omniauth_syncer 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a819b9cbe1e4eac56eeb9504aaa0b61efd924995f9a98036a346de8a4032fe7
-  data.tar.gz: df5d6f52e868a53c096de1f0dae3e57f777b41ccf6fdd25a7e9967802feccafa
+  metadata.gz: 48f9fcd40256a9a1a6b7ba4d94f2417bec8aced846f8510447eff1273acb1cae
+  data.tar.gz: 46379816e4394ed025c39c3b5fe263bae20789892c67124f4bde62ff612c9b07
 SHA512:
-  metadata.gz: 885231fb38457b3b9284f80081c60b87ccfb9a1672164df8e5efd657a7165087b4bfef266efdf4a1206fa9ed83e0406a5cc2d1099e0a952588eddc85e01333f2
-  data.tar.gz: f7aecc03a67a0f66aa77d854708e57a34955feabc32f7225dfe8496c046c31e67e13b9ff36bcc806d4453a04ec5adab2d66add266403325cf9464df725825d03
+  metadata.gz: 25e9c166e961720e081eed2c4b87d2e78da3e821c8907c8e6438a0c5f47dc24e352069ea3d2b0acb71ad08c5965472d75f89d37cd3bd0bb97a9f952564c6af02
+  data.tar.gz: d083b9589e57d984cf83b49ee519364ed256d3a75a48a8316959f8a51d4461450eba17e435b28456d55f5da5781660c9ec08a62ac037ad61f89e72d66a779441

data/CHANGELOG.md

@@ -0,0 +1,47 @@
+# Changelog
+
+## 0.2.0 — 2026-09-24
+
+### Breaking
+
+- The default `mappings` are now `{ email: 'info.email', name: 'info.name' }` (was `{}`).
+- `nil` is the only value skipped when syncing. `false`, `''` and `[]` are now written. In 0.1.0 anything not
+  `present?` was skipped, so a revoked flag could never be saved as `false`.
+- A blank uid now raises `OmniauthSyncer::MissingIdentityError`. In 0.1.0, `find_or_initialize_by(uid: nil)` could
+  return an unrelated user.
+- Another row holding the incoming email now raises `OmniauthSyncer::ConflictError` by default. Before, it failed on
+  the unique index or created a duplicate. Emails are compared case-insensitively. See `on_conflict`.
+- `ControllerHelpers#sync_sso_user` is now private. It logs and re-raises any error, and returns `nil` when the sync
+  is refused.
+- The `Rails::Engine` is replaced by a Railtie. The example controller and initializer moved from the gem root to
+  `examples/rails/`. Under an engine, Rails would have loaded them into every host app.
+- Requires Ruby ≥ 3.1 and ActiveSupport ≥ 6.1.
+
+### Added
+
+- `provider_field`: look users up by `(provider, uid)` and store `auth['provider']`.
+- `on_conflict: :raise | :link | :ignore` for "same email, different uid". `:link` attaches the uid only when the
+  existing row has no uid and `email_verified` is true. Each conflict publishes `conflict.omniauth_syncer`.
+- Mappings can be callables. `OmniauthSyncer::Mappings::ADMIN` and `EMAIL_VERIFIED` are ready-made hub mappings.
+- `clear_blank`: write `nil` when the provider sent the attribute empty. It checks the granted scopes (`extra.scope`,
+  or key presence in `extra.raw_info`) via `path_scopes`.
+- `Configuration#validate!` and `OmniauthSyncer.validate!` raise `OmniauthSyncer::ConfigurationError` with a precise
+  message. `SyncService` runs the same checks before every sync.
+- `include_controller_helpers`: have the Railtie include `ControllerHelpers` into `ActionController::Base`.
+- `ControllerHelpers` is required from `omniauth_syncer`.
+- Two simultaneous first logins no longer fail with `ActiveRecord::RecordNotUnique`: the losing request retries the
+  lookup once. The save runs in a savepoint, so the retry also works inside a host transaction.
+
+### Fixed
+
+- Path lookup no longer turns `false` into `nil`.
+
+### Internal
+
+- New spec suite against an in-memory SQLite database, with auth hash fixtures for strategy 0.2.0 and 0.1.2.
+- Added RuboCop config for Ruby 3.1, GitHub Actions CI (Ruby 3.1–3.4), a `Rakefile` and a `.gitignore`.
+- README rewritten around the `omniauth-ssoprovider` auth hash.
+
+## 0.1.0
+
+- Initial release.

data/README.md

@@ -1,127 +1,297 @@
-omniauth\_syncer 🚀
-===================
+# omniauth_syncer
 
-A plug-and-play Ruby gem designed for applications using **OmniAuth** (often with SSO providers) to reliably and safely synchronize user profile data into a local $\\text{ActiveRecord}$ model.
+Keeps a local ActiveRecord user in step with the OmniAuth auth hash after an SSO login.
 
-This gem prevents data drift by ensuring the local user record is always up-to-date with the latest information fetched from the SSO provider during a successful login.
+On each login, `OmniauthSyncer::SyncService.call(auth_hash)` does four things:
 
-Installation
-------------
+1. It looks up the local user by `(provider, uid)`, or by `uid` alone.
+2. It copies the mapped attributes out of the auth hash.
+3. It applies an explicit policy when another local user already holds the incoming email.
+4. It saves the user with `save!`.
 
-Add this line to your application's Gemfile:
+`ControllerHelpers#sync_sso_user` wraps the service for an OmniAuth callback controller.
 
