omniauth-whiplash 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 6ddcdbdf5c216dcde0d9cd8e1fccf00de859be9f
-  data.tar.gz: 64d0771c33f7dadb3b68d6be36785596f599cb1a
+  metadata.gz: f5bf177db66912eed1afa18035b59b3801edfa2a
+  data.tar.gz: 647973b4ad6f231446c470ff7f57703f2db1fdec
 SHA512:
-  metadata.gz: 0fcc782373d6bd909a506e682c7a8c85f52136c78b2d2bff17e81f08c373327afc531000e1e036ba85f0b816718ec9102952eb7be9b916bdd6bd13bfdcdede55
-  data.tar.gz: d0559dbccbf836fedcdd4e987aa30378643674e4b5c1612c3fc43a07c9029692ab63f2c019a1e1e9864cf240b4215e718cc25f9481e5fb1454af210e24884af5
+  metadata.gz: a8c04bddd93f89e43ca94bc641bed36a3a60c2f2ab20f27158a6002664ea075448cb4a55be08ba6ad8633315ad7c161630171620a35f3f0e4727ec9745323378
+  data.tar.gz: 34d068dcba1e6930a115d5bf0c9abe0a7b752e59f9ca99d417cb6517d2a130d5c10f085b1c4417b63775c86f3ff20d591c9b3d32bb6e5b19a2c640ebb5c0d31d

data/README.md

@@ -1,6 +1,6 @@
 # Omniauth::Whiplash
 
-Whiplash OAuth2 Strategy for OmniAuth 1.0.
+Whiplash OAuth2 Strategy for OmniAuth.
 
 ## Installation
 
@@ -20,32 +20,150 @@ Or install it yourself as:
 
 ## Usage
 
-`OmniAuth::Strategies::Whiplash` is simply a Rack middleware. Read the OmniAuth 1.0 docs for detailed instructions.
+`OmniAuth::Strategies::Whiplash` is simply a Rack middleware. Read the `omniauth-oauth2` docs for detailed instructions.
 
 Here's a quick example, adding the middleware to a Rails app in config/initializers/omniauth.rb:
 
 ```ruby
 Rails.application.config.middleware.use OmniAuth::Builder do
-  provider :whiplash, ENV['WHILASH_CLIENT_ID'], ENV['WHIPLASH_CLIENT_SECRET']
+  provider :whiplash, ENV.fetch('WHIPLASH_CLIENT_ID'), ENV.fetch('WHIPLASH_CLIENT_SECRET'), scope: ENV.fetch('WHIPLASH_CLIENT_SCOPE')
 end
 ```
 
-## Configuration
+If you are using Devise, you can skip the above and instead include this to your Devise configuration in `initializers/devise.rb`:
 
-You can configure the scope, which you pass in to the provider method via a Hash:
+```ruby
+config.omniauth :whiplash, ENV.fetch('WHIPLASH_CLIENT_ID'), ENV.fetch('WHIPLASH_CLIENT_SECRET'), scope: ENV.fetch('WHIPLASH_CLIENT_SCOPE')
+```
+
+Please refer to the Whiplash API documentation for information regarding scopes.
+
+## Single Sign-On (SSO)
 
-`scope`: A comma-separated list of permissions you want to request from the user. See the Shopify API docs for a full list of available permissions.
-For example, to request read_products, read_orders and write_content permissions and display the authentication page:
+There are a few steps to follow to get SSO configured via Oauth2. The solution below uses Devise. You don't have to use Devise, but it provides some of the OAuth2 legwork and so that is what we recommend.
+
+*Note:* User accounts that are admin-level on Whiplash will automatically authorize your application. That means admins redirected to Whiplash for authentication will be immediately redirected back to your application if the permissions were configured correctly.
+
+### 1. Configure your application for Devise
+
+Add to your `Gemfile`:
 
 ```ruby
-Rails.application.config.middleware.use OmniAuth::Builder do
-  provider :whiplash, ENV['WHILASH_CLIENT_ID'], ENV['WHIPLASH_CLIENT_SECRET'], scope: 'read_orders write_orders read_items write_items read_web_hooks write_web_hooks read_customers read_user'
+gem 'devise', '~> 4.3.0'
+```
+
+Install Devise:
+
+```
+rails generate devise:install
+```
+
+Create a `User` model:
+
+```
+rails generate devise User
+```
+
+### 2. Modify the user migration
+
+You can remove some default Devise columns as we will not be using a standard Devise configuration.
+
+Here is a sample migration that includes all the fields returned by the Whiplash OAuth endpoint:
+
+```ruby
+class DeviseCreateUsers < ActiveRecord::Migration[5.1]
+  def change
+    enable_extension("citext")
+
+    create_table :users do |t|
+      t.citext :email,              null: false, default: ""
+
+      t.string :provider
+      t.string :uid
+      t.string :first_name
+      t.string :last_name
+      t.string :role
+      t.string :whiplash_id
+
+      t.timestamps null: false
+    end
+
+    add_index :users, :email, unique: true
+  end
 end
 ```
 
