omniauth-shopline 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 01e751e6d88dcef0f68c96602a5d3a335602d9deb45a946d5c3c077492bac924
+  data.tar.gz: f3fad501ab98759d9a4721b715488ea48ba50a54992848df9234eaef3ce55b2a
+SHA512:
+  metadata.gz: ff0a41880509b2cce52b843a03017c486ddb167b28889b171a39e406b049b731a44d8652b88bfe78fb45e2b8494173fa8e485a45582063ec737c2a36fd280755
+  data.tar.gz: c87fa791adf2c9e92299256af917a56736a0084acfb191ab4be080a37416f632cc6f3dc1702f6ad353903251426c5677371cfeeb0a8fe6e245b2f58c0b364894

data/CHANGELOG.md

@@ -0,0 +1,78 @@
+# Changelog
+
+All notable changes to this project are documented in this file. Each version heading
+links to its [GitHub release](https://github.com/dropstream/omniauth-shopline/releases),
+where the notes are generated from the merged pull requests.
+
+## [0.1.0] - 2026-08-27
+
+First release published to RubyGems.org. Everything below is relative to the state of
+`master` before it, which is how the gem was installed until now (`git:` in a Gemfile).
+
+### Changed
+
+- Runtime dependencies are declared as `omniauth >= 2.0, < 4` and
+  `omniauth-oauth2 >= 1.8, < 3`. A plugin's ceiling becomes a ceiling in every
+  application that installs it, so this allows the next major of both gems rather than
+  blocking consumers on the day one ships. The floors are where OmniAuth 2 support
+  actually begins — `omniauth-oauth2` 1.8.0 is its first release to require
+  `omniauth ~> 2.0` — and CI runs the suite against those floors as well as against the
+  newest resolvable versions.
+- Requires Ruby >= 3.2, tested on 3.2 through 4.0.
+- The app key and secret are read from the `client_id`/`client_secret` positional
+  arguments, with `app_key`/`app_secret` accepted as named options. Previously the
+  strategy read `options.app_key`, which the positional arguments never set, so every
+  request went out with an empty `appKey`.
+- `client_options[:site]` is only derived from `handle` when it still holds the
+  `{handle}` placeholder, so an explicitly configured site now survives.
+- Removed the unused `token_params` default (`grant_type: authorization_code`). The
+  token endpoint takes only `{"code": ...}`, so the option never reached SHOPLINE.
+- Development toolchain: Bundler 4.x, `rake ~> 13.0`, `rspec ~> 3.13`, `webmock ~> 3.25`.
+- Added GitHub Actions for CI, a weekly `bundle-audit` run, and releases published to
+  RubyGems.org from the GitHub Releases UI via trusted publishing (OIDC, no stored API
+  key).
+
+### Added
+
+- `LICENSE.txt` (MIT) is declared in the gemspec, along with `required_ruby_version` and
+  the usual `homepage`/`changelog`/`rubygems_mfa_required` metadata.
+- CSRF protection for the callback. SHOPLINE has no `state` parameter, so the nonce
+  travels in `customField` — the documented pass-through — and is verified against the
+  session. Disable with `verify_state: false`.
+- Verification of the `sign` SHOPLINE appends to the callback query, computed the way
+  [SHOPLINE's own SDK](https://github.com/shoplineos/shopline-sdk-go/blob/main/client/sign.go)
+  computes it. Disable with `verify_signature: false`.
+- `scope` in the credentials hash, which the README documented but the code did not
+  provide.
+- `handle` is exposed as a reader on the strategy.
+- Integration specs covering the request phase, the token exchange and its signature,
+  state and signature verification, the auth hash, and the `callback_url` overrides.
+
+### Fixed
+
+- The authorize URL put its query string in front of the `#` fragment
+  (`/admin/oauth-web/?appKey=...#/oauth/authorize`), because `OAuth2::Client#authorize_url`
+  cannot build a URL for a hash-routed page. SHOPLINE's admin page never read those
+  params. It is now built by hand as
+  `/admin/oauth-web/#/oauth/authorize?appKey=...`.
+- The token request was signed with the sorted-parameter scheme SHOPLINE uses for GETs
+  (`appkey=..&timestamp=..`). A POST is signed over the request body concatenated with
+  the millisecond timestamp, and the signed string is now the exact body that is sent.
+- Every callback failed with `csrf_detected`: the request phase never wrote
+  `omniauth.state`, and SHOPLINE does not echo a `state` parameter, so
+  `OmniAuth::Strategies::OAuth2#callback_phase` rejected the callback before the token
+  exchange.
+- `callback_url` no longer doubles a mount prefix. The override added `script_name` to
+  `callback_path`, but OmniAuth 2 moved `script_name` into `callback_path` itself, so a
+  strategy mounted under a prefix (for example Devise's `/users`) would have sent
+  `redirectUri=http://host/users/users/auth/shopline/callback`.
+- A token response without an access token used to `fail!` from inside
+  `build_access_token` and hand the resulting Rack triple back as the access token. It
+  now raises `OAuth2::Error`, which OmniAuth turns into an `invalid_credentials` failure.
+- The callback nonce and signature are compared in constant time.
+- The token's `scope` reaches `OAuth2::AccessToken` under a string key. It was passed
+  with a symbol key, which `access_token.params['scope']` never found, so
+  `extra['scope']` was always `nil`.
+- Development scripts in `bin/` and the spec suite are no longer packaged into the gem.
+
+[0.1.0]: https://github.com/dropstream/omniauth-shopline/releases/tag/v0.1.0

