Sync fork with upstream auth0/omniauth-auth0 v3.2.0#4
Merged
Conversation
Bumps [faraday](https://github.com/lostisland/faraday) from 2.7.10 to 2.14.1. - [Release notes](https://github.com/lostisland/faraday/releases) - [Changelog](https://github.com/lostisland/faraday/blob/main/CHANGELOG.md) - [Commits](lostisland/faraday@v2.7.10...v2.14.1) --- updated-dependencies: - dependency-name: faraday dependency-version: 2.14.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [rack](https://github.com/rack/rack) from 2.2.7 to 2.2.23. - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@v2.2.7...v2.2.23) --- updated-dependencies: - dependency-name: rack dependency-version: 2.2.23 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…tinuing to support client secret authentication. The client assertion signing key allows Private Key JWT application authentication in Auth0. The client_assertion_signing_key and client_assertion_signing_algorithm are optional parameters. Client assercition signing key will be used if a client_assertion_signing_key is privided. The client_assertion_signing_algorithm is optional. The algorithm defaults to RS256 if nil or not provided.
…le-pinned versions
…and consolidate into v3.1.1
Brings the fork up to date with upstream v3.2.0, which adds client assertion signing key authentication (auth0#203) plus dependency and CI/release workflow updates. The fork's only customization -- forwarding `ext-` prefixed query params to /authorize -- is preserved. Conflicts resolved: - lib/omniauth/strategies/auth0.rb: kept the `ext-` passthrough in authorize_params and the is_authorized_param? helper alongside upstream's new client-assertion private methods. - spec/omniauth/strategies/auth0_spec.rb: upstream refactored the redirect tests into the shared example group 'oauth redirects with various parameters' run under two auth contexts. Folded the ext- assertions and the ext-test=testval example into that shared group so they now run under both client_secret and client-assertion auth. - Gemfile.lock: took upstream's resolution (fork's stale dependabot bump superseded). Full suite: 128 examples, 0 failures. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
jeffreyolio
approved these changes
May 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings our fork up to date with upstream
auth0/omniauth-auth0v3.2.0. The fork had drifted ~31 commits behind (it was sitting on a v3.1.1-era base plus our one customization). This merges upstreammasterwhile preserving our only real change: forwardingext-prefixed query params to/authorize.Why now
We want a feature from upstream v3.2.0:
Also pulled in: dependency bumps (faraday, rack, rexml), the new RL/release CI workflows, README/CHANGELOG updates, and the
JWTTokenhelper.Our customization, preserved
lib/omniauth/strategies/auth0.rb:authorize_paramsstill forwards anyext-prefixed param (Auth0's custom query parameter convention) via theis_authorized_param?helper, now sitting alongside upstream's new client-assertion private methods.Conflict resolution notes
is_authorized_param?helper and upstream's newclient_assertion_*methods.oauth redirects with various parameters, run under two auth contexts (client_secret and client-assertion). I folded ourext-assertions + theext-test=testvalexample into that shared group, so our customization is now exercised under both contexts (better coverage than the original single-context tests).The net diff vs upstream
masteris exactly theext-customization (lib + spec), nothing else.Test plan
bundle exec rspec— 128 examples, 0 failures (99.36% line coverage)ext-testcases pass under both auth contextsruby -csyntax check on resolved filesomniauth-auth0git dependency at the newmaster(or this merge SHA) and run the app's auth specsFollow-up (separate, not this PR)
Upstream issue auth0#214 requests this exact
ext-feature and references the previously-withdrawn auth0#204. Worth reviving as a clean, configurable upstream PR so we can eventually drop the fork — tracked separately.🤖 Generated with Claude Code