omniauth 2.1.4 → 2.3.0

data/lib/omniauth/strategy.rb

@@ -1,116 +1,32 @@
 require 'omniauth/key_store'
+require 'omniauth/strategy/class_methods'
+require 'omniauth/strategy/fetchers'
+require 'omniauth/strategy/hosts'
+require 'omniauth/strategy/paths'
+require 'omniauth/strategy/sign_ins'
+require 'omniauth/strategy/test_mode'
 
 module OmniAuth
   class NoSessionError < StandardError; end
+
   # The Strategy is the base unit of OmniAuth's ability to
   # wrangle multiple providers. Each strategy provided by
   # OmniAuth includes this mixin to gain the default functionality
   # necessary to be compatible with the OmniAuth library.
-  module Strategy # rubocop:disable ModuleLength
+  module Strategy # rubocop:disable Metrics/ModuleLength
+    include Fetchers
+    include Hosts
+    include Paths
+    include SignIns
+    include TestMode
+
     def self.included(base)
       OmniAuth.strategies << base
 
       base.extend ClassMethods
-      base.class_eval do
-        option :setup, false
-        option :skip_info, false
-        option :origin_param, 'origin'
-      end
-    end
-
-    module ClassMethods
-      # Returns an inherited set of default options set at the class-level
-      # for each strategy.
-      def default_options
-        # existing = superclass.default_options if superclass.respond_to?(:default_options)
-        existing = superclass.respond_to?(:default_options) ? superclass.default_options : {}
-        @default_options ||= OmniAuth::Strategy::Options.new(existing)
-      end
-
-      # This allows for more declarative subclassing of strategies by allowing
-      # default options to be set using a simple configure call.
-      #
-      # @param options [Hash] If supplied, these will be the default options (deep-merged into the superclass's default options).
-      # @yield [Options] The options Mash that allows you to set your defaults as you'd like.
-      #
-      # @example Using a yield to configure the default options.
-      #
-      #   class MyStrategy
-      #     include OmniAuth::Strategy
-      #
-      #     configure do |c|
-      #       c.foo = 'bar'
-      #     end
-      #   end
-      #
-      # @example Using a hash to configure the default options.
-      #
-      #   class MyStrategy
-      #     include OmniAuth::Strategy
-      #     configure foo: 'bar'
-      #   end
-      def configure(options = nil)
-        if block_given?
-          yield default_options
-        else
-          default_options.deep_merge!(options)
-        end
-      end
-
-      # Directly declare a default option for your class. This is a useful from
-      # a documentation perspective as it provides a simple line-by-line analysis
-      # of the kinds of options your strategy provides by default.
-      #
-      # @param name [Symbol] The key of the default option in your configuration hash.
-      # @param value [Object] The value your object defaults to. Nil if not provided.
-      #
-      # @example
-      #
-      #   class MyStrategy
-      #     include OmniAuth::Strategy
-      #
-      #     option :foo, 'bar'
-      #     option
-      #   end
-      def option(name, value = nil)
-        default_options[name] = value
-      end
-
-      # Sets (and retrieves) option key names for initializer arguments to be
-      # recorded as. This takes care of 90% of the use cases for overriding
-      # the initializer in OmniAuth Strategies.
-      def args(args = nil)
-        if args
-          @args = Array(args)
-          return
-        end
-        existing = superclass.respond_to?(:args) ? superclass.args : []
-        (instance_variable_defined?(:@args) && @args) || existing
-      end
-
-      %w[uid info extra credentials].each do |fetcher|
-        class_eval <<-RUBY, __FILE__, __LINE__ + 1
-          attr_reader :#{fetcher}_proc
-          private :#{fetcher}_proc
-
-          def #{fetcher}(&block)
-            return #{fetcher}_proc unless block_given?
-            @#{fetcher}_proc = block
-          end
-
-          def #{fetcher}_stack(context)
-            compile_stack(self.ancestors, :#{fetcher}, context)
-          end
-        RUBY
-      end
-
-      def compile_stack(ancestors, method, context)
-        stack = ancestors.inject([]) do |a, ancestor|
-          a << context.instance_eval(&ancestor.send(method)) if ancestor.respond_to?(method) && ancestor.send(method)
-          a
-        end
-        stack.reverse!
-      end
+      base.option :setup, false
+      base.option :skip_info, false
+      base.option :origin_param, 'origin'
     end
 