data/LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Dropstream
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,198 @@
+# OmniAuth SHOPLINE
+
+An OmniAuth strategy for authenticating with [SHOPLINE](https://www.shopline.com) using
+its [OAuth 2.0 app authorization flow](https://developer.shopline.com/docs/apps/api-instructions-for-use/app-authorization/).
+
+Requires Ruby >= 3.2 and OmniAuth 2.x.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'omniauth-shopline'
+```
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install omniauth-shopline
+
+## Usage
+
+OmniAuth 2 only accepts `POST` for the request phase. In a Rails app, add
+[`omniauth-rails_csrf_protection`](https://github.com/cookpad/omniauth-rails_csrf_protection)
+to your Gemfile and link to the provider with `button_to` or `link_to ..., method: :post`:
+
+```ruby
+gem 'omniauth-rails_csrf_protection'
+```
+
+```ruby
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider :shopline,
+           'app_key', 'app_secret',
+           handle: 'your-store',
+           scope: 'read_products,read_orders'
+end
+```
+
+`handle` is the store subdomain (`your-store` in `https://your-store.myshopline.com`) and
+is required — it is what the authorize and token endpoints are addressed against. It is
+read once, when the strategy is built, so serving several stores means one `provider`
+entry per store.
+
+The two positional arguments are SHOPLINE's app key and app secret. They may also be
+passed by name, which takes precedence:
+
+```ruby
+  provider :shopline, handle: 'your-store', app_key: 'app_key', app_secret: 'app_secret'
+```
+
+## Auth hash
+
+```ruby
+auth = request.env['omniauth.auth']
+
+auth['provider']               # => "shopline"
+auth['credentials']['token']   # => the access token, valid for ten hours
+auth['credentials']['expires_at'] # => 1762800000 (seconds since the epoch)
+auth['credentials']['expires']    # => true
+auth['credentials']['scope']   # => "read_products,read_orders"
+auth['extra']['handle']        # => "your-store"
+auth['extra']['scope']         # => "read_products,read_orders"
+```
+
+SHOPLINE's token response identifies a store, not a person, and the strategy does not set
+`uid`. Key records on `extra['handle']`.
+
+## Configuring
+
+### The callback URL
+
+The strategy overrides `callback_url` to drop the query string OmniAuth would otherwise
+append, because SHOPLINE matches `redirectUri` against the app's registered callback URLs
+exactly. Otherwise it is derived from the request, including the mount prefix — a strategy
+mounted under Devise's `/users` produces
+`https://app.example.com/users/auth/shopline/callback`.
+
+Pass `redirect_uri` (or `callback_url`) to override it outright:
+
+```ruby
+  redirect_uri: 'https://app.example.com/users/auth/shopline/callback'
+```
+
+### Callback verification
+
+SHOPLINE's authorize endpoint has no `state` parameter, so the CSRF nonce travels in
+`customField`, the documented pass-through, and is checked against the session when the
+callback comes back. SHOPLINE also signs the callback query string; the strategy verifies
+that `sign` the way [SHOPLINE's own SDK](https://github.com/shoplineos/shopline-sdk-go/blob/main/client/sign.go)
+does. Both checks are on by default and can be turned off individually:
+
+```ruby
+  verify_state: false,     # skip the customField nonce check
+  verify_signature: false  # skip the `sign` check
+```
+
+`provider_ignores_state` is left at `true` on purpose: SHOPLINE never sends `state`, so
+`OmniAuth::Strategies::OAuth2`'s own check can never pass. Use `verify_state` instead.
+
+### The store host
+
+`client_options[:site]` defaults to `https://{handle}.myshopline.com` with the placeholder
+filled in from `handle`. Setting it explicitly wins, which is useful for pointing the
+strategy at a proxy or a test double:
+
+```ruby
+  client_options: { site: 'https://shopline.test' }
+```
+
+## How it differs from a plain OAuth 2 strategy
+
