omniauth-skubana 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 9cf036ae19f6d3d5b24a4f0bc7d64a84e754ed7c
-  data.tar.gz: 001c844592b32d93df32836d4ee2f4517c69529f
+SHA256:
+  metadata.gz: cf465c6f804232f21358d25a1ec37d8b19d21f45b1809152ba04d6fed6cc1a37
+  data.tar.gz: d0f3400463df8476a185831e61edd0812f82a8b83c84e3851ef69ab5f866adc4
 SHA512:
-  metadata.gz: 7a907ac03ca8fc356b9703f97e911945164b83a466ca7baf918adde30a06b5f3e7a12e7cf1bdf05556193bce69275dce72c11868f7fe57b0e5b15ce38a9b1097
-  data.tar.gz: 13b172b80fd2d0de7a335169a26dd4c40073b73d762bb78ddedd1c3ec7d5d1172dc72641a3dc6c073c71a7f28836a22f7541f9d15cfee4f2abae7f54b95ad7e5
+  metadata.gz: 5c4439c2a44cb8da6d4b3b472a1d95c0f548558ac71d15778d026256d0a78ed907bf0122e8afbc0a977bbbcce265995de9da1d07338a2123686c8277eff2ca30
+  data.tar.gz: c2e35dc901b768e97b991c5496781bff14e95784cc1111aaad73995ad9dd8bfc394cb7f4d81179ba7f059c056aef1001c2929eb4239aae018866d8ec3a90c35c

data/CHANGELOG.md

@@ -0,0 +1,52 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+## [0.2.0] - 2026-10-19
+
+### Changed
+
+- **Breaking:** requires `omniauth ~> 2.0` and `omniauth-oauth2 >= 1.8, < 2` (previously an
+  unpinned `omniauth-oauth2`). Host applications must be on OmniAuth 2.x; Rails apps also
+  need [`omniauth-rails_csrf_protection`](https://github.com/cookpad/omniauth-rails_csrf_protection)
+  because OmniAuth 2 only accepts `POST` for the request phase.
+- Requires Ruby >= 3.2.
+- The token request now authenticates through `client_options[:auth_scheme] = :basic_auth`
+  instead of a hand-built `Authorization` header. On `oauth2` 2.x this sends the same
+  request as before; on `oauth2` 1.x it also stops sending `client_id`/`client_secret` in
+  the token request body. This removes the `base64` require, which is no longer a default
+  gem as of Ruby 3.4.
+- Development toolchain: Bundler 4.x, `rake ~> 13.0`, `rspec ~> 3.13`.
+- Replaced Travis CI with GitHub Actions, testing Ruby 3.2 through 3.4.
+- Releases are now cut from the GitHub Releases UI: publishing a `vX.Y.Z` release reruns
+  the matrix, checks the tag against `version.rb`, and publishes to RubyGems.org via
+  trusted publishing (OIDC, no stored API key).
+
+### Added
+
+- `LICENSE.txt` (MIT), now declared in the gemspec.
+- Integration specs covering the request phase, the token exchange, the `redirect_uri`
+  and the auth hash.
+- A weekly `bundle-audit` run, so a new advisory against the locked `oauth2`/`rack`
+  chain surfaces here rather than in a consuming app.
+
+### Fixed
+
+- `callback_url` drops the request's query string, so `/auth/skubana?type=shopping` no
+  longer sends a `redirect_uri` that does not match the one registered with Skubana, and
+  a mount prefix is included only once. (This was tagged as `v0.1.3` but never published
+  to RubyGems.)
+- `bin/console` required a non-existent `omniauth/skubana` file.
+- Development scripts in `bin/` and other scaffolding are no longer packaged in the gem.
+
+## [0.1.2] - 2020-05-21
+
+- Upgraded `omniauth-oauth2` and removed its version constraint.
+
+## [0.1.0] - 2016-08-25
+
+- Initial published strategy.
+
+[0.2.0]: https://github.com/dropstream/omniauth-skubana/releases/tag/v0.2.0
+[0.1.2]: https://rubygems.org/gems/omniauth-skubana/versions/0.1.2
+[0.1.0]: https://rubygems.org/gems/omniauth-skubana/versions/0.1.0

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2016-2026 Dropstream
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -1,8 +1,10 @@
 # OmniAuth Skubana
 
-This is an OmniAuth strategy for authenticating to Skubana. To use it, you'll need to sign up as an App Developer with 
+This is an OmniAuth strategy for authenticating to Skubana. To use it, you'll need to sign up as an App Developer with
 Skubana to receive an AppKey and AppSecret.
 
