omniauth 2.1.4 → 2.3.0

data/lib/omniauth/strategy/class_methods.rb

@@ -0,0 +1,118 @@
+module OmniAuth
+  module Strategy
+    module ClassMethods
+      DISPATCH_METHODS = %i[call! phase_call options_call? request_call? on_auth_path?].freeze
+      private_constant :DISPATCH_METHODS
+
+      # True when requests are dispatched by OmniAuth's own #call! and its
+      # phase checks, so #call can tell which ones would go to the app.
+      # They may live in Strategy or in a module it includes, like Paths.
+      # Methods patched directly onto Strategy count as its own.
+      #
+      # @api private
+      def default_dispatch?
+        return @default_dispatch if instance_variable_defined?(:@default_dispatch)
+
+        @default_dispatch = DISPATCH_METHODS.all? { |m| Strategy.ancestors.include?(instance_method(m).owner) }
+      end
+
+      # Returns an inherited set of default options set at the class-level
+      # for each strategy.
+      def default_options
+        @default_options ||= begin
+          parent = superclass
+          Options.new((parent.default_options if parent.is_a?(ClassMethods)))
+        end
+      end
+
+      # This allows for more declarative subclassing of strategies by allowing
+      # default options to be set using a simple configure call.
+      #
+      # @param options [Hash] If supplied, these will be the default options (deep-merged into the superclass's default options).
+      # @yield [Options] The options Mash that allows you to set your defaults as you'd like.
+      #
+      # @example Using a yield to configure the default options.
+      #
+      #   class MyStrategy
+      #     include OmniAuth::Strategy
+      #
+      #     configure do |c|
+      #       c.foo = 'bar'
+      #     end
+      #   end
+      #
+      # @example Using a hash to configure the default options.
+      #
+      #   class MyStrategy
+      #     include OmniAuth::Strategy
+      #     configure foo: 'bar'
+      #   end
+      def configure(options = nil)
+        if block_given?
+          yield default_options
+        else
+          default_options.deep_merge!(options || {})
+        end
+      end
+
+      # Directly declare a default option for your class. This is a useful from
+      # a documentation perspective as it provides a simple line-by-line analysis
+      # of the kinds of options your strategy provides by default.
+      #
+      # @param name [Symbol] The key of the default option in your configuration hash.
+      # @param value [Object] The value your object defaults to. Nil if not provided.
+      #
+      # @example
+      #
+      #   class MyStrategy
+      #     include OmniAuth::Strategy
+      #
+      #     option :foo, 'bar'
+      #     option
+      #   end
+      def option(name, value = nil)
+        default_options[name] = value
+      end
+
+      # Sets (and retrieves) option key names for initializer arguments to be
+      # recorded as. This takes care of 90% of the use cases for overriding
+      # the initializer in OmniAuth Strategies.
+      def args(args = nil)
+        if args
+          @args = args.is_a?(Array) ? args : [args]
+          return
+        end
+        return @args if instance_variable_defined?(:@args)
+
+        parent = superclass
+        parent.is_a?(ClassMethods) ? parent.args : []
+      end
+
+      %w[uid info extra credentials].each do |fetcher|
+        class_eval <<-RUBY, __FILE__, __LINE__ + 1
+          attr_reader :#{fetcher}_proc                                 # attr_reader :uid_proc
+          private :#{fetcher}_proc                                     # private :uid_proc
+
+          def #{fetcher}(&block)                                       # def uid(&block)
+            return #{fetcher}_proc unless block_given?                 #   return uid_proc unless block_given?
+            @#{fetcher}_proc = block                                   #   @uid_proc = block
+          end                                                          # end
+
+          def #{fetcher}_stack(context)                                # def uid_stack(context)
+            compile_stack(self.ancestors, :#{fetcher}, context)        #   compile_stack(self.ancestors, :uid, context)
+          end                                                          # end
+        RUBY
+      end
+
+      def compile_stack(ancestors, method, context)
+        stack = ancestors.inject([]) do |a, ancestor|
+          # Only strategy classes define these blocks. Other ancestors may
+          # respond to the same names (e.g. a monkeypatched Object#info).
+          a << context.instance_eval(&ancestor.public_send(method)) if ancestor.is_a?(ClassMethods) && ancestor.public_send(method)
+          a
+        end
+        stack.reverse
+      end
+    end
+  end
+end

