omniauth-wechat-oauth2 0.2.3 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a58c603f945673a1f7f58354fc3a38e733b5ba4d7e7ec6d75b263b1464deedf
-  data.tar.gz: 35b9a1e4e87ae4ae232ddb737d4f26272322050d2694c61b1a973614dc91f833
+  metadata.gz: 80313d7db1a1d6df69ed886099adead9279872a8fb49de1b8b961a8483fd6276
+  data.tar.gz: db075a26ae635ab40180b0b3f937bbad0484111c06dd54d3512067424e31c74b
 SHA512:
-  metadata.gz: 9164a1d25b4e22498a9d821019287922f49887901464dd5930b68c601207874a06f0e9340d0d309c97110f9ef0b71bd2e097749cac8e306e66ed8fb5978c012e
-  data.tar.gz: b9f728e86f74428d04bff8cd0b3ba2da5dd07b393b7b034cefd233c98f2fb27e56528f3d2d072992d2aac0cf4022941b5f274ad140fd7805e32cc3eb7ad65259
+  metadata.gz: 65f903b8e65eedb5017d1763919b92679e0f798eb3dd3df22d66067ba28e3e9d4492ed9b755249ec0b0cd57e53f7fcb61d058930b892c65a931bf756c686bc70
+  data.tar.gz: 1a95f075d1f32e42feca3ade502f874ca455832a8da6fc466c298f470fa28530773e256de98260c345f9adb83053d73da935576a02a2eb8adf0bddd72d48602c

data/README.md

@@ -93,6 +93,37 @@ Here's an example of an authentication hash available in the callback by accessi
 
 ## Wechat Qiye OAuth2
 
+Both enterprise strategies (`qiye_web` and `wechat_qiye`) require a successful
+WeCom API response (`errcode: 0`) and a nonempty member `userid`. A corporate
+access token does not authenticate a user: the callback's authorization code
+must also resolve to a member. Invalid codes, API errors, malformed responses,
+and nonmember identities fail authentication without invoking the application
+callback. TLS certificate verification is enabled by default.
+
+### WeCom web login
+
+```ruby
+config.omniauth :qiye_web, ENV['WECOM_CORP_ID'], ENV['WECOM_CORP_SECRET'],
+    agentid: ENV['WECOM_AGENT_ID']
+```
+
+Start login through OmniAuth's POST request phase with your application's CSRF
+protection. Keep `provider_ignores_state` at its default (`false`): the callback
+must return the generated state in the same browser session. State is consumed
+when checked, so a completed callback cannot be replayed. If valid logins fail
+with `csrf_detected`, check the session cookie, callback host, and proxy/HTTPS
+configuration instead of disabling state validation.
+
+When upgrading an existing deployment, publish or pin the fixed gem revision,
+update the application's lockfile, and restart its processes. A Bundler local
+override only changes the developer's checkout. This fix does not invalidate
+previously issued application sessions or tokens; revoke those associated with
+any confirmed unauthorized login separately. Applications should also reject
+blank `auth.uid` values before looking up local accounts and avoid logging the
+full authentication hash, which contains credentials.
+
+### Legacy enterprise OAuth2
+
 Wechat Qiey usage and configuration are the same with normal account above.
 
 ```ruby

data/lib/omniauth/strategies/qiye_web.rb

@@ -0,0 +1,59 @@
+require "omniauth-oauth2"
+require "omniauth/strategies/wecom_validation"
+
+module OmniAuth
+  module Strategies
+    class QiyeWeb < OmniAuth::Strategies::OAuth2
+      include WecomValidation
+
+      option :name, 'qiye_web'
+
+      option :client_options, { site: 'https://qyapi.weixin.qq.com',
+                                authorize_url: 'https://login.work.weixin.qq.com/wwlogin/sso/login',
+                                token_url: '/cgi-bin/gettoken',
+                                token_method: :get }
+
+      option :authorize_options, %i[agentid state login_type]
+      option :token_params, { parse: :json }
+      option :agentid, nil
+
+      uid do
+        raw_info
+      end
+
+      info do
+        { userid: uid }
+      end
+
+      extra do
+        { raw_info: nil }
+      end
+
+      # Inherit OAuth2#callback_phase so state, provider errors, and failures are
+      # checked before an authentication hash can reach the application.
