rack-oauth2 1.4.0 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8a2df927b2cd7727df348e6e2c2d2822382bb207
-  data.tar.gz: 0cbd438ae8f7be634556bdf320721142e6ff497d
+  metadata.gz: 8d200fef958c8cebe3584388068110e9faed12eb
+  data.tar.gz: 1cab3b4d8fc6de54a0488dbe0159791c31b5feb3
 SHA512:
-  metadata.gz: 6498b5c59d3bc2ccdbe0b651956872185c3e89023c59fb1f609c8d1cc2012d0a1df926146d5d3579431d6fd5ed95498214b34fa67d8bacf7911f5d327ddb26b4
-  data.tar.gz: 57fafb111c251219dc32f95abb3523448e8852868873eea00e72c7bd7ba63f90750ebb69abffca6676f1eaf978101e6a883c179a55c4ebda2ad4db86a4f23b85
+  metadata.gz: 9f95eaa8709c9cccb94cff056dae182fe21e502a7a49ae05de49d348814c546e5708c4499dcbbee4a5208fe9c49f1270cf202363b1cc2811ceed1ba41a18322c
+  data.tar.gz: 7d3ffe4b2be092ae751c36e11f459bd691fc534045ad306d37637ee4e21757e4ff6579ae114acfc06624290fbe1fd5ab74cf8dbe216adc7161940b7a5b2a4c14

data/.travis.yml

@@ -3,5 +3,6 @@ before_install:
 
 rvm:
   - 2.2.2
-  - 2.2.5
-  - 2.3.1
+  - 2.2.6
+  - 2.3.3
+  - 2.4.0

data/VERSION

@@ -1 +1 @@
-1.4.0
+1.5.0

data/lib/rack/oauth2/client.rb

@@ -76,16 +76,18 @@ module Rack
         params[:scope] = Array(options.delete(:scope)).join(' ') if options[:scope].present?
         params.merge! options
 
-        if secret && client_auth_method == :basic
-          cred = ["#{identifier}:#{secret}"].pack('m').tr("\n", '')
-          headers.merge!(
-            'Authorization' => "Basic #{cred}"
-          )
-        else
-          params.merge!(
-            client_id: identifier,
-            client_secret: secret
-          )
+        if secret
+          if client_auth_method == :basic
+            cred = ["#{identifier}:#{secret}"].pack('m').tr("\n", '')
+            headers.merge!(
+              'Authorization' => "Basic #{cred}"
+            )
+          else
+            params.merge!(
+              client_id: identifier,
+              client_secret: secret
+            )
+          end
         end
         handle_response do
           Rack::OAuth2.http_client.post(

