Makig state mandatory for OIDC URI

Author: superchilled

Diff for: lib/vonage/network_authentication/client_authentication.rb

@@ -23,16 +23,16 @@ def token(oidc_auth_code:, redirect_uri:, **params)
       ).access_token
     end
 
-    def generate_oidc_uri(purpose:, api_scope:, login_hint:, redirect_uri:, state: nil)
+    def generate_oidc_uri(purpose:, api_scope:, login_hint:, redirect_uri:, state:)
       scope = "openid%20dpv:#{purpose}%23#{api_scope}"
       uri = "https://oidc.idp.vonage.com/oauth2/auth?" +
         "client_id=#{@config.application_id}" +
         "&response_type=code" +
         "&scope=#{scope}" +
         "&login_hint=#{login_hint}" +
-        "&redirect_uri=#{redirect_uri}"
+        "&redirect_uri=#{redirect_uri}" +
+        "&state=#{state}"
 
-      uri += "&state=#{state}" if state
       uri
     end
   end

Diff for: lib/vonage/network_number_verification.rb

@@ -74,22 +74,21 @@ def verify(phone_number:, auth_data:, hashed: false)
     # @param [required, String] :redirect_uri The URI that will receive the callback containing the OIDC auth code.
     #
     # @param [required, String] :state A string that you can use for tracking. 
-    #   This field is optional, but it is recommended to set a unique identifier for each access token you generate.
+    #   Used to set a unique identifier for each access token you generate.
     #
     # @return [String]
     #
     # @see https://developer.vonage.com/en/getting-started-network/authentication#1-make-an-oidc-request
-    sig { params(phone_number: String, redirect_uri: String, state: T.nilable(String)).returns(String) }
-    def generate_oidc_uri(phone_number:, redirect_uri:, state: nil)
+    sig { params(phone_number: String, redirect_uri: String, state: String).returns(String) }
+    def generate_oidc_uri(phone_number:, redirect_uri:, state:)
       params = {
         purpose: 'FraudPreventionAndDetection',
         api_scope: 'number-verification-verify-read',
         login_hint: phone_number,
-        redirect_uri: redirect_uri
+        redirect_uri: redirect_uri,
+        state: state
       }
 
-      params[:state] = state if state
-
       Vonage::NetworkAuthentication::ClientAuthentication.new(@config).generate_oidc_uri(**params)
     end
   end

Diff for: test/vonage/network_authentication/client_authentication_test.rb

@@ -51,17 +51,6 @@ def test_token_method_without_redirect_uri
   end
 
   def test_generate_oidc_uri_method
-    uri = client_authentication.generate_oidc_uri(
-      purpose: example_purpose,
-      api_scope: example_api_scope,
-      login_hint: example_login_hint,
-      redirect_uri: example_redirect_uri
-    )
-
-    assert_equal "https://oidc.idp.vonage.com/oauth2/auth?client_id=#{application_id}&response_type=code&scope=openid%20dpv:#{example_purpose}%23#{example_api_scope}&login_hint=#{example_login_hint}&redirect_uri=#{example_redirect_uri}", uri
-  end
-
-  def test_generate_oidc_uri_method_with_optional_params
     uri = client_authentication.generate_oidc_uri(
       purpose: example_purpose,
       api_scope: example_api_scope,
@@ -74,18 +63,57 @@ def test_generate_oidc_uri_method_with_optional_params
   end
 
   def test_generate_oidc_uri_method_without_purpose
-    assert_raises(ArgumentError) { client_authentication.generate_oidc_uri(api_scope: example_api_scope, login_hint: example_login_hint, redirect_uri: example_redirect_uri) }
+    assert_raises(ArgumentError) do
+      client_authentication.generate_oidc_uri(
+        api_scope: example_api_scope,
+        login_hint: example_login_hint,
+        redirect_uri: example_redirect_uri,
+        state: '12345'
+      )
+    end
   end
 
   def test_generate_oidc_uri_method_without_api_scope
-    assert_raises(ArgumentError) { client_authentication.generate_oidc_uri(purpose: example_purpose, login_hint: example_login_hint, redirect_uri: example_redirect_uri) }
+    assert_raises(ArgumentError) do
+      client_authentication.generate_oidc_uri(
+        purpose: example_purpose,
+        login_hint: example_login_hint,
+        redirect_uri: example_redirect_uri,
+        state: '12345'
+      )
+    end
   end
 
   def test_generate_oidc_uri_method_without_login_hint
-    assert_raises(ArgumentError) { client_authentication.generate_oidc_uri(purpose: example_purpose, api_scope: example_api_scope, redirect_uri: example_redirect_uri) }
+    assert_raises(ArgumentError) do
+      client_authentication.generate_oidc_uri(
+        purpose: example_purpose,
+        api_scope: example_api_scope,
+        redirect_uri: example_redirect_uri,
+        state: '12345'
+      )
+    end
   end
 
   def test_generate_oidc_uri_method_without_redirect_uri
-    assert_raises(ArgumentError) { client_authentication.generate_oidc_uri(purpose: example_purpose, api_scope: example_api_scope, login_hint: example_login_hint) }
+    assert_raises(ArgumentError) do
+      client_authentication.generate_oidc_uri(
+        purpose: example_purpose,
+        api_scope: example_api_scope,
+        login_hint: example_login_hint,
+        state: '12345'
+      )
+    end
+  end
+
+  def test_generate_oidc_uri_method_without_state
+    assert_raises(ArgumentError) do
+      client_authentication.generate_oidc_uri(
+        purpose: example_purpose,
+        api_scope: example_api_scope,
+        login_hint: example_login_hint,
+        redirect_uri: example_redirect_uri
+      )
+    end
   end
 end