data/lib/omniauth/strategy/fetchers.rb

@@ -0,0 +1,57 @@
+module OmniAuth
+  module Strategy
+    # Builds the auth hash from the uid, info, credentials, and extra
+    # blocks a strategy declares with the class-level fetcher DSL.
+    module Fetchers
+      def uid
+        self.class.uid_stack(self).last
+      end
+
+      def info
+        merge_stack(self.class.info_stack(self))
+      end
+
+      def credentials
+        merge_stack(self.class.credentials_stack(self))
+      end
+
+      def extra
+        merge_stack(self.class.extra_stack(self))
+      end
+
+      def auth_hash
+        credentials_data = credentials
+        extra_data = extra
+        AuthHash.new(:provider => name, :uid => uid).tap do |auth|
+          auth.info = info unless skip_info?
+          auth.credentials = credentials_data if credentials_data
+          auth.extra = extra_data if extra_data
+        end
+      end
+
+      # Determines whether or not user info should be retrieved. This
+      # allows some strategies to save a call to an external API service
+      # for existing users. You can use it either by setting the `:skip_info`
+      # to true or by setting `:skip_info` to a Proc that takes a uid and
+      # evaluates to true when you would like to skip info.
+      #
+      # @example
+      #
+      #   use MyStrategy, :skip_info => lambda{|uid| User.find_by_uid(uid)}
+      def skip_info?
+        return false unless options.skip_info?
+        return true unless options.skip_info.respond_to?(:call)
+
+        options.skip_info.call(uid)
+      end
+
+    protected
+
+      def merge_stack(stack)
+        merged = {} #: Hash[untyped, untyped]
+        stack.each { |hash| merged.merge!(hash) }
+        merged
+      end
+    end
+  end
+end

data/lib/omniauth/strategy/hosts.rb

@@ -0,0 +1,48 @@
+module OmniAuth
+  module Strategy
+    # Guards against forged hosts. Unless a full_host is set, callback URLs
+    # use the request's host, which comes from the Host or X-Forwarded-Host
+    # header, so a forged one would send the provider a redirect_uri on
+    # another host.
+    module Hosts
+    protected
+
+      # Whether callback URLs may use this request's host. They always may
+      # when a full_host is set, since then the request's host isn't used.
+      # Otherwise, if OmniAuth.config.allowed_hosts is set, the host must
+      # match one of its entries: a string matches the whole host, ignoring
+      # case, and a regexp must match the whole host.
+      def allowed_host?
+        return true if full_host_set?
+
+        allowed_hosts = OmniAuth.config.allowed_hosts
+        return true unless allowed_hosts
+
+        host = request.host
+        allowed_hosts.any? do |allowed|
+          allowed.instance_of?(Regexp) ? /\A(?:#{allowed})\z/ === host : allowed.casecmp?(host)
+        end
+      end
+
+      def full_host_set?
+        !(options[:full_host] || OmniAuth.config.full_host).nil?
+      end
+
+      def warn_if_using_request_host
+        return if full_host_set? || OmniAuth.config.allowed_hosts
+
+        log :warn, <<-WARN
+  OmniAuth is building callback URLs from the request's host, which comes
+  from the Host or X-Forwarded-Host header and can be forged unless your
+  app or a proxy in front of it checks it. To fix this, set either:
+  OmniAuth.config.full_host = 'https://example.com'
+  OmniAuth.config.allowed_hosts = ['example.com']
+        WARN
+      end
+
+      def invalid_host!
+        fail!(:invalid_host, Error.new('The request host is not in OmniAuth.config.allowed_hosts'))
+      end
+    end
+  end
+end