+Three parts of SHOPLINE's flow are not standard OAuth 2, and the strategy handles each
+itself rather than inheriting it:
+
+1. The authorize endpoint is a hash-routed admin page
+   (`/admin/oauth-web/#/oauth/authorize`), so its query string sits *after* the fragment
+   and cannot be built by `OAuth2::Client#authorize_url`.
+2. There is no `state` parameter (see above).
+3. `POST /admin/oauth/token/create` authenticates with `appkey`, `timestamp` and `sign`
+   headers rather than client credentials, takes `{"code": "..."}` as its whole body, and
+   answers with the token nested under `data`. SHOPLINE signs a POST over the request body
+   concatenated with the millisecond timestamp — not the sorted-parameter scheme it uses
+   for GETs.
+
+## Development
+
+After checking out the repo, run `bin/setup` to install dependencies. Then run
+`bundle exec rake spec` to run the tests. You can also run `bin/console` for an
+interactive prompt.
+
+To install this gem onto your local machine, run `bundle exec rake install`.
+
+The gemspec allows a wide dependency range, so CI also runs the suite against the oldest
+versions it permits. To reproduce that locally:
+
+    $ BUNDLE_GEMFILE=gemfiles/floor.gemfile bundle install
+    $ BUNDLE_GEMFILE=gemfiles/floor.gemfile bundle exec rake spec
+
+Run `bundle exec bundle-audit check --update` to check the locked dependency tree against
+the advisory database; CI runs the same check weekly.
+
+## Releasing
+
+Releases are cut from the [GitHub Releases UI](https://github.com/dropstream/omniauth-shopline/releases/new);
+GitHub Actions builds and publishes the gem to [rubygems.org](https://rubygems.org) via
+[RubyGems trusted publishing](https://guides.rubygems.org/trusted-publishing/), so no API
+key is stored in the repo and the gemspec can keep `rubygems_mfa_required`.
+
+1. Bump `VERSION` in `lib/omniauth-shopline/version.rb` and add a `CHANGELOG.md` section
+   for it, along with a link definition for the new heading at the bottom of that file.
+   Commit both on `master`.
+2. Draft a new release with the target set to `master` and the tag set to the version
+   prefixed with `v` — `v0.1.0`, not `0.1.0`. The prefix is stripped before comparing
+   against `version.rb`; the gem version itself carries no `v`.
+3. Click **Generate release notes** — the preferred method — then publish. The generated
+   notes list the merged pull requests; `CHANGELOG.md` carries the curated prose and
+   links back to each release.
+
+Publishing creates the tag, which fires the `Release` workflow: it reruns the full test
+matrix, refuses to continue if the tag and `version.rb` disagree, and pushes the gem.
+Note that RubyGems versions are immutable — a bad release can be yanked, never replaced,
+so the version bump has to be committed before the release is published.
+
+### One-time RubyGems setup
+
+This gem has never been pushed, so the first release needs a **pending** trusted
+publisher, which both claims the name `omniauth-shopline` and makes you an owner of it
+once the push succeeds. On rubygems.org, open
+[pending trusted publishers](https://rubygems.org/profile/oidc/pending_trusted_publishers)
+-> **Create**, with:
+
+| Field | Value |
+| --- | --- |
+| RubyGem name | `omniauth-shopline` |
+| Repository owner | `dropstream` |
+| Repository name | `omniauth-shopline` |
+| Workflow filename | `release.yml` |
+| Environment | `release` |
+
+The repo also needs a GitHub environment named `release` (Settings -> Environments ->
+New environment), because the publishing job runs in it.
+
+After the first successful push the pending publisher becomes an ordinary trusted
+publisher, managed from the gem's own **Trusted publishers** page. It only needs
+revisiting if the gem is renamed or the repository moves.
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at
+https://github.com/dropstream/omniauth-shopline.
+
+## License
+
+Available as open source under the terms of the [MIT License](LICENSE.txt).

