Class: StandardId::SocialProviders::Google

Inherits:
Object
  • Object
show all
Includes:
ResponseBuilder
Defined in:
lib/standard_id/social_providers/google.rb

Constant Summary collapse

AUTH_ENDPOINT = 
"https://accounts.google.com/o/oauth2/v2/auth".freeze
TOKEN_ENDPOINT = 
"https://oauth2.googleapis.com/token".freeze
USERINFO_ENDPOINT = 
"https://www.googleapis.com/oauth2/v2/userinfo".freeze
TOKEN_INFO_ENDPOINT = 
"https://oauth2.googleapis.com/tokeninfo".freeze
DEFAULT_SCOPE = 
"openid email profile".freeze

Class Method Summary collapse

Class Method Details

.authorization_url(state:, redirect_uri:, scope: DEFAULT_SCOPE, prompt: nil) ⇒ Object 



15
16
17
18
19
20
21
22
23
24
25
26
27
 
# File 'lib/standard_id/social_providers/google.rb', line 15

def authorization_url(state:, redirect_uri:, scope: DEFAULT_SCOPE, prompt: nil)
  query = {
    client_id: credentials[:client_id],
    redirect_uri: redirect_uri,
    response_type: "code",
    scope: scope,
    state: state
  }

  query[:prompt] = prompt if prompt.present?

  "#{AUTH_ENDPOINT}?#{URI.encode_www_form(query)}"
end

.exchange_code_for_user_info(code:, redirect_uri:) ⇒ Object 



47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
 
# File 'lib/standard_id/social_providers/google.rb', line 47

def (code:, redirect_uri:)
  raise StandardId::InvalidRequestError, "Missing authorization code" if code.blank?

  token_response = HttpClient.post_form(TOKEN_ENDPOINT, {
    client_id: credentials[:client_id],
    client_secret: credentials[:client_secret],
    code: code,
    grant_type: "authorization_code",
    redirect_uri: redirect_uri
  }.compact)

  unless token_response.is_a?(Net::HTTPSuccess)
    raise StandardId::InvalidRequestError, "Failed to exchange Google authorization code"
  end

  parsed_token = JSON.parse(token_response.body)
  access_token = parsed_token["access_token"]
  raise StandardId::InvalidRequestError, "Google response missing access token" if access_token.blank?

  tokens = extract_token_payload(parsed_token)
   = (access_token: access_token)

  build_response(, tokens: tokens)
rescue StandardError => e
  raise e if e.is_a?(StandardId::OAuthError)
  raise StandardId::OAuthError, e.message, cause: e
end

.fetch_user_info(access_token:) ⇒ Object 



109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
 
# File 'lib/standard_id/social_providers/google.rb', line 109

def (access_token:)
  raise StandardId::InvalidRequestError, "Missing access token" if access_token.blank?

  verify_token(access_token)
  user_response = HttpClient.get_with_bearer(USERINFO_ENDPOINT, access_token)

  unless user_response.is_a?(Net::HTTPSuccess)
    raise StandardId::InvalidRequestError, "Failed to fetch Google user info"
  end

  JSON.parse(user_response.body)
rescue StandardError => e
  raise e if e.is_a?(StandardId::OAuthError)
  raise StandardId::OAuthError, e.message, cause: e
end

.get_user_info(code: nil, id_token: nil, access_token: nil, redirect_uri: nil) ⇒ Object 



29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
 
# File 'lib/standard_id/social_providers/google.rb', line 29

def (code: nil, id_token: nil, access_token: nil, redirect_uri: nil)
  if id_token.present?
    build_response(
      verify_id_token(id_token: id_token),
      tokens: { id_token: id_token }
    )
  elsif access_token.present?
    build_response(
      (access_token: access_token),
      tokens: { access_token: access_token }
    )
  elsif code.present?
    (code: code, redirect_uri: redirect_uri)
  else
    raise StandardId::InvalidRequestError, "Either code, id_token, or access_token must be provided"
  end
end

.verify_id_token(id_token:) ⇒ Object 



75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
 
# File 'lib/standard_id/social_providers/google.rb', line 75

def verify_id_token(id_token:)
  raise StandardId::InvalidRequestError, "Missing id_token" if id_token.blank?

  response = HttpClient.post_form(TOKEN_INFO_ENDPOINT, id_token: id_token)

  unless response.is_a?(Net::HTTPSuccess)
    raise StandardId::InvalidRequestError, "Invalid or expired id_token"
  end

  token_info = JSON.parse(response.body)

  unless token_info["aud"] == credentials[:client_id]
    raise StandardId::InvalidRequestError, "ID token audience mismatch. Expected: #{credentials[:client_id]}, got: #{token_info['aud']}"
  end

  unless ["accounts.google.com", "https://accounts.google.com"].include?(token_info["iss"])
    raise StandardId::InvalidRequestError, "ID token issuer invalid. Expected Google, got: #{token_info['iss']}"
  end

  {
    "sub" => token_info["sub"],
    "email" => token_info["email"],
    "email_verified" => token_info["email_verified"],
    "name" => token_info["name"],
    "given_name" => token_info["given_name"],
    "family_name" => token_info["family_name"],
    "picture" => token_info["picture"],
    "locale" => token_info["locale"]
  }.compact
rescue StandardError => e
  raise e if e.is_a?(StandardId::OAuthError)
  raise StandardId::OAuthError, e.message, cause: e
end