activeadmin-device_authorization 0.1.3

data/lib/active_admin/device_authorization/token_exchange.rb

@@ -0,0 +1,144 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module DeviceAuthorization
+    class TokenExchange
+      class Error < StandardError
+        attr_reader :code, :http_status
+
+        def initialize(code, http_status: 400)
+          @code = code
+          @http_status = http_status
+          super(code)
+        end
+      end
+
+      GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code"
+
+      def initialize(client_id:, device_code:, config: ActiveAdmin::DeviceAuthorization.config)
+        @client_id = client_id
+        @device_code = device_code
+        @config = config
+        @expiry = AccessTokenExpiry.new(config: config)
+      end
+
+      def call
+        client = @config.client_class.enabled.find_by(client_id: @client_id)
+        raise Error.new("invalid_client") unless client
+
+        result = @config.grant_class.transaction do
+          grant = @config.grant_class.lock.find_by(
+            client_association => client,
+            :device_code_digest => @config.digest(@device_code)
+          )
+          raise Error.new("invalid_grant") unless grant
+
+          grant.mark_expired_if_needed!
+          grant.reload
+
+          case grant.status
+          when "pending"
+            poll_error(grant)
+          when "denied"
+            raise Error.new("access_denied")
+          when "expired"
+            raise Error.new("expired_token")
+          when "approved"
+            issue_or_reject_already_delivered!(grant, client)
+          else
+            raise Error.new("invalid_grant")
+          end
+        end
+        raise result if result.is_a?(Error)
+
+        Callback.call(
+          @config.on_token_issued,
+          resource_owner: result.fetch(:token).public_send(resource_owner_association),
+          token: result.fetch(:token)
+        )
+        result.fetch(:payload)
+      end
+
+      private
+
+      def client_association
+        @config.client_class_name.underscore.to_sym
+      end
+
+      def resource_owner_association
+        @config.resource_owner_class_name.underscore.to_sym
+      end
+
+      def access_token_association
+        # has_one name on grant; default DeviceAuthorizationGrant -> device_authorization_access_token
+        @config.access_token_class_name.underscore.to_sym
+      end
+
+      def issue_or_reject_already_delivered!(grant, client)
+        if grant.public_send(access_token_association).present?
+          raise Error.new("invalid_grant")
+        end
+
+        plaintext = SecureRandom.urlsafe_base64(32)
+        now = Time.current
+        ttl = grant.try(:absolute_ttl_seconds)
+        absolute_expires_at = @expiry.absolute_expires_at_for(ttl_seconds: ttl, now: now)
+        # Column is NOT NULL in typical hosts; when absolute expiry is disabled,
+        # store a far-future sentinel so ActiveRecord hosts stay compatible.
+        absolute_expires_at ||= now + (100 * 365 * 24 * 60 * 60)
+
+        token = @config.access_token_class.create!(
+          client_association => client,
+          resource_owner_association => grant.public_send(resource_owner_association),
+          grant_association => grant,
+          :token_digest => @config.digest(plaintext),
+          :scopes => grant.granted_scopes,
+          :absolute_expires_at => absolute_expires_at,
+          :last_used_at => now
+        )
+        payload = {
+          access_token: plaintext,
+          token_type: "Bearer",
+          scope: Array(token.scopes).join(" ")
+        }
+        expires_in = @expiry.expires_in_seconds(
+          absolute_expires_at: token.absolute_expires_at,
+          last_used_at: token.last_used_at,
+          now: now
+        )
+        payload[:expires_in] = expires_in unless expires_in.nil?
+        {payload: payload, token: token}
+      end
+
+      def grant_association
+        @config.grant_class_name.underscore.to_sym
+      end
+
+      def poll_error(grant)
+        required = required_poll_interval(grant)
+        too_fast = grant.last_poll_at.present? && grant.last_poll_at > required.seconds.ago
+        attrs = {last_poll_at: Time.current}
+        if too_fast
+          next_interval = required + @config.slow_down_increment.to_i
+          if grant.respond_to?(:poll_interval_seconds=)
+            attrs[:poll_interval_seconds] = next_interval
+          end
+        end
+        grant.update!(attrs)
+        Error.new(too_fast ? "slow_down" : "authorization_pending")
+      end
+
+      # Hosts may store the raised interval on the grant (poll_interval_seconds).
+      # Without that column, slow_down still gates on the base poll_interval only.
+      def required_poll_interval(grant)
+        base = @config.poll_interval.to_i
+        stored =
+          if grant.respond_to?(:poll_interval_seconds)
+            grant.poll_interval_seconds
+          end
+        value = stored.to_i
+        value.positive? ? value : base
+      end
+    end
+  end
+end

