omniauth-skubana 0.1.2 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7cd05be9bdf0ec07c398468998ef496aa1d2ae10e2861748844300f5bc52e985
-  data.tar.gz: 3dcbf6c2e6f253d65fa617b61c5bcbcebef60e0e0b9eb127b5c484e883729ef2
+  metadata.gz: 80d19c6f5ab2fb372a01532cfb1814e2ae34efbf840323a89f8c425a399a780d
+  data.tar.gz: 19781d6be1140de429cb33a8580fcc37ac67a7eb9699c18b149f500323e25d8c
 SHA512:
-  metadata.gz: 3553d866b7ee643ee99ef5fc6638ec31daf782d8026cc548c0e22b61d7cb58a2290a9f9f131bfd4f908ded0297c0220b7bd2b8d798595673d688953601635726
-  data.tar.gz: 0cd9a0ab7b33792dd788fa8fb2d404150943f1ff26689b93d1cfa6417353307775b9c6e5ca3e0c723cb45d22be45361b99506451833ab223b89a2b0c4a348ece
+  metadata.gz: da2d068c3a63273dba2e8449ca7b339c52385c57a1a4390a312b112a2a9f7eb79d8bf8e96fa4e8e1d9a69ef043da0541ee085e6f04c911c2ab59a1b2eb42cd58
+  data.tar.gz: 402082bfeb8a1716ac77c34eca629f1014928eec66202cae4e6d715297a8d4cf48052ad831e70dc202a82a5e81ec7a9024b994c91419398da566032670f8bd7d

data/CHANGELOG.md

@@ -0,0 +1,72 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+## [Unreleased]
+
+### Changed
+
+- **Breaking:** the OAuth `state` check is enforced. The strategy no longer sets
+  `provider_ignores_state`, so a callback whose `state` is missing or doesn't match the
+  session fails with `csrf_detected`. App Store installs need `app_store_install`.
+- The gem version now comes from the release tag. `lib/omniauth-skubana/version.rb` reads
+  a top-level `VERSION` file, committed as a `0.0.0` placeholder, which the release
+  workflow writes from the tag with its leading `v` stripped.
+
+### Added
+
+- `app_store_install` option, for a provider registered with its callback at the URI
+  registered for the app with Skubana. An App Store install arrives there with `cid` and
+  `code` but no `state`: such callbacks skip the state check and exchange the code with
+  `redirect_uri=<callback URL>?cid=<cid>`, as Skubana requires. Previously such codes
+  failed with `invalid_grant`.
+
+## [0.2.0] - 2026-10-19
+
+### Changed
+
+- **Breaking:** requires `omniauth ~> 2.0` and `omniauth-oauth2 >= 1.8, < 2` (previously an
+  unpinned `omniauth-oauth2`). Host applications must be on OmniAuth 2.x; Rails apps also
+  need [`omniauth-rails_csrf_protection`](https://github.com/cookpad/omniauth-rails_csrf_protection)
+  because OmniAuth 2 only accepts `POST` for the request phase.
+- Requires Ruby >= 3.2.
+- The token request now authenticates through `client_options[:auth_scheme] = :basic_auth`
+  instead of a hand-built `Authorization` header. On `oauth2` 2.x this sends the same
+  request as before; on `oauth2` 1.x it also stops sending `client_id`/`client_secret` in
+  the token request body. This removes the `base64` require, which is no longer a default
+  gem as of Ruby 3.4.
+- Development toolchain: Bundler 4.x, `rake ~> 13.0`, `rspec ~> 3.13`.
+- Replaced Travis CI with GitHub Actions, testing Ruby 3.2 through 3.4.
+- Releases are now cut from the GitHub Releases UI: publishing a `vX.Y.Z` release reruns
+  the matrix, checks the tag against `version.rb`, and publishes to RubyGems.org via
+  trusted publishing (OIDC, no stored API key).
+
+### Added
+
+- `LICENSE.txt` (MIT), now declared in the gemspec.
+- Integration specs covering the request phase, the token exchange, the `redirect_uri`
+  and the auth hash.
+- A weekly `bundle-audit` run, so a new advisory against the locked `oauth2`/`rack`
+  chain surfaces here rather than in a consuming app.
+
+### Fixed
+
+- `callback_url` drops the request's query string, so `/auth/skubana?type=shopping` no
+  longer sends a `redirect_uri` that does not match the one registered with Skubana, and
+  a mount prefix is included only once. (This was tagged as `v0.1.3` but never published
+  to RubyGems.)
+- `bin/console` required a non-existent `omniauth/skubana` file.
+- Development scripts in `bin/` and other scaffolding are no longer packaged in the gem.
+
+## [0.1.2] - 2020-05-21
+
+- Upgraded `omniauth-oauth2` and removed its version constraint.
+
+## [0.1.0] - 2016-08-25
+
+- Initial published strategy.
+
+[Unreleased]: https://github.com/dropstream/omniauth-skubana/compare/v0.2.0...master
+[0.2.0]: https://github.com/dropstream/omniauth-skubana/releases/tag/v0.2.0
+[0.1.2]: https://rubygems.org/gems/omniauth-skubana/versions/0.1.2
+[0.1.0]: https://rubygems.org/gems/omniauth-skubana/versions/0.1.0