     attr_reader :app, :env, :options, :response
@@ -130,7 +46,7 @@ module OmniAuth
     #   will be passed through and set to the appropriate values.
     #
     # @yield [Options] Yields options to block for further configuration.
-    def initialize(app, *args, &block) # rubocop:disable UnusedMethodArgument
+    def initialize(app, *args)
       @app = app
       @env = nil
       @options = self.class.default_options.dup
@@ -145,7 +61,7 @@ module OmniAuth
       end
 
       # Make sure that all of the args have been dealt with, otherwise error out.
-      raise(ArgumentError.new("Received wrong number of arguments. #{args.inspect}")) unless args.empty?
+      raise(ArgumentError.new("Received wrong number of arguments. #{args}")) unless args.empty?
 
       yield options if block_given?
     end
@@ -160,12 +76,15 @@ module OmniAuth
     # @example
     #   log :warn, "This is a warning."
     def log(level, message)
-      OmniAuth.logger.send(level, "(#{name}) #{message}")
+      OmniAuth.logger.public_send(level, "(#{name}) #{message}")
     end
 
-    # Duplicates this instance and runs #call! on it.
+    # Duplicates this instance and runs #call! on it. A request that can't be
+    # the strategy's goes straight to the app instead, skipping the copy.
     # @param [Hash] The Rack environment.
     def call(env)
+      return @app.call(env) if passthrough?(env)
+
       dup.call!(env)
     end
 
@@ -174,9 +93,9 @@ module OmniAuth
     # the request path is recognized.
     #
     # @param env [Hash] The Rack environment.
-    def call!(env) # rubocop:disable CyclomaticComplexity, PerceivedComplexity
+    def call!(env)
       unless env['rack.session']
-        error = OmniAuth::NoSessionError.new('You must provide a session to use OmniAuth.')
+        error = NoSessionError.new('You must provide a session to use OmniAuth.')
         raise(error)
       end
 
@@ -184,22 +103,37 @@ module OmniAuth
 
       warn_if_using_get_on_request_path
 
-      @env['omniauth.strategy'] = self if on_auth_path?
+      env['omniauth.strategy'] = self if on_auth_path?
 
       return mock_call!(env) if OmniAuth.config.test_mode
 
-      begin
-        return options_call if on_auth_path? && options_request?
-        return request_call if on_request_path? && OmniAuth.config.allowed_request_methods.include?(request.request_method.downcase.to_sym)
-        return callback_call if on_callback_path?
-        return other_phase if respond_to?(:other_phase)
-      rescue StandardError => e
-        raise e if env.delete('omniauth.error.app')
+      phase_call || @app.call(env)
+    end
 
-        return fail!(e.message, e)
+    # Runs the phase that matches the current request, or returns nil
+    # if the request isn't for this strategy.
+    def phase_call
+      if options_call?
+        options_call
+      elsif request_call?
+        request_call
+      elsif on_callback_path?
+        callback_call
+      elsif respond_to?(:other_phase)
+        other_phase
       end
+    rescue StandardError => e
+      handle_phase_error(e)
+    end
+
+    # True for an OPTIONS request to the request or callback path.
+    def options_call?
+      on_auth_path? && options_request?
+    end
 