data/lib/omniauth/strategies/shopline.rb

@@ -0,0 +1,245 @@
+# frozen_string_literal: true
+
+require "json"
+require "openssl"
+require "securerandom"
+require "uri"
+
+require "omniauth-oauth2"
+
+module OmniAuth
+  module Strategies
+    # OmniAuth strategy for SHOPLINE's OAuth 2.0 app authorization flow.
+    #
+    # https://developer.shopline.com/docs/apps/api-instructions-for-use/app-authorization/
+    #
+    # SHOPLINE deviates from plain OAuth 2 in three ways that this strategy has to
+    # handle itself rather than inherit:
+    #
+    # 1. The authorize endpoint is a hash-routed admin page, so its query string sits
+    #    *after* the `#` fragment and cannot be built by `OAuth2::Client#authorize_url`.
+    # 2. There is no `state` parameter. `customField` is the documented pass-through,
+    #    so the CSRF nonce travels in it (see #verify_state).
+    # 3. The token endpoint authenticates with `appkey`/`timestamp`/`sign` headers
+    #    instead of client credentials, and signs POSTs over the request body.
+    class Shopline < OmniAuth::Strategies::OAuth2
+      SITE_TEMPLATE = "https://%<handle>s.myshopline.com"
+
+      # The placeholder is replaced with the configured handle unless the consumer
+      # supplies a site of their own.
+      DEFAULT_SITE = "https://{handle}.myshopline.com"
+
+      STATE_SESSION_KEY = "omniauth.shopline.state"
+
+      option :name, "shopline"
+
+      option :client_options, {
+        site: DEFAULT_SITE,
+        authorize_url: "/admin/oauth-web/#/oauth/authorize",
+        token_url: "/admin/oauth/token/create"
+      }
+
+      # SHOPLINE calls these the app key and app secret. They are the OAuth2
+      # client_id/client_secret positional arguments, and may also be passed by name.
+      option :app_key, nil
+      option :app_secret, nil
+
+      # SHOPLINE never sends `state`, so OmniAuth::Strategies::OAuth2's own check can
+      # never pass. Leave this alone and use :verify_state / :verify_signature below.
+      option :provider_ignores_state, true
+
+      # Round-trips a CSRF nonce through SHOPLINE's `customField` parameter.
+      option :verify_state, true
+
+      # Verifies the `sign` SHOPLINE appends to the callback query string.
+      option :verify_signature, true
+
+      attr_reader :handle
+
+      def initialize(app, *args, &block)
+        super
+
+        @handle = options[:handle] || raise(ArgumentError, "handle is required")
+
+        site = options.client_options[:site]
+        return unless site.nil? || site.to_s.include?("{handle}")
+
+        options.client_options[:site] = format(SITE_TEMPLATE, handle: @handle)
+      end
+
+      def app_key
+        options.app_key || options.client_id
+      end
+
+      def app_secret
+        options.app_secret || options.client_secret
+      end
+
+      # The authorize URL is built by hand: `/admin/oauth-web/#/oauth/authorize` is a
+      # client-side route, so the query string belongs after the fragment. Handing the
+      # path to `OAuth2::Client#authorize_url` would produce
+      # `/admin/oauth-web/?appKey=...#/oauth/authorize`, which the page never reads.
+      def authorize_url
+        client_options = options.client_options
+        query = URI.encode_www_form(authorize_params_for_shopline)
+
+        "#{client_options[:site]}#{client_options[:authorize_url]}?#{query}"
+      end
+
+      def request_phase
+        redirect authorize_url
+      end
+
+      def callback_phase
+        error = request.params["error"].to_s
+        unless error.empty?
+          return fail!(error.to_sym, CallbackError.new(error, request.params["error_description"]))
+        end
+
+        return fail!(:csrf_detected, CallbackError.new(:csrf_detected, "CSRF detected")) unless valid_state?
+
+        unless valid_signature?
+          return fail!(:invalid_signature, CallbackError.new(:invalid_signature, "Signature verification failed"))
+        end
+
+        super
+      end
+
+      # POST /admin/oauth/token/create, authenticated by the appkey/timestamp/sign
+      # headers rather than by client credentials, and answered with the token nested
+      # under `data`.
+      def build_access_token
+        timestamp = current_timestamp
+        body = JSON.generate(code: request.params["code"])
+
+        response = client.request(
+          :post,