+      def request_phase
+        raise ArgumentError, 'agentid is required for QiyeWeb strategy' if options.agentid.to_i <= 0
+
+        ap = authorize_params
+        params = {
+          'login_type' => ap[:login_type] || 'CorpApp',
+          'appid' => client.id,
+          'agentid' => options.agentid,
+          'redirect_uri' => callback_url,
+          'state' => ap[:state]
+        }
+
+        redirect client.authorize_url(params)
+      end
+
+      def raw_info
+        @uid ||= begin
+          access_token.options[:mode] = :query
+          response = access_token.get('/cgi-bin/auth/getuserinfo',
+                                      params: { 'code' => authorization_code }, parse: :json)
+          wecom_userid(wecom_response(response))
+        end
+      end
+    end
+  end
+end

data/lib/omniauth/strategies/wechat_qiye.rb

@@ -1,18 +1,18 @@
 require "omniauth-oauth2"
+require "omniauth/strategies/wecom_validation"
 
 module OmniAuth
   module Strategies
     class WechatQiye < OmniAuth::Strategies::OAuth2
+      include WecomValidation
+
       option :name, "wechat_qiye"
 
       option :client_options, {
                                 :site => "https://qyapi.weixin.qq.com",
                                 authorize_url: "https://open.weixin.qq.com/connect/oauth2/authorize#wechat_redirect",
                                 token_url:     "/cgi-bin/gettoken",
-                                token_method:  :get,
-                                connection_opts: {
-                                    ssl: { verify: false }
-                                }
+                                token_method:  :get
                               }
 
       option :authorize_params, {scope: "snsapi_userinfo"}
@@ -46,35 +46,23 @@ module OmniAuth
       end
 
       def raw_info
-        # step 2: get userid via code and access_token
-        @code ||= access_token[:code]
-
-        # step 3: get user info via userid
         @uid ||= begin
           access_token.options[:mode] = :query
-          response = access_token.get('/cgi-bin/user/getuserinfo', :params => {'code' => @code}, parse: :json)
-          response.parsed['UserId']
+          response = access_token.get('/cgi-bin/user/getuserinfo',
+                                      :params => {'code' => authorization_code}, parse: :json)
+          wecom_userid(wecom_response(response))
         end
 
         @raw_info ||= begin
           access_token.options[:mode] = :query
           response = access_token.get("/cgi-bin/user/get", :params => {"userid" => @uid}, parse: :json)
-          response.parsed
+          data = wecom_response(response)
+          unless wecom_userid(data).casecmp(@uid).zero?
+            raise CallbackError.new(:invalid_uid, 'WeCom member profile does not match the authenticated userid')
+          end
+          data
         end
       end
-
-      protected
-      def build_access_token
-        # step 0: wechat respond code
-        code = request.params['code']
-
-        # step 1: get access token
-        params = {
-            'corpid' => client.id,
-            'corpsecret' => client.secret,
-        }.merge(token_params.to_hash(symbolize_keys: true))
-        client.get_token(params, deep_symbolize(options.auth_token_params.merge({code: code})))
-      end
     end
   end
 end

data/lib/omniauth/strategies/wecom_validation.rb

@@ -0,0 +1,62 @@
+module OmniAuth
+  module Strategies
+    # WeCom returns API failures as HTTP 200 responses. A corporate access token
+    # alone does not authenticate the user presenting the callback code.
+    module WecomValidation
+      protected
+
+      def secure_compare(left, right)
+        return false unless left.is_a?(String) && right.is_a?(String)
+
+        super
+      end
+
+      def authorization_code
+        code = request.params['code']
+        unless code.is_a?(String) && !code.strip.empty?
+          raise OAuth2::CallbackError.new(:invalid_code, 'Missing or invalid WeCom authorization code')
+        end
+
+        code
+      end
+
+      def build_access_token
+        authorization_code
+        params = {
+          'corpid' => client.id,
+          'corpsecret' => client.secret
+        }.merge(token_params.to_hash(symbolize_keys: true))
+
+        client.get_token(params, deep_symbolize(options.auth_token_params)).tap do |token|
+          unless token && token.token.is_a?(String) && !token.token.strip.empty?
+            raise OAuth2::CallbackError.new(:invalid_token, 'Missing WeCom access token')
+          end
+          validate_wecom_response(token.params)
+        end
+      end
+
+      def wecom_response(response)
+        validate_wecom_response(response.parsed)
+      end
+
+      def validate_wecom_response(data)
+        unless data.is_a?(Hash) && data['errcode'] == 0
+          raise OAuth2::CallbackError.new(:invalid_response, 'WeCom API did not return a successful response')
+        end
+
+        data
+      end
+
+      def wecom_userid(data)
+        # Support both the current API and the legacy UserId response. OAuth2's
+        # SnakyHash also accepts the original spelling of normalized keys.