-      @app.call(env)
+    # True for a request to the request path with an allowed method.
+    def request_call?
+      on_request_path? && OmniAuth.config.allowed_request_methods.include?(request.request_method.downcase.to_sym)
     end
 
     def warn_if_using_get_on_request_path
@@ -224,137 +158,80 @@ module OmniAuth
 
     # Responds to an OPTIONS request.
     def options_call
-      OmniAuth.config.before_options_phase.call(env) if OmniAuth.config.before_options_phase
-      verbs = OmniAuth.config.allowed_request_methods.collect(&:to_s).collect(&:upcase).join(', ')
+      run_hook(:before_options_phase)
+      verbs = OmniAuth.config.allowed_request_methods.collect(&:upcase).join(', ')
       [200, {'Allow' => verbs}, []]
     end
 
     # Performs the steps necessary to run the request phase of a strategy.
-    def request_call # rubocop:disable CyclomaticComplexity, MethodLength, PerceivedComplexity
+    def request_call
       setup_phase
       log :debug, 'Request phase initiated.'
+      warn_if_using_request_host
+      return invalid_host! unless allowed_host?
 
-      # store query params from the request url, extracted in the callback_phase
-      session['omniauth.params'] = request.GET
-
-      OmniAuth.config.request_validation_phase.call(env) if OmniAuth.config.request_validation_phase
-      OmniAuth.config.before_request_phase.call(env) if OmniAuth.config.before_request_phase
+      run_hook(:request_validation_phase)
+      session['omniauth.params'] = omniauth_params
+      run_hook(:before_request_phase)
+      request_response.tap { run_hook(:after_request_phase) }
+    rescue OmniAuth::AuthenticityError => e
+      fail!(:authenticity_error, e)
+    end
 
-      result = if options.form.respond_to?(:call)
+    # Renders the login form (from a Rack endpoint or the app itself) if
+    # one is configured, or else runs the strategy's request phase.
+    def request_response
+      if options.form.respond_to?(:call)
         log :debug, 'Rendering form from supplied Rack endpoint.'
         options.form.call(env)
       elsif options.form
         log :debug, 'Rendering form from underlying application.'
         call_app!
-      elsif !options.origin_param
-        request_phase
       else
-        if request.params[options.origin_param]
-          env['rack.session']['omniauth.origin'] = request.params[options.origin_param]
-        elsif env['HTTP_REFERER'] && !env['HTTP_REFERER'].match(/#{request_path}$/)
-          env['rack.session']['omniauth.origin'] = env['HTTP_REFERER']
-        end
-
+        store_origin if options.origin_param
         request_phase
       end
-      
-      OmniAuth.config.after_request_phase.call(env) if OmniAuth.config.after_request_phase
-      result
-    rescue OmniAuth::AuthenticityError => e
-      fail!(:authenticity_error, e)
-    end
-
-    # Performs the steps necessary to run the callback phase of a strategy.
-    def callback_call
-      setup_phase
-      log :debug, 'Callback phase initiated.'
-      @env['omniauth.origin'] = session.delete('omniauth.origin')
-      @env['omniauth.origin'] = nil if env['omniauth.origin'] == ''
-      @env['omniauth.params'] = session.delete('omniauth.params') || {}
-      OmniAuth.config.before_callback_phase.call(@env) if OmniAuth.config.before_callback_phase
-      callback_phase
-    end
-
-    # Returns true if the environment recognizes either the
-    # request or callback path.
-    def on_auth_path?
-      on_request_path? || on_callback_path?
-    end
-
-    def on_request_path?
-      if options[:request_path].respond_to?(:call)
-        options[:request_path].call(env)
-      else
-        on_path?(request_path)
-      end
-    end
-
-    def on_callback_path?
-      on_path?(callback_path)
     end
 
-    def on_path?(path)
-      current_path.casecmp(path).zero?
-    end
+    # The authenticity token never goes into omniauth.params, so the app
+    # can't leak it by echoing the params back.
+    AUTHENTICITY_PARAM = 'authenticity_token'.freeze
 
-    def options_request?
-      request.request_method == 'OPTIONS'
+    # The params the app sent to the request phase, from both the query
+    # string and the form, which the callback phase hands back as
+    # env['omniauth.params'].
+    def omniauth_params
+      request.params.reject { |key, _| key.eql?(AUTHENTICITY_PARAM) }
     end
 