+Requires Ruby >= 3.2, OmniAuth 2.x and `omniauth-oauth2` 1.8 or later.
+
 ## Installation
 
 Add this line to your application's Gemfile:
@@ -21,21 +23,94 @@ Or install it yourself as:
 
 ## Usage
 
-````ruby
-OmniAuth::Builder do
-    provider :skubana,
-              'app_key', 'app_secret',
-              :callback_url => "http://www.example.com/auth/skubana/callback",                             
-              :scope => 'read_inventory+write_inventory'
+OmniAuth 2 only accepts `POST` for the request phase. In a Rails app, add
+[`omniauth-rails_csrf_protection`](https://github.com/cookpad/omniauth-rails_csrf_protection)
+to your Gemfile and link to the provider with `button_to` or `link_to ..., method: :post`.
 
+```ruby
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider :skubana,
+           'app_key', 'app_secret',
+           :callback_url => "http://www.example.com/auth/skubana/callback",
+           :scope => 'read_inventory write_inventory'
 end
-````
+```
+
+Scopes are space-separated. Don't join them with `+`: it is sent encoded as `%2B`, and
+Skubana rejects it with `invalid_scope`.
+
+The auth hash carries the token under `credentials`:
+
+```ruby
+auth = request.env['omniauth.auth']
+auth['credentials']['token']
+```
+
+## Configuring
+
+### Configure the site
+
+`client_options[:site]` defaults to `https://app.skubana.com`. Point it elsewhere to
+authenticate against Skubana's demo environment:
+
+```ruby
+  :client_options => { :site => 'https://demo.skubana.com' }
+```
+
+### Configure the callback URL
+
+The strategy overrides `callback_url` to drop the query string that OmniAuth would
+otherwise append, because Skubana rejects a `redirect_uri` that does not match the
+registered one exactly. Pass `callback_url` to override it outright; otherwise it is
+derived from the request, including the mount prefix.
+
+### Client credentials in the token request
+
+`client_options[:auth_scheme]` is pinned to `:basic_auth`, because Skubana expects the
+AppKey and AppSecret as HTTP Basic auth on the token request.
 
 ## Development
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+After checking out the repo, run `bin/setup` to install dependencies. Then, run `bundle exec rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+
+To install this gem onto your local machine, run `bundle exec rake install`.
+
+Run `bundle exec bundle-audit check --update` to check the locked dependency tree against
+the advisory database; CI runs the same check weekly.
+
+## Releasing
+
+Releases are cut from the [GitHub Releases UI](https://github.com/dropstream/omniauth-skubana/releases/new);
+GitHub Actions builds and publishes the gem to [rubygems.org](https://rubygems.org) via
+[RubyGems trusted publishing](https://guides.rubygems.org/trusted-publishing/), so no API
+key is stored in the repo and the gemspec can keep `rubygems_mfa_required`.
+
+1. Bump `VERSION` in `lib/omniauth-skubana/version.rb` and add a `CHANGELOG.md` section
+   for it, along with a link definition for the new heading at the bottom of that file.
+   Commit both on `master`.
+2. Draft a new release with the target set to `master` and the tag set to the version
+   prefixed with `v` — `v0.2.0`, not `0.2.0`. The prefix is stripped before comparing
+   against `version.rb`; the gem version itself carries no `v`.
+3. Click **Generate release notes** — the preferred method — then publish. The generated
+   notes list the merged pull requests; `CHANGELOG.md` carries the curated prose and
+   links back to each release.
+
+Publishing creates the tag, which fires the `Release` workflow: it reruns the full test
+matrix, refuses to continue if the tag and `version.rb` disagree, and pushes the gem.
+Note that RubyGems versions are immutable — a bad release can be yanked, never replaced,
+so the version bump has to be committed before the release is published.
+
+### One-time RubyGems setup
+
+Needed before the first release from CI, and again only if the gem is renamed or moved:
+on rubygems.org open the gem -> **Trusted publishers** -> **Create**, with owner
+`dropstream`, repository `omniauth-skubana`, workflow `release.yml`, and environment
+`release`. The repo also needs an environment named `release`.
 
