omniauth-wechat-oauth2 0.2.2 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7957db81f8a3ca70305b81820dfad15f36eb1e4995ce4decb99515f9763539cf
-  data.tar.gz: d48c9cef8cb649a4b4c941f5d16328ea54cb13c21f8d9ab883a539defac22f99
+  metadata.gz: 80313d7db1a1d6df69ed886099adead9279872a8fb49de1b8b961a8483fd6276
+  data.tar.gz: db075a26ae635ab40180b0b3f937bbad0484111c06dd54d3512067424e31c74b
 SHA512:
-  metadata.gz: a57cab028371e48d8f4e0c307e7172133c5b1a6715de8c8faaf63dc15702301e870a5192941427ed11c15f7b208b27af51ed260170002df34fc24d3d04fd74d1
-  data.tar.gz: 1a2af84613bf942a76a72d462e5196ab907378f7ef2ac6cf014ebf40eab41f7a22a743c3acff775e836bb5dc0dd7232b63157d6d98066d1e2ecf4a0dac2da205
+  metadata.gz: 65f903b8e65eedb5017d1763919b92679e0f798eb3dd3df22d66067ba28e3e9d4492ed9b755249ec0b0cd57e53f7fcb61d058930b892c65a931bf756c686bc70
+  data.tar.gz: 1a95f075d1f32e42feca3ade502f874ca455832a8da6fc466c298f470fa28530773e256de98260c345f9adb83053d73da935576a02a2eb8adf0bddd72d48602c

data/README.md

@@ -3,11 +3,11 @@ Omniauth-wechat-oauth2
 
 [![Gem Version](https://img.shields.io/gem/v/omniauth-wechat-oauth2.svg)][gem]
 [![Security Check](https://hakiri.io/github/NeverMin/omniauth-wechat-oauth2/master.svg)][security]
-[![Build Status](https://travis-ci.org/NeverMin/omniauth-wechat-oauth2.svg)][travis]
+[![Build Status](https://app.travis-ci.com/Eric-Guo/omniauth-wechat-oauth2.svg?branch=master)][travis]
 
 [gem]: https://rubygems.org/gems/omniauth-wechat-oauth2
 [security]: https://hakiri.io/github/NeverMin/omniauth-wechat-oauth2/master
-[travis]: https://travis-ci.org/NeverMin/omniauth-wechat-oauth2
+[travis]: https://app.travis-ci.com/github/Eric-Guo/omniauth-wechat-oauth2
 
 
 Wechat OAuth2 Strategy for OmniAuth 1.0.
@@ -93,6 +93,37 @@ Here's an example of an authentication hash available in the callback by accessi
 