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2016-2026 Dropstream
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -1,8 +1,10 @@
 # OmniAuth Skubana
 
-This is an OmniAuth strategy for authenticating to Skubana. To use it, you'll need to sign up as an App Developer with 
+This is an OmniAuth strategy for authenticating to Skubana. To use it, you'll need to sign up as an App Developer with
 Skubana to receive an AppKey and AppSecret.
 
+Requires Ruby >= 3.2, OmniAuth 2.x and `omniauth-oauth2` 1.8 or later.
+
 ## Installation
 
 Add this line to your application's Gemfile:
@@ -21,21 +23,120 @@ Or install it yourself as:
 
 ## Usage
 
-````ruby
-OmniAuth::Builder do
-    provider :skubana,
-              'app_key', 'app_secret',
-              :callback_url => "http://www.example.com/auth/skubana/callback",                             
-              :scope => 'read_inventory+write_inventory'
+OmniAuth 2 only accepts `POST` for the request phase. In a Rails app, add
+[`omniauth-rails_csrf_protection`](https://github.com/cookpad/omniauth-rails_csrf_protection)
+to your Gemfile and link to the provider with `button_to` or `link_to ..., method: :post`.
 
+```ruby
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider :skubana,
+           'app_key', 'app_secret',
+           :callback_url => "http://www.example.com/auth/skubana/callback",
+           :scope => 'read_inventory write_inventory'
 end
-````
+```
+
+Scopes are space-separated. Don't join them with `+`: it is sent encoded as `%2B`, and
+Skubana rejects it with `invalid_scope`.
+
+The auth hash carries the token under `credentials`:
+
+```ruby
+auth = request.env['omniauth.auth']
+auth['credentials']['token']
+```
+
+## Configuring
+
+### Configure the site
+
+`client_options[:site]` defaults to `https://app.skubana.com`. Point it elsewhere to
+authenticate against Skubana's demo environment:
+
+```ruby
+  :client_options => { :site => 'https://demo.skubana.com' }
+```
+
+### Configure the callback URL
+
+The strategy overrides `callback_url` to drop the query string that OmniAuth would
+otherwise append, because Skubana rejects a `redirect_uri` that does not match the
+registered one exactly. Pass `callback_url` to override it outright; otherwise it is
+derived from the request, including the mount prefix.
+
+### App Store installs
+
+An install from Skubana's App Store doesn't go through the request phase: Skubana
+redirects straight to the callback URI registered for the app with `?cid=...&code=...`,
+and no `state`. The code is bound to that registered URI, and must be exchanged with
+`redirect_uri=<registered URI>?cid=<cid>`.
+
+To accept App Store installs, register the strategy a second time, under its own name,
+with its callback at the registered URI and `app_store_install` set:
+
+```ruby
+  provider :skubana, 'app_key', 'app_secret',
+           :name => 'skubana_app_store',
+           :callback_path => '/apps/skubana/install',
+           :callback_url => 'https://www.example.com/apps/skubana/install',
+           :request_path => ->(_env) { false },
+           :app_store_install => true
+```
+
+On that provider, a callback that carries a `cid` and no `state` skips OmniAuth's CSRF
+state check and is exchanged with the `cid` appended. Any other callback is checked as
+usual. Note what accepting installs gives up: anyone can send a signed-in user to that
+URI with a `cid` and `code` of their own, and the user's account gets connected to that
+Skubana account.
+
+### Client credentials in the token request
+
+`client_options[:auth_scheme]` is pinned to `:basic_auth`, because Skubana expects the
+AppKey and AppSecret as HTTP Basic auth on the token request.
 
