omniauth-spotify 1.0.2 → 1.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cc8741608bbfa92369035a3998b72a27b73a17a67b603688d5cc55d9fdb47728
-  data.tar.gz: fdc122f1bb1adc612c2bb2de212c69da8a16ec4323a4b79ba178fccef1f4532f
+  metadata.gz: de25e7d9dc464fdd5bb4b7b8ffd945fd7ef6ccd025ac8d938f3bad368a1b7ae1
+  data.tar.gz: 4ec21d397695d96c73f3eff5d202462d62d882430b25e272406b60cc25955c53
 SHA512:
-  metadata.gz: ded11472a459b53ffcb5250e0f581a311b516cc1c2985d52ffdec91c3b0f1bb0596c64aa3210ca2d465ca426c50e1b1d10cdf1cb01a3340c9b2e6912a98536f6
-  data.tar.gz: ea62dfdad9b92d5813a3fffe1752e31d74d15f7e92a013d854a56b50dcf4454e17e072dd38c70f9f94225c475ee3aae70e0c7c93924f39d4de3b965ece499a7b
+  metadata.gz: 4735b6ad5984b8cbb9ab8d1e37e942b6a90edf67e0b0cfef1595133e8ccfd76320fa0e4048c40c15973719868586ea42fbb71a5aa6c8d3ede64bc6b6f5ba3149
+  data.tar.gz: 60e28c8cb306d54f96747c6a52120a61e4aa3156c903ee6ba67cfc4607bfe665262c622c79a13f13b54e8c6f4151839ee6e8244f306e208031acf823c5f6d34c

data/README.md

@@ -1,7 +1,7 @@
 # OmniAuth Spotify Strategy
 
 [![Test](https://github.com/icoretech/omniauth-spotify/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/icoretech/omniauth-spotify/actions/workflows/test.yml?query=branch%3Amain)
-[![Gem Version](https://img.shields.io/gem/v/omniauth-spotify.svg)](https://rubygems.org/gems/omniauth-spotify)
+[![Gem Version](https://badge.fury.io/rb/omniauth-spotify.svg)](https://badge.fury.io/rb/omniauth-spotify)
 
 `omniauth-spotify` provides a Spotify OAuth2 strategy for OmniAuth.
 
@@ -35,6 +35,9 @@ end
 - Spotify developer dashboard: <https://developer.spotify.com/dashboard>
 - OAuth scopes reference: <https://developer.spotify.com/documentation/web-api/concepts/scopes>
 - Register callback URL (example): `https://your-app.example.com/auth/spotify/callback`
+- The redirect URI must match exactly in Spotify's dashboard.
+- Spotify requires HTTPS redirect URIs except for loopback IP literals such as
+  `http://127.0.0.1:3000/auth/spotify/callback`; `localhost` is not accepted.
 
