class OmniAuth::Strategies::PracticeFusion
Public Instance Methods
callback_phase()
click to toggle source
override the callback_phase
so we can validate the state token signature
Calls superclass method
# File lib/omniauth/strategies/practicefusion.rb, line 75 def callback_phase # If decode_state_parameter returns the correct state token, then # request.params['state'] == session['omniauth.state'] # which passes the CSRF check of omniauth-oauth2 # If decode_state_parameter returns nil, then this is true: # request.params['state'].to_s.empty? # which fails the CSRF check of omniauth-oauth2 request.params['state'] = decode_state_parameter # omniauth sets the environment up _before_ the callback_phase # begins, but we need to set it up after we've decoded the session @env['omniauth.origin'] = session.delete('omniauth.origin') @env['omniauth.origin'] = nil if env['omniauth.origin'] == '' @env['omniauth.params'] = session.delete('omniauth.params') # And now back to our regularly scheduled program super end
callback_url()
click to toggle source
override callback_url
so we don't include query parameters See github.com/intridea/omniauth-oauth2/issues/81 for more details
# File lib/omniauth/strategies/practicefusion.rb, line 54 def callback_url full_host + script_name + callback_path end
raw_info()
click to toggle source
# File lib/omniauth/strategies/practicefusion.rb, line 58 def raw_info @raw_info ||= access_token.get('/ehr/v1/users/me').parsed end
session()
click to toggle source
instead of using the session store, just collect into a hash
# File lib/omniauth/strategies/practicefusion.rb, line 96 def session @fake_session ||= {} end
session=(obj)
click to toggle source
# File lib/omniauth/strategies/practicefusion.rb, line 100 def session=(obj) @fake_session = obj end
Private Instance Methods
decode_state_parameter()
click to toggle source
# File lib/omniauth/strategies/practicefusion.rb, line 117 def decode_state_parameter # this will throw an exception if the state parameter is not valid ciphertext # otherwise, decode the JWT and stick the object back into our fake session self.session, _jwt = JWT.decode(request.params["state"].to_s, options.client_secret) session['omniauth.state'] rescue JWT::VerificationError, JWT::DecodeError nil end
prune!(hash)
click to toggle source
# File lib/omniauth/strategies/practicefusion.rb, line 106 def prune!(hash) hash.delete_if do |_, v| prune!(v) if v.is_a?(Hash) v.nil? || (v.respond_to?(:empty?) && v.empty?) end end
value_or_blank(value)
click to toggle source
# File lib/omniauth/strategies/practicefusion.rb, line 113 def value_or_blank(value) (value.blank?) ? '' : value end