omniauth-skubana 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cf465c6f804232f21358d25a1ec37d8b19d21f45b1809152ba04d6fed6cc1a37
-  data.tar.gz: d0f3400463df8476a185831e61edd0812f82a8b83c84e3851ef69ab5f866adc4
+  metadata.gz: 80d19c6f5ab2fb372a01532cfb1814e2ae34efbf840323a89f8c425a399a780d
+  data.tar.gz: 19781d6be1140de429cb33a8580fcc37ac67a7eb9699c18b149f500323e25d8c
 SHA512:
-  metadata.gz: 5c4439c2a44cb8da6d4b3b472a1d95c0f548558ac71d15778d026256d0a78ed907bf0122e8afbc0a977bbbcce265995de9da1d07338a2123686c8277eff2ca30
-  data.tar.gz: c2e35dc901b768e97b991c5496781bff14e95784cc1111aaad73995ad9dd8bfc394cb7f4d81179ba7f059c056aef1001c2929eb4239aae018866d8ec3a90c35c
+  metadata.gz: da2d068c3a63273dba2e8449ca7b339c52385c57a1a4390a312b112a2a9f7eb79d8bf8e96fa4e8e1d9a69ef043da0541ee085e6f04c911c2ab59a1b2eb42cd58
+  data.tar.gz: 402082bfeb8a1716ac77c34eca629f1014928eec66202cae4e6d715297a8d4cf48052ad831e70dc202a82a5e81ec7a9024b994c91419398da566032670f8bd7d

data/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 All notable changes to this project are documented in this file.
 
+## [Unreleased]
+
+### Changed
+
+- **Breaking:** the OAuth `state` check is enforced. The strategy no longer sets
+  `provider_ignores_state`, so a callback whose `state` is missing or doesn't match the
+  session fails with `csrf_detected`. App Store installs need `app_store_install`.
+- The gem version now comes from the release tag. `lib/omniauth-skubana/version.rb` reads
+  a top-level `VERSION` file, committed as a `0.0.0` placeholder, which the release
+  workflow writes from the tag with its leading `v` stripped.
+
+### Added
+
+- `app_store_install` option, for a provider registered with its callback at the URI
+  registered for the app with Skubana. An App Store install arrives there with `cid` and
+  `code` but no `state`: such callbacks skip the state check and exchange the code with
+  `redirect_uri=<callback URL>?cid=<cid>`, as Skubana requires. Previously such codes
+  failed with `invalid_grant`.
+
 ## [0.2.0] - 2026-10-19
 
 ### Changed
@@ -47,6 +66,7 @@ All notable changes to this project are documented in this file.
 
 - Initial published strategy.
 
+[Unreleased]: https://github.com/dropstream/omniauth-skubana/compare/v0.2.0...master
 [0.2.0]: https://github.com/dropstream/omniauth-skubana/releases/tag/v0.2.0
 [0.1.2]: https://rubygems.org/gems/omniauth-skubana/versions/0.1.2
 [0.1.0]: https://rubygems.org/gems/omniauth-skubana/versions/0.1.0

data/README.md

@@ -64,6 +64,31 @@ otherwise append, because Skubana rejects a `redirect_uri` that does not match t
 registered one exactly. Pass `callback_url` to override it outright; otherwise it is
 derived from the request, including the mount prefix.
 
+### App Store installs
+
+An install from Skubana's App Store doesn't go through the request phase: Skubana
+redirects straight to the callback URI registered for the app with `?cid=...&code=...`,
+and no `state`. The code is bound to that registered URI, and must be exchanged with
+`redirect_uri=<registered URI>?cid=<cid>`.
+
+To accept App Store installs, register the strategy a second time, under its own name,
+with its callback at the registered URI and `app_store_install` set:
+
+```ruby
+  provider :skubana, 'app_key', 'app_secret',
+           :name => 'skubana_app_store',
+           :callback_path => '/apps/skubana/install',
+           :callback_url => 'https://www.example.com/apps/skubana/install',
+           :request_path => ->(_env) { false },
+           :app_store_install => true
+```
+
+On that provider, a callback that carries a `cid` and no `state` skips OmniAuth's CSRF
+state check and is exchanged with the `cid` appended. Any other callback is checked as
+usual. Note what accepting installs gives up: anyone can send a signed-in user to that
+URI with a `cid` and `code` of their own, and the user's account gets connected to that
+Skubana account.
+
 ### Client credentials in the token request
 
 `client_options[:auth_scheme]` is pinned to `:basic_auth`, because Skubana expects the
@@ -85,20 +110,21 @@ GitHub Actions builds and publishes the gem to [rubygems.org](https://rubygems.o
 [RubyGems trusted publishing](https://guides.rubygems.org/trusted-publishing/), so no API
 key is stored in the repo and the gemspec can keep `rubygems_mfa_required`.
 
