a2a-ruby 1.0.0

data/lib/a2a/server/middleware/authentication_middleware.rb

@@ -0,0 +1,212 @@
+# frozen_string_literal: true
+
+require "base64"
+require_relative "../../errors"
+
+module A2A
+  module Server
+    module Middleware
+    end
+  end
+end
+
+##
+# Authentication middleware for A2A requests
+#
+# Handles authentication for A2A requests based on various security schemes
+# including OAuth2, JWT, API keys, and HTTP authentication.
+#
+# @example Basic usage
+#   middleware = AuthenticationMiddleware.new(
+#     schemes: ['bearer', 'api_key'],
+#     required: true
+#   )
+#
+module A2A
+  module Server
+    module Middleware
+      class AuthenticationMiddleware
+        attr_reader :schemes, :required, :authenticators
+
+        ##
+        # Initialize authentication middleware
+        #
+        # @param schemes [Array<String>] Allowed authentication schemes
+        # @param required [Boolean] Whether authentication is required
+        # @param authenticators [Hash] Custom authenticator implementations
+        def initialize(schemes: [], required: false, authenticators: {})
+          @schemes = schemes.map(&:to_s)
+          @required = required
+          @authenticators = default_authenticators.merge(authenticators)
+        end
+
+        ##
+        # Process authentication for a request
+        #
+        # @param request [A2A::Protocol::Request] The JSON-RPC request
+        # @param context [A2A::Server::Context] The request context
+        # @yield Block to continue the middleware chain
+        # @return [Object] The result from the next middleware or handler
+        def call(request, context)
+          # Extract authentication information
+          auth_info = extract_authentication(request, context)
+
+          if auth_info
+            scheme, credentials = auth_info
+
+            # Check if scheme is allowed
+            unless @schemes.empty? || @schemes.include?(scheme)
+              raise A2A::Errors::AuthorizationFailed, "Authentication scheme '#{scheme}' not supported"
+            end
+
+            # Authenticate using the appropriate authenticator
+            authenticate(scheme, credentials, context)
+
+          elsif @required
+            raise A2A::Errors::AuthenticationRequired,
+                  "Authentication required. Supported schemes: #{@schemes.join(', ')}"
+          end
+
+          # Continue to next middleware
+          yield
+        end
+
+        ##
+        # Add a custom authenticator
+        #
+        # @param scheme [String] The authentication scheme name
+        # @param authenticator [Proc] The authenticator proc
+        def add_authenticator(scheme, authenticator)
+          @authenticators[scheme.to_s] = authenticator
+        end
+
+        private
+
+        ##
+        # Extract authentication information from request/context
+        #
+        # @param request [A2A::Protocol::Request] The request
+        # @param context [A2A::Server::Context] The context
+        # @return [Array<String>, nil] [scheme, credentials] or nil if no auth
+        def extract_authentication(request, context)
+          # Try to extract from various sources
+
+          # 1. Check context metadata for HTTP headers
+          auth_header = context.get_metadata(:authorization) ||
+                        context.get_metadata("Authorization")
+
+          return parse_authorization_header(auth_header) if auth_header
+
+          # 2. Check request parameters for API key
+          if request.params.is_a?(Hash)
+            api_key = request.params["api_key"] || request.params[:api_key]
+            return ["api_key", api_key] if api_key
+          end
+
+          # 3. Check context for pre-set authentication
+          if context.authenticated?