Diff for: test/vonage/network_number_verification_test.rb

@@ -73,7 +73,7 @@ def test_verify_method_with_hashed_phone_number
     assert_kind_of Vonage::Response, response
   end
 
-  def test_check_method_without_phone_number
+  def test_verify_method_without_phone_number
     assert_raises(ArgumentError) do
       network_number_verification.verify(
       auth_data: {
@@ -84,7 +84,7 @@ def test_check_method_without_phone_number
     end
   end
 
-  def test_check_method_with_invalid_phone_number
+  def test_verify_method_with_invalid_phone_number
     auth_data = {
       oidc_auth_code: example_oidc_auth_code,
       redirect_uri: example_redirect_uri
@@ -95,7 +95,7 @@ def test_check_method_with_invalid_phone_number
     assert_raises(ArgumentError) { network_number_verification.verify(phone_number: '447904603505', auth_data: auth_data) }
   end
 
-  def test_check_method_with_invalid_hashed
+  def test_verify_method_with_invalid_hashed
     auth_data = {
       oidc_auth_code: example_oidc_auth_code,
       redirect_uri: example_redirect_uri
@@ -104,11 +104,11 @@ def test_check_method_with_invalid_hashed
     assert_raises(TypeError) { network_number_verification.verify(phone_number: hashed_phone_number, auth_data: auth_data, hashed: 'true') }
   end
 
-  def test_check_method_without_auth_data
+  def test_verify_method_without_auth_data
     assert_raises(ArgumentError) { network_number_verification.verify(phone_number: phone_number) }
   end
 
-  def test_check_method_with_invalid_auth_data
+  def test_verify_method_with_invalid_auth_data
     auth_data = [
       example_oidc_auth_code,
       example_redirect_uri
@@ -117,15 +117,15 @@ def test_check_method_with_invalid_auth_data
     assert_raises(TypeError) { network_number_verification.verify(phone_number: phone_number, auth_data: auth_data) }
   end
 
-  def test_check_method_without_oidc_auth_code
+  def test_verify_method_without_oidc_auth_code
     auth_data = {
       redirect_uri: example_redirect_uri
     }
 
     assert_raises(ArgumentError) { network_number_verification.verify(phone_number: phone_number, auth_data: auth_data) }
   end
 
-  def test_check_method_with_invalid_oidc_auth_code
+  def test_verify_method_with_invalid_oidc_auth_code
     auth_data = {
       oidc_auth_code: 12345,
       redirect_uri: example_redirect_uri
@@ -134,15 +134,15 @@ def test_check_method_with_invalid_oidc_auth_code
     assert_raises(ArgumentError) { network_number_verification.verify(phone_number: phone_number, auth_data: auth_data) }
   end
 
-  def test_check_method_without_redirect_uri
+  def test_verify_method_without_redirect_uri
     auth_data = {
       oidc_auth_code: example_oidc_auth_code
     }
 
     assert_raises(ArgumentError) { network_number_verification.verify(phone_number: phone_number, auth_data: auth_data) }
   end
 
-  def test_check_method_with_invalid_redirect_uri
+  def test_verify_method_with_invalid_redirect_uri
     auth_data = {
       oidc_auth_code: example_oidc_auth_code,
       redirect_uri: 12345
@@ -152,22 +152,20 @@ def test_check_method_with_invalid_redirect_uri
   end
 
   def test_generate_client_uri_method
-    expected_uri = "https://oidc.idp.vonage.com/oauth2/auth?client_id=#{application_id}&response_type=code&scope=openid%20dpv:FraudPreventionAndDetection%23number-verification-verify-read&login_hint=#{phone_number}&redirect_uri=#{example_redirect_uri}"
-
-    assert_equal expected_uri, network_number_verification.generate_oidc_uri(phone_number: phone_number, redirect_uri: example_redirect_uri)
-  end
-
-  def test_generate_client_uri_method_with_optional_params
     expected_uri = "https://oidc.idp.vonage.com/oauth2/auth?client_id=#{application_id}&response_type=code&scope=openid%20dpv:FraudPreventionAndDetection%23number-verification-verify-read&login_hint=#{phone_number}&redirect_uri=#{example_redirect_uri}&state=12345"
 
     assert_equal expected_uri, network_number_verification.generate_oidc_uri(phone_number: phone_number, redirect_uri: example_redirect_uri, state: '12345')
   end
 
   def test_generate_client_uri_method_without_phone_number
-    assert_raises(ArgumentError) { network_number_verification.generate_oidc_uri(redirect_uri: example_redirect_uri) }
+    assert_raises(ArgumentError) { network_number_verification.generate_oidc_uri(redirect_uri: example_redirect_uri, state: '12345') }
   end
 
   def test_generate_client_uri_method_without_redirect_uri
-    assert_raises(ArgumentError) { network_number_verification.generate_oidc_uri(phone_number: phone_number) }
+    assert_raises(ArgumentError) { network_number_verification.generate_oidc_uri(phone_number: phone_number, state: '12345') }
+  end
+
+  def test_generate_client_uri_method_without_state
+    assert_raises(ArgumentError) { network_number_verification.generate_oidc_uri(phone_number: phone_number, redirect_uri: example_redirect_uri) }
   end
 end