-Ruby
+The gem is written for client apps that sign in through a SecureSSOHub server with
+[`omniauth-ssoprovider`](https://github.com/danielefrisanco/omniauth-ssoprovider). It works with any OmniAuth
+strategy that fills `uid` and `info`.
+
+Requires Ruby ≥ 3.1 and ActiveSupport ≥ 6.1. The user model must be ActiveRecord.
+
+## Installation
 
 ```ruby
+gem 'omniauth-ssoprovider'
 gem 'omniauth_syncer'
 ```
 
-Then execute:
+## The auth hash
 
-Bash
+With `omniauth-ssoprovider` 0.2.0, a hub login produces:
 
-```bash
-bundle install   
+```ruby
+{
+  "provider" => "ssoprovider",                    # or whatever name the strategy is mounted under
+  "uid"      => "<sso_id>",                       # stable UUID, the hub's `sub`
+  "info"     => { "name" => "…", "email" => "…" }, # each nil without its scope
+  "extra"    => {
+    "raw_info"       => { "id" => "<sso_id>", "sub" => "<sso_id>", "name" => "…",
+                          "email" => "…", "email_verified" => false, "roles" => ["admin"] },
+    "access_token"   => "<RS256 JWT, 10 min>",
+    "refresh_token"  => "<opaque or nil>",
+    "expires_at"     => 1758200000,
+    "id_token"       => { "sub" => "…", "iss" => "…", "aud" => "…", "nonce" => "…" },
+    "roles"          => ["admin"],                # or []
+    "email_verified" => false,
+    "scope"          => ["openid", "profile", "email"]
+  }
+}
 ```
 
-Configuration
--------------
+`omniauth-ssoprovider` 0.1.2 gives the same `provider`, `uid` and `info`. Its `extra` holds only `raw_info` and
+`access_token`. The default mappings work with both versions.
 
-The gem requires a basic setup to know which local model to use and how to map fields from the OmniAuth hash.
+Treat `uid` as the only stable identity. Users can change their email on the hub.
 
-Create an initializer file at config/initializers/omniauth\_syncer.rb:
-
-Ruby
+## Configuration
 
 ```ruby
 # config/initializers/omniauth_syncer.rb
 OmniauthSyncer.configure do |config|
-  # 1. Local User Model
-  # The name of the local ActiveRecord class to sync data to (e.g., 'User')
-  config.user_model = 'User'
-  # 2. Unique Identifier Field
-  # The column in your local User model used for lookup (must be unique).
-  config.uid_field = :sso_uid
-  # 3. Path to UID in Auth Hash
-  # The string path in the OmniAuth Auth Hash that holds the unique identifier.
-  # Example: 'uid' is used for the top-level hash['uid'].
-  config.uid_field_in_auth = 'uid'
-  # 4. Attribute Mappings
-  # Map local attributes (keys) to the path in the OmniAuth Auth Hash (values).
-  # Use dot notation for nested fields (e.g., 'info.email').
-  config.mappings = {
-    email: 'info.email',
-    full_name: 'info.name',
-    # Example for nested data like roles provided by the SSO server:
-    roles: 'extra.raw_info.roles'
-  }
-end   
+  config.user_model = 'User'          # default
+  config.uid_field = :sso_uid         # column holding the uid; default :uid
+  config.uid_field_in_auth = 'uid'    # dotted path in the auth hash; default
+  config.provider_field = :provider   # optional: look users up by (provider, uid)
+
+  # Default mappings: { email: 'info.email', name: 'info.name' }
+  config.mappings[:admin] = OmniauthSyncer::Mappings::ADMIN
+  config.mappings[:email_verified] = OmniauthSyncer::Mappings::EMAIL_VERIFIED
+
+  config.on_conflict = :raise         # :raise (default), :link or :ignore
+  config.clear_blank = false          # default
+end
 ```
 
-Usage
------
+The host needs the matching columns and unique indexes:
+
+```ruby
+add_column :users, :sso_uid, :string
+add_column :users, :provider, :string
+add_index :users, %i[provider sso_uid], unique: true
+add_index :users, :email, unique: true
+```
+
+### Mappings
+
+A mapping points a local attribute at a source. The source can be one of two things:
+
+- **A dotted path** such as `'info.email'` or `'extra.raw_info.roles'`. Paths work with string keys, symbol keys and
+  `OmniAuth::AuthHash`.
+- **A callable** that receives the auth hash, such as `->(auth) { auth['info']['name']&.titleize }`.
+
+Two mappings are ready to use for the hub, and neither is enabled by default:
+
+| Constant | Writes |
+| - | - |
+| `Mappings::ADMIN` | `true` or `false` from `extra.roles.include?("admin")`. Leaves the attribute untouched when the auth hash has no `extra.roles`, which is the case with strategy 0.1.2. |
+| `Mappings::EMAIL_VERIFIED` | `extra.email_verified`. For strategy 0.1.2 use `'extra.raw_info.email_verified'` instead. |
+
+`roles` is the hub's assertion that a user is a hub administrator. It is not an entitlement system.
 
-The gem provides the core synchronization logic via a helper module, which should be included in your application's **OmniAuth Callback Controller**.
+The hub sends roles only from `/api/v1/userinfo`, so `ADMIN` needs the strategy's `user_info_url:
+'/api/v1/userinfo'`. If the strategy uses `/oauth/userinfo` or has userinfo turned off, admins arrive with `roles: []`,
+and `ADMIN` revokes their flag.
 
-### Step 1: Include the Helper
+### Nil values and `clear_blank`
 
-In your OmniAuth Callback Controller (e.g., app/controllers/users/omniauth\_callbacks\_controller.rb):
+`false`, `''` and `[]` are values and are always written, so a revoked admin or an unverified email is saved as such.
 
-Ruby
+A `nil` value is skipped by default, which keeps the local value.
+
+With `clear_blank = true`, a `nil` is written only when the provider actually sent the attribute:
+
+- **Scoped paths.** `path_scopes` lists paths that depend on a scope. By default `info.email` and
+  `extra.email_verified` need `email`, and `info.name` needs `profile`. Such a path is cleared only when its scope was
+  granted.
+  - When `extra.scope` is present (strategy 0.2.0), the gem reads the granted scopes from it.
+  - Otherwise, the gem checks whether `extra.raw_info` has the key. The hub leaves a key out entirely when its scope
+    wasn't granted.
+- **Other paths.** A path not in `path_scopes` is cleared when its key is present in the auth hash with a `nil` value.
+- **Callables.** A callable that returns `nil` never clears anything. Return `''` or `false` to clear.
+
+Without this check, a client that didn't request the `email` scope would wipe every user's email on login.
+
+### Same email, different uid
+
+This happens when no user has the incoming uid, but another row already holds the incoming email. Emails are compared
+case-insensitively, so an older `Ada@Example.com` row matches the hub's `ada@example.com`. The same check runs when a
+known user changes to an email that another row holds. Typical causes:
+
+- a local account created before SSO,
+- a hub account that was deleted and recreated,
+- a stale email, where user X changed their email on the hub and user Y took the old address.
+
+| `on_conflict` | Result |
+| - | - |
+| `:raise` (default) | Raises `OmniauthSyncer::ConflictError` and writes nothing. |
+| `:ignore` | Returns `nil` and writes nothing. Treat it as a failed login. |
+| `:link` | Attaches the uid to the existing row if three conditions hold: the uid has no row of its own yet, the existing row has no uid, and `email_verified` is `true`. Otherwise it raises `ConflictError`. |
+
+`:link` never overwrites another uid, even when the email is verified. Doing so would hand user X's local account to
+user Y.
+
+The hub reports `email_verified: false` for everyone until it gets email confirmation (hub TODO T26). Until then,
+`:link` always raises against the hub.
+
+If the same user's first login arrives twice at once, both requests try to insert the row. The one that loses the race
+gets `ActiveRecord::RecordNotUnique`, looks the user up once more and updates the row the other request created. This
+relies on a unique index on the uid (or `(provider, uid)`) column.
+
+Every conflict publishes a `conflict.omniauth_syncer` notification with the payload `{ policy:, uid:, provider:,
+existing_id: }`:
 
