standard_id-google 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 77c483758db0802e58687b5c8ed4465ed8d4c5ecb1bd4af9f7078b6ed12d236b
-  data.tar.gz: '00569352c386b2b28c6cfacbdda6640f2bcaa287af315c2d15820726bc7a89be'
+  metadata.gz: 54193c55f7d0359d865c030e3c4f42457d038a53bff4a3b3e78e46f792d577a2
+  data.tar.gz: 34ba47a877d286cf4cb8f5662e08665c78b03e6025c70b2490c87d536de27064
 SHA512:
-  metadata.gz: 528bb72eb448ce2f3c4078d64b31d9d91ab6602cd176279ead86226849c295a25494af7cb4a8b0703260f90b47bf5a77d094b5b137eef5506c4e46158052f7d7
-  data.tar.gz: 4cf122d55787bf6fa36902023afab87c4540c0a9824899447a7b0e81ce4082f9ca3a0f92d0f1d970067c61f7a52ab9638c97a7d7bd2fd3d5cd1d6f44a113c8a6
+  metadata.gz: a4e65705d26b442d36d2f362539cd9e305f429bc3cf2ed5cee39c31aca7f0e29f0f79fcbde2a2e6d48924ab15775a1c3b9103bc0b72d115520ed5fa714c51b80
+  data.tar.gz: 2ecded046bf8c360c8d61a448b72025f2e2baea42dc06c5a590a5bdd81185e95d4c48601c3893142968f3f7882f3152d8cf7fe356290c40bd7daf858653d519b

data/lib/standard_id/google/providers/google.rb

@@ -9,33 +9,38 @@ module StandardId
       USERINFO_ENDPOINT = "https://www.googleapis.com/oauth2/v2/userinfo".freeze
       TOKEN_INFO_ENDPOINT = "https://oauth2.googleapis.com/tokeninfo".freeze
       DEFAULT_SCOPE = "openid email profile".freeze
+      AUTHORIZATION_PARAM_DEFAULTS = {
+        scope: DEFAULT_SCOPE
+      }.freeze
 
       class << self
         def provider_name
           "google"
         end
 
-        def authorization_url(state:, redirect_uri:, **options)
-          scope = options[:scope] || DEFAULT_SCOPE
-          prompt = options[:prompt]
+        def supported_authorization_params
+          [:nonce, :login_hint, :prompt, :scope, :access_type, :hd, :response_mode, :include_granted_scopes]
+        end
 
+        def authorization_url(state:, redirect_uri:, **options)
           query = {
             client_id: credentials[:client_id],
             redirect_uri: redirect_uri,
             response_type: "code",
-            scope: scope,
             state: state
           }
 
-          query[:prompt] = prompt if prompt.present?
+          supported_authorization_params.each do |param|
+            query[param] = options[param] || AUTHORIZATION_PARAM_DEFAULTS[param]
+          end
 
-          "#{AUTH_ENDPOINT}?#{URI.encode_www_form(query)}"
+          "#{AUTH_ENDPOINT}?#{URI.encode_www_form(query.compact)}"
         end
 
-        def get_user_info(code: nil, id_token: nil, access_token: nil, redirect_uri: nil, **_options)
+        def get_user_info(code: nil, id_token: nil, access_token: nil, redirect_uri: nil, nonce: nil, **_options)
           if id_token.present?
             build_response(
-              verify_id_token(id_token: id_token),
+              verify_id_token(id_token: id_token, nonce: nonce),
               tokens: { id_token: id_token }
             )
           elsif access_token.present?
@@ -44,7 +49,7 @@ module StandardId
               tokens: { access_token: access_token }
             )
           elsif code.present?
-            exchange_code_for_user_info(code: code, redirect_uri: redirect_uri)
+            exchange_code_for_user_info(code: code, redirect_uri: redirect_uri, nonce: nonce)
           else
             raise StandardId::InvalidRequestError, "Either code, id_token, or access_token must be provided"
           end
@@ -61,7 +66,7 @@ module StandardId
           DEFAULT_SCOPE
         end
 
-        def exchange_code_for_user_info(code:, redirect_uri:)
+        def exchange_code_for_user_info(code:, redirect_uri:, nonce: nil)
           raise StandardId::InvalidRequestError, "Missing authorization code" if code.blank?
 
           token_response = HttpClient.post_form(TOKEN_ENDPOINT, {
@@ -80,6 +85,11 @@ module StandardId
           access_token = parsed_token["access_token"]
           raise StandardId::InvalidRequestError, "Google response missing access token" if access_token.blank?
 
+          # If we have an ID token in the response and a nonce was provided, verify it
+          if parsed_token["id_token"].present? && nonce.present?
+            verify_id_token(id_token: parsed_token["id_token"], nonce: nonce)
+          end
+
           tokens = extract_token_payload(parsed_token)
           user_info = fetch_user_info(access_token: access_token)
 
@@ -90,7 +100,7 @@ module StandardId
           raise StandardId::OAuthError, e.message, cause: e
         end
 
-        def verify_id_token(id_token:)
+        def verify_id_token(id_token:, nonce: nil)
           raise StandardId::InvalidRequestError, "Missing id_token" if id_token.blank?
 
           response = HttpClient.post_form(TOKEN_INFO_ENDPOINT, id_token: id_token)
@@ -99,6 +109,15 @@ module StandardId
 
           token_info = JSON.parse(response.body)
 
+          # Validate nonce if provided (web flow with server-generated nonce)
+          if nonce.present?
+            token_nonce = token_info["nonce"]
+            if token_nonce != nonce
+              raise StandardId::InvalidRequestError,
+                    "ID token nonce mismatch. Expected: #{nonce}, got: #{token_nonce}"
+            end
+          end
+
           unless token_info["aud"] == credentials[:client_id]
             raise StandardId::InvalidRequestError,
                   "ID token audience mismatch. Expected: #{credentials[:client_id]}, got: #{token_info["aud"]}"

data/lib/standard_id/google/version.rb

@@ -2,6 +2,6 @@
 
 module StandardId
   module Google
-    VERSION = "0.1.1"
+    VERSION = "0.1.2"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id-google
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Jaryl Sim