# [CRUCIBLE-SEED]
# category: hardcoded_secret
# severity: critical
# language: ruby
# expected: Hardcoded OAuth client secret and social login credentials

GOOGLE_CLIENT_ID     = '1234567890-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com'
GOOGLE_CLIENT_SECRET = 'GOCSPX-abcdefghijklmnopqrstuvwxyz123456'
GITHUB_CLIENT_SECRET = 'ghsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
FACEBOOK_APP_SECRET  = 'abcdef0123456789abcdef0123456789'

OmniAuth.config.on_failure = proc { |env| OmniAuth::FailureEndpoint.call(env) }

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :google_oauth2, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET
  provider :github,        'github_client_id_xxxxx', GITHUB_CLIENT_SECRET
end