+          options.client_options[:token_url],
+          body: body,
+          headers: {
+            "Content-Type" => "application/json",
+            "appkey" => app_key.to_s,
+            "timestamp" => timestamp.to_s,
+            "sign" => signature_for_body(body, timestamp)
+          }
+        )
+
+        access_token_from(response)
+      end
+
+      # OmniAuth::Strategy#callback_url appends the callback request's own query
+      # string, which would send those params to SHOPLINE as part of redirect_uri and
+      # fail the registered-URL match. Note that omniauth 2's `callback_path` already
+      # carries SCRIPT_NAME, so mount prefixes must not be added again.
+      def callback_url
+        options[:callback_url] || options[:redirect_uri] || (full_host + callback_path)
+      end
+
+      # OmniAuth merges this with OmniAuth::Strategies::OAuth2's own credentials block
+      # (token, expires_at, expires) rather than replacing it.
+      credentials do
+        {"scope" => access_token.params["scope"]}.compact
+      end
+
+      extra do
+        {
+          "handle" => handle,
+          "scope" => access_token.params["scope"]
+        }
+      end
+
+      private
+
+      def authorize_params_for_shopline
+        params = {
+          appKey: app_key,
+          responseType: "code",
+          scope: options.scope,
+          redirectUri: callback_url
+        }
+
+        params[:customField] = new_state if options.verify_state
+        params.compact
+      end
+
+      # SHOPLINE has no `state` parameter, but `customField` is passed through to the
+      # callback untouched, so it carries the nonce.
+      def new_state
+        state = SecureRandom.hex(24)
+        session[STATE_SESSION_KEY] = state
+        state
+      end
+
+      def valid_state?
+        return true unless options.verify_state
+
+        expected = session.delete(STATE_SESSION_KEY)
+        !expected.to_s.empty? && secure_compare(request.params["customField"], expected)
+      end
+
+      # SHOPLINE signs the callback query the same way it signs any GET: the params
+      # other than `sign`, sorted by key and joined as `k=v&k=v`.
+      # https://developer.shopline.com/docs/apps/api-instructions-for-use/generate-and-verify-signatures/
+      def valid_signature?
+        return true unless options.verify_signature
+
+        received = request.GET["sign"]
+        return false if received.to_s.empty?
+
+        secure_compare(received, signature_for_query(request.GET))
+      end
+
+      def access_token_from(response)
+        parsed = response.parsed
+        data = parsed["data"] if parsed.is_a?(Hash)
+        token = data["accessToken"] if data.is_a?(Hash)
+
+        raise ::OAuth2::Error, response if token.to_s.empty?
+
+        ::OAuth2::AccessToken.new(
+          client,
+          token,
+          "expires_at" => data["expireTime"],
+          "scope" => data["scope"]
+        )
+      end
+
+      # Milliseconds since the epoch, as SHOPLINE's `timestamp` header requires.
+      def current_timestamp
+        (Time.now.to_f * 1000).to_i
+      end
+
+      # SHOPLINE signs a POST over the request body concatenated with the timestamp --
+      # not the sorted-parameter scheme used for GETs. The body passed here must be the
+      # exact string that is sent.
+      # https://github.com/shoplineos/shopline-sdk-go/blob/main/client/sign.go
+      def signature_for_body(body, timestamp)
+        hmac_sha256("#{body}#{timestamp}")
+      end
+
+      def signature_for_query(params)
+        source = params.reject { |key, _| key.to_s == "sign" }
+                       .sort_by { |key, _| key.to_s }
+                       .map { |key, value| "#{key}=#{value}" }
+                       .join("&")
+
+        hmac_sha256(source)
+      end
+
+      def hmac_sha256(source)
+        secret = app_secret.to_s
+        raise ArgumentError, "app_secret is required to sign SHOPLINE requests" if secret.empty?
+
+        OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new("sha256"), secret, source)
+      end
+
+      def secure_compare(received, expected)
+        received = received.to_s
+        expected = expected.to_s
+        return false unless received.bytesize == expected.bytesize
+
+        OpenSSL.fixed_length_secure_compare(received, expected)
+      end
+    end
+  end
+end