-    # This is called in lieu of the normal request process
-    # in the event that OmniAuth has been configured to be
-    # in test mode.
-    def mock_call!(*)
-      begin
-        return mock_request_call if on_request_path? && OmniAuth.config.allowed_request_methods.include?(request.request_method.downcase.to_sym)
-        return mock_callback_call if on_callback_path?
-      rescue StandardError => e
-        raise e if env.delete('omniauth.error.app')
-
-        return fail!(e.message, e)
+    # Remembers where the user came from (the origin param, or else the
+    # referer) so the callback phase can send them back there.
+    def store_origin
+      origin = request.params[options.origin_param]
+      referer = env['HTTP_REFERER']
+      if origin
+        session['omniauth.origin'] = origin
+      elsif referer && !referer.match?(/#{request_path}$/)
+        session['omniauth.origin'] = referer
       end
-
-      call_app!
     end
 
-    def mock_request_call
+    # Performs the steps necessary to run the callback phase of a strategy.
+    def callback_call
       setup_phase
+      log :debug, 'Callback phase initiated.'
+      return invalid_host! unless allowed_host?
 
-      session['omniauth.params'] = request.GET
-
-      OmniAuth.config.request_validation_phase.call(env) if OmniAuth.config.request_validation_phase
-      OmniAuth.config.before_request_phase.call(env) if OmniAuth.config.before_request_phase
-
-      if options.origin_param
-        if request.params[options.origin_param]
-          session['omniauth.origin'] = request.params[options.origin_param]
-        elsif env['HTTP_REFERER'] && !env['HTTP_REFERER'].match(/#{request_path}$/)
-          session['omniauth.origin'] = env['HTTP_REFERER']
-        end
-      end
-
-      result = redirect(callback_url)
-
-      OmniAuth.config.after_request_phase.call(env) if OmniAuth.config.after_request_phase
-      result
+      sign_in = recall_sign_in
+      origin = sign_in.fetch('origin')
+      env['omniauth.origin'] = (origin unless origin.eql?(''))
+      env['omniauth.params'] = sign_in.fetch('params') || {}
+      run_hook(:before_callback_phase)
+      callback_phase
     end
 
-    def mock_callback_call
-      setup_phase
-
-      origin = session.delete('omniauth.origin')
-      @env['omniauth.origin'] ||= origin
-      @env['omniauth.origin'] = nil if env['omniauth.origin'] == ''
-      @env['omniauth.params'] = session.delete('omniauth.params') || {}
-
-      mocked_auth = OmniAuth.mock_auth_for(name.to_s)
-      if mocked_auth.is_a?(Symbol)
-        fail!(mocked_auth)
-      else
-        @env['omniauth.auth'] = mocked_auth
-        OmniAuth.config.before_callback_phase.call(@env) if OmniAuth.config.before_callback_phase
-        call_app!
-      end
+    def options_request?
+      request.request_method.eql?('OPTIONS')
     end
 
     # The setup phase looks for the `:setup` option to exist and,
@@ -362,10 +239,11 @@ module OmniAuth
     # `:setup` option or it will call out to the setup path of the
     # underlying application. This will default to `/auth/:provider/setup`.
     def setup_phase
-      if options[:setup].respond_to?(:call)
+      setup = options[:setup]
+      if setup.respond_to?(:call)
         log :debug, 'Setup endpoint detected, running now.'
-        options[:setup].call(env)
-      elsif options[:setup]
+        setup.call(env)
+      elsif setup
         log :debug, 'Calling through to underlying application for setup.'
         setup_env = env.merge('PATH_INFO' => setup_path, 'REQUEST_METHOD' => 'GET')
         call_app!(setup_env)
@@ -379,147 +257,28 @@ module OmniAuth
       raise(NotImplementedError)
     end
 