 ## Contributing
 
 Bug reports and pull requests are welcome on GitHub at https://github.com/dropstream/omniauth-skubana.
 
+## License
+
+Available as open source under the terms of the [MIT License](LICENSE.txt).

data/lib/omniauth/strategies/skubana.rb

@@ -1,5 +1,6 @@
+# frozen_string_literal: true
+
 require 'omniauth-oauth2'
-require 'base64'
 
 module OmniAuth
   module Strategies
@@ -8,25 +9,25 @@ module OmniAuth
       option :client_options, {
         :authorize_url => '/oauth/authorize',
         :token_url => '/oauth/token',
-        :site => 'https://app.skubana.com'
+        :site => 'https://app.skubana.com',
+        # Skubana expects the client credentials as HTTP Basic auth on the token
+        # request. Pinned so it doesn't depend on the oauth2 version's default
+        # (oauth2 1.x defaulted to :request_body).
+        :auth_scheme => :basic_auth
       }
 
       option :callback_url
-      
+
       option :provider_ignores_state, true
-            
-      protected 
 
-      def build_access_token
-        options.token_params.merge!(:headers => {'Authorization' => basic_auth_header })
-        super
+      # OmniAuth::Strategy#callback_url appends the callback request's own query
+      # string, which would send those params to Skubana as part of redirect_uri.
+      # Skubana requires redirect_uri to exactly match the URI registered for the
+      # app. Note that omniauth 2's `callback_path` already carries SCRIPT_NAME,
+      # so mount prefixes must not be added again.
+      def callback_url
+        options[:callback_url] || (full_host + callback_path)
       end
-      
-      private
-
-      def basic_auth_header
-        "Basic " + Base64.strict_encode64("#{options[:client_id]}:#{options[:client_secret]}")
-      end      
     end
   end
 end

data/lib/omniauth-skubana/version.rb

@@ -1,5 +1,7 @@
+# frozen_string_literal: true
+
 module OmniAuth
   module Skubana
-    VERSION = "0.1.0"
+    VERSION = "0.2.0"
   end
 end

data/lib/omniauth-skubana.rb

@@ -1,2 +1,4 @@
+# frozen_string_literal: true
+
 require 'omniauth-skubana/version'
 require 'omniauth/strategies/skubana'

data/omniauth-skubana.gemspec

@@ -1,34 +1,37 @@
-# coding: utf-8
-lib = File.expand_path('../lib', __FILE__)
+# frozen_string_literal: true
+
+lib = File.expand_path("lib", __dir__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
-require 'omniauth-skubana/version'
+require "omniauth-skubana/version"
 
 Gem::Specification.new do |spec|
   spec.name          = "omniauth-skubana"
   spec.version       = OmniAuth::Skubana::VERSION
   spec.authors       = ["Karl Falconer"]
-  spec.email         = ["karl.falconer@falconerdevelopment.com"]
+  spec.email         = ["karl.falconer@getdropstream.com"]
 
-  spec.summary       = %q{OmniAuth strategy for Skubana}
-  spec.description   = %q{In this gem you will find an OmniAuth Skubana strategy.}
+  spec.summary       = "OmniAuth strategy for Skubana"
+  spec.description   = "In this gem you will find an OmniAuth Skubana strategy."
   spec.homepage      = "https://github.com/dropstream/omniauth-skubana"
+  spec.license       = "MIT"
 
-  # Prevent pushing this gem to RubyGems.org by setting 'allowed_push_host', or
-  # delete this section to allow pushing this gem to any host.
-  if spec.respond_to?(:metadata)
-    spec.metadata['allowed_push_host'] = "https://rubygems.org"
-  else
-    raise "RubyGems 2.0 or newer is required to protect against public gem pushes."
-  end
+  spec.required_ruby_version = ">= 3.2"
 
-  spec.files         = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
-  spec.bindir        = "exe"
-  spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
-  spec.require_paths = ["lib"]
+  spec.metadata["allowed_push_host"] = "https://rubygems.org"
+  spec.metadata["homepage_uri"]      = spec.homepage
+  spec.metadata["source_code_uri"]   = spec.homepage
+  spec.metadata["changelog_uri"]     = "#{spec.homepage}/blob/master/CHANGELOG.md"
+  spec.metadata["rubygems_mfa_required"] = "true"
 