 ```ruby
-class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
-  # Include the helper module
-  include OmniauthSyncer::ControllerHelpers
-  # ...
-end   
+ActiveSupport::Notifications.subscribe('conflict.omniauth_syncer') do |event|
+  Rails.logger.warn("SSO email conflict: #{event.payload.inspect}")
+end
 ```
 
-### Step 2: Sync the User
+### Validation
+
+`SyncService` validates the configuration before every sync. A mistake raises `OmniauthSyncer::ConfigurationError`
+with a precise message (for example `User has no writer for mapped attribute :full_name`) instead of a
+`NoMethodError`. The checks are:
+
+- `user_model` constantizes,
+- the uid, provider and email columns exist,
+- every mapped attribute has a writer,
+- every mapping is a path or a callable,
+- `on_conflict` is a known policy.
+
+To catch mistakes before the first login, call `OmniauthSyncer.validate!` from a spec, a boot check, or a deploy
+task. It needs the database schema, so don't call it from `config/initializers`, which also run for `db:create` and
+`assets:precompile`.
+
+### Tokens
+
+The gem never stores tokens unless you map them yourself:
+
+- **`extra.access_token`** lives for 10 minutes. Don't persist it. Use it during the callback, or keep it in memory.
+- **`extra.refresh_token`**, if you do store it, must be encrypted, for example with `encrypts :sso_refresh_token`
+  (Rails 7+ ActiveRecord encryption).
 
-Call the **sync\_sso\_user** method inside your provider action (e.g., sso\_provider). This method will handle the following automatically:
+## Callback controller
 
-1.  Retrieving the current $\\text{OmniAuth Auth Hash}$.
-    
-2.  Calling the $\\text{SyncService}$ to $\\text{find or create}$ the local user record based on the configured $\\text{uid}$.
-    
-3.  Updating all configured attributes.
-    
-4.  Safely **preserving** existing local data if a field is missing or nil in the incoming SSO data.
-    
+`sync_sso_user` has three outcomes:
 
-Ruby
+- It returns the saved user.
+- It returns `nil` when the `:ignore` policy refuses the sync.
+- It logs the error and re-raises it: `OmniauthSyncer::Error` subclasses, or `ActiveRecord::RecordInvalid` from your
+  model.
+
+It is a private method, so it never becomes a routable action.
+
+### With Devise
+
+```ruby
+# config/initializers/devise.rb (inside Devise.setup)
+config.omniauth :ssoprovider, ENV.fetch('SSO_CLIENT_ID'), ENV.fetch('SSO_CLIENT_SECRET'),
+                strategy_class: OmniAuth::Strategies::SSOProvider,
+                client_options: { site: ENV.fetch('SSO_HUB_URL') },
+                user_info_url: '/api/v1/userinfo',
+                scope: 'openid profile email'
+
+# config/routes.rb
+devise_for :users, controllers: { omniauth_callbacks: 'users/omniauth_callbacks' }
+
+# app/models/user.rb
+devise :omniauthable, omniauth_providers: %i[ssoprovider]
+```
 
