Class: StandardId::Providers::Google

Inherits:
Base
  • Object
show all
Defined in:
lib/standard_id/providers/google.rb

Constant Summary collapse

AUTH_ENDPOINT = 
"https://accounts.google.com/o/oauth2/v2/auth".freeze
TOKEN_ENDPOINT = 
"https://oauth2.googleapis.com/token".freeze
USERINFO_ENDPOINT = 
"https://www.googleapis.com/oauth2/v2/userinfo".freeze
TOKEN_INFO_ENDPOINT = 
"https://oauth2.googleapis.com/tokeninfo".freeze
DEFAULT_SCOPE = 
"openid email profile".freeze

Class Method Summary collapse

Methods inherited from Base

callback_path, resolve_params, setup, skip_csrf?, supports_mobile_callback?

Class Method Details

.authorization_url(state:, redirect_uri:, **options) ⇒ Object 



17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
 
# File 'lib/standard_id/providers/google.rb', line 17

def authorization_url(state:, redirect_uri:, **options)
  scope = options[:scope] || DEFAULT_SCOPE
  prompt = options[:prompt]

  query = {
    client_id: credentials[:client_id],
    redirect_uri: redirect_uri,
    response_type: "code",
    scope: scope,
    state: state
  }

  query[:prompt] = prompt if prompt.present?

  "#{AUTH_ENDPOINT}?#{URI.encode_www_form(query)}"
end

.config_schema ⇒ Object 



52
53
54
55
56
57
 
# File 'lib/standard_id/providers/google.rb', line 52

def config_schema
  {
    google_client_id: { type: :string, default: nil },
    google_client_secret: { type: :string, default: nil }
  }
end

.default_scope ⇒ Object 



59
60
61
 
# File 'lib/standard_id/providers/google.rb', line 59

def default_scope
  DEFAULT_SCOPE
end

.exchange_code_for_user_info(code:, redirect_uri:) ⇒ Object 



63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
 
# File 'lib/standard_id/providers/google.rb', line 63

def (code:, redirect_uri:)
  raise StandardId::InvalidRequestError, "Missing authorization code" if code.blank?

  token_response = HttpClient.post_form(TOKEN_ENDPOINT, {
    client_id: credentials[:client_id],
    client_secret: credentials[:client_secret],
    code: code,
    grant_type: "authorization_code",
    redirect_uri: redirect_uri
  }.compact)

  unless token_response.is_a?(Net::HTTPSuccess)
    raise StandardId::InvalidRequestError, "Failed to exchange Google authorization code"
  end

  parsed_token = JSON.parse(token_response.body)
  access_token = parsed_token["access_token"]
  raise StandardId::InvalidRequestError, "Google response missing access token" if access_token.blank?

  tokens = extract_token_payload(parsed_token)
   = (access_token: access_token)

  build_response(, tokens: tokens)
rescue StandardError => e
  raise e if e.is_a?(StandardId::OAuthError)
  raise StandardId::OAuthError, e.message, cause: e
end

.fetch_user_info(access_token:) ⇒ Object 



125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
 
# File 'lib/standard_id/providers/google.rb', line 125

def (access_token:)
  raise StandardId::InvalidRequestError, "Missing access token" if access_token.blank?

  verify_token(access_token)
  user_response = HttpClient.get_with_bearer(USERINFO_ENDPOINT, access_token)

  unless user_response.is_a?(Net::HTTPSuccess)
    raise StandardId::InvalidRequestError, "Failed to fetch Google user info"
  end

  JSON.parse(user_response.body)
rescue StandardError => e
  raise e if e.is_a?(StandardId::OAuthError)
  raise StandardId::OAuthError, e.message, cause: e
end

.get_user_info(code: nil, id_token: nil, access_token: nil, redirect_uri: nil, **options) ⇒ Object 



34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
 
# File 'lib/standard_id/providers/google.rb', line 34

def (code: nil, id_token: nil, access_token: nil, redirect_uri: nil, **options)
  if id_token.present?
    build_response(
      verify_id_token(id_token: id_token),
      tokens: { id_token: id_token }
    )
  elsif access_token.present?
    build_response(
      (access_token: access_token),
      tokens: { access_token: access_token }
    )
  elsif code.present?
    (code: code, redirect_uri: redirect_uri)
  else
    raise StandardId::InvalidRequestError, "Either code, id_token, or access_token must be provided"
  end
end

.provider_name ⇒ Object 



13
14
15
 
# File 'lib/standard_id/providers/google.rb', line 13

def provider_name
  "google"
end

.verify_id_token(id_token:) ⇒ Object 



91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
 
# File 'lib/standard_id/providers/google.rb', line 91

def verify_id_token(id_token:)
  raise StandardId::InvalidRequestError, "Missing id_token" if id_token.blank?

  response = HttpClient.post_form(TOKEN_INFO_ENDPOINT, id_token: id_token)

  unless response.is_a?(Net::HTTPSuccess)
    raise StandardId::InvalidRequestError, "Invalid or expired id_token"
  end

  token_info = JSON.parse(response.body)

  unless token_info["aud"] == credentials[:client_id]
    raise StandardId::InvalidRequestError, "ID token audience mismatch. Expected: #{credentials[:client_id]}, got: #{token_info['aud']}"
  end

  unless ["accounts.google.com", "https://accounts.google.com"].include?(token_info["iss"])
    raise StandardId::InvalidRequestError, "ID token issuer invalid. Expected Google, got: #{token_info['iss']}"
  end

  {
    "sub" => token_info["sub"],
    "email" => token_info["email"],
    "email_verified" => token_info["email_verified"],
    "name" => token_info["name"],
    "given_name" => token_info["given_name"],
    "family_name" => token_info["family_name"],
    "picture" => token_info["picture"],
    "locale" => token_info["locale"]
  }.compact
rescue StandardError => e
  raise e if e.is_a?(StandardId::OAuthError)
  raise StandardId::OAuthError, e.message, cause: e
end