data/spec/rack/oauth2/server/extension/pkce_spec.rb

@@ -0,0 +1,162 @@
+require 'spec_helper.rb'
+
+describe Rack::OAuth2::Server::Authorize::Code do
+  let(:request) { Rack::MockRequest.new app }
+  let(:redirect_uri)   { 'http://client.example.com/callback' }
+  let(:code_verifier)  { SecureRandom.hex(16) }
+  let(:code_challenge) { Base64.urlsafe_encode64(OpenSSL::Digest::SHA256.digest(code_verifier)).delete('=') }
+  let(:code_challenge_method) { :S256 }
+  subject { @request }
+
+  describe 'authorization request' do
+    let :app do
+      Rack::OAuth2::Server::Authorize.new do |request, response|
+        @request = request
+      end
+    end
+
+    context 'when code_challenge is given' do
+      context 'when code_challenge_method is given' do
+        before do
+          request.get "/?response_type=code&client_id=client&redirect_uri=#{redirect_uri}&state=state&code_challenge=#{code_challenge}&code_challenge_method=#{code_challenge_method}"
+        end
+        its(:code_challenge) { should == code_challenge }
+        its(:code_challenge_method) { should == code_challenge_method.to_s }
+      end
+
+      context 'when code_challenge_method is omitted' do
+        before do
+          request.get "/?response_type=code&client_id=client&redirect_uri=#{redirect_uri}&state=state&code_challenge=#{code_challenge}"
+        end
+        its(:code_challenge) { should == code_challenge }
+        its(:code_challenge_method) { should == nil }
+      end
+    end
+
+    context 'otherwise' do
+      before do
+        request.get "/?response_type=code&client_id=client&redirect_uri=#{redirect_uri}&state=state"
+      end
+      its(:code_challenge) { should == nil }
+      its(:code_challenge_method) { should == nil }
+    end
+  end
+
+  describe 'token request' do
+    let(:app) do
+      Rack::OAuth2::Server::Token.new do |request, response|
+        @request = request
+        response.access_token = Rack::OAuth2::AccessToken::Bearer.new(access_token: 'access_token')
+      end
+    end
+    let(:default_params) do
+      {
+        grant_type: 'authorization_code',
+        client_id: 'client_id',
+        client_secret: 'client_secret',
+        code: 'authorization_code',
+        redirect_uri: 'http://client.example.com/callback'
+      }
+    end
+
+    context 'when code_verifier is given' do
+      before do
+        request.post '/', params: default_params.merge(
+          code_verifier: code_verifier
+        )
+      end
+      its(:code_verifier) { should == code_verifier }
+
+      describe '#verify_code_verifier!' do
+        context 'when code_verifier is given with code_challenge_method=plain' do
+          it do
+            expect do
+              subject.verify_code_verifier! code_verifier, :plain
+            end.not_to raise_error
+          end
+        end
+
+        context 'when collect code_challenge is given' do
+          it do
+            expect do
+              subject.verify_code_verifier! code_challenge
+            end.not_to raise_error
+          end
+        end
+
+        context 'when wrong code_challenge is blank' do
+          it do
+            expect do
+              subject.verify_code_verifier! 'wrong'
+            end.to raise_error Rack::OAuth2::Server::Token::BadRequest, /invalid_grant/
+          end
+        end
+
+        context 'when code_challenge is nil' do
+          it do
+            expect do
+              subject.verify_code_verifier! nil
+            end.to raise_error Rack::OAuth2::Server::Token::BadRequest, /invalid_grant/
+          end
+        end
+
+        context 'when unknown code_challenge_method is given' do
+          it do
+            expect do
+              subject.verify_code_verifier! code_challenge, :unknown
+            end.to raise_error Rack::OAuth2::Server::Token::BadRequest, /invalid_grant/
+          end
+        end
+      end
+    end
+
+    context 'otherwise' do
+      before do
+        request.post '/', params: default_params
+      end
+      its(:code_verifier) { should == nil }
+
+      describe '#verify_code_verifier!' do
+        context 'when code_verifier is given with code_challenge_method=plain' do
+          it do
+            expect do
+              subject.verify_code_verifier! code_verifier, :plain
+            end.to raise_error Rack::OAuth2::Server::Token::BadRequest, /invalid_grant/
+          end
+        end
+
+        context 'when collect code_challenge is given' do
+          it do
+            expect do
+              subject.verify_code_verifier! code_challenge
+            end.to raise_error Rack::OAuth2::Server::Token::BadRequest, /invalid_grant/
+          end
+        end
+
+        context 'when wrong code_challenge is blank' do
+          it do
+            expect do
+              subject.verify_code_verifier! 'wrong'
+            end.to raise_error Rack::OAuth2::Server::Token::BadRequest, /invalid_grant/
+          end
+        end
+
+        context 'when code_challenge is nil' do
+          it do
+            expect do
+              subject.verify_code_verifier! nil
+            end.not_to raise_error
+          end
+        end
+
+        context 'when unknown code_challenge_method is given' do
+          it do
+            expect do
+              subject.verify_code_verifier! code_challenge, :unknown
+            end.to raise_error Rack::OAuth2::Server::Token::BadRequest, /invalid_grant/
+          end
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-oauth2
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.5.0
 platform: ruby
 authors:
 - nov matake
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-07-14 00:00:00.000000000 Z
+date: 2017-01-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -261,6 +261,7 @@ files:
 - spec/rack/oauth2/server/authorize/extensions/code_and_token_spec.rb
 - spec/rack/oauth2/server/authorize/token_spec.rb
 - spec/rack/oauth2/server/authorize_spec.rb
+- spec/rack/oauth2/server/extension/pkce_spec.rb
 - spec/rack/oauth2/server/resource/bearer/error_spec.rb
 - spec/rack/oauth2/server/resource/bearer_spec.rb
 - spec/rack/oauth2/server/resource/error_spec.rb
@@ -339,6 +340,7 @@ test_files:
 - spec/rack/oauth2/server/authorize/extensions/code_and_token_spec.rb
 - spec/rack/oauth2/server/authorize/token_spec.rb
 - spec/rack/oauth2/server/authorize_spec.rb
+- spec/rack/oauth2/server/extension/pkce_spec.rb
 - spec/rack/oauth2/server/resource/bearer/error_spec.rb
 - spec/rack/oauth2/server/resource/bearer_spec.rb
 - spec/rack/oauth2/server/resource/error_spec.rb