-NOTE: The default scope is `read_user` and is required as part of the `scope` argument, if it's passed in.
+*Please Note:* We are using the case-insensitive Postgres column type (`citext`) here. If you are using MySQL, you will want to switch this to `string` as that defaults to case-insensitive.
+
+### 3. Setup the User Model
+
+You can add any additional validations or methods as per usual to the `User` model. This is just the base setup to get SSO working.
+
+```ruby
+class User < ApplicationRecord
+
+  devise :omniauthable, omniauth_providers: [:whiplash]
+
+  def self.from_omniauth(omniauth_params)
+    User.find_or_create_by(email: omniauth_params.info['email']) do |u|
+      u.first_name  = omniauth_params.info['first_name']
+      u.last_name   = omniauth_params.info['last_name']
+      u.whiplash_id = omniauth_params.info['id']
+      u.role        = omniauth_params.info['role']
+    end
+  end
+
+end
+```
+
+The `self.from_omniauth` method is called automatically when a user is signing in. It will create a `User` record for new users and return existing users for previously created ones.
+
+### 4. Setup the OmniAuth Endpoint
+
+Create the controller in `controllers/users/omniauth_callbacks_controller.rb`:
+
+```ruby
+class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
+
+  skip_before_action :require_user
+
+  def whiplash
+    @user = User.from_omniauth(request.env["omniauth.auth"])
+
+    if @user.persisted?
+      sign_in_and_redirect(@user, event: :authentication)
+    end
+  end
+
+  def failure
+    redirect_to root_path
+  end
+
+end
+```
+
+*Please Note:* We have a `before_action` defined here called `require_user`. We have that defined in `ApplicationController` like so:
+
+```ruby
+def require_user
+  unless current_user
+    redirect_to user_whiplash_omniauth_authorize_path
+  end
+end
+```
+
+Any controller you would like to place behind the SSO login, you can add the respective `before_action :require_user`.
+
+Lastly, create the route in `routes.rb`
+
+```ruby
+devise_for :users, controllers: { omniauth_callbacks: "users/omniauth_callbacks" }
+```
+
+### 5. There is no step 5!
+
+You are done. Just make sure you have set the environment variables and Devise configuration degined in the Usage section.
 
-ALSO: The scope arguments should be passed in *separated by spaces, not commas*, as per above.
 
 ## Development
 

data/lib/omniauth/strategies/whiplash.rb

@@ -4,42 +4,28 @@ module OmniAuth
       option :name, :whiplash
 
       option :client_options, {
-        site: "https://www.whiplashmerch.com",
-        authorize_url: "oauth/authorize",
-        request_token_url: "oauth/authorize",
-        access_token_url: "oauth/token"
+        site: ENV['WHIPLASH_API_URL'] || "https://www.getwhiplash.com",
+        authorize_url: "/oauth/authorize"
       }
 
       uid { raw_info["id"] }
 
       info do
-        { email: raw_info["email"], name: user_full_name }
-      end
-
-      extra do
-        { raw_info: raw_info }
-      end
-
-      def callback_url
-        options[:callback_url] || super
-      end
-
-      def user_full_name
-        "#{raw_info['first_name']} #{raw_info['last_name']}".strip
+        {
+          email: raw_info["email"],
+          first_name: raw_info["first_name"],
+          last_name: raw_info["last_name"],
+          role: raw_info["role"]
+        }
       end
 
       def raw_info
-        @raw_info ||= access_token.get('/api/v2/me.json').parsed
+        @raw_info ||= access_token.get('/api/v2/me').parsed
       end
 
-      def authorize_params
-        super.tap do |params|
-          %w[scope client_options].each do |v|
-            if request.params[v]
-              params[v.to_sym] = request.params[v]
-            end
-          end
-        end
+      # https://github.com/intridea/omniauth-oauth2/issues/81
+      def callback_url
+        full_host + script_name + callback_path
       end
     end
   end

data/lib/omniauth/whiplash/version.rb

@@ -1,5 +1,5 @@
 module Omniauth
   module Whiplash
-    VERSION = "0.1.0"
+    VERSION = "0.2.0"
   end
 end

data/omniauth-whiplash.gemspec

@@ -24,5 +24,5 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rspec"
 
   spec.add_dependency 'omniauth', '~> 1.0'
-  spec.add_dependency 'omniauth-oauth2', '~> 1.3.1'
+  spec.add_dependency 'omniauth-oauth2', '~> 1.4'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-whiplash
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Mark Dickson
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-04-25 00:00:00.000000000 Z
+date: 2017-06-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -73,14 +73,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.3.1
+        version: '1.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.3.1
+        version: '1.4'
 description: Omniauth Strategy for Whiplash Merchandising
 email:
 - mark@whiplashmerch.com
@@ -124,9 +124,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5.1
+rubygems_version: 2.6.11
 signing_key: 
 specification_version: 4
 summary: Omniauth Strategy for Whiplash Merchandising
 test_files: []
-has_rdoc: