rodauth-oauth 1.3.0 → 1.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4d7d5f8b68686703954bf4e335cef0ea33f9e31c94c439df84f08e8ff3270829
-  data.tar.gz: 1da57ba2082818a74dbca4d1c6bcab0c15f97da891e12c03a8bf91440a4edcfd
+  metadata.gz: ac42aa0fb7d65030b403957a408d6d5b1f999614c957ec8176d814030ddb9381
+  data.tar.gz: f67cf98dfdb162d1e015d3930b569756f2a25737a64e68ed36fcf31e2d672be2
 SHA512:
-  metadata.gz: 8230b54e51d2081e25d1386d6294745d54eebbe11a6677bdb9cade14e0a418658bc2b8a67ae2e6355458f4b43d8a2df1700cd3e0496fa8a10e690318f3d03ba0
-  data.tar.gz: 31ab5721a6464b751860b6896f47999e189592582842ba419ab0a057ff38af98612d54a8b00177092e2fe5993af1e5554cecafbbfaab18a495656117f19ce4fd
+  metadata.gz: e86da1d43f30dfb18e1ae530dc5b1cc9cf69903d32a39bade2dc5881075140d79ef5644159ff40b1406b58dfb12197c79d13f683f20b431330d02d452b3cf87e
+  data.tar.gz: ad35b6bc881f1e22f7cb7227115daee9556ebeada9e10b21e8ecfeb9dc0e7a51ddd606ef481f1125064e49d6ee39076bd8bc2043d58d0d103df6a27813a022db

data/doc/release_notes/1_3_1.md

@@ -0,0 +1,10 @@
+### 1.3.1 (27/06/2023)
+
+#### Bugfixes
+
+* Set 401 error response when `client_id` parameter is invalid, or from an unexisting client application, instead of failing with a 500 (@igor-alexandrov).
+* update rails authorize form to use roda request params instead, as plain params was breaking JAR and PAR-based authorize forms in rails applications.
+
+#### Chore
+
+* set `:padding` to `false` in `Base64.urlsafe_encode64` calls (@felipe.zavan)

data/lib/generators/rodauth/oauth/templates/app/views/rodauth/authorize.html.erb

@@ -37,10 +37,10 @@
         </div>
       <% end %>
     <% end %>
-    <%= hidden_field_tag :client_id, params[:client_id] %>
-    <% %i[access_type response_type response_mode state redirect_uri].each do |oauth_param| %>
-      <% if params[oauth_param] %>
-        <%= hidden_field_tag oauth_param,  params[oauth_param] %>
+    <%= hidden_field_tag :client_id, rodauth.raw_param("client_id") %>
+    <% %w[access_type response_type response_mode state redirect_uri].each do |oauth_param| %>
+      <% if rodauth.raw_param(oauth_param) %>
+        <%= hidden_field_tag oauth_param, rodauth.raw_param(oauth_param) %>
       <% end %>
     <% end %>
     <% if rodauth.features.include?(:oauth_resource_indicators) && rodauth.resource_indicators %>
@@ -49,39 +49,39 @@
       <% end %>
     <% end %>
     <% if rodauth.features.include?(:oauth_pkce) %>
-      <% if params[:code_challenge] %>
-        <%= hidden_field_tag :code_challenge,  params[:code_challenge] %>
+      <% if rodauth.raw_param("code_challenge") %>
+        <%= hidden_field_tag :code_challenge, rodauth.raw_param("code_challenge") %>
       <% end %>
-      <% if params[:code_challenge_method] %>
-        <%= hidden_field_tag :code_challenge_method,  params[:code_challenge_method] %>
+      <% if rodauth.raw_param("code_challenge_method") %>
+        <%= hidden_field_tag :code_challenge_method, rodauth.raw_param("code_challenge_method") %>
       <% end %>
     <% end %>
     <% if rodauth.features.include?(:oidc) %>
-      <% if params[:prompt] %>
-        <%= hidden_field_tag :prompt,  params[:prompt] %>
+      <% if rodauth.raw_param("prompt") %>
+        <%= hidden_field_tag :prompt, rodauth.raw_param("prompt") %>
       <% end %>
-      <% if params[:nonce] %>
-        <%= hidden_field_tag :nonce,  params[:nonce] %>
+      <% if rodauth.raw_param("nonce") %>
+        <%= hidden_field_tag :nonce, rodauth.raw_param("nonce") %>
       <% end %>
-      <% if params[:ui_locales] %>
-        <%= hidden_field_tag :ui_locales,  params[:ui_locales] %>
+      <% if rodauth.raw_param("ui_locales") %>
+        <%= hidden_field_tag :ui_locales, rodauth.raw_param("ui_locales") %>
       <% end %>
-      <% if params[:claims_locales] %>
-        <%= hidden_field_tag :claims_locales,  params[:claims_locales] %>
+      <% if rodauth.raw_param("claims_locales") %>
+        <%= hidden_field_tag :claims_locales, rodauth.raw_param("claims_locales") %>
       <% end %>
-      <% if params[:claims] %>
-        <%= hidden_field_tag :claims,  sanitize(params[:claims]) %>
+      <% if rodauth.raw_param("claims") %>
+        <%= hidden_field_tag :claims, sanitize(rodauth.raw_param("claims")) %>
       <% end %>
-      <% if params[:acr_values] %>
-        <%= hidden_field_tag :acr_values,  params[:acr_values] %>
+      <% if rodauth.raw_param("acr_values") %>
+        <%= hidden_field_tag :acr_values, rodauth.raw_param("acr_values") %>
       <% end %>
-      <% if params[:registration] %>
-        <%= hidden_field_tag :registration,  params[:registration] %>
+      <% if rodauth.raw_param("registration") %>
+        <%= hidden_field_tag :registration, rodauth.raw_param("registration") %>
       <% end %>
     <% end %>
   </div>
  <p class="text-center">
     <%= submit_tag rodauth.oauth_authorize_button, class: "btn btn-outline-primary" %>
-    <%= link_to rodauth.oauth_cancel_button, "#{rodauth.redirect_uri}?error=access_denied&error_description=The+resource+owner+or+authorization+server+denied+the+request#{"&state=\#{CGI.escape(rodauth.state)}" if params[:state] }", class: "btn btn-outline-danger" %>
+    <%= link_to rodauth.oauth_cancel_button, "#{rodauth.redirect_uri}?error=access_denied&error_description=The+resource+owner+or+authorization+server+denied+the+request#{"&state=\#{CGI.escape(rodauth.state)}" if rodauth.raw_param("state") }", class: "btn btn-outline-danger" %>
   </p>
 <% end %>