data/lib/omniauth/strategy/paths.rb

@@ -0,0 +1,140 @@
+module OmniAuth
+  module Strategy
+    # Works out the request, callback, and setup paths for a strategy and
+    # whether the current request is on one of them, plus the full URLs
+    # built from them.
+    module Paths
+      # Returns true if the environment recognizes either the
+      # request or callback path.
+      def on_auth_path?
+        on_request_path? || on_callback_path?
+      end
+
+      def on_request_path?
+        if options[:request_path].respond_to?(:call)
+          options.fetch(:request_path).call(env)
+        else
+          on_path?(request_path)
+        end
+      end
+
+      def on_callback_path?
+        on_path?(callback_path) || current_path.sub(FORMAT_EXTENSION_REGEX, EMPTY_STRING).casecmp(callback_path).zero?
+      end
+
+      def on_path?(path)
+        current_path.casecmp(path).zero?
+      end
+
+      def path_prefix
+        options[:path_prefix] || OmniAuth.config.path_prefix
+      end
+
+      def custom_path(kind)
+        if options[kind].respond_to?(:call)
+          result = options.fetch(kind).call(env)
+          return nil unless result.is_a?(String)
+
+          result
+        else
+          options[kind]
+        end
+      end
+
+      def request_path
+        @request_path ||=
+          if options[:request_path].is_a?(String)
+            options.fetch(:request_path)
+          else
+            "#{script_name}#{path_prefix}/#{name}"
+          end
+      end
+
+      def callback_path
+        @callback_path ||= callback_path_option || custom_path(:request_path) || "#{script_name}#{path_prefix}/#{name}/callback"
+      end
+
+      def setup_path
+        options[:setup_path] || "#{path_prefix}/#{name}/setup"
+      end
+
+      CURRENT_PATH_REGEX = %r{/$}.freeze
+      FORMAT_EXTENSION_REGEX = /\.\w+\z/.freeze
+      EMPTY_STRING = ''.freeze
+      # Repeated slashes are collapsed, as Rails routing does, so a proxy
+      # that sends //auth/:provider still reaches the strategy.
+      def current_path
+        @current_path ||= request.path.downcase.squeeze('/').sub(CURRENT_PATH_REGEX, EMPTY_STRING)
+      end
+
+      def query_string
+        request.query_string.empty? ? '' : "?#{request.query_string}"
+      end
+
+      # The scheme and host for URLs such as callback_url: the strategy's
+      # :full_host option, else OmniAuth.config.full_host, else the
+      # request's. Either setting can be a string or a proc taking the env.
+      def full_host
+        host = options[:full_host] || OmniAuth.config.full_host
+        case host
+        when String then host
+        when Proc then host.call(env)
+        else full_host_from_request
+        end
+      end
+
+      def callback_url
+        full_host + callback_path + query_string
+      end
+
+      def script_name
+        current_env = @env
+        return '' if current_env.nil?
+
+        current_env['SCRIPT_NAME'] || ''
+      end
+
+    protected
+
+      # The :callback_path option: a string, or a lambda that returns true
+      # when the current path is the callback path.
+      def callback_path_option
+        option = options[:callback_path]
+        return option if option.is_a?(String)
+
+        current_path if option.respond_to?(:call) && option.call(env)
+      end
+
+      # The scheme, host, and port of the current request, or an empty
+      # string if the request URL isn't absolute.
+      def full_host_from_request
+        # in Rack 1.3.x, request.url explodes if scheme is nil
+        return '' unless request.scheme && URI.parse(request.url).absolute?
+
+        uri = URI.parse(request.url.sub(/\?.*/, ''))
+        uri.path = ''
+        # sometimes the url is actually showing http inside rails because the
+        # other layers (like nginx) have handled the ssl termination.
+        uri.scheme = 'https' if ssl?
+        String(uri)
+      end
+
+      # Rack env values that mean the request came in over HTTPS.
+      SSL_ENV_VALUES = {
+        'HTTPS' => 'on',
+        'HTTP_X_FORWARDED_SSL' => 'on',
+        'HTTP_X_FORWARDED_SCHEME' => 'https',
+        'rack.url_scheme' => 'https'
+      }.freeze
+
+      # Reads request.env rather than env, so full_host and callback_url also
+      # work outside a Rack call, as when a strategy's tests stub #request.
+      def ssl?
+        request_env = request.env
+        # A proxy chain can list several protocols; the first is the client's.
+        forwarded_proto = request_env['HTTP_X_FORWARDED_PROTO'].to_s.split(',').first
+        forwarded_proto.eql?('https') || SSL_ENV_VALUES.any? { |key, value| request_env[key].eql?(value) }
+      end
+    end
+  end
+end

