add_auth 0.2.2 → 0.3.0

data/lib/add_auth/rails/provider_enrollment.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require "json"
+require "active_support/message_encryptor"
+
+module AddAuth
+  module Rails
+    # Bounded transport storage for the form collected before provider consent.
+    # This grants no identity/account authority: G3/G4 still consume the exact
+    # verified enrollment transaction inside the new-account transaction.
+    class ProviderEnrollment
+      MAX_BYTES = 4096
+
+      def initialize(model:, digest:, key:)
+        @model, @digest = model, digest
+        @cipher = ActiveSupport::MessageEncryptor.new(key, cipher: "aes-256-gcm", serializer: :json)
+      end
+
+      def write(pending:, identifier:, profile:)
+        return false unless enrollment?(pending) && bounded_profile?(profile) && identifier.is_a?(String)
+        payload = {"identifier" => identifier, "profile" => profile}
+        return false unless JSON.generate(payload).bytesize <= MAX_BYTES
+        ciphertext = @cipher.encrypt_and_sign(payload, purpose: purpose(pending), expires_at: pending.expires_at)
+        row(pending).where(enrollment_payload: nil).update_all(enrollment_payload: ciphertext) == 1
+      rescue JSON::GeneratorError, EncodingError
+        false
+      end
+
+      def read(pending:)
+        return unless enrollment?(pending)
+        ciphertext = row(pending).pick(:enrollment_payload)
+        return unless ciphertext.is_a?(String) && ciphertext.bytesize <= MAX_BYTES * 3
+        payload = @cipher.decrypt_and_verify(ciphertext, purpose: purpose(pending))
+        return unless payload.is_a?(Hash) && payload["identifier"].is_a?(String) && bounded_profile?(payload["profile"])
+        {identifier: payload.fetch("identifier"), profile: payload.fetch("profile").symbolize_keys}
+      rescue ActiveSupport::MessageEncryptor::InvalidMessage
+        nil
+      end
+
+      def erase(pending:)
+        row(pending).update_all(enrollment_payload: nil) if enrollment?(pending)
+      end
+
+      private
+
+      def enrollment?(pending)
+        pending.is_a?(Core::ExternalIdentities::Pending) && pending.purpose == Core::ExternalIdentities::ENROLL
+      end
+
+      def bounded_profile?(profile)
+        profile.is_a?(Hash) && profile.size <= 20 && profile.all? do |name, value|
+          (name.is_a?(String) || name.is_a?(Symbol)) && name.to_s.valid_encoding? && name.to_s.bytesize.between?(1, 64) &&
+            (value.nil? || value == true || value == false || (value.is_a?(String) && value.valid_encoding? && value.bytesize <= 2048))
+        end
+      end
+
+      def purpose(pending) = "add_auth.external-enrollment:#{@digest.digest(pending.id)}"
+      def row(pending) = @model.where(digest: @digest.digest(pending.id))
+    end
+  end
+end

data/lib/add_auth/rails/provider_libraries/apple_form_post_correlation.rb

@@ -0,0 +1,127 @@
+# frozen_string_literal: true
+
+require "active_support/message_encryptor"
+require "rack/request"
+require "rack/utils"
+
+module AddAuth
+  module Rails
+    module ProviderLibraries
+      # OmniAuth's Apple strategy binds state and nonce to rack.session. Apple
+      # posts its callback cross-site, where a normal SameSite=Lax Rails session
+      # is intentionally absent. This tiny Rack wrapper copies only those
+      # verifier inputs and the Core browser correlation into a separately
+      # encrypted, HttpOnly, Secure, SameSite=None cookie scoped to Apple's
+      # callback path. It never changes the application's normal session cookie.
