simple_oauth 0.5.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7eca3b8d3940706967367e25b8f42261d48b325c8f2cd1c1cc01ad58a800f284
-  data.tar.gz: 63cec8ec4204dd64c40fdf61ecf1782df0364687794896199ded8a6dcb890ca3
+  metadata.gz: 680161f3f3fc8cf54f78c5111c1f0c4bcd6380b0d29022fb9ac5fd407805d8b7
+  data.tar.gz: 6951095c0b1b04b7755e8857a977946825053a141e3fd4c1c3b7e10cade061fe
 SHA512:
-  metadata.gz: 967d4c8e1f174da75c8818fa0b94432ca2878d44474e5433930aa5bca728d4636b1ae4594e930be98fc68d6d9d57a40622dd5075ff507242100f424b95213e75
-  data.tar.gz: 7b24159117153d934834c2767692be078a78c58ec6fc34775d91bd90794767bbf86cbde9fb6306bcf5640b2a7b212f8bd0866e980ed3a871a3e0212120a7494b
+  metadata.gz: f852606e3aa48e70a5856f0cfccbfafe4c9235a6a701faca692446186b5bf8f30781b316577b7ac15a164b07293f9b550ad5cdfe0db58df6e57be396de380cf6
+  data.tar.gz: d938005d0ad30817b294e0e8143b272be0dafb794dfa4a57ee012fc8f162c7d895d85a5a2ae0a57f4bc3b9e50c372fde93ac22b31bc01579ead3deec968f2d2a

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [0.5.1] - 2026-09-12
+
+### Fixed
+
+* Build the signature base string with a String conversion that every supported Ruby offers; `Header#url` called `URI::Generic#to_str`, which arrived in `uri` 0.13, so it raised `NoMethodError` on a stock Ruby 3.2, the oldest version the gem claims to support
+* Sign a parameter that carries no value, such as a bare `?flag` in the query string or the `c2` of the RFC 5849 Section 3.4.1.3.1 example, as `name=` rather than dropping it from the signature base string; a request carrying one signed differently than the server computes, so it was rejected
+
 ## [0.5.0] - 2026-09-12
 
 ### Added

data/lib/simple_oauth/header/class_methods.rb

@@ -71,7 +71,7 @@ module SimpleOAuth
       def from_request(request, oauth = {})
         uri = request.uri || raise(ArgumentError, "The request has no URI")
         body = request.body
-        return new(request.method, uri, CGI.parse(body.to_s), oauth) if form_encoded?(request)
+        return new(request.method, uri, form_params(body), oauth) if form_encoded?(request)
 
         no_params = {} #: Header::request_params
         new(request.method, uri, no_params, oauth, body)
@@ -117,6 +117,21 @@ module SimpleOAuth
 
       private
 
+      # Parses a form-encoded body into the parameter pairs to sign
+      #
+      # A parameter with no value, such as the "c2" of the RFC 5849 Section 3.4.1.3.1
+      # example, is signed with an empty value rather than dropped.
+      #
+      # @api private
+      # @param body [String, nil] the form-encoded body
+      # @return [Array<Array(String, String)>] the parameter pairs
+      def form_params(body)
+        CGI.parse(body.to_s).flat_map do |key, values|
+          # A parameter with no value still makes one pair, carrying an empty value
+          (values.empty? ? [""] : values).map { |value| [key, value] }
+        end
+      end
+
       # Checks whether a request carries a form-encoded body
       #
       # @api private

data/lib/simple_oauth/header/params.rb

@@ -33,11 +33,15 @@ module SimpleOAuth
 
       # Extracts query parameters from the request URL
       #
+      # A parameter with no value, such as the "c2" of the RFC 5849 Section 3.4.1.3.1
+      # example, is signed with an empty value rather than dropped.
+      #
       # @api private
       # @return [Array<Array>] URL query parameters as key-value pairs
       def url_params
         CGI.parse(@uri.query || "").flat_map do |key, values|
-          values.sort.map { |value| [key, value] }
+          # A parameter with no value still makes one pair, carrying an empty value
+          (values.empty? ? [""] : values.sort).map { |value| [key, value] }
         end
       end
 

data/lib/simple_oauth/header.rb

@@ -102,7 +102,9 @@ module SimpleOAuth
     #   header.url
     #   # => "https://api.example.com/path"
     def url
-      @uri.dup.tap { |uri| uri.query = nil }.to_str
+      # String() takes whichever conversion the installed uri defines: it gained to_str in
+      # 0.13, and the uri that ships with Ruby 3.2 offers only to_s
+      String(@uri.dup.tap { |uri| uri.query = nil })
     end
 
     # Returns the OAuth Authorization header string

data/lib/simple_oauth/version.rb

@@ -1,5 +1,5 @@
 # OAuth 1.0 header generation library
 module SimpleOauth
   # The current version of the SimpleOAuth gem
-  VERSION = "0.5.0".freeze
+  VERSION = "0.5.1".freeze
 end

data/sig/simple_oauth/header/class_methods.rbs

@@ -28,6 +28,9 @@ module SimpleOAuth
 
       private
 
+      # Parses a form-encoded body into the parameter pairs to sign
+      def form_params: (String? body) -> Array[[String, String]]
+
       # Checks whether a request carries a form-encoded body
       def form_encoded?: (Header::_Request request) -> bool
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: simple_oauth
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.5.1
 platform: ruby
 authors:
 - Steve Richert
@@ -72,7 +72,6 @@ files:
 - sig/simple_oauth/parser.rbs
 - sig/simple_oauth/signature.rbs
 - sig/strscan.rbs
-- sig/uri_ext.rbs
 homepage: https://github.com/laserlemon/simple_oauth
 licenses:
 - MIT

data/sig/uri_ext.rbs

@@ -1,7 +0,0 @@
-# Extensions to the URI module
-module URI
-  class Generic
-    # Returns the URI as a String (implicit conversion)
-    def to_str: () -> String
-  end
-end