rodauth-oauth 0.5.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7324d08b229d4bfdea92df95c769539570565e161d758a38d95bea50f78fda96
-  data.tar.gz: c421e4886baf39eb9ebe04e6919c6ab292d3c85dbc32bc78e5d8992c17a40816
+  metadata.gz: 366fa7201a8cb26525b2abdfab0c4108a4afbef4fa8697cf57e874919eda2afd
+  data.tar.gz: 958b9fd8b4cd2996a85b96fac6dff6a6b35832adcdaed4d81e20842041a1299e
 SHA512:
-  metadata.gz: 4ba7e8a7975260618034285b77d4489416fe368c500b31516e7dd69d89e75863e18bebdb4868a72caa61fa2ed93541f1da6ea1c9c9d4cf15072bf4008209a1a9
-  data.tar.gz: 87e9f031183ede6af4f338f60ff5ae5f7a8581412068abb484b5312de4a6962fcaa68cb95eae8aab7c755adc4e1c0ada6e3e19b009ece35d4902cc84d1ab1e01
+  metadata.gz: fb496f7d438c0447ba4ef899f9ec37549cea355fb5c670818cd040970c1316c13442caa58aebc4ea66cd92f2f369d6ff7c39b502190e2d4fec2f95d5e27b4279
+  data.tar.gz: 73048d860285b29056ade97d9092103e2cae18fa9967df603ddce9c83c10fd5c44891e7282f3195d0b79b2d73bf12c748483a811f404d50fb29df40da26a6bf4

data/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## master
 
+### 0.5.1 (19/03/2021)
+
+#### Improvements
+
+* Changing "Callback URL" to "Redirect URL" in default templates;
+
+#### Bugfixes
+
+* (rails integration) Fixed templates location;
+* (rails integration) Fixed migration name from generator;
+* (rails integration) fixed links, html tags, styling and unassigned variables from a few view templates;
+* `oauth_application_path` is now compliant with prefixes and other url helpers, while now having a `oauth_application_url` counterpart;
+* (rails integration) skipping csrf checks for "/userinfo" request (OIDC)
+
 ### 0.5.0 (08/02/2021)
 
 #### RP-Initiated Logout

data/lib/generators/{roda → rodauth}/oauth/templates/db/migrate/create_rodauth_oauth.rb

@@ -1,4 +1,4 @@
-class CreateRodauthOAuth < ActiveRecord::Migration<%= migration_version %>
+class CreateRodauthOauth < ActiveRecord::Migration<%= migration_version %>
   def change
     create_table :oauth_applications do |t|
       t.integer :account_id

data/lib/rodauth/features/oauth.rb

@@ -139,7 +139,15 @@ module Rodauth
     auth_value_method :already_in_use_response_status, 409
 
     # OAuth Applications
-    auth_value_method :oauth_applications_path, "oauth-applications"
+    auth_value_method :oauth_applications_route, "oauth-applications"
+    def oauth_applications_path(opts = {})
+      route_path(oauth_applications_route, opts)
+    end
+
+    def oauth_applications_url(opts = {})
+      route_url(oauth_applications_route, opts)
+    end
+
     auth_value_method :oauth_applications_table, :oauth_applications
 
     auth_value_method :oauth_applications_id_column, :id
@@ -192,6 +200,7 @@ module Rodauth
     auth_value_method :oauth_unique_id_generation_retries, 3
 
     auth_value_methods(
+      :oauth_application_path,
       :fetch_access_token,
       :oauth_unique_id_generator,
       :secret_matches?,
@@ -363,9 +372,13 @@ module Rodauth
       end
     end
 
+    def oauth_application_path(id)
+      "#{oauth_applications_path}/#{id}"
+    end
+
     # /oauth-applications routes
     def oauth_applications
-      request.on(oauth_applications_path) do
+      request.on(oauth_applications_route) do
         require_account
 
         request.get "new" do
@@ -422,16 +435,20 @@ module Rodauth
         false
       when revoke_path
         !json_request?
-      when authorize_path, %r{/#{oauth_applications_path}}
+      when authorize_path, oauth_applications_path
         only_json? ? false : super
       else
         super
       end
     end
 
-    # Overrides logged_in?, so that a valid authorization token also authnenticates a request
-    def logged_in?
-      super || authorization_token
+    # Overrides session_value, so that a valid authorization token also authenticates a request
+    def session_value
+      super || begin
+        return unless authorization_token
+
+        authorization_token[oauth_tokens_account_id_column]
+      end
     end
 
     def accepts_json?
@@ -1350,7 +1367,7 @@ module Rodauth
         issuer: issuer,
         authorization_endpoint: authorize_url,
         token_endpoint: token_url,
-        registration_endpoint: route_url(oauth_applications_path),
+        registration_endpoint: oauth_applications_url,
         scopes_supported: oauth_application_scopes,
         response_types_supported: responses_supported,
         response_modes_supported: response_modes_supported,

data/lib/rodauth/features/oauth_jwt.rb

@@ -62,6 +62,15 @@ module Rodauth
       authorization_required unless scopes.any? { |scope| token_scopes.include?(scope) }
     end
 
+    # Overrides session_value, so that a valid authorization token also authenticates a request
+    def session_value
+      super || begin
+        return unless authorization_token
+
+        authorization_token["sub"]
+      end
+    end
+
     private
 
     unless method_defined?(:last_account_login_at)

data/lib/rodauth/features/oidc.rb

@@ -215,6 +215,15 @@ module Rodauth
       end
     end
 
+    def check_csrf?
+      case request.path
+      when userinfo_path
+        false
+      else
+        super
+      end
+    end
+
     private
 
     def require_authorizable_account

data/lib/rodauth/oauth/version.rb

@@ -2,6 +2,6 @@
 
 module Rodauth
   module OAuth
-    VERSION = "0.5.0"
+    VERSION = "0.5.1"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-oauth
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.5.1
 platform: ruby
 authors:
 - Tiago Cardoso
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-02-08 00:00:00.000000000 Z
+date: 2021-03-19 00:00:00.000000000 Z
 dependencies: []
 description: Implementation of the OAuth 2.0 protocol on top of rodauth.
 email:
@@ -23,12 +23,12 @@ files:
 - CHANGELOG.md
 - LICENSE.txt
 - README.md
-- lib/generators/roda/oauth/install_generator.rb
-- lib/generators/roda/oauth/templates/app/models/oauth_application.rb
-- lib/generators/roda/oauth/templates/app/models/oauth_grant.rb
-- lib/generators/roda/oauth/templates/app/models/oauth_token.rb
-- lib/generators/roda/oauth/templates/db/migrate/create_rodauth_oauth.rb
-- lib/generators/roda/oauth/views_generator.rb
+- lib/generators/rodauth/oauth/install_generator.rb
+- lib/generators/rodauth/oauth/templates/app/models/oauth_application.rb
+- lib/generators/rodauth/oauth/templates/app/models/oauth_grant.rb
+- lib/generators/rodauth/oauth/templates/app/models/oauth_token.rb
+- lib/generators/rodauth/oauth/templates/db/migrate/create_rodauth_oauth.rb
+- lib/generators/rodauth/oauth/views_generator.rb
 - lib/rodauth/features/oauth.rb
 - lib/rodauth/features/oauth_http_mac.rb
 - lib/rodauth/features/oauth_jwt.rb