 ## Options
 
@@ -103,7 +106,38 @@ Example payload from `request.env['omniauth.auth']` (real shape, anonymized):
 }
 ```
 
-`info.image` and `info.birthdate` are included only when Spotify returns those fields.
+`info.email`, `info.image`, `info.birthdate`, `info.country_code`,
+`info.product`, and `info.follower_count` are included only when Spotify
+returns those fields.
+
+## Spotify API Changelog Notes
+
+The strategy still uses Spotify's authorization-code flow and
+`GET https://api.spotify.com/v1/me` for the current user profile.
+
+Recent changelog items reviewed:
+
+- February 2026 Development Mode changes: Spotify deprecated `country`,
+  `email`, `explicit_content`, `followers`, and `product` and may omit them
+  from `GET /me` user payloads for affected development-mode apps. The gem
+  treats these fields as optional and omits absent values from `info`.
+- March 2026 changelog: Spotify reverted the February removal of Album and
+  Track `external_ids`. This gem does not call Album or Track endpoints and
+  does not map `external_ids`, so no code change is required for that reversal.
+- February 2025 redirect URI security changes: Spotify rejects `localhost`
+  redirect URIs and requires HTTPS except for explicit loopback IP literals.
+- Development Mode access changes: if `GET /me` returns `403` with a message
+  requiring Spotify Premium for the app owner, OAuth token exchange may still
+  be working; the Web API call is blocked by Spotify account/app policy, not by
+  this strategy's auth-hash mapping.
+
+References:
+
+- <https://developer.spotify.com/documentation/web-api/tutorials/february-2026-migration-guide>
+- <https://developer.spotify.com/documentation/web-api/references/changes/february-2026>
+- <https://developer.spotify.com/documentation/web-api/references/changes/march-2026>
+- <https://developer.spotify.com/documentation/web-api/concepts/redirect_uri>
+- <https://developer.spotify.com/blog/2026-02-06-update-on-developer-access-and-platform-security>
 
 ## Development
 
@@ -128,7 +162,7 @@ RAILS_VERSION='~> 8.1.0' bundle exec rake test_rails_integration
 ## Compatibility
 
 - Ruby: `>= 3.2` (tested on `3.2`, `3.3`, `3.4`, `4.0`)
-- `omniauth-oauth2`: `>= 1.8`, `< 1.9`
+- `omniauth-oauth2`: `>= 1.8`, `< 2.0`
 - Rails integration lanes: `~> 7.1.0`, `~> 7.2.0`, `~> 8.0.0`, `~> 8.1.0`
 
 ## Release

data/lib/omniauth/spotify/version.rb

@@ -2,6 +2,6 @@
 
 module OmniAuth
   module Spotify
-    VERSION = '1.0.2'
+    VERSION = "1.0.4"
   end
 end

data/lib/omniauth/spotify.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 
-require 'omniauth/spotify/version'
-require 'omniauth/strategies/spotify'
+require "omniauth/spotify/version"
+require "omniauth/strategies/spotify"

data/lib/omniauth/strategies/spotify.rb

@@ -1,67 +1,67 @@
 # frozen_string_literal: true
 
-require 'date'
-require 'omniauth-oauth2'
+require "date"
+require "omniauth-oauth2"
 
 module OmniAuth
   module Strategies
     # OmniAuth strategy for Spotify OAuth2.
     class Spotify < OmniAuth::Strategies::OAuth2
-      option :name, 'spotify'
+      option :name, "spotify"
 
-      FORCE_APPROVAL_KEY = 'omniauth_spotify_force_approval?'
-      LEGACY_FORCE_APPROVAL_KEY = 'ommiauth_spotify_force_approval?'
+      FORCE_APPROVAL_KEY = "omniauth_spotify_force_approval?"
+      LEGACY_FORCE_APPROVAL_KEY = "ommiauth_spotify_force_approval?"
 
       option :client_options,
-             site: 'https://api.spotify.com',
-             authorize_url: 'https://accounts.spotify.com/authorize',
-             token_url: 'https://accounts.spotify.com/api/token',
-             connection_opts: {
-               headers: {
-                 user_agent: 'icoretech-omniauth-spotify gem',
-                 accept: 'application/json',
-                 content_type: 'application/json'
-               }
-             }
-
-      uid { raw_info['id'] }
+        site: "https://api.spotify.com",
+        authorize_url: "https://accounts.spotify.com/authorize",
+        token_url: "https://accounts.spotify.com/api/token",
+        connection_opts: {
+          headers: {
+            user_agent: "icoretech-omniauth-spotify gem",
+            accept: "application/json",
+            content_type: "application/json"
+          }
+        }
+
+      uid { raw_info["id"] }
 
       info do
         {
-          name: raw_info['display_name'] || raw_info['id'],
-          nickname: raw_info['id'],
-          email: raw_info['email'],
-          urls: raw_info['external_urls'],
+          name: raw_info["display_name"] || raw_info["id"],
+          nickname: raw_info["id"],
+          email: raw_info["email"],
+          urls: raw_info["external_urls"],
           image: image_url,
-          birthdate: parse_birthdate(raw_info['birthdate']),
-          country_code: raw_info['country'],
-          product: raw_info['product'],
-          follower_count: raw_info.dig('followers', 'total')
+          birthdate: parse_birthdate(raw_info["birthdate"]),
+          country_code: raw_info["country"],
+          product: raw_info["product"],
+          follower_count: raw_info.dig("followers", "total")
         }.compact
       end
 
       credentials do
         {
-          'token' => access_token.token,
-          'refresh_token' => access_token.refresh_token,
-          'expires_at' => access_token.expires_at,
-          'expires' => access_token.expires?,