+      class AppleFormPostCorrelation
+        COOKIE = "add_auth_apple_callback"
+        PENDING_KEY = "add_auth.apple_pending"
+        START_PATH = "/auth/apple"
+        CALLBACK_PATH = "/auth/apple/callback"
+        PURPOSE = "add_auth.apple-form-post.v1"
+
+        def self.remember!(session:, transaction:, browser_secret:, configuration_id:, purpose:, remember: false)
+          raise ArgumentError, "Apple provider transaction is invalid" unless text?(transaction)
+          raise ArgumentError, "Apple provider browser secret is invalid" unless text?(browser_secret)
+          raise ArgumentError, "Apple provider configuration is invalid" unless text?(configuration_id)
+          raise ArgumentError, "Apple provider purpose is invalid" unless text?(purpose.to_s)
+
+          session[PENDING_KEY] = {"transaction" => transaction, "browser_secret" => browser_secret,
+                                  "configuration_id" => configuration_id, "purpose" => purpose.to_s, "remember" => remember == true}
+        end
+
+        def self.text?(value)
+          value.is_a?(String) && value.valid_encoding? && value.bytesize.between?(1, 2048) && !value.match?(/[\x00-\x1f\x7f]/)
+        end
+        private_class_method :text?
+
+        def initialize(app, key:, lifetime: 600, clock: -> { Time.now })
+          raise ArgumentError, "Apple callback key must be 32 bytes" unless key.is_a?(String) && key.bytesize == 32
+          raise ArgumentError, "Apple callback lifetime must be positive" unless lifetime.is_a?(Integer) && lifetime.positive?
+
+          @app = app
+          @cipher = ActiveSupport::MessageEncryptor.new(key, cipher: "aes-256-gcm", serializer: :json)
+          @lifetime, @clock = lifetime, clock
+        end
+
+        def call(env)
+          request = Rack::Request.new(env)
+          return request.post? ? start(env) : @app.call(env) if request.path_info == START_PATH
+          return callback(env, request) if request.path_info == CALLBACK_PATH
+
+          @app.call(env)
+        end
+
+        private
+
+        def start(env)
+          pending = env.fetch("rack.session", {}).delete(PENDING_KEY)
+          return @app.call(env) if pending.nil?
+          return failure unless pending.is_a?(Hash) && valid_pending?(pending)
+
+          status, headers, body = @app.call(env)
+          return [status, headers, body] unless status.between?(300, 399)
+
+          payload = pending.merge("state" => env.fetch("rack.session", {})["omniauth.state"],
+            "nonce" => env.fetch("rack.session", {})["omniauth.nonce"])
+          return [status, headers, body] unless valid_payload?(payload)
+
+          write_cookie(headers, encrypt(payload))
+          [status, headers, body]
+        end
+
+        def callback(env, request)
+          # Do not claim a host-owned Apple callback without our capsule. A
+          # request reaching AddAuth's controller still needs valid correlation.
+          return @app.call(env) unless request.cookies.key?(COOKIE)
+          payload = decrypt(request.cookies[COOKIE])
+          return failure unless valid_payload?(payload)
+
+          session = env.fetch("rack.session", {})
+          session["omniauth.state"] = payload.fetch("state")
+          session["omniauth.nonce"] = payload.fetch("nonce")
+          env["add_auth.apple_correlation"] = payload.slice("transaction", "browser_secret", "configuration_id", "purpose", "remember")
+          status, headers, body = @app.call(env)
+          clear_cookie(headers)
+          [status, headers, body]
+        end
+
+        def valid_pending?(payload)
+          self.class.send(:text?, payload["transaction"]) && self.class.send(:text?, payload["browser_secret"]) &&
+            self.class.send(:text?, payload["configuration_id"]) && self.class.send(:text?, payload["purpose"]) &&
+            [true, false].include?(payload["remember"])
+        end
+
+        def valid_payload?(payload)
+          payload.is_a?(Hash) && valid_pending?(payload) && self.class.send(:text?, payload["state"]) && self.class.send(:text?, payload["nonce"])
+        end
+
+        def encrypt(payload)
+          @cipher.encrypt_and_sign(payload, purpose: PURPOSE, expires_in: @lifetime)
+        end
+
+        def decrypt(value)
+          return unless self.class.send(:text?, value)
+
+          @cipher.decrypt_and_verify(value, purpose: PURPOSE)
+        rescue ActiveSupport::MessageEncryptor::InvalidMessage
+          nil
+        end
+
+        def write_cookie(headers, value)
+          Rack::Utils.set_cookie_header!(headers, COOKIE, value: value, path: CALLBACK_PATH, secure: true,
+            httponly: true, same_site: :none, max_age: @lifetime)
+        end
+
+        def clear_cookie(headers)
+          Rack::Utils.set_cookie_header!(headers, COOKIE, value: "", path: CALLBACK_PATH, secure: true,
+            httponly: true, same_site: :none, max_age: 0)
+        end
+
+        def failure
+          [422, {"content-type" => "text/plain", "cache-control" => "no-store"}, ["Provider sign-in could not be verified."]]
