       def valid_scope?(token)
         params = options.authorize_params.merge(options_for("authorize"))
         return false unless token && params[:scope] && token['scope']
-        expected_scope = params[:scope].split(',').map(&:strip).reject(&:empty?).uniq.sort
-        (expected_scope == token['scope'].split(',').sort)
+        expected_scope = normalized_scopes(params[:scope]).sort
+        (expected_scope == token['scope'].split(SCOPE_DELIMITER).sort)
+      end
+
+      def normalized_scopes(scopes)
+        scope_list = scopes.to_s.split(SCOPE_DELIMITER).map(&:strip).reject(&:empty?).uniq
+        ignore_scopes = scope_list.map { |scope| scope =~ /\Awrite_(.*)\z/ && "read_#{$1}" }.compact
+        scope_list - ignore_scopes
       end
 
       def self.encoded_params_for_signature(params)
@@ -99,7 +106,7 @@ module OmniAuth
 
       def authorize_params
         super.tap do |params|
-          params[:scope] ||= DEFAULT_SCOPE
+          params[:scope] = normalized_scopes(params[:scope] || DEFAULT_SCOPE).join(SCOPE_DELIMITER)
         end
       end
 

data/test/integration_test.rb

@@ -148,6 +148,22 @@ class IntegrationTest < Minitest::Test
     assert_equal 'https://app.example.com/admin/auth/legacy/callback', redirect_params['redirect_uri']
   end
 
+  def test_unnecessary_read_scopes_are_removed
+    build_app scope: 'read_content,read_products,write_products',
+              callback_path: '/admin/auth/legacy/callback',
+              myshopify_domain: 'myshopify.dev:3000',
+              setup: lambda { |env|
+                shop = Rack::Request.new(env).GET['shop']
+                shop += ".myshopify.dev:3000" unless shop.include?(".")
+                env['omniauth.strategy'].options[:client_options][:site] = "https://#{shop}"
+              }
+
+    response = authorize('snowdevil')
+    assert_equal 302, response.status
+    redirect_params = Rack::Utils.parse_query(URI(response.location).query)
+    assert_equal 'read_content,write_products', redirect_params['scope']
+  end
+
   def test_callback_with_invalid_state_fails
     access_token = SecureRandom.hex(16)
     code = SecureRandom.hex(16)
@@ -219,6 +235,18 @@ class IntegrationTest < Minitest::Test
     assert_callback_success(response, access_token, code)
   end
 
+  def test_callback_with_extra_coma_works
+    build_app scope: 'read_content,,write_products,'
+
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'read_content,write_products')
+
+    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+
+    assert_callback_success(response, access_token, code)
+  end
+
   private
 
   def sign_params(params)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-shopify-oauth2
 version: !ruby/object:Gem::Version
-  version: 1.1.13
+  version: 1.1.14
 platform: ruby
 authors:
 - Denis Odorcic
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-02-23 00:00:00.000000000 Z
+date: 2016-02-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-oauth2