 ```ruby
 # app/controllers/users/omniauth_callbacks_controller.rb
-class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
-  include OmniauthSyncer::ControllerHelpers
-  def sso_provider
-    begin
-      # 1. Sync the user and get the local user object
-      @user = sync_sso_user
-      # 2. Sign in the user (e.g., using Devise or a custom method)
-      if @user.persisted?
-        sign_in_and_redirect @user, event: :authentication
-      else
-        # This occurs if the user record fails local validations (e.g., missing mandatory field)
-        redirect_to root_path, alert: "Could not sync user profile due to data issues."
-      end
-    rescue => e
-      # Log any synchronization or validation errors
-      logger.error "SSO Sync Failure: #{e.message}"
-      redirect_to root_path, alert: "Authentication failed due to internal error."
+module Users
+  class OmniauthCallbacksController < Devise::OmniauthCallbacksController
+    include OmniauthSyncer::ControllerHelpers
+
+    # Named after the provider the strategy is mounted as.
+    def ssoprovider
+      user = sync_sso_user
+      return refuse('This email already belongs to another account.') unless user
+
+      sign_in_and_redirect user, event: :authentication
+    rescue OmniauthSyncer::Error, ActiveRecord::RecordInvalid
+      refuse('Sign-in failed.')
+    end
+
+    def failure
+      refuse('Sign-in failed.')
+    end
+
+    private
+
+    def refuse(message)
+      redirect_to new_user_session_path, alert: message
     end
   end
-end   
+end
 ```
 
-Contributing
-------------
+### Without Devise
+
+```ruby
+# config/initializers/omniauth.rb
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider OmniAuth::Strategies::SSOProvider, ENV.fetch('SSO_CLIENT_ID'), ENV.fetch('SSO_CLIENT_SECRET'),
+           client_options: { site: ENV.fetch('SSO_HUB_URL') },
+           user_info_url: '/api/v1/userinfo',
+           scope: 'openid profile email'
+end
+
+# config/routes.rb
+get '/auth/:provider/callback', to: 'sessions#create'
+get '/auth/failure', to: 'sessions#failure'
+```
+
+```ruby
+class SessionsController < ApplicationController
+  include OmniauthSyncer::ControllerHelpers
+
+  def create
+    user = sync_sso_user
+    return redirect_to(root_path, alert: 'This email already belongs to another account.') unless user
+
+    reset_session
+    session[:user_id] = user.id
+    redirect_to root_path
+  rescue OmniauthSyncer::Error, ActiveRecord::RecordInvalid
+    redirect_to root_path, alert: 'Sign-in failed.'
+  end
+
+  def failure
+    redirect_to root_path, alert: 'Sign-in failed.'
+  end
+end
+```
+
+OmniAuth 2 starts the login with a POST. Use `button_to '/auth/ssoprovider'` with
+`omniauth-rails_csrf_protection`.
+
+To include the helpers in every controller instead of each callback controller, set
+`config.include_controller_helpers = true`. The gem's Railtie then includes them into `ActionController::Base`.
+
+The same setup is in [`examples/rails/`](examples/rails/).
+
+## Development
+
+```bash
+bundle install
+bundle exec rake      # specs + rubocop
+bundle exec rake build
+```
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/danielefrisanco/omniauth_syncer.
+The specs use an in-memory SQLite database, so no Rails app is needed. Fixture auth hashes for strategy 0.2.0 and
+0.1.2 are in `spec/fixtures/`.
 
-License
--------
+## License
 
-The gem is available as open source under the terms of the **MIT License**.
+MIT

data/lib/omniauth_syncer/auth_path.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module OmniauthSyncer
+  # Dotted-path lookup into an auth hash ('info.email', 'extra.raw_info.roles').
+  # Works on plain Hashes with string or symbol keys and on OmniAuth::AuthHash.
+  # Unlike `a || b` lookups it keeps `false` values, and it can tell a key that
+  # is present with a nil value from a key that is missing.
+  module AuthPath
+    MISSING = Object.new.freeze
+    private_constant :MISSING
+
+    module_function
+
+    def dig(auth, path)
+      value = lookup(auth, path)
+      value.equal?(MISSING) ? nil : value
+    end
+
+    def key?(auth, path)
+      !lookup(auth, path).equal?(MISSING)
+    end
+
+    def lookup(auth, path)
+      path.to_s.split('.').reduce(auth) do |node, segment|
+        break MISSING unless node.respond_to?(:key?)
+
+        if node.key?(segment)
+          node[segment]
+        elsif node.key?(segment.to_sym)
+          node[segment.to_sym]
+        else
+          break MISSING
+        end
+      end
+    end
+    private_class_method :lookup
+  end
+end

data/lib/omniauth_syncer/configuration.rb

@@ -1,18 +1,105 @@
+# frozen_string_literal: true
+
 module OmniauthSyncer
   class Configuration
-    # Define settings with default values or required accessors
-    attr_accessor :user_model, :uid_field, :uid_field_in_auth, :mappings
+    ON_CONFLICT_POLICIES = %i[raise link ignore].freeze
+
+    # user_model:         ActiveRecord class name the users live in.
+    # uid_field:          column holding the provider's uid.
+    # uid_field_in_auth:  dotted path to the uid in the auth hash.
+    # provider_field:     column holding auth['provider']; when set, users are
+    #                     looked up by (provider, uid) instead of uid alone.
+    # email_field:        local attribute checked for "same email, different uid".
+    # mappings:           local attribute => dotted path or callable(auth).
+    # on_conflict:        :raise, :link or :ignore (see SyncService).
+    # clear_blank:        write nil when the provider sent the attribute empty.
+    # path_scopes:        dotted path => OAuth scope that must be granted before
+    #                     clear_blank may clear it.
+    # email_verified_path: dotted path to the provider's email_verified flag.
+    # include_controller_helpers: include ControllerHelpers into
+    #                     ActionController::Base (Rails only).
+    attr_accessor :user_model, :uid_field, :uid_field_in_auth, :provider_field, :email_field,
+                  :mappings, :on_conflict, :clear_blank, :path_scopes, :email_verified_path,
+                  :include_controller_helpers
 
     def initialize
-      # Sensible defaults