+        end
+      end
+    end
+  end
+end

data/lib/add_auth/rails/provider_libraries/apple_jwks.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "json"
+
+module AddAuth
+  module Rails
+    module ProviderLibraries
+      class AppleJwks
+        URL = URI("https://appleid.apple.com/auth/keys").freeze
+        CACHE_KEY = "add_auth:apple:jwks:v1"
+        MAX_BYTES = 65_536
+
+        def initialize(cache:)
+          @cache = cache
+        end
+
+        # ruby-jwt's key finder requests one invalidation on an unknown kid.
+        # No request/header claim selects a URL or changes TLS verification.
+        def call(options = {})
+          cached = cache_operation { @cache.read(CACHE_KEY) } unless options[:invalidate]
+          return cached if valid?(cached)
+          keys = fetch
+          cache_operation { @cache.write(CACHE_KEY, keys, expires_in: 3600) }
+          keys
+        end
+
+        private
+
+        def cache_operation
+          yield
+        rescue
+          raise AddAuth::Error, "Apple signing keys unavailable", cause: nil
+        end
+
+        def fetch
+          body = +""
+          Timeout.timeout(5) do
+            Net::HTTP.start(URL.host, URL.port, use_ssl: true, open_timeout: 2, read_timeout: 3, write_timeout: 3) do |http|
+              http.max_retries = 0
+              http.request(Net::HTTP::Get.new(URL.request_uri)) do |response|
+                raise AddAuth::Error, "Apple signing keys unavailable" unless response.code == "200"
+                response.read_body do |part|
+                  raise AddAuth::Error, "Apple signing keys unavailable" if body.bytesize + part.bytesize > MAX_BYTES
+                  body << part
+                end
+              end
+            end
+          end
+          keys = JSON.parse(body)
+          raise AddAuth::Error, "Apple signing keys unavailable" unless valid?(keys)
+          keys
+        rescue JSON::ParserError, Timeout::Error, SocketError, SystemCallError, IOError, OpenSSL::SSL::SSLError
+          raise AddAuth::Error, "Apple signing keys unavailable", cause: nil
+        end
+
+        def valid?(value)
+          value.is_a?(Hash) && value["keys"].is_a?(Array) && value["keys"].size.between?(1, 16) &&
+            value["keys"].all? { |key|
+              key.is_a?(Hash) && key["kty"] == "RSA" && key["alg"] == "RS256" &&
+                key["kid"].is_a?(String) && key["kid"].bytesize.between?(1, 128) && key["n"].is_a?(String) && key["n"].bytesize.between?(1, 1024) &&
+                key["e"].is_a?(String) && key["e"].bytesize.between?(1, 16)
+            } && value["keys"].map { |key| key["kid"] }.uniq.length == value["keys"].length
+        end
+      end
+    end
+  end
+end

data/lib/add_auth/rails/provider_libraries/apple_native.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+# Optional adapter: the host installs and requires ruby-jwt. No OAuth strategy,
+# global library setting or provider credential storage is introduced.
