omniauth-shopify-oauth2 2.0.0 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 3c2fdff942824597bca290d63c4d5f2e8ad3fea3
-  data.tar.gz: 175291a1282389126084a7d32c2fd7c4965faa9c
+SHA256:
+  metadata.gz: a323c0e91f3f9574a06a0510f3a68e3ac0d0fefd52a9202d1d7899005ed3fa33
+  data.tar.gz: 3fb6661fe5e570d77070bdac24f88577c53a36b5fd847955dbf9368491620d28
 SHA512:
-  metadata.gz: f905cd84cc0df6a8b1ef9d61ae432e0aaeb2d88547b77e4ddf5ca09c991ef181d131690a5ec6022553ff31b1246875cc76fd7420911cb463d021f459a72b8b4b
-  data.tar.gz: e909527c818473c35ae5e9caf4f3afaffe38e9fdf835fc7bff13fe41c1be8ab2e81f71f1fca02011013d78303d1baccb222fb9e2c6cd7be9704fd9645c668e31
+  metadata.gz: 8f4909d9271c0b50bade9ea456594275aee7ee4877c6d89c55c9cae824e6b63c9659fecf945cfa6cc44ac3bdc67c1ae8961289b6a84f4683f2874419846fbcfc
+  data.tar.gz: d4df88d5a00976d50b2137f213ac6f64ff9ea011538a835d7e63204a3b5cdafc9b2f000947652de0ad0407a8ef37a9710b94495a8a3fe7aa175aaff77a89679d

data/lib/omniauth/shopify/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module Shopify
-    VERSION = "2.0.0"
+    VERSION = "2.1.0"
   end
 end

data/lib/omniauth/strategies/shopify.rb

@@ -17,6 +17,7 @@ module OmniAuth
 
       option :callback_url
       option :myshopify_domain, 'myshopify.com'
+      option :old_client_secret
 
       # When `true`, the user's permission level will apply (in addition to
       # the requested access scope) when making API requests to Shopify.
@@ -61,8 +62,10 @@ module OmniAuth
 
         return false unless timestamp.to_i > Time.now.to_i - CODE_EXPIRES_AFTER
 
-        calculated_signature = self.class.hmac_sign(self.class.encoded_params_for_signature(params), options.client_secret)
-        Rack::Utils.secure_compare(calculated_signature, signature)
+        new_secret = options.client_secret
+        old_secret = options.old_client_secret
+
+        validate_signature(new_secret) || (old_secret && validate_signature(old_secret))
       end
 
       def valid_scope?(token)
@@ -139,6 +142,14 @@ module OmniAuth
       def callback_url
         options[:callback_url] || full_host + script_name + callback_path
       end
+
+      private
+
+      def validate_signature(secret)
+        params = request.GET
+        calculated_signature = self.class.hmac_sign(self.class.encoded_params_for_signature(params), secret)
+        Rack::Utils.secure_compare(calculated_signature, params['hmac'])
+      end
     end
   end
 end

data/test/integration_test.rb

@@ -52,7 +52,7 @@ class IntegrationTest < Minitest::Test
       response = authorize(shop)
       assert_auth_failure(response, 'invalid_site')
 
-      response = callback(sign_params(shop: shop, code: code))
+      response = callback(sign_with_new_secret(shop: shop, code: code))
       assert_auth_failure(response, 'invalid_site')
     end
   end
@@ -62,7 +62,7 @@ class IntegrationTest < Minitest::Test
     code = SecureRandom.hex(16)
     expect_access_token_request(access_token, OmniAuth::Strategies::Shopify::DEFAULT_SCOPE)
 
-    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    response = callback(sign_with_new_secret(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
 
     assert_callback_success(response, access_token, code)
   end
@@ -73,7 +73,7 @@ class IntegrationTest < Minitest::Test
     code = SecureRandom.hex(16)
     expect_access_token_request(access_token, OmniAuth::Strategies::Shopify::DEFAULT_SCOPE)
 
