slack_oauth 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 854ea6bb849afb1579b16e1324fa30914a2540ff
-  data.tar.gz: eb3a7718f284e9ebce134b5ec6bb3510e6e0d619
+  metadata.gz: de0ea259393f9c2ec042054322246580cbae1b88
+  data.tar.gz: 86f34f1d90ea7f376acb19ebf44904e666f638e2
 SHA512:
-  metadata.gz: 3ed2ed608984dd91cde6a970b0754ef8159836462acceb134cd277fe17dca2a739f0da8de190139192fe55bd29900dde48693f21eda4fe7ca03c8bbfd38d2f77
-  data.tar.gz: 93eeaad7c2eadc3614cc968fcbcaa0dbc6fd887a821fc54692456ab5e38967a16e824f6628d8d72ee8bfb1b48bbf98227d501715883066a5d723ee429128a5bc
+  metadata.gz: 28447d0c64a37945004ec170590adf2589d27b9d1f3e35123c31e28a541cd90f4881b420b7c0349a5374430d68e0d6cb4e11d3b70ac550f7e9749ffb8d1f3100
+  data.tar.gz: 85363069f748f108d4c3867189b4b6f13013fe666d9ebad5a2df9388b3e4391cc1b8b1e24ad5a8c1a55ac0931174d7ab26bb92bb8c128036b07a8bd74c83a084

data/Gemfile

@@ -1,4 +1,4 @@
 source 'https://rubygems.org'
 
-# Specify your gem's dependencies in slack_oauth.gemspec
+# Specify your gem's dependencies in hello.gemspec
 gemspec

data/README.md

@@ -8,6 +8,9 @@ oauth client library for sinatra
 - team id(slack) using the authorization
 - team name(slack) using the authorization
 
+# Caution
+don't use Rack::Session::Cookie
+
 ## Installation
 
 Add this line to your application's Gemfile:
@@ -32,23 +35,18 @@ require 'slack_oauth'
 
 register SlackOauth::Driver
 
-use Rack::Session::Cookie,
-    :expire_after => 3600,
-    :secret => 'change'
-
 configure do
-  set :slack_token, 'xxxxx-xxxxx-xxxx-xxxx'
-  set :slack_client_id, 'nnnnnn.nnnnn'
-  set :slack_secret_key, 'xxxxxxxxxxxxxxxxxx'
-  set :logined_uri, '/'
-  set :error_uri, '/'
+  set :slack_token, 'xxxxx-xxxxx-xxxx-xxxx' # required
+  set :slack_client_id, 'nnnnnn.nnnnn' # required
+  set :slack_secret_key, 'xxxxxxxxxxxxxxxxxx' # required
+  set :logined_uri, '/' # required if use register
+  set :error_uri, '/' # required if use register
   set :slack_redirect_uri, 'http://yourhost:4567/oauth'
   set :slack_team, 'your-team' # or nil
-  set :slack_allowed_teams, ['allowed team']
-  set :slack_scope, 'identify'
-  use Rack::Session::Cookie,
-      :expire_after => 3600,
-      :secret => 'change'
+  set :slack_allowed_teams, ['allowed team'] # required
+  set :slack_scope, 'identify' # required
+  use Rack::Session::Pool, # slack_oauth use session
+      :expire_after => 3600
 end
 
 get '/' do

data/lib/helper.rb

@@ -1,6 +1,7 @@
 require 'sinatra/base'
 require 'net/https'
 require 'json'
+require 'securerandom'
 
 module SlackOauth
   module Driver
@@ -20,21 +21,27 @@ module SlackOauth
         if has_settings(:slack_redirect_uri)
           params[:redirect_uri] = settings.slack_redirect_uri
         end
-          
+
         req.set_form_data(params)
         res = JSON.parse(http.request(req).body)
-        session[:authorized] = res['ok'] && settings.slack_allowed_teams.include?(res['team_name'])
-        if session[:authorized]
+
+        session[:slack_authorized] = res['ok'] && settings.slack_allowed_teams.include?(res['team_name'])
+
+        if session[:slack_authorized]
           session[:slack_team] = res['team_name']
           session[:slack_access_token] = res['access_token']
           session[:slack_user_id] = res['user_id']
           session[:slack_team_id] = res['team_id']
         end
-        session[:authorized]
+        session[:slack_authorized]
       end
 
       def authorized?
-        session[:authorized]
+        session[:slack_authorized]
+      end
+
+      def validate_state(state)
+        session[:slack_state] == state
       end
 
       def get_params
@@ -50,6 +57,14 @@ module SlackOauth
         if has_settings(:slack_redirect_uri)
           params << "redirect_uri=#{settings.slack_redirect_uri}"
         end
+
+        @slack_state_generator ||= has_settings(:slack_state_generator) ?  settings.slack_state_generator : ->{
+          SecureRandom.hex(32)
+        }
+
+        session[:slack_state] = @slack_state_generator.call
+        params << "state=#{session[:slack_state]}"
+
         "?#{params.join('&')}"
       end
 

data/lib/slack_oauth.rb

@@ -1,4 +1,4 @@
-require_relative 'version'
+require_relative 'version.rb'
 require_relative 'helper.rb'
 require 'sinatra/base'
 require 'net/https'
@@ -16,7 +16,7 @@ module SlackOauth
         elsif !params[:error].nil?
           redirect settings.error_uri
         elsif !params[:code].nil?
-          if authorize(params[:code])
+          if validate_state(params[:state]) && authorize(params[:code])
             redirect settings.logined_uri
           else
             redirect settings.error_uri

data/lib/version.rb

@@ -1,3 +1,3 @@
 module SlackOauth
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

data/sample/helper.rb

@@ -13,9 +13,8 @@ configure do
   set :slack_team, 'your-team' # or nil
   set :slack_allowed_teams, ['allowed team']
   set :slack_scope, 'identify'
-  use Rack::Session::Cookie,
-      :expire_after => 3600,
-      :secret => 'change'
+  use Rack::Session::Pool,
+      :expire_after => 3600
 end
 
 get '/your-path' do

data/slack_oauth.gemspec

@@ -1,7 +1,7 @@
 # coding: utf-8
 lib = File.expand_path('../lib', __FILE__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
-require 'slack_oauth'
+require_relative 'lib/version'
 
 Gem::Specification.new do |spec|
   spec.name          = "slack_oauth"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: slack_oauth
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - m0cchi
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-07-18 00:00:00.000000000 Z
+date: 2016-07-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sinatra
@@ -99,7 +99,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.4
+rubygems_version: 2.4.5
 signing_key: 
 specification_version: 4
 summary: Slack OAuth driver.