-    def uid
-      self.class.uid_stack(self).last
-    end
-
-    def info
-      merge_stack(self.class.info_stack(self))
-    end
-
-    def credentials
-      merge_stack(self.class.credentials_stack(self))
-    end
-
-    def extra
-      merge_stack(self.class.extra_stack(self))
-    end
-
-    def auth_hash
-      credentials_data = credentials
-      extra_data = extra
-      AuthHash.new(:provider => name, :uid => uid).tap do |auth|
-        auth.info = info unless skip_info?
-        auth.credentials = credentials_data if credentials_data
-        auth.extra = extra_data if extra_data
-      end
-    end
-
-    # Determines whether or not user info should be retrieved. This
-    # allows some strategies to save a call to an external API service
-    # for existing users. You can use it either by setting the `:skip_info`
-    # to true or by setting `:skip_info` to a Proc that takes a uid and
-    # evaluates to true when you would like to skip info.
-    #
-    # @example
-    #
-    #   use MyStrategy, :skip_info => lambda{|uid| User.find_by_uid(uid)}
-    def skip_info?
-      return false unless options.skip_info?
-      return true unless options.skip_info.respond_to?(:call)
-
-      options.skip_info.call(uid)
-    end
-
     def callback_phase
       env['omniauth.auth'] = auth_hash
       call_app!
     end
 
-    def path_prefix
-      options[:path_prefix] || OmniAuth.config.path_prefix
-    end
-
-    def custom_path(kind)
-      if options[kind].respond_to?(:call)
-        result = options[kind].call(env)
-        return nil unless result.is_a?(String)
-
-        result
-      else
-        options[kind]
-      end
-    end
-
-    def request_path
-      @request_path ||=
-        if options[:request_path].is_a?(String)
-          options[:request_path]
-        else
-          "#{script_name}#{path_prefix}/#{name}"
-        end
-    end
-
-    def callback_path
-      @callback_path ||= begin
-        path = options[:callback_path] if options[:callback_path].is_a?(String)
-        path ||= current_path if options[:callback_path].respond_to?(:call) && options[:callback_path].call(env)
-        path ||= custom_path(:request_path)
-        path ||= "#{script_name}#{path_prefix}/#{name}/callback"
-        path
-      end
-    end
-
-    def setup_path
-      options[:setup_path] || "#{path_prefix}/#{name}/setup"
-    end
-
-    CURRENT_PATH_REGEX = %r{/$}.freeze
-    EMPTY_STRING       = ''.freeze
-    def current_path
-      @current_path ||= request.path.downcase.sub(CURRENT_PATH_REGEX, EMPTY_STRING)
-    end
-
-    def query_string
-      request.query_string.empty? ? '' : "?#{request.query_string}"
-    end
-
-    def call_app!(env = @env)
-      @app.call(env)
-    rescue StandardError => e
-      env['omniauth.error.app'] = true
-      raise e
-    end
-
-    def full_host
-      case OmniAuth.config.full_host
-      when String
-        OmniAuth.config.full_host
-      when Proc
-        OmniAuth.config.full_host.call(env)
-      else
-        # in Rack 1.3.x, request.url explodes if scheme is nil
-        if request.scheme && URI.parse(request.url).absolute?
-          uri = URI.parse(request.url.gsub(/\?.*$/, ''))
-          uri.path = ''
-          # sometimes the url is actually showing http inside rails because the
-          # other layers (like nginx) have handled the ssl termination.
-          uri.scheme = 'https' if ssl? # rubocop:disable BlockNesting
-          uri.to_s
-        else ''
-        end
-      end
-    end
-
-    def callback_url
-      full_host + callback_path + query_string
-    end
-
-    def script_name
-      return '' if @env.nil?
-      @env['SCRIPT_NAME'] || ''
+    def call_app!(app_env = env)
+      @app.call(app_env)
+    rescue StandardError
+      app_env['omniauth.error.app'] = true
+      raise
     end
 
     def session
-      @env['rack.session']
+      env['rack.session']
     end
 
     def request
-      @request ||= Rack::Request.new(@env)
+      @request ||= Rack::Request.new(env)
     end
 