+        userid = data['userid'] || data['UserId']
+        unless userid.is_a?(String) && !userid.strip.empty?
+          raise OAuth2::CallbackError.new(:invalid_uid, 'WeCom did not return a member userid')
+        end
+
+        userid
+      end
+    end
+  end
+end

data/lib/omniauth/wechat.rb

@@ -1,2 +1,3 @@
 require "omniauth/strategies/wechat"
 require "omniauth/strategies/wechat_qiye"
+require "omniauth/strategies/qiye_web"

metadata

@@ -1,43 +1,42 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-wechat-oauth2
 version: !ruby/object:Gem::Version
-  version: 0.2.3
+  version: 0.3.0
 platform: ruby
 authors:
 - Alex Hu
 - Never Min
 - Eric Guo
-autorequire:
 bindir: bin
 cert_chain:
 - |
   -----BEGIN CERTIFICATE-----
   MIIEeDCCAuCgAwIBAgIBATANBgkqhkiG9w0BAQsFADBBMRMwEQYDVQQDDAplcmlj
   Lmd1b2N6MRUwEwYKCZImiZPyLGQBGRYFZ21haWwxEzARBgoJkiaJk/IsZAEZFgNj
-  b20wHhcNMjIxMjA5MDcyMTE1WhcNMjMxMjA5MDcyMTE1WjBBMRMwEQYDVQQDDApl
+  b20wHhcNMjYwNTIyMTUyNDI0WhcNMjcwNTIyMTUyNDI0WjBBMRMwEQYDVQQDDApl
   cmljLmd1b2N6MRUwEwYKCZImiZPyLGQBGRYFZ21haWwxEzARBgoJkiaJk/IsZAEZ
-  FgNjb20wggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQC6jGarls5mU792
-  leWot9tWKXnnvVnj1oUPea8M77PpHcYMVmjUTkjgsrKiOFNv2nAjUIDrUaLJvuKi
-  95zZYLIT3uWqI9QvSSDr+rs4HyIDcXuWWB89GpKN5WgyCVel6V9X5PN0C5hIiz8T
-  ThW7ZqkS8mTmHm2micL8/lmnelpxj9EjCin7xOCvebB9pdA7Y0kXMLbnRq4QK2lB
-  O2YRbLvYKWOQfO/sqLlwFsNWMNkj5ZROIqmKRvOHQdchox2RfBNsWRZ7XH8tTW1L
-  cqx95dI2qC6Xg+IHjN4Wc6n+Ak1KENlVjI4mGcuk+34d1S9gaZT8vW/cYcL30Nbg
-  AAUQvS4AQ8gmAkk1+oNs+725QLBprbnSN5PJr9VQiDteNHHkY5ugjndeAByOGy8h
-  /TgV4tBZQ0IT37ZRDcP4dayFMm2DVjS4uU7RUXLgc8sdOGeMmsFwdz9QrBPGeKsV
-  4+dXjrzzUvwRX4K21mx4ZSP9eSOscOEuzRIRTnab0GniDhkkHc8CAwEAAaN7MHkw
-  CQYDVR0TBAIwADALBgNVHQ8EBAMCBLAwHQYDVR0OBBYEFPGkToJNhoEfhsOYqnTH
-  MZDYyjQtMB8GA1UdEQQYMBaBFGVyaWMuZ3VvY3pAZ21haWwuY29tMB8GA1UdEgQY
-  MBaBFGVyaWMuZ3VvY3pAZ21haWwuY29tMA0GCSqGSIb3DQEBCwUAA4IBgQCdTl5T
-  qfcrbo4KdgZM84ZbeiUIXcRy/chbfQfPZ/qPp7qKARLxRJINmaqt/bP+RrlQypEe
-  1EIYhbxLGo1TvpbRFuADUhZjGZ8Vaa+bgPfj8Dxa71ow5dF9nrqidddV7qjmk57F
-  klOrOl+99Ryx01OAdlxGZqz/VrHrzbhQNtiUl2BYnosZLddYPTzuhNLe72eIypkY
-  synsOqoXRuegCtO4sSGSvRV79/GyN0jqtptpa61MaxgYG13+P8QwXeTo2Ro86ZAJ
-  h+KBs65p0MiFHl6zc2oany9Pk0kqs50TDKOCT7ZdSxz5xes0SvTi3mmX3XemjQhm
-  qNb+5zsj4Kn5auKYA7GupfLYKS/dYt4EIfNKhSEHgkVFdVPxSAQ73UAWsndINTTA
-  HjK18j09PoL9vWMUtyez2xpxlRDA+bEkF74AEVwMYozjP8VNM1ERTG+8kROuQjGV
-  aWhGk3yVuHjmlBvfDpPqmux3ulWXnvHulcYiPxETh/m3PUfIKMTHydjAz88=
+  FgNjb20wggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQC49ueF2WFVqQye