       @user_model = 'User'
       @uid_field = :uid
-      @uid_field_in_auth = 'uid' # Default path in AuthHash
-      @mappings = {}
+      @uid_field_in_auth = 'uid'
+      @provider_field = nil
+      @email_field = :email
+      @mappings = { email: 'info.email', name: 'info.name' }
+      @on_conflict = :raise
+      @clear_blank = false
+      @path_scopes = { 'info.email' => 'email', 'info.name' => 'profile', 'extra.email_verified' => 'email' }
+      @email_verified_path = 'extra.email_verified'
+      @include_controller_helpers = false
+    end
+
+    def model_class
+      user_model.to_s.safe_constantize ||
+        raise(ConfigurationError, "user_model #{user_model.inspect} is not a defined constant")
+    end
+
+    # Raises ConfigurationError with the first problem found; returns true otherwise.
+    # Needs the database schema, so call it where a connection is available.
+    def validate!
+      klass = model_class
+      validate_on_conflict!
+      validate_mappings!(klass)
+      validate_link!
+      validate_lookup_columns!(klass)
+      true
+    end
+
+    private
+
+    def validate_on_conflict!
+      return if ON_CONFLICT_POLICIES.include?(on_conflict)
+
+      raise ConfigurationError,
+            "on_conflict must be one of #{ON_CONFLICT_POLICIES.map(&:inspect).join(', ')}, got #{on_conflict.inspect}"
+    end
+
+    def validate_mappings!(klass)
+      raise ConfigurationError, "mappings must be a Hash, got #{mappings.class}" unless mappings.is_a?(Hash)
+
+      klass.define_attribute_methods if klass.respond_to?(:define_attribute_methods)
+      mappings.each { |attribute, source| validate_mapping!(klass, attribute, source) }
+    end
+
+    def validate_link!
+      return if on_conflict != :link || mapped?(email_field)
+
+      raise ConfigurationError, "on_conflict :link needs a mapping for email_field #{email_field.inspect}"
+    end
+
+    def validate_mapping!(klass, attribute, source)
+      unless klass.method_defined?("#{attribute}=")
+        raise ConfigurationError, "#{klass.name} has no writer for mapped attribute #{attribute.inspect}"
+      end
+      return if source.respond_to?(:call) || (source.is_a?(String) && !source.empty?)
+
+      raise ConfigurationError,
+            "mapping #{attribute.inspect} must be a dotted path String or a callable, got #{source.inspect}"
+    end
+
+    def validate_lookup_columns!(klass)
+      fields = { uid_field: uid_field }
+      fields[:provider_field] = provider_field if provider_field
+      fields[:email_field] = email_field if mapped?(email_field)
+      fields.each do |setting, column|
+        next if klass.column_names.include?(column.to_s)
+
+        raise ConfigurationError, "#{klass.name} has no column #{column.inspect} (configured as #{setting})"
+      end
+    end
+
+    def mapped?(attribute)
+      mappings.keys.map(&:to_s).include?(attribute.to_s)
     end
   end
 
-  # Class method to expose the configuration object and the configuration block
   def self.configuration
     @configuration ||= Configuration.new
   end
@@ -20,4 +107,12 @@ module OmniauthSyncer
   def self.configure
     yield(configuration)
   end
+
+  def self.validate!
+    configuration.validate!
+  end
+
+  def self.reset_configuration!
+    @configuration = Configuration.new
+  end
 end

data/lib/omniauth_syncer/controller_helpers.rb

@@ -1,17 +1,19 @@
+# frozen_string_literal: true
+
 module OmniauthSyncer
   module ControllerHelpers
-    # Call this method inside the OmniAuth callback action
-    def sync_sso_user
-      # Retrieve the auth hash from the Rack environment
-      auth_hash = request.env['omniauth.auth']
+    private
 
-      # Execute the core sync logic
-      OmniauthSyncer::SyncService.call(auth_hash)
-    rescue ActiveRecord::RecordInvalid => e
-      # Provide a clear, common way to handle sync validation errors
-      logger.error "OmniauthSyncer Validation Error: #{e.message}"
-      # Optionally, you might raise a custom error here
-      raise e
+    # Call this inside the OmniAuth callback action. Returns the synced user, or
+    # nil when the sync was refused (on_conflict: :ignore); treat nil as a
+    # failed login. Errors are logged and re-raised.
+    def sync_sso_user
+      user = OmniauthSyncer::SyncService.call(request.env['omniauth.auth'])
+      logger&.warn('OmniauthSyncer: sync refused, email belongs to another local user') if user.nil?
+      user
+    rescue StandardError => e
+      logger&.error("OmniauthSyncer: #{e.class}: #{e.message}")
+      raise
     end
   end
 end

data/lib/omniauth_syncer/mappings.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module OmniauthSyncer
+  # Opt-in mappings for the auth hash omniauth-ssoprovider builds from a hub login.
+  #
+  #   config.mappings[:admin] = OmniauthSyncer::Mappings::ADMIN
+  #   config.mappings[:email_verified] = OmniauthSyncer::Mappings::EMAIL_VERIFIED
+  module Mappings
+    # true/false from the hub's role assertion, nil (left untouched) when the
+    # auth hash has no extra.roles. The hub sends roles only from
+    # /api/v1/userinfo, so the strategy must use that user_info_url; against
+    # /oauth/userinfo every user, admins included, arrives with roles [].
+    ADMIN = lambda do |auth|
+      Array(AuthPath.dig(auth, 'extra.roles')).include?('admin') if AuthPath.key?(auth, 'extra.roles')
+    end
+
+    EMAIL_VERIFIED = 'extra.email_verified'
+  end
+end

data/lib/omniauth_syncer/railtie.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module OmniauthSyncer
+  # A Railtie rather than an Engine: an Engine would add this gem's app/ and
+  # config/ directories to the host application.
+  class Railtie < ::Rails::Railtie
+    # after_initialize runs after the host's config/initializers, so the flag
+    # set there is visible.
+    config.after_initialize do
+      next unless OmniauthSyncer.configuration.include_controller_helpers
+
+      ActiveSupport.on_load(:action_controller_base) { include OmniauthSyncer::ControllerHelpers }
+    end
+  end
+end

data/lib/omniauth_syncer/sync_service.rb

@@ -1,57 +1,158 @@
+# frozen_string_literal: true
+
 module OmniauthSyncer