data/lib/omniauth-shopline/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Omniauth
+  module Shopline
+    VERSION = "0.1.0"
+  end
+end

data/lib/omniauth-shopline.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+require "omniauth-shopline/version"
+require "omniauth/strategies/shopline"

data/omniauth-shopline.gemspec

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+lib = File.expand_path("lib", __dir__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require "omniauth-shopline/version"
+
+Gem::Specification.new do |spec|
+  spec.name          = "omniauth-shopline"
+  spec.version       = Omniauth::Shopline::VERSION
+  spec.authors       = ["Dropstream"]
+  spec.email         = ["karl.falconer@getdropstream.com"]
+
+  spec.summary       = "OmniAuth strategy for SHOPLINE"
+  spec.description   = "In this gem you will find an OmniAuth SHOPLINE strategy"
+  spec.homepage      = "https://github.com/dropstream/omniauth-shopline"
+  spec.license       = "MIT"
+
+  spec.required_ruby_version = ">= 3.2"
+
+  spec.metadata["allowed_push_host"] = "https://rubygems.org"
+  spec.metadata["homepage_uri"]      = spec.homepage
+  spec.metadata["changelog_uri"]     = "#{spec.homepage}/blob/master/CHANGELOG.md"
+  spec.metadata["rubygems_mfa_required"] = "true"
+
+  # Ship only the library itself; development scaffolding stays out of the gem.
+  spec.files = Dir.chdir(__dir__) do
+    `git ls-files -z`.split("\x0").reject do |f|
+      f.match(%r{\A(?:spec|bin|pkg|gemfiles|\.github)/}) ||
+        f.match(%r{\A(?:\.gitignore|\.rspec|\.ruby-version|\.ruby-gemset|Gemfile|Gemfile\.lock|Rakefile)\z})
+    end
+  end
+  spec.require_paths = ["lib"]
+
+  # Deliberately loose. This is a plugin: a ceiling here becomes a ceiling in every
+  # consuming application, so it allows the next major of both gems rather than
+  # blocking upgrades on the day one ships. The floors are where OmniAuth 2 support
+  # actually begins -- omniauth-oauth2 1.8.0 is its first release to require
+  # `omniauth ~> 2.0` -- and CI runs the suite against those floors as well as against
+  # the newest resolvable versions.
+  spec.add_dependency "omniauth", ">= 2.0", "< 4"
+  spec.add_dependency "omniauth-oauth2", ">= 1.8", "< 3"
+end

metadata

@@ -0,0 +1,91 @@
+--- !ruby/object:Gem::Specification
+name: omniauth-shopline
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Dropstream
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: omniauth
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+- !ruby/object:Gem::Dependency
+  name: omniauth-oauth2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.8'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.8'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
+description: In this gem you will find an OmniAuth SHOPLINE strategy
+email:
+- karl.falconer@getdropstream.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE.txt
+- README.md
+- lib/omniauth-shopline.rb
+- lib/omniauth-shopline/version.rb
+- lib/omniauth/strategies/shopline.rb
+- omniauth-shopline.gemspec
+homepage: https://github.com/dropstream/omniauth-shopline
+licenses:
+- MIT
+metadata:
+  allowed_push_host: https://rubygems.org
+  homepage_uri: https://github.com/dropstream/omniauth-shopline
+  changelog_uri: https://github.com/dropstream/omniauth-shopline/blob/master/CHANGELOG.md
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.2'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: OmniAuth strategy for SHOPLINE
+test_files: []