+  d1kwtvBNyXx9AI8fLWwLHJqf+3ojjWEYwf8NtwYbBgptw7sMDfbpu+H0TjLSYW9e
+  R5IVlfP0v55JtDNjZLnQTtXxaiGLZ9aZgT1t5Rn42RSYqfjLKN2maKpRUCnw8Tw4
+  +G1tdxFnYIsHda7jiNvetZjqeVhaoN4enfPk2pTeHpmXvH/FzLuKRkPz0yQOFD6P
+  IFdE1a4sPs7Fk9QJa6zyPQ/7cL1Uu+IjNzibvTot+Go1GtWvc7bqdDueX6MSo9Ki
+  7XBVH4Svk9BqGKKCJFibYjBRxMbzlwA8fik9JUKj9Q0gmXeRRf+tQUZWJHKF5Y/4
+  wzqyT6k4u5e3S/QnpD/ZNo1ESiu1Bxc6KvlIihKlOvA8+RSgSAmZtcHhk2en4DtP
+  aeBgCrJABFbkMVk9+OiRcq1kDAIJHnH9XxyrM/s4x5FYPgZWbqfbYltHp+Y9ByNw
+  uzG6YQkT6PkKRAdl8i6udI70iLQZIE8sI+4bwl3JnTfDrJsklhsCAwEAAaN7MHkw
+  CQYDVR0TBAIwADALBgNVHQ8EBAMCBLAwHQYDVR0OBBYEFAAS4PVX34FrNYW9Iv16
+  R4Qyoj1CMB8GA1UdEQQYMBaBFGVyaWMuZ3VvY3pAZ21haWwuY29tMB8GA1UdEgQY
+  MBaBFGVyaWMuZ3VvY3pAZ21haWwuY29tMA0GCSqGSIb3DQEBCwUAA4IBgQBFdbRh
+  Wh50P882h5BMysO8Ru/cnqUENIsHxUnZsssHuFcU3Gn3Sq43ixKzFhA4uOCDfY36
+  xvX7johxHhukDAdo4lD9h+f5Vck35Qns5Ln+b0o0iTyENOFou57CgeqpWeVkDIi4
+  vlwdgCunr64KKW7snC4E76AUXRnOYC0UhZL2VQRc54sN6eMIACogJ9ZHii3h5FmG
+  ep6LMfi1oKBrU7MLT5BidvCxG3ePEtdfACGznDE7GgimLVcsb3Ft+sNeP6fBtvrM
+  OljHZezOIi+Wbot4pvwdt8tCI4eCoAWAYuoCtyav5dDRUeqI7TPdQGgMPDcVckNE
+  e3iKcBAe/0pRYSZxORE63n3SOo9MPL2oGe9A21LR/tk/CJ8kZxDdeTh4zL+Ufw3R
+  G4TR+pkSPTTDPI2Ft/RAqHjqectqrcz4gZ4e/x1nBhoF8QKrBuEvHXNTR5EtMzcz
+  CU8I1U00X8GGbinHiVIfDJnOkCq7cBmbTamZpNwZLCrgQupqUNhEP2vcZVg=
   -----END CERTIFICATE-----
-date: 2023-02-19 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-oauth2
@@ -45,28 +44,28 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.7.3
+        version: 1.8.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.7.3
+        version: 1.8.0
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.10.0
+        version: 3.13.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.10.0
+        version: 3.13.1
 description: Using OAuth2 to authenticate wechat user when web resources being viewed
   within wechat(weixin) client.
 email:
@@ -79,14 +78,15 @@ extra_rdoc_files: []
 files:
 - README.md
 - lib/omniauth-wechat-oauth2.rb
+- lib/omniauth/strategies/qiye_web.rb
 - lib/omniauth/strategies/wechat.rb
 - lib/omniauth/strategies/wechat_qiye.rb
+- lib/omniauth/strategies/wecom_validation.rb
 - lib/omniauth/wechat.rb
 homepage: https://github.com/nevermin/omniauth-wechat-oauth2
 licenses:
 - MIT
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -102,8 +102,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.4.7
-signing_key:
+rubygems_version: 4.0.22
 specification_version: 4
 summary: Omniauth strategy for wechat(weixin)
 test_files: []