+  # Finds or initialises the local user for an auth hash, copies the mapped
+  # attributes onto it and saves it.
+  #
+  # Returns the saved user, or nil when on_conflict: :ignore refused the sync.
+  # Raises MissingIdentityError, ConflictError, ConfigurationError, or the
+  # model's own ActiveRecord::RecordInvalid.
+  #
+  # "Same email, different uid" (another row already holds the incoming email,
+  # compared case-insensitively):
+  #   :raise  -> ConflictError, nothing written.
+  #   :ignore -> nil, nothing written.
+  #   :link   -> attach the uid to that row, but only when this identity has no
+  #              row yet, the row has no uid, and the provider says the email is
+  #              verified; ConflictError otherwise.
+  # Every conflict is published as the 'conflict.omniauth_syncer' notification.
+  #
+  # If a concurrent first login inserts the same user between lookup and save,
+  # the resulting ActiveRecord::RecordNotUnique triggers one fresh lookup.
   class SyncService
-    # Use the .call convention for single-purpose service objects
+    # The strategy's list of granted scopes, and the raw userinfo response used
+    # to infer them (key presence) when the list is absent.
+    GRANTED_SCOPES_PATH = 'extra.scope'
+    RAW_INFO_PATH = 'extra.raw_info'
+
     def self.call(auth_hash)
       new(auth_hash).sync_user
     end
 
+    def initialize(auth_hash)
+      @auth_hash = auth_hash
+      @config = OmniauthSyncer.configuration
+    end
+
     def sync_user
-      # Step 1: Find or Create the User
-      user = find_or_initialize_user
+      @config.validate!
+      @user_class = @config.model_class
 
-      # Step 2: Update Mapped Attributes
-      @config.mappings.each do |local_attr, auth_path|
-        # Use a helper to safely retrieve nested data (e.g., 'info.email')
-        auth_value = get_auth_value(auth_path)
+      identity = identity_attributes
+      attributes = mapped_attributes
+      retried = false
+      begin
+        find_and_save(identity, attributes)
+      rescue ActiveRecord::RecordNotUnique
+        # A concurrent first login inserted the row after our lookup: look it up once more.
+        raise if retried
 
-        # Only set if the value is present and the local attribute is writable
-        user.send("#{local_attr}=", auth_value) if auth_value.present?
+        retried = true
+        retry
       end
+    end
+
+    private
+
+    def find_and_save(identity, attributes)
+      user = @user_class.find_by(identity) || @user_class.new
+      conflicting = conflicting_user(user, attributes)
+      user = resolve_conflict(conflicting, user) if conflicting
+      return if user.nil?
 
-      # Step 3: Save and Return
-      user.save! # Use save! to ensure we raise an error on validation failure
+      user.assign_attributes(identity.merge(attributes))
+      # A savepoint, so a unique-index failure leaves a surrounding transaction usable for the retry.
+      @user_class.transaction(requires_new: true) { user.save! }
       user
     end
 
-    private
+    def identity_attributes
+      uid = AuthPath.dig(@auth_hash, @config.uid_field_in_auth)
+      raise MissingIdentityError, "auth hash has no uid at #{@config.uid_field_in_auth.inspect}" if uid.blank?
 
-    def initialize(auth_hash)
-      @auth_hash = auth_hash
-      @config = OmniauthSyncer.configuration
-      # Dynamically get the User model class
-      @user_class = @config.user_model.constantize
+      identity = { @config.uid_field => uid.to_s }
+      return identity unless @config.provider_field
+
+      provider = AuthPath.dig(@auth_hash, 'provider')
+      raise MissingIdentityError, 'auth hash has no provider' if provider.blank?
+
+      identity.merge(@config.provider_field => provider.to_s)
+    end
+
+    # nil means "nothing to write" and is skipped, unless clear_blank is on and
+    # the provider actually sent the attribute. false, '' and [] are values.
+    def mapped_attributes
+      @config.mappings.each_with_object({}) do |(attribute, source), attributes|
+        value = source.respond_to?(:call) ? source.call(@auth_hash) : AuthPath.dig(@auth_hash, source)
+        next if value.nil? && !clearable?(source)
+
+        attributes[attribute.to_sym] = value
+      end
+    end
+
+    # A callable signals "clear" by returning a non-nil blank value itself.
+    def clearable?(source)
+      return false if !@config.clear_blank || source.respond_to?(:call)
+
+      scope = @config.path_scopes[source.to_s]
+      scope ? scope_granted?(scope, source) : AuthPath.key?(@auth_hash, source)
+    end
+
+    def scope_granted?(scope, path)
+      granted = AuthPath.dig(@auth_hash, GRANTED_SCOPES_PATH)
+      if granted
+        scopes = granted.is_a?(String) ? granted.split : Array(granted)
+        scopes.map(&:to_s).include?(scope.to_s)
+      else
+        AuthPath.key?(AuthPath.dig(@auth_hash, RAW_INFO_PATH), path.to_s.split('.').last)
+      end
     end
 
-    def find_or_initialize_user
-      # Get the unique identifier value from the auth hash (e.g., the UID)
-      uid_value = get_auth_value(@config.uid_field_in_auth) # Assume config holds the path to UID
+    def conflicting_user(user, attributes)
+      email = attributes[@config.email_field.to_sym]
+      return if email.blank?
 
-      # Use the configured uid_field for the database lookup
-      @user_class.find_or_initialize_by(@config.uid_field => uid_value)
+      scope = users_with_email(email)
+      scope = scope.where.not(@user_class.primary_key => user.id) if user.persisted?
+      scope.first
     end
 
-    # Helper method to safely traverse the nested AuthHash
-    # (Simplified for demonstration; a real implementation would be more robust)
-    def get_auth_value(path)
-      parts = path.to_s.split('.')
-      current = @auth_hash.dup
+    # Case-insensitive, with LOWER() on both sides so SQL and Ruby case rules can't disagree.
+    def users_with_email(email)
+      column = @user_class.arel_table[@config.email_field]
+      incoming = Arel::Nodes::NamedFunction.new('LOWER', [Arel::Nodes.build_quoted(email, column)])
+      @user_class.where(column.lower.eq(incoming))
+    end
 
-      parts.each do |part|