 ## Wechat Qiye OAuth2
 
+Both enterprise strategies (`qiye_web` and `wechat_qiye`) require a successful
+WeCom API response (`errcode: 0`) and a nonempty member `userid`. A corporate
+access token does not authenticate a user: the callback's authorization code
+must also resolve to a member. Invalid codes, API errors, malformed responses,
+and nonmember identities fail authentication without invoking the application
+callback. TLS certificate verification is enabled by default.
+
+### WeCom web login
+
+```ruby
+config.omniauth :qiye_web, ENV['WECOM_CORP_ID'], ENV['WECOM_CORP_SECRET'],
+    agentid: ENV['WECOM_AGENT_ID']
+```
+
+Start login through OmniAuth's POST request phase with your application's CSRF
+protection. Keep `provider_ignores_state` at its default (`false`): the callback
+must return the generated state in the same browser session. State is consumed
+when checked, so a completed callback cannot be replayed. If valid logins fail
+with `csrf_detected`, check the session cookie, callback host, and proxy/HTTPS
+configuration instead of disabling state validation.
+
+When upgrading an existing deployment, publish or pin the fixed gem revision,
+update the application's lockfile, and restart its processes. A Bundler local
+override only changes the developer's checkout. This fix does not invalidate
+previously issued application sessions or tokens; revoke those associated with
+any confirmed unauthorized login separately. Applications should also reject
+blank `auth.uid` values before looking up local accounts and avoid logging the
+full authentication hash, which contains credentials.
+
+### Legacy enterprise OAuth2
+
 Wechat Qiey usage and configuration are the same with normal account above.
 
 ```ruby

data/lib/omniauth/strategies/qiye_web.rb

@@ -0,0 +1,59 @@
+require "omniauth-oauth2"
+require "omniauth/strategies/wecom_validation"
+
+module OmniAuth
+  module Strategies
+    class QiyeWeb < OmniAuth::Strategies::OAuth2
+      include WecomValidation
+
+      option :name, 'qiye_web'
+
+      option :client_options, { site: 'https://qyapi.weixin.qq.com',
+                                authorize_url: 'https://login.work.weixin.qq.com/wwlogin/sso/login',
+                                token_url: '/cgi-bin/gettoken',
+                                token_method: :get }
+
+      option :authorize_options, %i[agentid state login_type]
+      option :token_params, { parse: :json }
+      option :agentid, nil
+
+      uid do
+        raw_info
+      end
+
+      info do
+        { userid: uid }
+      end
+
+      extra do
+        { raw_info: nil }
+      end
+
+      # Inherit OAuth2#callback_phase so state, provider errors, and failures are
+      # checked before an authentication hash can reach the application.
+      def request_phase
+        raise ArgumentError, 'agentid is required for QiyeWeb strategy' if options.agentid.to_i <= 0
+
+        ap = authorize_params
+        params = {
+          'login_type' => ap[:login_type] || 'CorpApp',
+          'appid' => client.id,
+          'agentid' => options.agentid,
+          'redirect_uri' => callback_url,
+          'state' => ap[:state]
+        }
+
+        redirect client.authorize_url(params)
+      end
+
+      def raw_info
+        @uid ||= begin
+          access_token.options[:mode] = :query
+          response = access_token.get('/cgi-bin/auth/getuserinfo',
+                                      params: { 'code' => authorization_code }, parse: :json)
+          wecom_userid(wecom_response(response))
+        end
+      end
+    end
+  end
+end

data/lib/omniauth/strategies/wechat.rb

@@ -52,7 +52,7 @@ module OmniAuth
         @uid ||= access_token["openid"]
         @raw_info ||= begin
           access_token.options[:mode] = :query
-          if access_token["scope"]&.include?("snsapi_login")
+          if ["snsapi_login", "snsapi_userinfo"].include?(access_token["scope"])
             access_token.get("/sns/userinfo", :params => { "openid" => @uid, "lang" => "zh_CN" }, parse: :json).parsed
           else
             { "openid" => @uid }

data/lib/omniauth/strategies/wechat_qiye.rb

@@ -1,18 +1,18 @@
 require "omniauth-oauth2"