data/lib/active_admin/device_authorization/user_code.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module DeviceAuthorization
+    module UserCode
+      MAX_GENERATION_ATTEMPTS = 100
+      class GenerationExhausted < StandardError; end
+
+      module_function
+
+      def generate(config: ActiveAdmin::DeviceAuthorization.config, exists: nil)
+        alphabet = Array(config.user_code_alphabet)
+        raise ArgumentError, "user_code_alphabet must not be empty" if alphabet.empty?
+
+        count = config.user_code_character_count.to_i
+        group = config.user_code_group_size.to_i
+        raise ArgumentError, "user_code_character_count must be positive" if count <= 0
+
+        MAX_GENERATION_ATTEMPTS.times do
+          chars = Array.new(count) { alphabet[SecureRandom.random_number(alphabet.size)] }
+          code =
+            if group.positive?
+              chars.each_slice(group).map(&:join).join("-")
+            else
+              chars.join
+            end
+          return code if exists.nil? || !exists.call(code)
+        end
+
+        raise GenerationExhausted, "could not allocate a unique user code"
+      end
+
+      def normalize(value, config: ActiveAdmin::DeviceAuthorization.config)
+        raw = value.to_s.strip.upcase
+        alphabet = Array(config.user_code_alphabet).each_with_object({}) do |character, canonical|
+          canonical[character.to_s.upcase] = character.to_s
+        end
+        characters = raw.each_char.filter_map { |character| alphabet[character.upcase] }
+        return raw unless characters.length == config.user_code_character_count.to_i
+
+        group = config.user_code_group_size.to_i
+        return characters.join unless group.positive?
+
+        characters.each_slice(group).map(&:join).join("-")
+      end
+    end
+  end
+end

data/lib/active_admin/device_authorization/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module DeviceAuthorization
+    VERSION = "0.1.3"
+  end
+end

data/lib/active_admin/device_authorization.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require "digest"
+require "securerandom"
+require "active_support"
+require "active_support/core_ext/object/blank"
+require "active_support/core_ext/numeric/time"
+
+require_relative "device_authorization/version"
+require_relative "device_authorization/configuration"
+require_relative "device_authorization/callback"
+require_relative "device_authorization/user_code"
+require_relative "device_authorization/access_token_expiry"
+require_relative "device_authorization/device_authorization_request"
+require_relative "device_authorization/consent"
+require_relative "device_authorization/token_exchange"
+require_relative "device_authorization/retention"
+require_relative "device_authorization/routes"
+require_relative "device_authorization/page"
+
+module ActiveAdmin
+  module DeviceAuthorization
+    class << self
+      def config
+        @config ||= Configuration.new
+      end
+
+      def configure
+        yield config
+        config.validate!
+        config
+      end
+
+      def reset_config!
+        @config = Configuration.new
+      end
+    end
+  end
+end
+
+require_relative "device_authorization/engine" if defined?(Rails::Engine)

data/lib/activeadmin-device_authorization.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require "active_admin/device_authorization"

data/lib/tasks/active_admin_device_authorization.rake

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+namespace :active_admin do
+  namespace :device_authorization do
+    desc "Delete expired device authorization records"
+    task retention: :environment do
+      ActiveAdmin::DeviceAuthorization::Retention.call
+    end
+  end
+end

data/sig/active_admin/device_authorization.rbs

@@ -0,0 +1,5 @@
+module ActiveAdmin
+  module DeviceAuthorization
+    VERSION: String
+  end
+end