-  spec.add_runtime_dependency 'omniauth-oauth2', '~> 1.1.0'
+  # Ship only the library itself; development scaffolding stays out of the gem.
+  spec.files = Dir.chdir(__dir__) do
+    `git ls-files -z`.split("\x0").reject do |f|
+      f.match(%r{\A(?:spec|bin|pkg|\.github)/}) ||
+        f.match(%r{\A(?:\.gitignore|\.rspec|\.ruby-version|\.ruby-gemset|Gemfile|Gemfile\.lock|Rakefile)\z})
+    end
+  end
+  spec.require_paths = ["lib"]
 
-  spec.add_development_dependency "bundler", "~> 1.10"
-  spec.add_development_dependency "rake", "~> 10.0"
-  spec.add_development_dependency "rspec"
+  spec.add_dependency "omniauth", "~> 2.0"
+  spec.add_dependency "omniauth-oauth2", ">= 1.8", "< 2"
 end

metadata

@@ -1,97 +1,71 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-skubana
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Karl Falconer
-autorequire: 
-bindir: exe
+bindir: bin
 cert_chain: []
-date: 2016-08-25 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: omniauth-oauth2
+  name: omniauth
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.1.0
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.1.0
+        version: '2.0'
 - !ruby/object:Gem::Dependency
-  name: bundler
+  name: omniauth-oauth2
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.10'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.10'
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
+        version: '1.8'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '10.0'
-  type: :development
+        version: '2'
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '10.0'
-- !ruby/object:Gem::Dependency
-  name: rspec
-  requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
+        version: '1.8'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '2'
 description: In this gem you will find an OmniAuth Skubana strategy.
 email:
-- karl.falconer@falconerdevelopment.com
+- karl.falconer@getdropstream.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".gitignore"
-- ".rspec"
-- ".ruby-gemset"
-- ".ruby-version"
-- ".travis.yml"
-- Gemfile
+- CHANGELOG.md
+- LICENSE.txt
 - README.md
-- Rakefile
-- bin/console
-- bin/setup
 - lib/omniauth-skubana.rb
 - lib/omniauth-skubana/version.rb
 - lib/omniauth/strategies/skubana.rb
 - omniauth-skubana.gemspec
 homepage: https://github.com/dropstream/omniauth-skubana
-licenses: []
+licenses:
+- MIT
 metadata:
   allowed_push_host: https://rubygems.org
-post_install_message: 
+  homepage_uri: https://github.com/dropstream/omniauth-skubana
+  source_code_uri: https://github.com/dropstream/omniauth-skubana
+  changelog_uri: https://github.com/dropstream/omniauth-skubana/blob/master/CHANGELOG.md
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -99,16 +73,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.4.5.1
-signing_key: 
+rubygems_version: 3.6.9
 specification_version: 4
 summary: OmniAuth strategy for Skubana
 test_files: []

data/.gitignore

@@ -1,9 +0,0 @@
-/.bundle/
-/.yardoc
-/Gemfile.lock
-/_yardoc/
-/coverage/
-/doc/
-/pkg/
-/spec/reports/
-/tmp/

data/.rspec

@@ -1,2 +0,0 @@
---format documentation
---color

data/.ruby-gemset

@@ -1 +0,0 @@
-omniauth-skubana

data/.ruby-version

@@ -1 +0,0 @@
-ruby-2.2.3

data/.travis.yml

@@ -1,4 +0,0 @@
-language: ruby
-rvm:
-  - 2.1.2
-before_install: gem install bundler -v 1.10.6

data/Gemfile

@@ -1,4 +0,0 @@
-source 'https://rubygems.org'
-
-# Specify your gem's dependencies in omniauth-skubana.gemspec
-gemspec

data/Rakefile

@@ -1,6 +0,0 @@
-require "bundler/gem_tasks"
-require "rspec/core/rake_task"
-
-RSpec::Core::RakeTask.new(:spec)
-
-task :default => :spec

data/bin/console

@@ -1,14 +0,0 @@
-#!/usr/bin/env ruby
-
-require "bundler/setup"
-require "omniauth/skubana"
-
-# You can add fixtures and/or initialization code here to make experimenting
-# with your gem easier. You can also use a different console, if you like.
-
-# (If you use this, don't forget to add pry to your Gemfile!)
-# require "pry"
-# Pry.start
-
-require "irb"
-IRB.start

data/bin/setup

@@ -1,7 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-IFS=$'\n\t'
-
-bundle install
-
-# Do any other automated setup that you need to do here