+module AddAuth
+  module Rails
+    module ProviderLibraries
+      module AppleNative
+        ISSUER = "https://appleid.apple.com"
+        PURPOSES = [Core::ExternalIdentities::NATIVE, Core::ExternalIdentities::NATIVE_ENROLL].freeze
+
+        class CallbackResult
+          def self.capture(identity_token:, pending:, nonce:, jwks:)
+            return unless defined?(::JWT) && pending.is_a?(Core::ExternalIdentities::Pending) &&
+              PURPOSES.include?(pending.purpose) && pending.configuration.issuer == ISSUER &&
+              identity_token.is_a?(String) && identity_token.bytesize.between?(1, 16_384) && nonce.is_a?(String)
+            claims, = ::JWT.decode(identity_token, nil, true, algorithms: ["RS256"], jwks: jwks, allow_nil_kid: false,
+              iss: ISSUER, verify_iss: true, aud: pending.configuration.audience, verify_aud: true, verify_iat: true,
+              required_claims: %w[iss aud sub exp iat nonce])
+            signed_nonce = claims["nonce"]
+            return unless signed_nonce.is_a?(String) && signed_nonce.bytesize == nonce.bytesize &&
+              OpenSSL.fixed_length_secure_compare(signed_nonce, nonce) && claims["iat"].is_a?(Integer) && claims["exp"].is_a?(Integer) &&
+              claims["iat"] >= pending.issued_at.to_i && claims["aud"] == pending.configuration.audience
+            new(pending: pending, subject: claims["sub"])
+          rescue ::JWT::DecodeError, ArgumentError
+            nil
+          end
+
+          def initialize(pending:, subject:)
+            @transaction_id = pending.id
+            @configuration = pending.configuration
+            @purpose = pending.purpose
+            @subject = Core::ExternalIdentities::Configuration.text(subject)
+            freeze
+          end
+          private_class_method :new
+
+          def verified_claims(transaction:)
+            return unless transaction.is_a?(Core::ExternalIdentities::Pending) && transaction.id == @transaction_id &&
+              transaction.configuration.equal?(@configuration) && transaction.purpose == @purpose
+            {issuer: ISSUER, audience: @configuration.audience, subject: @subject, provenance: "ruby-jwt/apple-native-v1"}
+          end
+
+          def inspect = "#<AddAuth::Rails::ProviderLibraries::AppleNative::CallbackResult [FILTERED]>"
+        end
+
+        class Verifier
+          def call(server_result:, transaction:)
+            server_result.verified_claims(transaction: transaction) if server_result.is_a?(CallbackResult)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/add_auth/rails/provider_libraries/callback_route.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module AddAuth
+  module Rails
+    module ProviderLibraries
+      # Routing selects only host-registered AddAuth providers. Authentication
+      # and transaction ownership are checked later by the library and Core.
+      class CallbackRoute
+        def self.matches?(request)
+          options = AddAuth.configuration.external_identities
+          options.enabled && options.providers.any? { |provider| provider.middleware_name == request.path_parameters[:provider] }
+        end
+      end
+    end
+  end
+end

data/lib/add_auth/rails/provider_libraries/omniauth.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+# This adapter deliberately has no `require "omniauth"`: provider gems remain
+# host-selected optional dependencies. It accepts only the in-process Rack
+# callback product that OmniAuth installs after a strategy completes. It never
+# accepts HTTP parameters or an auth hash supplied by a controller.
+module AddAuth
+  module Rails
+    module ProviderLibraries
+      module OmniAuth
+        # An immutable, allowlisted projection of an OmniAuth callback. The raw
+        # auth hash can include OAuth credentials and profile data, so this
+        # object intentionally exposes neither. A configured Verifier maps only
+        # the identity claims it needs into Core's trusted verifier contract.
