From 72f227ff05fa663fc07c93b07dc4a7b8a84485cf Mon Sep 17 00:00:00 2001
From: Ben Standefer <benstandefer@gmail.com>
Date: Thu, 20 May 2021 00:34:00 -0700
Subject: [PATCH] Fix for Public Integration use

---
 lib/omniauth-notion.rb | 43 +++++++++++++++++++++++++++++++++++-------
 1 file changed, 36 insertions(+), 7 deletions(-)

diff --git a/lib/omniauth-notion.rb b/lib/omniauth-notion.rb
index b96ffed..ca41906 100644
--- a/lib/omniauth-notion.rb
+++ b/lib/omniauth-notion.rb
@@ -14,7 +14,13 @@ class Notion < OmniAuth::Strategies::OAuth2
         site: 'https://api.notion.com/v1',
         authorize_url: 'https://api.notion.com/v1/oauth/authorize',
         token_url: 'https://api.notion.com/v1/oauth/token',
-        connection_opts: { headers: { user_agent: 'Omniauth-notion', accept: 'application/json', content_type: 'application/json' } }
+        connection_opts: {
+          headers: {
+            user_agent: 'Omniauth-notion',
+            accept: 'application/json',
+            content_type: 'application/json',
+          },
+        }
 
       # These are called after authentication has succeeded. If
       # possible, you should try to set the UID without making
@@ -38,18 +44,41 @@ class Notion < OmniAuth::Strategies::OAuth2
         }
       end
 
+      # The Notion API requires HTTP Basic Authentication when exchanging the
+      # code for a token (i.e. when POSTing to /v1/oauth/token)
+      #   Notion Docs: https://developers.notion.com/docs/authorization#exchanging-the-grant-for-an-access-token
+      #   Similar solution: https://gist.github.com/handylearn/6d6125263d32544c2057#file-filab_strategy-rb-L35
+      def build_access_token
+        options.token_params.merge!(
+          headers: { 'Authorization' => basic_auth_header },
+        )
+        super
+      end
+
+      def basic_auth_header
+        "Basic " + Base64.strict_encode64("#{options[:client_id]}:#{options[:client_secret]}")
+      end
+
+      # The Notion API gives us some core data as part of the token response. I
+      # don't think there is a separate /user/me endpoint (at least as of May
+      # 2021). Also, we get a `bot_id`, not a real user ID. We do get some
+      # informaton about the connector Organization, however.
       def raw_info
-        @raw_info ||= access_token.post('v1/oauth/token', body: nil.to_json).parsed
+        @raw_info ||= access_token.params.except('access_token', 'bearer')
       end
 
       def callback_url
-        if @authorization_code_from_signed_request
-          ''
-        else
-          options[:callback_url] || super
-        end
+        full_host + script_name + callback_path
       end
 
+      # def callback_url
+      #   if @authorization_code_from_signed_request
+      #     ''
+      #   else
+      #     options[:callback_url] || super
+      #   end
+      # end
+
       # def callback_url
       #   # If redirect_uri is configured in token_params, use that
       #   # value.