 ## Development
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+After checking out the repo, run `bin/setup` to install dependencies. Then, run `bundle exec rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+
+To install this gem onto your local machine, run `bundle exec rake install`.
+
+Run `bundle exec bundle-audit check --update` to check the locked dependency tree against
+the advisory database; CI runs the same check weekly.
+
+## Releasing
+
+Releases are cut from the [GitHub Releases UI](https://github.com/dropstream/omniauth-skubana/releases/new);
+GitHub Actions builds and publishes the gem to [rubygems.org](https://rubygems.org) via
+[RubyGems trusted publishing](https://guides.rubygems.org/trusted-publishing/), so no API
+key is stored in the repo and the gemspec can keep `rubygems_mfa_required`.
+
+1. Add a `CHANGELOG.md` section for the new version, along with a link definition for the
+   new heading at the bottom of that file, and merge it to `master`. There is no version
+   to bump: the committed `VERSION` file is a `0.0.0` placeholder.
+2. Draft a new release with the target set to `master` and the tag set to the version
+   prefixed with `v` — `v0.3.0`, not `0.3.0`. The workflow strips the `v` and uses the
+   rest as the gem version.
+3. Click **Generate release notes** — the preferred method — then publish. The generated
+   notes list the merged pull requests; `CHANGELOG.md` carries the curated prose and
+   links back to each release.
+
+Publishing creates the tag, which fires the `Release` workflow: it reruns the full test
+matrix, refuses to continue unless the tag looks like `vX.Y.Z`, writes the version into
+`VERSION` (and `Gemfile.lock`) in its own checkout, and pushes the gem. That change is
+never pushed back to the repo. Note that RubyGems versions are immutable — a bad release
+can be yanked, never replaced, so double-check the tag before publishing.
+
+### One-time RubyGems setup
+
+Needed before the first release from CI, and again only if the gem is renamed or moved:
+on rubygems.org open the gem -> **Trusted publishers** -> **Create**, with owner
+`dropstream`, repository `omniauth-skubana`, workflow `release.yml`, and environment
+`release`. The repo also needs an environment named `release`.
 
 ## Contributing
 
 Bug reports and pull requests are welcome on GitHub at https://github.com/dropstream/omniauth-skubana.
 
+## License
+
+Available as open source under the terms of the [MIT License](LICENSE.txt).

data/VERSION

@@ -0,0 +1 @@
+0.2.1

data/lib/omniauth/strategies/skubana.rb

@@ -1,5 +1,6 @@
+# frozen_string_literal: true
+
 require 'omniauth-oauth2'
-require 'base64'
 
 module OmniAuth
   module Strategies
@@ -8,25 +9,50 @@ module OmniAuth
       option :client_options, {
         :authorize_url => '/oauth/authorize',
         :token_url => '/oauth/token',
-        :site => 'https://app.skubana.com'
+        :site => 'https://app.skubana.com',
+        # Skubana expects the client credentials as HTTP Basic auth on the token
+        # request. Pinned so it doesn't depend on the oauth2 version's default
+        # (oauth2 1.x defaulted to :request_body).
+        :auth_scheme => :basic_auth
       }
 
       option :callback_url
-      
-      option :provider_ignores_state, true
-            
-      protected 
 