+        class CallbackResult
+          attr_reader :provider, :strategy_class
+
+          def self.capture(env:, provider:)
+            return unless env.respond_to?(:[])
+
+            strategy = env["omniauth.strategy"]
+            auth = env["omniauth.auth"]
+            return unless defined?(::OmniAuth::Strategy) && strategy.is_a?(::OmniAuth::Strategy)
+            return unless defined?(::OmniAuth::AuthHash) && auth.is_a?(::OmniAuth::AuthHash)
+            return unless strategy.name.to_s == provider.to_s && auth.provider.to_s == provider.to_s
+
+            new(provider: provider.to_s, strategy_class: strategy.class.name, auth: auth)
+          end
+
+          def initialize(provider:, strategy_class:, auth:)
+            @provider = provider.dup.freeze
+            @strategy_class = strategy_class.dup.freeze
+            @auth = auth
+            freeze
+          end
+          private_class_method :new
+
+          # A mapping is declared in trusted server configuration, rather than
+          # selected by a request. Its paths are evaluated against the Rack
+          # result before this object crosses into Core.
+          def values(mapping)
+            mapping.transform_values { |path| read(path) }
+          end
+
+          def inspect = "#<AddAuth::Rails::ProviderLibraries::OmniAuth::CallbackResult [FILTERED]>"
+
+          private
+
+          def read(path)
+            Array(path).reduce(@auth) do |value, key|
+              if value.respond_to?(:[])
+                value[key] || value[key.to_s] || value[key.to_sym]
+              end
+            end
+          rescue NoMethodError
+            nil
+          end
+        end
+
+        # Builds the callable supplied to
+        # Core::ExternalIdentities::Configuration#verifier. It binds that
+        # configuration to one OmniAuth strategy and one static claim map. The
+        # provider strategy remains responsible for authorization-code exchange,
+        # JWKS/signature validation, state and nonce verification; this adapter
+        # only prevents an HTTP parameter/raw profile from impersonating that
+        # completed strategy result.
+        class Verifier
+          DEFAULT_MAPPING = {
+            issuer: %i[extra id_info iss],
+            audience: %i[extra id_info aud],
+            subject: %i[extra id_info sub],
+            authenticated_at: %i[extra id_info auth_time]
+          }.freeze
+
+          def initialize(provider:, provenance:, mapping: DEFAULT_MAPPING)
+            @provider = text(provider.to_s)
+            @provenance = text(provenance)
+            @mapping = normalize_mapping(mapping)
+            freeze
+          end
+
+          def call(server_result:, transaction:)
+            return unless server_result.is_a?(CallbackResult) && server_result.provider == @provider
+            return unless transaction.respond_to?(:id)
+
+            claims = server_result.values(@mapping)
+            issuer, audience, subject = claims.values_at(:issuer, :audience, :subject)
+            return unless [issuer, audience, subject].all? { |value| valid_text?(value) }
+            return unless subject == server_result.values(subject: :uid).fetch(:subject)
+
+            authenticated_at = time(claims[:authenticated_at])
+            return if claims[:authenticated_at] && !authenticated_at
+
+            {issuer: issuer, audience: audience, subject: subject, provenance: @provenance,
+             authenticated_at: authenticated_at}
+          end
+
+          private
+
+          def normalize_mapping(mapping)
+            required = %i[issuer audience subject]
+            raise ArgumentError, "provider claim mapping must contain issuer, audience and subject" unless mapping.is_a?(Hash) &&
+              (required - mapping.keys.map(&:to_sym)).empty?
+
+            mapping.to_h.transform_keys(&:to_sym).transform_values do |path|
+              parts = Array(path)
+              raise ArgumentError, "provider claim paths must be nonempty" if parts.empty? || parts.any? { |part| !part.is_a?(String) && !part.is_a?(Symbol) }
+
+              parts.map(&:to_sym).freeze
+            end.freeze
+          end
+
+          def text(value)
+            raise ArgumentError, "invalid provider verifier value" unless valid_text?(value)
+
+            value.dup.freeze
+          end
+
+          def valid_text?(value)
+            value.is_a?(String) && value.valid_encoding? && value.bytesize.between?(1, 2048) && !value.match?(/[\x00-\x1f\x7f]/)
+          end
+
+          def time(value)
+            return value if value.is_a?(Time)
+            return unless value.is_a?(Integer) || value.is_a?(Float)
+            return if value.is_a?(Float) && !value.finite?