     def name
-      options[:name]
+      options.fetch(:name)
     end
 
     def redirect(uri)
@@ -557,24 +316,53 @@ module OmniAuth
 
   protected
 
+    # Re-raises errors from the downstream app; reports anything else
+    # raised during a phase as an authentication failure.
+    def handle_phase_error(error)
+      raise error if env.delete('omniauth.error.app')
+
+      fail!(error.message, error)
+    end
+
+    # Calls the named OmniAuth.config hook (such as :before_request_phase)
+    # with the Rack env. A hook set to nil or false is skipped.
+    def run_hook(name)
+      hook = OmniAuth.config.public_send(name)
+      return unless hook # not hook&.call: a hook can be set to false
+
+      hook.call(env)
+    end
+
     def initialize_copy(*args)
       super
       @options = @options.dup
     end
 
-    def merge_stack(stack)
-      stack.inject({}) do |a, e|
-        a.merge!(e)
-        a
-      end
+    # True when #call! would only hand env to the app: there's a session, the
+    # path alone decides, and env isn't on the strategy's paths. The
+    # strategy's own path methods check, on a copy that shares its options.
+    def passthrough?(env)
+      return false unless env['rack.session'] && dispatch_by_path?
+      return false if path_probe(env).on_auth_path?
+
+      true
+    end
+
+    # True when OmniAuth's own dispatch runs, with no test mode or
+    # other_phase, and no path lambdas, which would otherwise run twice on
+    # the strategy's own paths.
+    def dispatch_by_path?
+      self.class.default_dispatch? && !OmniAuth.config.test_mode && !respond_to?(:other_phase) &&
+        !options[:request_path].respond_to?(:call) && !options[:callback_path].respond_to?(:call)
     end
 
-    def ssl?
-      request.env['HTTPS'] == 'on' ||
-        request.env['HTTP_X_FORWARDED_SSL'] == 'on' ||
-        request.env['HTTP_X_FORWARDED_SCHEME'] == 'https' ||
-        (request.env['HTTP_X_FORWARDED_PROTO'] && request.env['HTTP_X_FORWARDED_PROTO'].split(',')[0] == 'https') ||
-        request.env['rack.url_scheme'] == 'https'
+    # A copy like #dup makes, but sharing this instance's options, so the
+    # path methods can memoize on it instead of on this shared instance.
+    def path_probe(env)
+      probe = self.class.allocate
+      instance_variables.each { |ivar| probe.instance_variable_set(ivar, instance_variable_get(ivar)) }
+      probe.instance_variable_set(:@env, env)
+      probe
     end
   end
 end

data/lib/omniauth/test/phony_session.rb

@@ -6,7 +6,7 @@ module OmniAuth
       end
 
       def call(env)
-        @session ||= (env['rack.session'] || {})
+        @session ||= env['rack.session'] || {}
         env['rack.session'] = @session
         @app.call(env)
       end

data/lib/omniauth/test/strategy_test_case.rb

@@ -18,18 +18,17 @@ module OmniAuth
     #   end
     module StrategyTestCase
       def app
-        strat = strategy
         resp = app_response
-        Rack::Builder.new do
-          use(OmniAuth::Test::PhonySession)
-          use(*strat)
-          run lambda { |env| [404, {'Content-Type' => 'text/plain'}, [resp || env.key?('omniauth.auth').to_s]] }
-        end.to_app
+        builder = Rack::Builder.new
+        builder.use(PhonySession)
+        builder.use(*strategy)
+        # @type var endpoint: ^(Rack::env) -> Rack::response
+        endpoint = lambda { |env| [404, {'Content-Type' => 'text/plain'}, [resp || env.key?('omniauth.auth').to_s]] }
+        builder.run(endpoint)
+        builder.to_app
       end
 
-      def app_response
-        nil
-      end
+      def app_response; end
 
       def session
         last_request.env['rack.session']

data/lib/omniauth/version.rb

@@ -1,3 +1,3 @@
 module OmniAuth
-  VERSION = '2.1.4'.freeze
+  VERSION = '2.3.0'.freeze
 end