-1. Bump `VERSION` in `lib/omniauth-skubana/version.rb` and add a `CHANGELOG.md` section
-   for it, along with a link definition for the new heading at the bottom of that file.
-   Commit both on `master`.
+1. Add a `CHANGELOG.md` section for the new version, along with a link definition for the
+   new heading at the bottom of that file, and merge it to `master`. There is no version
+   to bump: the committed `VERSION` file is a `0.0.0` placeholder.
 2. Draft a new release with the target set to `master` and the tag set to the version
-   prefixed with `v` — `v0.2.0`, not `0.2.0`. The prefix is stripped before comparing
-   against `version.rb`; the gem version itself carries no `v`.
+   prefixed with `v` — `v0.3.0`, not `0.3.0`. The workflow strips the `v` and uses the
+   rest as the gem version.
 3. Click **Generate release notes** — the preferred method — then publish. The generated
    notes list the merged pull requests; `CHANGELOG.md` carries the curated prose and
    links back to each release.
 
 Publishing creates the tag, which fires the `Release` workflow: it reruns the full test
-matrix, refuses to continue if the tag and `version.rb` disagree, and pushes the gem.
-Note that RubyGems versions are immutable — a bad release can be yanked, never replaced,
-so the version bump has to be committed before the release is published.
+matrix, refuses to continue unless the tag looks like `vX.Y.Z`, writes the version into
+`VERSION` (and `Gemfile.lock`) in its own checkout, and pushes the gem. That change is
+never pushed back to the repo. Note that RubyGems versions are immutable — a bad release
+can be yanked, never replaced, so double-check the tag before publishing.
 
 ### One-time RubyGems setup
 

data/VERSION

@@ -0,0 +1 @@
+0.2.1

data/lib/omniauth/strategies/skubana.rb

@@ -18,15 +18,40 @@ module OmniAuth
 
       option :callback_url
 
-      option :provider_ignores_state, true
+      # Set on a provider registered for App Store installs, with its
+      # callback_path at the callback URI registered for the app with Skubana.
+      # An install is started by Skubana, not by us: it redirects there with
+      # `?cid=...&code=...` and no state to check. Accepting that means anyone
+      # can deliver a code of their choosing to a signed-in user's callback, so
+      # installs are only handled when the host app sets this.
+      option :app_store_install, false
+
+      def callback_phase
+        # Safe to change: OmniAuth dups the options for every request.
+        options.provider_ignores_state = true if app_store_install?
+        super
+      end
 
       # OmniAuth::Strategy#callback_url appends the callback request's own query
       # string, which would send those params to Skubana as part of redirect_uri.
       # Skubana requires redirect_uri to exactly match the URI registered for the
       # app. Note that omniauth 2's `callback_path` already carries SCRIPT_NAME,
       # so mount prefixes must not be added again.
+      #
+      # An App Store install's code must be exchanged with
+      # `redirect_uri=<registered URI>?cid=<cid>`.
       def callback_url
-        options[:callback_url] || (full_host + callback_path)
+        url = options[:callback_url] || (full_host + callback_path)
+        app_store_install? ? "#{url}?cid=#{request.params["cid"]}" : url
+      end
+
+      private
+
+      def app_store_install?
+        return false unless options.app_store_install && @env
+
+        cid = request.params["cid"]
+        cid.is_a?(String) && !cid.empty? && request.params["state"].to_s.empty?
       end
     end
   end

data/lib/omniauth-skubana/version.rb

@@ -2,6 +2,8 @@
 
 module OmniAuth
   module Skubana
-    VERSION = "0.2.0"
+    # The release workflow writes VERSION from the release tag; the committed
+    # value is a 0.0.0 placeholder.
+    VERSION = File.read(File.expand_path("../../VERSION", __dir__)).strip
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-skubana
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Karl Falconer
@@ -53,6 +53,7 @@ files:
 - CHANGELOG.md
 - LICENSE.txt
 - README.md
+- VERSION
 - lib/omniauth-skubana.rb
 - lib/omniauth-skubana/version.rb
 - lib/omniauth/strategies/skubana.rb