+            # Return the first available authentication scheme
+            context.instance_variable_get(:@auth_schemes)&.first
+          end
+
+          nil
+        end
+
+        ##
+        # Parse Authorization header
+        #
+        # @param header [String] The Authorization header value
+        # @return [Array<String>] [scheme, credentials]
+        def parse_authorization_header(header)
+          parts = header.strip.split(" ", 2)
+          return nil if parts.length != 2
+
+          scheme = parts[0].downcase
+          credentials = parts[1]
+
+          [scheme, credentials]
+        end
+
+        ##
+        # Authenticate using the appropriate authenticator
+        #
+        # @param scheme [String] The authentication scheme
+        # @param credentials [String] The credentials
+        # @param context [A2A::Server::Context] The request context
+        def authenticate(scheme, credentials, context)
+          authenticator = @authenticators[scheme]
+
+          unless authenticator
+            raise A2A::Errors::AuthorizationFailed,
+                  "No authenticator configured for scheme '#{scheme}'"
+          end
+
+          # Call the authenticator
+          result = authenticator.call(credentials, context)
+
+          raise A2A::Errors::AuthorizationFailed, "Authentication failed for scheme '#{scheme}'" unless result
+
+          # Set authentication in context
+          context.set_authentication(scheme, result)
+        end
+
+        ##
+        # Default authenticator implementations
+        #
+        # @return [Hash] Hash of scheme name to authenticator proc
+        def default_authenticators
+          {
+            "bearer" => method(:authenticate_bearer),
+            "basic" => method(:authenticate_basic),
+            "api_key" => method(:authenticate_api_key)
+          }
+        end
+
+        ##
+        # Authenticate Bearer token (JWT or API key)
+        #
+        # @param token [String] The bearer token
+        # @param context [A2A::Server::Context] The request context
+        # @return [Hash, nil] Authentication result or nil if invalid
+        def authenticate_bearer(token, _context)
+          # This is a basic implementation - in practice you would:
+          # 1. Validate JWT signature and expiration
+          # 2. Check API key against database
+          # 3. Extract user/session information
+
+          # For now, just return the token as valid
+          { token: token, scheme: "bearer" }
+        end
+
+        ##
+        # Authenticate Basic authentication
+        #
+        # @param credentials [String] Base64 encoded username:password
+        # @param context [A2A::Server::Context] The request context
+        # @return [Hash, nil] Authentication result or nil if invalid
+        def authenticate_basic(credentials, _context)
+          decoded = Base64.decode64(credentials)
+          username, = decoded.split(":", 2)
+
+          # In practice, validate against user database
+          # For now, just return the username
+          { username: username, scheme: "basic" }
+        rescue StandardError
+          nil
+        end
+
+        ##
+        # Authenticate API key
+        #
+        # @param api_key [String] The API key
+        # @param context [A2A::Server::Context] The request context
+        # @return [Hash, nil] Authentication result or nil if invalid
+        def authenticate_api_key(api_key, _context)
+          # In practice, validate against API key database
+          # For now, just return the key as valid
+          { api_key: api_key, scheme: "api_key" }
+        end
+      end
+    end
+  end
+end

data/lib/a2a/server/middleware/cors_middleware.rb

@@ -0,0 +1,171 @@
+# frozen_string_literal: true
+
+##
+# CORS (Cross-Origin Resource Sharing) middleware for A2A requests
+#
+# Handles CORS headers for A2A JSON-RPC requests to enable
+# cross-origin requests from web browsers.
+#
+# @example Basic usage
+#   middleware = CorsMiddleware.new(
+#     origins: ['https://example.com'],
+#     methods: ['POST', 'OPTIONS'],
+#     headers: ['Content-Type', 'Authorization']
+#   )
+#
+module A2A
+  module Server
+    module Middleware
+      class CorsMiddleware
+        attr_reader :origins, :methods, :headers, :credentials, :max_age
+
+        ##
+        # Initialize CORS middleware
+        #
+        # @param origins [Array<String>, String] Allowed origins (* for all)
+        # @param methods [Array<String>] Allowed HTTP methods
+        # @param headers [Array<String>] Allowed headers
+        # @param credentials [Boolean] Whether to allow credentials
+        # @param max_age [Integer] Preflight cache duration in seconds
+        # @param expose_headers [Array<String>] Headers to expose to client
+        def initialize(origins: "*", methods: %w[POST OPTIONS],
+                       headers: %w[Content-Type Authorization],
+                       credentials: false, max_age: 86_400, expose_headers: [])
+          @origins = normalize_origins(origins)
+          @methods = Array(methods).map(&:upcase)
+          @headers = Array(headers)
+          @credentials = credentials
+          @max_age = max_age
+          @expose_headers = Array(expose_headers)
+        end
+
+        ##
+        # Process CORS for a request
+        #
+        # @param request [A2A::Protocol::Request] The JSON-RPC request
+        # @param context [A2A::Server::Context] The request context
+        # @yield Block to continue the middleware chain
+        # @return [Object] The result from the next middleware or handler
+        def call(_request, context)
+          # Extract HTTP method and origin from context
+          http_method = context.get_metadata(:http_method) || "POST"
+          origin = context.get_metadata(:origin) || context.get_metadata("Origin")
+
+          # Handle preflight requests
+          return handle_preflight(origin, context) if http_method.casecmp("OPTIONS").zero?