data/lib/rodauth/features/oauth_base.rb

@@ -367,7 +367,7 @@ module Rodauth
     end
 
     def require_oauth_application_from_client_secret_basic(token)
-      client_id, client_secret = Base64.decode64(token).split(/:/, 2)
+      client_id, client_secret = Base64.decode64(token).split(":", 2)
       authorization_required unless client_id
       oauth_application = db[oauth_applications_table].where(oauth_applications_client_id_column => client_id).first
       authorization_required unless supports_auth_method?(oauth_application,
@@ -389,6 +389,8 @@ module Rodauth
     end
 
     def supports_auth_method?(oauth_application, auth_method)
+      return false unless oauth_application
+
       supported_auth_methods = if oauth_application[oauth_applications_token_endpoint_auth_method_column]
                                  oauth_application[oauth_applications_token_endpoint_auth_method_column].split(/ +/)
                                else

data/lib/rodauth/features/oauth_pkce.rb

@@ -76,8 +76,7 @@ module Rodauth
       when "plain"
         challenge == verifier
       when "S256"
-        generated_challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(verifier))
-        generated_challenge.delete_suffix!("=") while generated_challenge.end_with?("=")
+        generated_challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(verifier), padding: false)
 
         challenge == generated_challenge
       else

data/lib/rodauth/oauth/version.rb

@@ -2,6 +2,6 @@
 
 module Rodauth
   module OAuth
-    VERSION = "1.3.0"
+    VERSION = "1.3.1"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-oauth
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.3.1
 platform: ruby
 authors:
 - Tiago Cardoso
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-04-01 00:00:00.000000000 Z
+date: 2023-06-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rodauth
@@ -70,6 +70,7 @@ extra_rdoc_files:
 - doc/release_notes/1_1_0.md
 - doc/release_notes/1_2_0.md
 - doc/release_notes/1_3_0.md
+- doc/release_notes/1_3_1.md
 files:
 - CHANGELOG.md
 - LICENSE.txt
@@ -111,6 +112,7 @@ files:
 - doc/release_notes/1_1_0.md
 - doc/release_notes/1_2_0.md
 - doc/release_notes/1_3_0.md
+- doc/release_notes/1_3_1.md
 - lib/generators/rodauth/oauth/install_generator.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_application.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_grant.rb
@@ -204,7 +206,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
+rubygems_version: 3.4.10
 signing_key:
 specification_version: 4
 summary: Implementation of the OAuth 2.0 protocol on top of rodauth.