-        # Use dig for safety, converting to symbol or string keys
-        current = current.respond_to?(:dig) ? current.dig(part.to_sym) || current.dig(part.to_s) : current[part]
-        return nil unless current
+    def resolve_conflict(conflicting, user)
+      ActiveSupport::Notifications.instrument(
+        'conflict.omniauth_syncer',
+        policy: @config.on_conflict, uid: AuthPath.dig(@auth_hash, @config.uid_field_in_auth),
+        provider: AuthPath.dig(@auth_hash, 'provider'), existing_id: conflicting.id
+      )
+      case @config.on_conflict
+      when :ignore then nil
+      when :link then link(conflicting, user)
+      else raise conflict_error(conflicting, 'on_conflict is :raise')
       end
-      current
+    end
+
+    def link(conflicting, user)
+      raise conflict_error(conflicting, 'cannot link, this uid already has its own user') if user.persisted?
+
+      existing_uid = conflicting[@config.uid_field]
+      raise conflict_error(conflicting, 'cannot link, that user already has a uid') if existing_uid.present?
+      raise conflict_error(conflicting, 'cannot link, the email is not verified') unless email_verified?
+
+      conflicting
+    end
+
+    def email_verified?
+      AuthPath.dig(@auth_hash, @config.email_verified_path) == true
+    end
+
+    def conflict_error(conflicting, reason)
+      ConflictError.new("#{@user_class.name} ##{conflicting.id} already holds this email (#{reason})")
     end
   end
 end

data/lib/omniauth_syncer/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module OmniauthSyncer
-  VERSION = '0.1.0'
+  VERSION = '0.2.0'
 end

data/lib/omniauth_syncer.rb

@@ -1,9 +1,28 @@
-require 'active_support/core_ext/string/inflections' # For constantize
+# frozen_string_literal: true
+
+require 'active_support'
+require 'active_support/core_ext/object/blank'
+require 'active_support/core_ext/string/inflections'
+require 'active_support/notifications'
+
 require 'omniauth_syncer/version'
-require 'omniauth_syncer/configuration'
-require 'omniauth_syncer/sync_service'
 
 module OmniauthSyncer
-  # No code here, just module definition.
-  # All logic is in SyncService and Configuration.
+  class Error < StandardError; end
+
+  # The configuration cannot work against the configured model.
+  class ConfigurationError < Error; end
+
+  # The auth hash carries no usable uid (or provider, when provider_field is set).
+  class MissingIdentityError < Error; end
+
+  # Another local user already holds the incoming email.
+  class ConflictError < Error; end
 end
+
+require 'omniauth_syncer/auth_path'
+require 'omniauth_syncer/configuration'
+require 'omniauth_syncer/mappings'
+require 'omniauth_syncer/sync_service'
+require 'omniauth_syncer/controller_helpers'
+require 'omniauth_syncer/railtie' if defined?(Rails::Railtie)

metadata

@@ -1,125 +1,70 @@
 --- !ruby/object:Gem::Specification
 name: omniauth_syncer
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Daniele Frisanco
 autorequire: 
-bindir: exe
+bindir: bin
 cert_chain: []
-date: 2025-10-23 00:00:00.000000000 Z
+date: 2026-09-24 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: omniauth
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '6.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '6.1'
 - !ruby/object:Gem::Dependency
-  name: bundler
+  name: omniauth
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
-  type: :development
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '13.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '13.0'
-- !ruby/object:Gem::Dependency
-  name: rspec
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.0'
-- !ruby/object:Gem::Dependency
-  name: pry
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-description: Ensures local user records are created or updated with the latest data
-  from the SSO provider after a successful OmniAuth login.
+description: Finds or creates the local user by (provider, uid), copies mapped attributes
+  out of the OmniAuth auth hash and saves it, with explicit policies for email conflicts
+  and cleared values.
 email:
 - daniele.frisanco@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".rspec_status"
-- ".rubocop.yml"
-- Gemfile
-- Gemfile.lock
+- CHANGELOG.md
 - LICENSE.txt
 - README.md
-- app/controllers/users/omniauth_callbacks_controller.rb
-- config/initializers/omniauth_syncer.rb
 - lib/omniauth_syncer.rb
+- lib/omniauth_syncer/auth_path.rb
 - lib/omniauth_syncer/configuration.rb
 - lib/omniauth_syncer/controller_helpers.rb
-- lib/omniauth_syncer/engine.rb
+- lib/omniauth_syncer/mappings.rb
+- lib/omniauth_syncer/railtie.rb
 - lib/omniauth_syncer/sync_service.rb
 - lib/omniauth_syncer/version.rb
 homepage: https://github.com/danielefrisanco/omniauth_syncer
 licenses:
 - MIT
-metadata: {}
+metadata:
+  source_code_uri: https://github.com/danielefrisanco/omniauth_syncer
+  changelog_uri: https://github.com/danielefrisanco/omniauth_syncer/blob/main/CHANGELOG.md
+  rubygems_mfa_required: 'true'
 post_install_message: 
 rdoc_options: []
 require_paths:
@@ -128,16 +73,16 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '3.1'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.3
+rubygems_version: 3.3.26
 signing_key: 
 specification_version: 4
-summary: A Ruby gem for synchronizing user profile data from OmniAuth to local ActiveRecord
-  models.
+summary: Keeps a local ActiveRecord user in step with the OmniAuth auth hash after
+  an SSO login.
 test_files: []

data/.rspec_status

@@ -1,8 +0,0 @@
-example_id                                           | status | run_time        |
----------------------------------------------------- | ------ | --------------- |
-./spec/omniauth_syncer/sync_service_spec.rb[1:1:1:1] | passed | 0.00427 seconds |
-./spec/omniauth_syncer/sync_service_spec.rb[1:1:2:1] | passed | 0.00022 seconds |
-./spec/omniauth_syncer/sync_service_spec.rb[1:1:3:1] | passed | 0.00079 seconds |
-./spec/omniauth_syncer/sync_service_spec.rb[1:1:3:2] | passed | 0.00019 seconds |
-./spec/omniauth_syncer/sync_service_spec.rb[1:1:4:1] | passed | 0.00072 seconds |
-./spec/omniauth_syncer/sync_service_spec.rb[1:1:5:1] | passed | 0.00029 seconds |

data/.rubocop.yml

@@ -1,48 +0,0 @@
-require:
-  - rubocop-performance