-    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]).merge(signature: 'ignored'))
+    response = callback(sign_with_new_secret(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]).merge(signature: 'ignored'))
 
     assert_callback_success(response, access_token, code)
   end
@@ -100,21 +100,21 @@ class IntegrationTest < Minitest::Test
     code = SecureRandom.hex(16)
     expect_access_token_request(access_token, 'read_orders,write_products')
 
-    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    response = callback(sign_with_new_secret(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
 
     assert_callback_success(response, access_token, code)
   end
 
   def test_callback_rejects_invalid_hmac
     @secret = 'wrong_secret'
-    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: SecureRandom.hex(16)))
+    response = callback(sign_with_new_secret(shop: 'snowdevil.myshopify.com', code: SecureRandom.hex(16)))
 
     assert_auth_failure(response, 'invalid_signature')
   end
 
   def test_callback_rejects_old_timestamps
     expired_timestamp = Time.now.to_i - OmniAuth::Strategies::Shopify::CODE_EXPIRES_AFTER - 1
-    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: SecureRandom.hex(16), timestamp: expired_timestamp))
+    response = callback(sign_with_new_secret(shop: 'snowdevil.myshopify.com', code: SecureRandom.hex(16), timestamp: expired_timestamp))
 
     assert_auth_failure(response, 'invalid_signature')
   end
@@ -129,7 +129,7 @@ class IntegrationTest < Minitest::Test
 
   def test_callback_rejects_body_params
     code = SecureRandom.hex(16)
-    params = sign_params(shop: 'snowdevil.myshopify.com', code: code)
+    params = sign_with_new_secret(shop: 'snowdevil.myshopify.com', code: code)
     body = Rack::Utils.build_nested_query(unsigned: 'value')
 
     response = request.get("https://app.example.com/auth/shopify/callback?#{Rack::Utils.build_query(params)}",
@@ -189,7 +189,7 @@ class IntegrationTest < Minitest::Test
     code = SecureRandom.hex(16)
     expect_access_token_request(access_token, OmniAuth::Strategies::Shopify::DEFAULT_SCOPE)
 
-    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: 'invalid'))
+    response = callback(sign_with_new_secret(shop: 'snowdevil.myshopify.com', code: code, state: 'invalid'))
 
     assert_equal 302, response.status
     assert_equal '/auth/failure?message=csrf_detected&strategy=shopify', response.location
@@ -200,7 +200,7 @@ class IntegrationTest < Minitest::Test
     code = SecureRandom.hex(16)
     expect_access_token_request(access_token, 'some_invalid_scope', nil)
 
-    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    response = callback(sign_with_new_secret(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
 
     assert_equal 302, response.status
     assert_equal '/auth/failure?message=invalid_scope&strategy=shopify', response.location
@@ -211,7 +211,7 @@ class IntegrationTest < Minitest::Test
     code = SecureRandom.hex(16)
     expect_access_token_request(access_token, nil)
 
-    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    response = callback(sign_with_new_secret(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
 
     assert_equal 302, response.status
     assert_equal '/auth/failure?message=invalid_scope&strategy=shopify', response.location
@@ -224,7 +224,7 @@ class IntegrationTest < Minitest::Test
     code = SecureRandom.hex(16)
     expect_access_token_request(access_token, 'first_scope')
 
-    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    response = callback(sign_with_new_secret(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
 
     assert_equal 302, response.status
     assert_equal '/auth/failure?message=invalid_scope&strategy=shopify', response.location
@@ -237,7 +237,7 @@ class IntegrationTest < Minitest::Test
     code = SecureRandom.hex(16)
     expect_access_token_request(access_token, 'second_scope,first_scope,third_scope')
 
-    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    response = callback(sign_with_new_secret(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
 
     assert_equal 302, response.status
     assert_equal '/auth/failure?message=invalid_scope&strategy=shopify', response.location
@@ -250,7 +250,7 @@ class IntegrationTest < Minitest::Test
     code = SecureRandom.hex(16)
     expect_access_token_request(access_token, 'second_scope,first_scope')
 