-          'scope' => token_scope
+          "token" => access_token.token,
+          "refresh_token" => access_token.refresh_token,
+          "expires_at" => access_token.expires_at,
+          "expires" => access_token.expires?,
+          "scope" => token_scope
         }.compact
       end
 
       extra do
         {
-          'raw_info' => raw_info
+          "raw_info" => raw_info
         }
       end
 
       def raw_info
-        @raw_info ||= access_token.get('v1/me').parsed
+        @raw_info ||= access_token.get("v1/me").parsed
       end
 
       def image_url
-        raw_info.fetch('images', []).first&.fetch('url', nil)
+        raw_info.fetch("images", []).first&.fetch("url", nil)
       end
 
       def authorize_params
@@ -71,18 +71,18 @@ module OmniAuth
       end
 
       def request_phase
-        options[:authorize_params][:show_dialog] = request.params['show_dialog'] if request.params.key?('show_dialog')
+        options[:authorize_params][:show_dialog] = request.params["show_dialog"] if request.params.key?("show_dialog")
         super
       end
 
       def callback_url
-        return '' if @authorization_code_from_signed_request
+        return "" if @authorization_code_from_signed_request
 
         options[:callback_url] || super
       end
 
       def query_string
-        return '' if request.params['code']
+        return "" if request.params["code"]
 
         super
       end
@@ -91,7 +91,7 @@ module OmniAuth
 
       def token_scope
         token_params = access_token.respond_to?(:params) ? access_token.params : {}
-        token_params['scope'] || (access_token['scope'] if access_token.respond_to?(:[]))
+        token_params["scope"] || (access_token["scope"] if access_token.respond_to?(:[]))
       end
 
       def force_approval_requested?
@@ -102,7 +102,7 @@ module OmniAuth
       end
 
       def flash_force_approval?(key)
-        flashes = session.dig(:flash, 'flashes') || session.dig('flash', 'flashes')
+        flashes = session.dig(:flash, "flashes") || session.dig("flash", "flashes")
         !!flashes&.[](key)
       end
 

data/lib/omniauth-spotify/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'omniauth/spotify/version'
+require "omniauth/spotify/version"
 
 # Backward compatibility for historical constant usage.
 module Omniauth

data/lib/omniauth-spotify.rb

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-require 'omniauth/spotify'
+require "omniauth/spotify"

data/omniauth-spotify.gemspec

@@ -1,34 +1,34 @@
 # frozen_string_literal: true
 
-lib = File.expand_path('lib', __dir__)
+lib = File.expand_path("lib", __dir__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
-require 'omniauth/spotify/version'
+require "omniauth/spotify/version"
 
 Gem::Specification.new do |spec|
-  spec.name = 'omniauth-spotify'
+  spec.name = "omniauth-spotify"
   spec.version = OmniAuth::Spotify::VERSION
-  spec.authors = ['Claudio Poli']
-  spec.email = ['masterkain@gmail.com']
+  spec.authors = ["Claudio Poli"]
+  spec.email = ["masterkain@gmail.com"]
 
-  spec.summary = 'OmniAuth strategy for Spotify OAuth2 authentication.'
-  spec.description = 'OAuth2 strategy for OmniAuth that authenticates users with Spotify and exposes account metadata.'
-  spec.homepage = 'https://github.com/icoretech/omniauth-spotify'
-  spec.license = 'MIT'
-  spec.required_ruby_version = '>= 3.2'
+  spec.summary = "OmniAuth strategy for Spotify OAuth2 authentication."
+  spec.description = "OAuth2 strategy for OmniAuth that authenticates users with Spotify and exposes account metadata."
+  spec.homepage = "https://github.com/icoretech/omniauth-spotify"
+  spec.license = "MIT"
+  spec.required_ruby_version = ">= 3.2"
 
-  spec.metadata['source_code_uri'] = 'https://github.com/icoretech/omniauth-spotify'
-  spec.metadata['bug_tracker_uri'] = 'https://github.com/icoretech/omniauth-spotify/issues'
-  spec.metadata['changelog_uri'] = 'https://github.com/icoretech/omniauth-spotify/releases'
-  spec.metadata['rubygems_mfa_required'] = 'true'
+  spec.metadata["source_code_uri"] = "https://github.com/icoretech/omniauth-spotify"
+  spec.metadata["bug_tracker_uri"] = "https://github.com/icoretech/omniauth-spotify/issues"
+  spec.metadata["changelog_uri"] = "https://github.com/icoretech/omniauth-spotify/releases"
+  spec.metadata["rubygems_mfa_required"] = "true"
 
   spec.files = Dir[
-    'lib/**/*.rb',
-    'README*',
-    'LICENSE*',
-    '*.gemspec'
+    "lib/**/*.rb",
+    "README*",
+    "LICENSE*",
+    "*.gemspec"
   ]
-  spec.require_paths = ['lib']
+  spec.require_paths = ["lib"]
 
-  spec.add_dependency 'cgi', '>= 0.3.6'
-  spec.add_dependency 'omniauth-oauth2', '>= 1.8', '< 1.9'
+  spec.add_dependency "cgi", ">= 0.3.6"
+  spec.add_dependency "omniauth-oauth2", ">= 1.8", "< 2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-spotify
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.0.4
 platform: ruby
 authors:
 - Claudio Poli
@@ -32,7 +32,7 @@ dependencies:
         version: '1.8'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '1.9'
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -42,7 +42,7 @@ dependencies:
         version: '1.8'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '1.9'
+        version: '2.0'
 description: OAuth2 strategy for OmniAuth that authenticates users with Spotify and
   exposes account metadata.
 email: