omniauth / omniauth / 39815554731

100%

push

github

Let strategies keep several sign-ins' origins apart

The session holds one omniauth.origin and omniauth.params, so starting
a second sign-in before the first finished, in another tab for
example, gave the first one's callback the second one's origin and
params.

A strategy whose provider sends a value from the request phase back to
the callback, such as OAuth 2.0's state, can now opt in: its request
phase calls remember_sign_in with the value, and it overrides
callback_sign_in_key to return it from the callback. OmniAuth stores
the origin and params of the latest 5 sign-ins under their keys in
session["omniauth.sign_ins"] and gives each callback its own.

omniauth.origin and omniauth.params still hold the latest sign-in, and
the callback falls back to them when its key isn't remembered, so
strategies that don't opt in, and apps and tests that set these keys,
work as before.

This is the core half of
https://github.com/omniauth/omniauth-oauth2/issues/195

201 of 201 branches covered (100.0%)

29 of 29 new or added lines in 2 files covered. (100.0%)

711 of 711 relevant lines covered (100.0%)

126.99 hits per line