data/lib/omniauth/strategy/sign_ins.rb

@@ -0,0 +1,57 @@
+module OmniAuth
+  module Strategy
+    # Keeps the origin and params of several sign-ins in progress at once,
+    # for example in several tabs, so each callback gets its own. Without
+    # this, the session holds a single omniauth.origin and omniauth.params,
+    # and starting a sign-in replaces the last one's.
+    #
+    # A strategy opts in when its provider sends a value from the request
+    # phase back to the callback, such as OAuth 2.0's state. Its request
+    # phase calls remember_sign_in with that value, and it overrides
+    # callback_sign_in_key to return the value from the callback.
+    module SignIns
+      # How many sign-ins are remembered. Remembering another forgets the
+      # oldest.
+      MAX_REMEMBERED_SIGN_INS = 5
+
+      # Remembers the origin and params stored for the current request phase
+      # under key, which the provider sends back to the callback.
+      def remember_sign_in(key)
+        return if key.empty?
+
+        sign_ins = remembered_sign_ins
+        sign_ins.delete(key)
+        sign_ins[key] = {'origin' => session['omniauth.origin'], 'params' => session.fetch('omniauth.params')}
+        session['omniauth.sign_ins'] = sign_ins.to_a.last(MAX_REMEMBERED_SIGN_INS).to_h
+      end
+
+      # The key the callback sends back, which a strategy that calls
+      # remember_sign_in returns. Nil for a strategy that doesn't.
+      def callback_sign_in_key; end
+
+    protected
+
+      # The origin and params for this callback, removed from the session:
+      # the ones remembered under its key, or else omniauth.origin and
+      # omniauth.params, which hold the latest sign-in's.
+      def recall_sign_in
+        fallback = {'origin' => session.delete('omniauth.origin'), 'params' => session.delete('omniauth.params')}
+        key = callback_sign_in_key
+        sign_ins = remembered_sign_ins
+        remembered = sign_ins.keys.detect { |stored| Rack::Utils.secure_compare(stored, key) } if key.instance_of?(String)
+        sign_in = sign_ins.delete(remembered)
+        return fallback unless sign_in
+
+        session['omniauth.sign_ins'] = sign_ins
+        sign_in
+      end
+
+      # A copy of the remembered sign-ins, which are changed by assigning the
+      # session key, not in place.
+      def remembered_sign_ins
+        sign_ins = session['omniauth.sign_ins']
+        sign_ins.is_a?(Hash) ? sign_ins.dup : {}
+      end
+    end
+  end
+end

data/lib/omniauth/strategy/test_mode.rb

@@ -0,0 +1,53 @@
+module OmniAuth
+  module Strategy
+    # Runs the request and callback phases against OmniAuth.config.mock_auth
+    # instead of the provider when OmniAuth.config.test_mode is enabled.
+    module TestMode
+      # This is called in lieu of the normal request process
+      # in the event that OmniAuth has been configured to be
+      # in test mode.
+      def mock_call!(*)
+        if request_call?
+          mock_request_call
+        elsif on_callback_path?
+          mock_callback_call
+        else
+          call_app!
+        end
+      rescue StandardError => e
+        handle_phase_error(e)
+      end
+
+      def mock_request_call
+        setup_phase
+
+        run_hook(:request_validation_phase)
+
+        session['omniauth.params'] = omniauth_params
+
+        run_hook(:before_request_phase)
+
+        store_origin if options.origin_param
+
+        result = redirect(callback_url)
+
+        run_hook(:after_request_phase)
+        result
+      end
+
+      def mock_callback_call
+        setup_phase
+
+        origin = session.delete('omniauth.origin')
+        env['omniauth.origin'] ||= origin
+        env['omniauth.origin'] = nil if env.fetch('omniauth.origin').eql?('')
+        env['omniauth.params'] = session.delete('omniauth.params') || {}
+
+        mocked_auth = OmniAuth.mock_auth_for(name)
+        env['omniauth.auth'] = mocked_auth unless mocked_auth.instance_of?(Symbol)
+        run_hook(:before_callback_phase)
+        mocked_auth.instance_of?(Symbol) ? fail!(mocked_auth) : call_app!
+      end
+    end
+  end
+end