+
+            Time.at(value).utc
+          rescue ArgumentError, RangeError
+            nil
+          end
+        end
+      end
+    end
+  end
+end

data/lib/add_auth/rails/provider_libraries/omniauth_correlation.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+require "rack/request"
+
+module AddAuth
+  module Rails
+    module ProviderLibraries
+      # Correlates the Core one-use transaction with OmniAuth's already-CSRF-
+      # protected state value. It stores only opaque Core data in the ordinary
+      # application session; OAuth tokens, profile data, and claims never enter
+      # this boundary. Apple form_post needs its own cookie transport because
+      # its cross-site callback deliberately lacks this session.
+      class OmniAuthCorrelation
+        PENDING_KEY = "add_auth.provider_pending"
+        CORRELATIONS_KEY = "add_auth.provider_correlations"
+        ENV_KEY = "add_auth.provider_correlation"
+
+        def self.remember!(session:, provider:, transaction:, browser_secret:, configuration_id:, purpose:, remember: false)
+          payload = {"provider" => provider.to_s, "transaction" => transaction, "browser_secret" => browser_secret,
+                     "configuration_id" => configuration_id, "purpose" => purpose.to_s, "remember" => remember == true}
+          raise ArgumentError, "provider transaction correlation is invalid" unless valid_payload?(payload)
+
+          session[PENDING_KEY] ||= {}
+          raise ArgumentError, "provider transaction correlation is invalid" unless session[PENDING_KEY].is_a?(Hash)
+
+          session[PENDING_KEY][payload.fetch("provider")] = payload
+        end
+
+        def self.valid_payload?(payload)
+          payload.is_a?(Hash) && %w[provider transaction browser_secret configuration_id purpose].all? { |key| text?(payload[key]) } &&
+            [true, false].include?(payload["remember"])
+        end
+
+        def self.text?(value)
+          value.is_a?(String) && value.valid_encoding? && value.bytesize.between?(1, 2048) && !value.match?(/[\x00-\x1f\x7f]/)
+        end
+        private_class_method :text?, :valid_payload?
+
+        def initialize(app, providers:, lifetime: 600, clock: -> { Time.now })
+          raise ArgumentError, "provider correlation lifetime is invalid" unless lifetime.is_a?(Integer) && lifetime.between?(1, 600)
+          raise ArgumentError, "provider correlation providers are invalid" unless providers.is_a?(Array) && providers.all? { |name| self.class.send(:text?, name.to_s) }
+
+          @app, @providers, @lifetime, @clock = app, providers.map(&:to_s).freeze, lifetime, clock
+        end
+
+        def call(env)
+          request = Rack::Request.new(env)
+          provider = provider_for(request.path_info)
+          return @app.call(env) unless provider
+
+          return request.post? ? start(env, provider) : @app.call(env) if request.path_info == "/auth/#{provider}"
+          callback(env, request, provider)
+        end
+
+        private
+
+        def provider_for(path)
+          @providers.find { |provider| ["/auth/#{provider}", "/auth/#{provider}/callback"].include?(path) }
+        end
+
+        def start(env, provider)
+          session = env.fetch("rack.session", {})
+          pending = session.fetch(PENDING_KEY, {}).delete(provider)
+          return @app.call(env) if pending.nil?
+          return failure unless self.class.send(:valid_payload?, pending) && pending.fetch("provider") == provider
+
+          status, headers, body = @app.call(env)
+          state = session["omniauth.state"]
+          return [status, headers, body] unless status.between?(300, 399) && self.class.send(:text?, state)
+
+          correlations = session[CORRELATIONS_KEY] ||= {}
+          return failure unless correlations.is_a?(Hash)
+
+          purge!(correlations)
+          correlations[state] = pending.merge("expires_at" => (@clock.call + @lifetime).to_i)
+          [status, headers, body]
+        end
+
+        def callback(env, request, provider)
+          state = request.params["state"]
+          session = env.fetch("rack.session", {})
+          correlations = session.fetch(CORRELATIONS_KEY, {})
+          payload = correlations.delete(state) if self.class.send(:text?, state) && correlations.is_a?(Hash)
+          # A shared OmniAuth stack may serve other host-owned OAuth journeys.