+require "omniauth/strategies/wecom_validation"
 
 module OmniAuth
   module Strategies
     class WechatQiye < OmniAuth::Strategies::OAuth2
+      include WecomValidation
+
       option :name, "wechat_qiye"
 
       option :client_options, {
                                 :site => "https://qyapi.weixin.qq.com",
                                 authorize_url: "https://open.weixin.qq.com/connect/oauth2/authorize#wechat_redirect",
                                 token_url:     "/cgi-bin/gettoken",
-                                token_method:  :get,
-                                connection_opts: {
-                                    ssl: { verify: false }
-                                }
+                                token_method:  :get
                               }
 
       option :authorize_params, {scope: "snsapi_userinfo"}
@@ -46,35 +46,23 @@ module OmniAuth
       end
 
       def raw_info
-        # step 2: get userid via code and access_token
-        @code ||= access_token[:code]
-
-        # step 3: get user info via userid
         @uid ||= begin
           access_token.options[:mode] = :query
-          response = access_token.get('/cgi-bin/user/getuserinfo', :params => {'code' => @code}, parse: :json)
-          response.parsed['UserId']
+          response = access_token.get('/cgi-bin/user/getuserinfo',
+                                      :params => {'code' => authorization_code}, parse: :json)
+          wecom_userid(wecom_response(response))
         end
 
         @raw_info ||= begin
           access_token.options[:mode] = :query
           response = access_token.get("/cgi-bin/user/get", :params => {"userid" => @uid}, parse: :json)
-          response.parsed
+          data = wecom_response(response)
+          unless wecom_userid(data).casecmp(@uid).zero?
+            raise CallbackError.new(:invalid_uid, 'WeCom member profile does not match the authenticated userid')
+          end
+          data
         end
       end
-
-      protected
-      def build_access_token
-        # step 0: wechat respond code
-        code = request.params['code']
-
-        # step 1: get access token
-        params = {
-            'corpid' => client.id,
-            'corpsecret' => client.secret,
-        }.merge(token_params.to_hash(symbolize_keys: true))
-        client.get_token(params, deep_symbolize(options.auth_token_params.merge({code: code})))
-      end
     end
   end
 end

data/lib/omniauth/strategies/wecom_validation.rb

@@ -0,0 +1,62 @@
+module OmniAuth
+  module Strategies
+    # WeCom returns API failures as HTTP 200 responses. A corporate access token
+    # alone does not authenticate the user presenting the callback code.
+    module WecomValidation
+      protected
+
+      def secure_compare(left, right)
+        return false unless left.is_a?(String) && right.is_a?(String)
+
+        super
+      end
+
+      def authorization_code
+        code = request.params['code']
+        unless code.is_a?(String) && !code.strip.empty?
+          raise OAuth2::CallbackError.new(:invalid_code, 'Missing or invalid WeCom authorization code')
+        end
+
+        code
+      end
+
+      def build_access_token
+        authorization_code
+        params = {
+          'corpid' => client.id,
+          'corpsecret' => client.secret
+        }.merge(token_params.to_hash(symbolize_keys: true))
+
+        client.get_token(params, deep_symbolize(options.auth_token_params)).tap do |token|
+          unless token && token.token.is_a?(String) && !token.token.strip.empty?
+            raise OAuth2::CallbackError.new(:invalid_token, 'Missing WeCom access token')
+          end
+          validate_wecom_response(token.params)
+        end
+      end
+
+      def wecom_response(response)
+        validate_wecom_response(response.parsed)
+      end
+
+      def validate_wecom_response(data)
+        unless data.is_a?(Hash) && data['errcode'] == 0
+          raise OAuth2::CallbackError.new(:invalid_response, 'WeCom API did not return a successful response')
+        end
+
+        data
+      end
+
+      def wecom_userid(data)