-      def build_access_token
-        options.token_params.merge!(:headers => {'Authorization' => basic_auth_header })
+      # Set on a provider registered for App Store installs, with its
+      # callback_path at the callback URI registered for the app with Skubana.
+      # An install is started by Skubana, not by us: it redirects there with
+      # `?cid=...&code=...` and no state to check. Accepting that means anyone
+      # can deliver a code of their choosing to a signed-in user's callback, so
+      # installs are only handled when the host app sets this.
+      option :app_store_install, false
+
+      def callback_phase
+        # Safe to change: OmniAuth dups the options for every request.
+        options.provider_ignores_state = true if app_store_install?
         super
       end
-      
+
+      # OmniAuth::Strategy#callback_url appends the callback request's own query
+      # string, which would send those params to Skubana as part of redirect_uri.
+      # Skubana requires redirect_uri to exactly match the URI registered for the
+      # app. Note that omniauth 2's `callback_path` already carries SCRIPT_NAME,
+      # so mount prefixes must not be added again.
+      #
+      # An App Store install's code must be exchanged with
+      # `redirect_uri=<registered URI>?cid=<cid>`.
+      def callback_url
+        url = options[:callback_url] || (full_host + callback_path)
+        app_store_install? ? "#{url}?cid=#{request.params["cid"]}" : url
+      end
+
       private
 
-      def basic_auth_header
-        "Basic " + Base64.strict_encode64("#{options[:client_id]}:#{options[:client_secret]}")
-      end      
+      def app_store_install?
+        return false unless options.app_store_install && @env
+
+        cid = request.params["cid"]
+        cid.is_a?(String) && !cid.empty? && request.params["state"].to_s.empty?
+      end
     end
   end
 end

data/lib/omniauth-skubana/version.rb

@@ -1,5 +1,9 @@
+# frozen_string_literal: true
+
 module OmniAuth
   module Skubana
-    VERSION = "0.1.2"
+    # The release workflow writes VERSION from the release tag; the committed
+    # value is a 0.0.0 placeholder.
+    VERSION = File.read(File.expand_path("../../VERSION", __dir__)).strip
   end
 end

data/lib/omniauth-skubana.rb

@@ -1,2 +1,4 @@
+# frozen_string_literal: true
+
 require 'omniauth-skubana/version'
 require 'omniauth/strategies/skubana'

data/omniauth-skubana.gemspec

@@ -1,33 +1,37 @@
-# coding: utf-8
-lib = File.expand_path('../lib', __FILE__)
+# frozen_string_literal: true
+
+lib = File.expand_path("lib", __dir__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
-require 'omniauth-skubana/version'
+require "omniauth-skubana/version"
 
 Gem::Specification.new do |spec|
   spec.name          = "omniauth-skubana"
   spec.version       = OmniAuth::Skubana::VERSION
   spec.authors       = ["Karl Falconer"]
-  spec.email         = ["karl.falconer@falconerdevelopment.com"]
+  spec.email         = ["karl.falconer@getdropstream.com"]
 
-  spec.summary       = %q{OmniAuth strategy for Skubana}
-  spec.description   = %q{In this gem you will find an OmniAuth Skubana strategy.}
+  spec.summary       = "OmniAuth strategy for Skubana"
+  spec.description   = "In this gem you will find an OmniAuth Skubana strategy."
   spec.homepage      = "https://github.com/dropstream/omniauth-skubana"
+  spec.license       = "MIT"
 
-  # Prevent pushing this gem to RubyGems.org by setting 'allowed_push_host', or
-  # delete this section to allow pushing this gem to any host.
-  if spec.respond_to?(:metadata)
-    spec.metadata['allowed_push_host'] = "https://rubygems.org"
-  else
-    raise "RubyGems 2.0 or newer is required to protect against public gem pushes."
-  end
+  spec.required_ruby_version = ">= 3.2"
 
-  spec.files         = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
-  spec.bindir        = "exe"
-  spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
-  spec.require_paths = ["lib"]
+  spec.metadata["allowed_push_host"] = "https://rubygems.org"
+  spec.metadata["homepage_uri"]      = spec.homepage
+  spec.metadata["source_code_uri"]   = spec.homepage
+  spec.metadata["changelog_uri"]     = "#{spec.homepage}/blob/master/CHANGELOG.md"
+  spec.metadata["rubygems_mfa_required"] = "true"
 
