Skip to content

Commit

Permalink
Skip routing callback request if not in callback phase
Browse files Browse the repository at this point in the history
There are other routes in OmniAuth strategies that will not assign
`omniauth.auth`, and we don't want `omniauth_provider` to error or
return `nil` in this case.
  • Loading branch information
janko committed Aug 31, 2024
1 parent dc51817 commit fbb5045
Show file tree
Hide file tree
Showing 3 changed files with 18 additions and 5 deletions.
2 changes: 1 addition & 1 deletion lib/rodauth/features/omniauth.rb
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ module Rodauth

def route_omniauth!
result = super
handle_omniauth_callback if omniauth_request?
handle_omniauth_callback if omniauth_strategy&.on_callback_path?
result
end

Expand Down
4 changes: 0 additions & 4 deletions lib/rodauth/features/omniauth_base.rb
Original file line number Diff line number Diff line change
Expand Up @@ -194,10 +194,6 @@ def handle_omniauth_response(res)
end
end

def omniauth_request?
request.env.key?("omniauth.strategy")
end

def self.included(auth)
auth.extend ClassMethods
auth.instance_variable_set(:@omniauth_providers, [])
Expand Down
17 changes: 17 additions & 0 deletions test/omniauth_test.rb
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,23 @@
assert_equal '{"name":"New Name","email":"[email protected]"}', DB[:account_identities].first[:info]
end

it "gracefully handles GET on request phase when GET is not allowed" do
OmniAuth.config.allowed_request_methods = %i[post]

rodauth do
enable :omniauth
omniauth_provider :developer
end
roda do |r|
r.rodauth
end

visit "/auth/developer"
assert_equal 404, page.status_code

OmniAuth.config.allowed_request_methods = %i[get post]
end

it "deletes omniauth identities when account is closed" do
rodauth do
enable :omniauth, :close_account
Expand Down

0 comments on commit fbb5045

Please sign in to comment.