+          # Only attach authority correlation for a transaction we started. The
+          # AddAuth callback controller independently rejects missing correlation.
+          return @app.call(env) if payload.nil?
+          return failure unless self.class.send(:valid_payload?, payload) && payload.fetch("provider") == provider &&
+            payload.fetch("expires_at", 0).is_a?(Integer) && payload.fetch("expires_at") > @clock.call.to_i
+
+          env[ENV_KEY] = payload.slice("transaction", "browser_secret", "configuration_id", "purpose", "remember")
+          @app.call(env)
+        end
+
+        def purge!(correlations)
+          now = @clock.call.to_i
+          correlations.delete_if { |_state, payload| !payload.is_a?(Hash) || payload["expires_at"].to_i <= now }
+          correlations.shift while correlations.size >= 8
+        end
+
+        def failure
+          [422, {"content-type" => "text/plain", "cache-control" => "no-store"}, ["Provider sign-in could not be verified."]]
+        end
+      end
+    end
+  end
+end

data/lib/add_auth/rails/provider_libraries/openid_connect.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+# Optional bridge for a host that uses openid_connect directly rather than
+# OmniAuth. It deliberately accepts an OpenIDConnect::AccessToken obtained by
+# the server-side authorization-code exchange, never `params[:id_token]`.
+module AddAuth
+  module Rails
+    module ProviderLibraries
+      module OpenIdConnect
+        class CallbackResult
+          attr_reader :issuer, :audience, :subject, :authenticated_at, :provenance
+
+          def self.capture(access_token:, verification_key:, issuer:, audience:, nonce:, provenance:)
+            return unless defined?(::OpenIDConnect::AccessToken) && access_token.is_a?(::OpenIDConnect::AccessToken)
+            return unless access_token.id_token.is_a?(String) && !access_token.id_token.empty?
+
+            # `decode` performs JWS verification using the discovery/JWKS key
+            # (or an equivalent pinned verification key); `verify!` performs
+            # the OIDC issuer, audience, expiration and nonce checks. AddAuth
+            # deliberately delegates both operations to openid_connect.
+            token = ::OpenIDConnect::ResponseObject::IdToken.decode(access_token.id_token, verification_key)
+            token.verify!(issuer: issuer, audience: audience, nonce: nonce)
+            new(issuer: token.iss, audience: audience_for(token.aud, audience), subject: token.sub,
+              authenticated_at: token.auth_time && Time.at(token.auth_time).utc, provenance: provenance)
+          rescue
+            nil
+          end
+
+          def initialize(issuer:, audience:, subject:, authenticated_at:, provenance:)
+            @issuer = text(issuer)
+            @audience = text(audience)
+            @subject = text(subject)
+            @authenticated_at = authenticated_at&.dup&.freeze
+            @provenance = text(provenance)
+            freeze
+          end
+          private_class_method :new
+
+          def to_verified_claims(transaction:)
+            return unless transaction.respond_to?(:id)
+
+            {issuer: issuer, audience: audience, subject: subject, authenticated_at: authenticated_at, provenance: provenance}
+          end
+
+          def inspect = "#<AddAuth::Rails::ProviderLibraries::OpenIdConnect::CallbackResult [FILTERED]>"
+
+          def self.audience_for(value, expected)
+            Array(value).find { |candidate| candidate == expected }
+          end
+          private_class_method :audience_for
+
+          def text(value)
+            raise ArgumentError, "invalid verified OIDC claim" unless value.is_a?(String) && value.valid_encoding? &&
+              value.bytesize.between?(1, 2048) && !value.match?(/[\x00-\x1f\x7f]/)
+
+            value.dup.freeze
+          end
+        end
+      end
+    end
+  end
+end