omniauth-ebay-oauth implementation

[ignat-z]

No description provided.

[palkan]

Why do we have to stub this const and not use it as body?

[ignat-z]

The main reason -- it's easier to read when something went wrong, compare:

       You can stub this request with the following snippet:

       stub_request(:post, "https://api.com/endpoint").
         with(:body => "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<GetUserRequest xmlns=\"urn:ebay:apis:eBLBaseComponents\">\n  <ErrorLanguage>en_US</ErrorLanguage>\n  <WarningLevel>High</WarningLevel>\n  <DetailLevel>ReturnAll</DetailLevel>\n</GetUserRequest>\n",
              :headers => {'Accept'=>'*/*', 'Accept-Encoding'=>'gzip;q=1.0,deflate;q=0.6,identity;q=0.3', 'Content-Type'=>'text/xml', 'Host'=>'api.com', 'User-Agent'=>'Ruby', 'X-Ebay-Api-Call-Name'=>'GetUser', 'X-Ebay-Api-Compatibility-Level'=>'967', 'X-Ebay-Api-Iaf-Token'=>'token+1', 'X-Ebay-Api-Siteid'=>'0'}).
         to_return(:status => 200, :body => "", :headers => {})

       registered request stubs:

       stub_request(:post, "https://api.com/endpoint").
         with(:body => "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<GetUserRequest xmlns=\"urn:ebay:apis:eBLBaseComponents\">\n  <ErrorLanguage>en_US</ErrorLanguage>\n  <WarningLevel>High</WarningLevel>\n  <DetailLevel>ReturnAll</DetailLevel>\n</GetUserRequest>\n",
              :headers => {'Accept'=>'*/*', 'Accept-Encoding'=>'gzip;q=1.0,deflate;q=0.6,identity;q=0.3', 'Content-Type'=>'text/xml', 'Host'=>'api.com', 'User-Agent'=>'Ruby', 'X-Ebay-Api-Call-Name'=>'GetUser', 'X-Ebay-Api-Compatibility-Level'=>'967', 'X-Ebay-Api-Iaf-Token'=>'token', 'X-Ebay-Api-Siteid'=>'0'})

vs

       You can stub this request with the following snippet:

       stub_request(:post, "https://api.com/endpoint").
         with(:body => "<>",
              :headers => {'Accept'=>'*/*', 'Accept-Encoding'=>'gzip;q=1.0,deflate;q=0.6,identity;q=0.3', 'Content-Type'=>'text/xml', 'Host'=>'api.com', 'User-Agent'=>'Ruby', 'X-Ebay-Api-Call-Name'=>'GetUser', 'X-Ebay-Api-Compatibility-Level'=>'967', 'X-Ebay-Api-Iaf-Token'=>'token+1', 'X-Ebay-Api-Siteid'=>'0'}).
         to_return(:status => 200, :body => "", :headers => {})

       registered request stubs:

       stub_request(:post, "https://api.com/endpoint").
         with(:body => "<>",
              :headers => {'Accept'=>'*/*', 'Accept-Encoding'=>'gzip;q=1.0,deflate;q=0.6,identity;q=0.3', 'Content-Type'=>'text/xml', 'Host'=>'api.com', 'User-Agent'=>'Ruby', 'X-Ebay-Api-Call-Name'=>'GetUser', 'X-Ebay-Api-Compatibility-Level'=>'967', 'X-Ebay-Api-Iaf-Token'=>'token', 'X-Ebay-Api-Siteid'=>'0'})

Seems like it will be nice even stub default headers, to reduce all this mass. Furthermore, we don't depend on this constants as code control structure, so we could stub it for free.

BTW, changed from stub_const to DI.

[Envek]

Thank you for quick and clean implementation!

Some things that should be fixed for use in real apps:

1. eBay username. It's unreliable to use it as user identifier as it may be changed by the user.

   See the code comment for details.

2. In real apps, it is important to know when refresh_token will expire to send a reminder to the user, asking to log in again. Also, it allows distinguishing between token expiration and token revocation by the user.

   Please add refresh_token_expires_at field into credentials hash.

3. OAuth scopes. Empty scope list is fine for sign-in purposes, but it should be documented better IMHO.

   Also, an example should be added (should user concatenate the list of scopes with space or can we do it for them?)

[Envek]

Unfortunately, eBay username is not reliable value as the user can change it and can change it frequently.

So it's better to use scary EIASToken value because it doesn't change. Username is still important though, so it's better to keep it in nickname field of info hash as per https://github.com/omniauth/omniauth/wiki/Auth-Hash-Schema#schema-10-and-later

[ignat-z]

Fixed, UserID moved to nickname

[Envek]

Style note: you can get rid of lambdas and use just methods by using method method:

def call
  MultiXml.parse(…).tap(&method(:ensure_success_result))
end

def ensure_success_code(response)
 …
end

[ignat-z]

A matter of taste, but changed to this way

[Envek]

Please don't do that! This is a security hole!

You may wish to enable bypassing SSL certificate check via an option, but that option must be disabled by default.

[ignat-z]

Yep, agree, shame on me, fixed

[Envek]

Maybe it worth to note that by default that list of scopes is empty and users should provide it if they will use eBay APIs. Or perhaps it will be good to include public access scope https://api.ebay.com/oauth/api_scope by default.

[ignat-z]

Not sure about default value, it's omniauth strategy and eBay returns enough information for simple SSO. Add ability to pass scope as array of scopes or string.

[Envek]

Released as v0.1.0. Congratulations and thank you for your work!