metadata

@@ -0,0 +1,296 @@
+--- !ruby/object:Gem::Specification
+name: activeadmin-device_authorization
+version: !ruby/object:Gem::Version
+  version: 0.1.3
+platform: ruby
+authors:
+- Andrei Makarov
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: activeadmin
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.2'
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 7.2.3.2
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 7.2.3.2
+- !ruby/object:Gem::Dependency
+  name: appraisal
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2'
+- !ruby/object:Gem::Dependency
+  name: bundler-audit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+- !ruby/object:Gem::Dependency
+  name: polyrun
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.2.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.2.0
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13'
+- !ruby/object:Gem::Dependency
+  name: rbs
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3'
+- !ruby/object:Gem::Dependency
+  name: rubocop-rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.8'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.8'
+- !ruby/object:Gem::Dependency
+  name: rubocop-thread_safety
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.7'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.7'
+- !ruby/object:Gem::Dependency
+  name: standard
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.52'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.52'
+- !ruby/object:Gem::Dependency
+  name: standard-custom
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: standard-performance
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.8'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.8'
+- !ruby/object:Gem::Dependency
+  name: standard-rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.3'
+description: Configurable device authorization grant, ActiveAdmin consent UI, and
+  short-lived bearer tokens for admin APIs.
+email:
+- contact@kiskolabs.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- CODE_OF_CONDUCT.md
+- CONTRIBUTING.md
+- GOVERNANCE.md
+- LICENSE.md
+- README.md
+- SECURITY.md
+- activeadmin-device_authorization.gemspec
+- app/controllers/active_admin/device_authorization/application_controller.rb
+- app/controllers/active_admin/device_authorization/consents_controller.rb
+- app/controllers/active_admin/device_authorization/device_authorizations_controller.rb
+- app/controllers/active_admin/device_authorization/json_response.rb
+- app/controllers/active_admin/device_authorization/tokens_controller.rb
+- app/views/active_admin/device_authorization/_consent.html.erb
+- app/views/active_admin/device_authorization/_enter_code.html.erb
+- app/views/active_admin/device_authorization/_standalone_styles.html.erb
+- app/views/active_admin/device_authorization/consents/index.html.erb
+- app/views/active_admin/device_authorization/consents/show.html.erb
+- config/locales/en.yml
+- config/locales/fi.yml
+- config/locales/sv.yml
+- config/polyrun_coverage.yml
+- lib/active_admin/device_authorization.rb
+- lib/active_admin/device_authorization/access_token_expiry.rb
+- lib/active_admin/device_authorization/callback.rb
+- lib/active_admin/device_authorization/configuration.rb
+- lib/active_admin/device_authorization/consent.rb
+- lib/active_admin/device_authorization/device_authorization_request.rb
+- lib/active_admin/device_authorization/engine.rb
+- lib/active_admin/device_authorization/page.rb
+- lib/active_admin/device_authorization/retention.rb
+- lib/active_admin/device_authorization/routes.rb
+- lib/active_admin/device_authorization/token_exchange.rb
+- lib/active_admin/device_authorization/user_code.rb
+- lib/active_admin/device_authorization/version.rb
+- lib/activeadmin-device_authorization.rb
+- lib/tasks/active_admin_device_authorization.rake
+- sig/active_admin/device_authorization.rbs
+homepage: https://github.com/amkisko/activeadmin-device_authorization.rb
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/amkisko/activeadmin-device_authorization.rb
+  source_code_uri: https://github.com/amkisko/activeadmin-device_authorization.rb/tree/main
+  changelog_uri: https://github.com/amkisko/activeadmin-device_authorization.rb/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/amkisko/activeadmin-device_authorization.rb/issues
+  documentation_uri: https://github.com/amkisko/activeadmin-device_authorization.rb#readme
+  allowed_push_host: https://rubygems.org
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.4.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.6
+specification_version: 4
+summary: RFC 8628 device authorization for ActiveAdmin bearer access
+test_files: []