-  spec.add_runtime_dependency 'omniauth-oauth2'
+  # Ship only the library itself; development scaffolding stays out of the gem.
+  spec.files = Dir.chdir(__dir__) do
+    `git ls-files -z`.split("\x0").reject do |f|
+      f.match(%r{\A(?:spec|bin|pkg|\.github)/}) ||
+        f.match(%r{\A(?:\.gitignore|\.rspec|\.ruby-version|\.ruby-gemset|Gemfile|Gemfile\.lock|Rakefile)\z})
+    end
+  end
+  spec.require_paths = ["lib"]
 
-  spec.add_development_dependency "rake", "~> 10.0"
-  spec.add_development_dependency "rspec"
+  spec.add_dependency "omniauth", "~> 2.0"
+  spec.add_dependency "omniauth-oauth2", ">= 1.8", "< 2"
 end

metadata

@@ -1,83 +1,72 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-skubana
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.2.1
 platform: ruby
 authors:
 - Karl Falconer
-autorequire: 
-bindir: exe
+bindir: bin
 cert_chain: []
-date: 2020-05-21 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: omniauth-oauth2
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rake
+  name: omniauth
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
-  type: :development
+        version: '2.0'
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '2.0'
 - !ruby/object:Gem::Dependency
-  name: rspec
+  name: omniauth-oauth2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
+        version: '1.8'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2'
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.8'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2'
 description: In this gem you will find an OmniAuth Skubana strategy.
 email:
-- karl.falconer@falconerdevelopment.com
+- karl.falconer@getdropstream.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".gitignore"
-- ".rspec"
-- ".ruby-gemset"
-- ".ruby-version"
-- ".travis.yml"
-- Gemfile
+- CHANGELOG.md
+- LICENSE.txt
 - README.md
-- Rakefile
-- bin/console
-- bin/setup
+- VERSION
 - lib/omniauth-skubana.rb
 - lib/omniauth-skubana/version.rb
 - lib/omniauth/strategies/skubana.rb
 - omniauth-skubana.gemspec
 homepage: https://github.com/dropstream/omniauth-skubana
-licenses: []
+licenses:
+- MIT
 metadata:
   allowed_push_host: https://rubygems.org
-post_install_message: 
+  homepage_uri: https://github.com/dropstream/omniauth-skubana
+  source_code_uri: https://github.com/dropstream/omniauth-skubana
+  changelog_uri: https://github.com/dropstream/omniauth-skubana/blob/master/CHANGELOG.md
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -85,15 +74,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.8
-signing_key: 
+rubygems_version: 3.6.9
 specification_version: 4
 summary: OmniAuth strategy for Skubana
 test_files: []

data/.gitignore

@@ -1,9 +0,0 @@
-/.bundle/
-/.yardoc
-/Gemfile.lock
-/_yardoc/
-/coverage/
-/doc/
-/pkg/
-/spec/reports/
-/tmp/

data/.rspec

@@ -1,2 +0,0 @@
---format documentation
---color

data/.ruby-gemset

@@ -1 +0,0 @@
-omniauth-skubana

data/.ruby-version

@@ -1 +0,0 @@
-ruby-2.4.4

data/.travis.yml

@@ -1,4 +0,0 @@
-language: ruby
-rvm:
-  - 2.4.4
-before_install: gem install bundler -v 1.16

data/Gemfile

@@ -1,4 +0,0 @@
-source 'https://rubygems.org'
-
-# Specify your gem's dependencies in omniauth-skubana.gemspec
-gemspec

data/Rakefile

@@ -1,6 +0,0 @@
-require "bundler/gem_tasks"
-require "rspec/core/rake_task"
-
-RSpec::Core::RakeTask.new(:spec)
-
-task :default => :spec

data/bin/console

@@ -1,14 +0,0 @@
-#!/usr/bin/env ruby
-
-require "bundler/setup"
-require "omniauth/skubana"
-
-# You can add fixtures and/or initialization code here to make experimenting
-# with your gem easier. You can also use a different console, if you like.
-
-# (If you use this, don't forget to add pry to your Gemfile!)
-# require "pry"
-# Pry.start
-
-require "irb"
-IRB.start

data/bin/setup

@@ -1,7 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-IFS=$'\n\t'
-
-bundle install
-
-# Do any other automated setup that you need to do here