+
+          # Add CORS headers to the response
+          add_cors_headers(origin, context)
+
+          # Continue to next middleware
+          yield
+        end
+
+        ##
+        # Check if an origin is allowed
+        #
+        # @param origin [String] The origin to check
+        # @return [Boolean] True if origin is allowed
+        def origin_allowed?(origin)
+          return true if @origins == "*"
+          return false if origin.nil?
+
+          @origins.any? do |allowed_origin|
+            if allowed_origin.include?("*")
+              # Handle wildcard patterns
+              pattern = Regexp.escape(allowed_origin).gsub('\*', ".*")
+              origin.match?(/\A#{pattern}\z/)
+            else
+              origin == allowed_origin
+            end
+          end
+        end
+
+        ##
+        # Get CORS headers for an origin
+        #
+        # @param origin [String] The request origin
+        # @return [Hash] CORS headers
+        def cors_headers(origin)
+          headers = {}
+
+          if origin_allowed?(origin)
+            headers["Access-Control-Allow-Origin"] = @origins == "*" ? "*" : origin
+
+            headers["Access-Control-Allow-Credentials"] = "true" if @credentials
+
+            headers["Access-Control-Expose-Headers"] = @expose_headers.join(", ") unless @expose_headers.empty?
+          end
+
+          headers
+        end
+
+        ##
+        # Get preflight CORS headers
+        #
+        # @param origin [String] The request origin
+        # @return [Hash] Preflight CORS headers
+        def preflight_headers(origin)
+          headers = cors_headers(origin)
+
+          if origin_allowed?(origin)
+            headers["Access-Control-Allow-Methods"] = @methods.join(", ")
+            headers["Access-Control-Allow-Headers"] = @headers.join(", ")
+            headers["Access-Control-Max-Age"] = @max_age.to_s
+          end
+
+          headers
+        end
+
+        private
+
+        ##
+        # Normalize origins configuration
+        #
+        # @param origins [Array, String] Origins configuration
+        # @return [Array<String>, String] Normalized origins
+        def normalize_origins(origins)
+          case origins
+          when String
+            origins == "*" ? "*" : [origins]
+          when Array
+            origins.include?("*") ? "*" : origins
+          else
+            ["*"]
+          end
+        end
+
+        ##
+        # Handle preflight OPTIONS request
+        #
+        # @param origin [String] The request origin
+        # @param context [A2A::Server::Context] The request context
+        # @return [Hash] Preflight response
+        def handle_preflight(origin, context)
+          # Add preflight headers to context for response
+          preflight_headers(origin).each do |key, value|
+            context.set_metadata("response_header_#{key.downcase}", value)
+          end
+
+          # Return empty response for preflight
+          {
+            status: 200,
+            headers: preflight_headers(origin),
+            body: ""
+          }
+        end
+
+        ##
+        # Add CORS headers to response context
+        #
+        # @param origin [String] The request origin
+        # @param context [A2A::Server::Context] The request context
+        def add_cors_headers(origin, context)
+          cors_headers(origin).each do |key, value|
+            context.set_metadata("response_header_#{key.downcase}", value)
+          end
+        end
+      end
+    end
+  end
+end