+        # Support both the current API and the legacy UserId response. OAuth2's
+        # SnakyHash also accepts the original spelling of normalized keys.
+        userid = data['userid'] || data['UserId']
+        unless userid.is_a?(String) && !userid.strip.empty?
+          raise OAuth2::CallbackError.new(:invalid_uid, 'WeCom did not return a member userid')
+        end
+
+        userid
+      end
+    end
+  end
+end

data/lib/omniauth/wechat.rb

@@ -1,2 +1,3 @@
 require "omniauth/strategies/wechat"
 require "omniauth/strategies/wechat_qiye"
+require "omniauth/strategies/qiye_web"

data.tar.gz.sig

@@ -0,0 +1,2 @@
+��d�;�I	�;�߼"� v�؉d�E+����;�1�	�栁|����;AD�d.�!�u�c�̜B�N����8���cCY�`��cv~�Y�v(q�����|���yw��F�ٙ�*���#"H�2����ö�;Xh��������X�ؙ�l��{��IB9��
+�nGo�sp?��o�P�ݳ6�1!6�x�4��2����;������W
aj�6�4%k���z-�v��4='!���E��8t1��I���
��6F�K�B��.���*�>��l��٬ޡ;���s��PG�b���cv
d�r

metadata

@@ -1,59 +1,71 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-wechat-oauth2
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 0.3.0
 platform: ruby
 authors:
 - Alex Hu
 - Never Min
 - Eric Guo
-autorequire:
 bindir: bin
-cert_chain: []
-date: 2020-06-12 00:00:00.000000000 Z
+cert_chain:
+- |
+  -----BEGIN CERTIFICATE-----
+  MIIEeDCCAuCgAwIBAgIBATANBgkqhkiG9w0BAQsFADBBMRMwEQYDVQQDDAplcmlj
+  Lmd1b2N6MRUwEwYKCZImiZPyLGQBGRYFZ21haWwxEzARBgoJkiaJk/IsZAEZFgNj
+  b20wHhcNMjYwNTIyMTUyNDI0WhcNMjcwNTIyMTUyNDI0WjBBMRMwEQYDVQQDDApl
+  cmljLmd1b2N6MRUwEwYKCZImiZPyLGQBGRYFZ21haWwxEzARBgoJkiaJk/IsZAEZ
+  FgNjb20wggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQC49ueF2WFVqQye
+  d1kwtvBNyXx9AI8fLWwLHJqf+3ojjWEYwf8NtwYbBgptw7sMDfbpu+H0TjLSYW9e
+  R5IVlfP0v55JtDNjZLnQTtXxaiGLZ9aZgT1t5Rn42RSYqfjLKN2maKpRUCnw8Tw4
+  +G1tdxFnYIsHda7jiNvetZjqeVhaoN4enfPk2pTeHpmXvH/FzLuKRkPz0yQOFD6P
+  IFdE1a4sPs7Fk9QJa6zyPQ/7cL1Uu+IjNzibvTot+Go1GtWvc7bqdDueX6MSo9Ki
+  7XBVH4Svk9BqGKKCJFibYjBRxMbzlwA8fik9JUKj9Q0gmXeRRf+tQUZWJHKF5Y/4
+  wzqyT6k4u5e3S/QnpD/ZNo1ESiu1Bxc6KvlIihKlOvA8+RSgSAmZtcHhk2en4DtP
+  aeBgCrJABFbkMVk9+OiRcq1kDAIJHnH9XxyrM/s4x5FYPgZWbqfbYltHp+Y9ByNw
+  uzG6YQkT6PkKRAdl8i6udI70iLQZIE8sI+4bwl3JnTfDrJsklhsCAwEAAaN7MHkw
+  CQYDVR0TBAIwADALBgNVHQ8EBAMCBLAwHQYDVR0OBBYEFAAS4PVX34FrNYW9Iv16
+  R4Qyoj1CMB8GA1UdEQQYMBaBFGVyaWMuZ3VvY3pAZ21haWwuY29tMB8GA1UdEgQY
+  MBaBFGVyaWMuZ3VvY3pAZ21haWwuY29tMA0GCSqGSIb3DQEBCwUAA4IBgQBFdbRh
+  Wh50P882h5BMysO8Ru/cnqUENIsHxUnZsssHuFcU3Gn3Sq43ixKzFhA4uOCDfY36
+  xvX7johxHhukDAdo4lD9h+f5Vck35Qns5Ln+b0o0iTyENOFou57CgeqpWeVkDIi4
+  vlwdgCunr64KKW7snC4E76AUXRnOYC0UhZL2VQRc54sN6eMIACogJ9ZHii3h5FmG
+  ep6LMfi1oKBrU7MLT5BidvCxG3ePEtdfACGznDE7GgimLVcsb3Ft+sNeP6fBtvrM
+  OljHZezOIi+Wbot4pvwdt8tCI4eCoAWAYuoCtyav5dDRUeqI7TPdQGgMPDcVckNE
+  e3iKcBAe/0pRYSZxORE63n3SOo9MPL2oGe9A21LR/tk/CJ8kZxDdeTh4zL+Ufw3R
+  G4TR+pkSPTTDPI2Ft/RAqHjqectqrcz4gZ4e/x1nBhoF8QKrBuEvHXNTR5EtMzcz
+  CU8I1U00X8GGbinHiVIfDJnOkCq7cBmbTamZpNwZLCrgQupqUNhEP2vcZVg=
+  -----END CERTIFICATE-----
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: omniauth
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.3.2
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.3.2
 - !ruby/object:Gem::Dependency
   name: omniauth-oauth2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.1.1
+        version: 1.8.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.1.1
+        version: 1.8.0
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.99'
+        version: 3.13.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.99'
+        version: 3.13.1
 description: Using OAuth2 to authenticate wechat user when web resources being viewed
   within wechat(weixin) client.
 email:
@@ -66,14 +78,15 @@ extra_rdoc_files: []
 files:
 - README.md
 - lib/omniauth-wechat-oauth2.rb
+- lib/omniauth/strategies/qiye_web.rb
 - lib/omniauth/strategies/wechat.rb
 - lib/omniauth/strategies/wechat_qiye.rb
+- lib/omniauth/strategies/wecom_validation.rb
 - lib/omniauth/wechat.rb
 homepage: https://github.com/nevermin/omniauth-wechat-oauth2
 licenses:
 - MIT
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -89,8 +102,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.1.4
-signing_key:
+rubygems_version: 4.0.22
 specification_version: 4
 summary: Omniauth strategy for wechat(weixin)
 test_files: []