-    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    response = callback(sign_with_new_secret(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
 
     assert_callback_success(response, access_token, code)
   end
@@ -262,7 +262,7 @@ class IntegrationTest < Minitest::Test
     code = SecureRandom.hex(16)
     expect_access_token_request(access_token, 'read_content,write_products')
 
-    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    response = callback(sign_with_new_secret(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
 
     assert_callback_success(response, access_token, code)
   end
@@ -274,7 +274,7 @@ class IntegrationTest < Minitest::Test
     code = SecureRandom.hex(16)
     expect_access_token_request(access_token, 'scope', { id: 1, email: 'bob@bobsen.com'})
 
-    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    response = callback(sign_with_new_secret(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
 
     assert_equal 302, response.status
     assert_equal '/auth/failure?message=invalid_permissions&strategy=shopify', response.location
@@ -287,7 +287,7 @@ class IntegrationTest < Minitest::Test
     code = SecureRandom.hex(16)
     expect_access_token_request(access_token, 'scope', nil)
 
-    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    response = callback(sign_with_new_secret(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
 
     assert_equal 302, response.status
     assert_equal '/auth/failure?message=invalid_permissions&strategy=shopify', response.location
@@ -300,18 +300,45 @@ class IntegrationTest < Minitest::Test
     code = SecureRandom.hex(16)
     expect_access_token_request(access_token, 'scope', { id: 1, email: 'bob@bobsen.com'})
 
-    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+    response = callback(sign_with_new_secret(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
 
     assert_equal 200, response.status
   end
 
+  def test_callback_works_with_old_secret
+    build_app scope: OmniAuth::Strategies::Shopify::DEFAULT_SCOPE
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, OmniAuth::Strategies::Shopify::DEFAULT_SCOPE)
+
+    signed_params = sign_with_old_secret(
+      shop: 'snowdevil.myshopify.com',
+      code: code,
+      state: opts["rack.session"]["omniauth.state"]
+    )
+
+    response = callback(signed_params)
+
+    assert_callback_success(response, access_token, code)
+  end
+
   private
 
-  def sign_params(params)
-    params = params.dup
+  def sign_with_old_secret(params)
+    params = add_time(params)
+    encoded_params = OmniAuth::Strategies::Shopify.encoded_params_for_signature(params)
+    params['hmac'] = OmniAuth::Strategies::Shopify.hmac_sign(encoded_params, @old_secret)
+    params
+  end
 
+  def add_time(params)
+    params = params.dup
     params[:timestamp] ||= Time.now.to_i
+    params
+  end
 
+  def sign_with_new_secret(params)
+    params = add_time(params)
     encoded_params = OmniAuth::Strategies::Shopify.encoded_params_for_signature(params)
     params['hmac'] = OmniAuth::Strategies::Shopify.hmac_sign(encoded_params, @secret)
     params
@@ -344,6 +371,9 @@ class IntegrationTest < Minitest::Test
   end
 
   def build_app(options={})
+    @old_secret = '12d34s1'
+    @secret = '53cr3tz'
+    options.merge!(old_client_secret: @old_secret)
     app = proc { |env|
       @omniauth_result = env['omniauth.auth']
       [200, {Rack::CONTENT_TYPE => "text/plain"}, "OK"]
@@ -351,9 +381,8 @@ class IntegrationTest < Minitest::Test
 
     opts["rack.session"]["omniauth.state"] = SecureRandom.hex(32)
     app = OmniAuth::Builder.new(app) do
-      provider :shopify, '123', '53cr3tz', options
+      provider :shopify, '123', '53cr3tz' , options
     end
-    @secret = '53cr3tz'
     @app = Rack::Session::Cookie.new(app, secret: SecureRandom.hex(64))
   end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-shopify-oauth2
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.1.0
 platform: ruby
 authors:
 - Denis Odorcic
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-11-14 00:00:00.000000000 Z
+date: 2019-02-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-oauth2
@@ -124,7 +124,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.14
+rubygems_version: 2.7.6
 signing_key: 
 specification_version: 4
 summary: Shopify strategy for OmniAuth