-  - rubocop-rails # Even if this is a non-Rails gem, many conventions apply
-
-AllCops:
-  # Exclude common files that aren't source code
-  Exclude:
-    - 'bin/*'
-    - 'vendor/**/*'
-    - 'spec/fixtures/**/*'
-    - 'Gemfile'
-    - 'Rakefile'
-    - '**/*.gemspec'
-  # Target the Ruby version you are developing against (e.g., 3.2 is modern)
-  TargetRubyVersion: 3.2
-  NewCops: enable
-
-# === Layout Cops (Formatting) ===
-Layout/LineLength:
-  # Relax line length for documentation/complex setup in specs
-  Max: 120
-  IgnoredPatterns: ['\.gemspec']
-
-# === Style Cops (Idiomatic Ruby) ===
-Style/Documentation:
-  # Gems often skip documenting simple classes/modules
-  Enabled: false
-Style/ClassAndModuleChildren:
-  # Use the standard, compact (nested) style: 
-  # e.g., 'module A; class B; end; end' instead of 'class A::B'
-  EnforcedStyle: nested
-Style/FrozenStringLiteralComment:
-  # Enable the magic comment for performance in modern Ruby
-  Enabled: true
-Style/ClassMethods:
-  # Use self.method_name for class methods
-  EnforcedStyle: self_name
-
-# === Performance Cops ===
-# Performance cops are helpful for writing efficient code
-Performance/FlatMap:
-  Enabled: true
-
-# === Naming Cops ===
-Naming/FileName:
-  # Allow the standard gem entry point file to have a hyphen
-  Exclude:
-    - 'exe/omniauth-syncer'

data/Gemfile

@@ -1,13 +0,0 @@
-source "https://rubygems.org"
-gemspec
-# Add development and testing tools
-group :development, :test do
-  # ... (other tools like rspec, pry)
-  
-  # Core RuboCop gem
-  gem 'rubocop', '~> 1.0' 
-  
-  # Extensions for common Ruby idioms and performance checks
-  gem 'rubocop-performance'
-  gem 'rubocop-rails' # Good to include even for a general gem
-end

data/Gemfile.lock

@@ -1,100 +0,0 @@
-PATH
-  remote: .
-  specs:
-    omniauth_syncer (0.1.0)
-      activesupport (>= 6.0)
-      omniauth (~> 2.0)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    activesupport (6.1.7.10)
-      concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (>= 1.6, < 2)
-      minitest (>= 5.1)
-      tzinfo (~> 2.0)
-      zeitwerk (~> 2.3)
-    ast (2.4.3)
-    coderay (1.1.3)
-    concurrent-ruby (1.3.5)
-    diff-lcs (1.6.2)
-    hashie (5.0.0)
-    i18n (1.14.7)
-      concurrent-ruby (~> 1.0)
-    json (2.7.6)
-    logger (1.7.0)
-    method_source (1.1.0)
-    minitest (5.25.4)
-    omniauth (2.1.4)
-      hashie (>= 3.4.6)
-      logger
-      rack (>= 2.2.3)
-      rack-protection
-    parallel (1.24.0)
-    parser (3.3.9.0)
-      ast (~> 2.4.1)
-      racc
-    pry (0.15.2)
-      coderay (~> 1.1)
-      method_source (~> 1.0)
-    racc (1.8.1)
-    rack (3.2.3)
-    rack-protection (3.0.6)
-      rack
-    rainbow (3.1.1)
-    rake (13.3.0)
-    regexp_parser (2.11.3)
-    rexml (3.4.4)
-    rspec (3.13.2)
-      rspec-core (~> 3.13.0)
-      rspec-expectations (~> 3.13.0)
-      rspec-mocks (~> 3.13.0)
-    rspec-core (3.13.6)
-      rspec-support (~> 3.13.0)
-    rspec-expectations (3.13.5)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.6)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.13.0)
-    rspec-support (3.13.6)
-    rubocop (1.50.2)
-      json (~> 2.3)
-      parallel (~> 1.10)
-      parser (>= 3.2.0.0)
-      rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 1.8, < 3.0)
-      rexml (>= 3.2.5, < 4.0)
-      rubocop-ast (>= 1.28.0, < 2.0)
-      ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 2.4.0, < 3.0)
-    rubocop-ast (1.30.0)
-      parser (>= 3.2.1.0)
-    rubocop-performance (1.17.1)
-      rubocop (>= 1.7.0, < 2.0)
-      rubocop-ast (>= 0.4.0)
-    rubocop-rails (2.19.1)
-      activesupport (>= 4.2.0)
-      rack (>= 1.1)
-      rubocop (>= 1.33.0, < 2.0)
-    ruby-progressbar (1.13.0)
-    tzinfo (2.0.6)
-      concurrent-ruby (~> 1.0)
-    unicode-display_width (2.6.0)
-    zeitwerk (2.6.18)
-
-PLATFORMS
-  x86_64-linux
-
-DEPENDENCIES
-  bundler (~> 2.0)
-  omniauth_syncer!
-  pry
-  rake (~> 13.0)
-  rspec (~> 3.0)
-  rubocop (~> 1.0)
-  rubocop-performance
-  rubocop-rails
-
-BUNDLED WITH
-   2.4.22

data/app/controllers/users/omniauth_callbacks_controller.rb

@@ -1,13 +0,0 @@
-# The final controller setup in the user's application
-class Users::OmniauthCallbacksController < ApplicationController
-  include OmniauthSyncer::ControllerHelpers # Includes the sync_sso_user method
-
-  def sso_provider
-    # Use the helper to sync the user and retrieve the record
-    @user = sync_sso_user
-
-    sign_in_and_redirect @user, event: :authentication
-  rescue StandardError
-    redirect_to root_path, alert: 'Authentication failed.'
-  end
-end

data/config/initializers/omniauth_syncer.rb

@@ -1,16 +0,0 @@
-OmniauthSyncer.configure do |config|
-  # The ActiveRecord model class name
-  config.user_model = 'User'
-
-  # The column used for the unique identifier
-  config.uid_field = :sso_id
-
-  # Mapping: local_attribute => path_in_auth_hash
-  # 'info.email' looks into auth_hash.info['email']
-  config.mappings = {
-    email: 'info.email',
-    full_name: 'info.name',
-    # Example for nested/extra data: auth_hash.extra['raw_info']['roles']
-    roles: 'extra.raw_info.roles'
-  }
-end

data/lib/omniauth_syncer/engine.rb

@@ -1,25 +0,0 @@
-require 'rails/engine'
-
-module OmniauthSyncer
-  class Engine < ::Rails::Engine
-    # Allows the host application to use OmniauthSyncer configurations
-    isolate_namespace OmniauthSyncer
-
-    # This initializer runs before all other application initializers.
-    # It ensures that our configuration block is loaded early.
-    initializer 'omniauth_syncer.configure_defaults' do
-      # Load your configuration settings here if needed,
-      # but typically, we rely on the host app's initializer.
-    end
-
-    # Optionally, you can include logic to automatically integrate
-    # the SyncService into the host app's controller.
-    initializer 'omniauth_syncer.controller_mixin' do
-      ActiveSupport.on_load(:action_controller_base) do
-        # This is where you would define a helper method
-        # that the user can call in their OmniAuth controller:
-        # include OmniauthSyncer::ControllerHelpers
-      end
-    end
-  end
-end