aha_builder_core 1.0.0 → 1.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7ff589bfc8b84ca502361ec7db8fcd9052a02fcef786d45bdfa8f1463ab2ce92
-  data.tar.gz: 4271e05f6300fda500e3062d1ae8f2ad3ab0227cff5925919d8fd2a97c4b49c1
+  metadata.gz: 3bfa1fb612c68e9997d4058381ef9c4b6b8d7eb61ddcbb52800fac41ace7fcd0
+  data.tar.gz: e673fd8edc82b0ae0f1a7c32ecf82bdd6c8368ebe2b8b626dc4e5d1cf6d6b696
 SHA512:
-  metadata.gz: 3698b01b1e05371f68dd84881ac9ebda989a629def95533db97c6f48bf97803095a43ae7c6c2af6fcf6e5fe5f5700826da0a54780dccbba85860c25d92db12e8
-  data.tar.gz: 227dafe8165fc4562d26761a331bd4f128ec0ba10bdf1a2a8c859f15ee71c8ac95090f457bc772b3db9bede007f253523558294332b34fdd6acfe2fab4d96fd5
+  metadata.gz: a2b43eeff2fbea68a9b7b908097ca88bf858504035671808c8dac2716b0621d37219c06f92aaed8d9be7eb6571da665a1f8fed95f52cf02f3d02ba4151c29898
+  data.tar.gz: 927e0f48d3a1d2e4cb492ccefa7cb3bc377468ac7c57b3896abcaaa449a3b85a42cad99392927f0733127b28a7fe612d0f365c55060993b3c545c8c193048606

data/README.md

@@ -12,20 +12,7 @@ gem "aha_builder_core", path: "engines/builder_core/client"
 
 ## Configuration
 
-The configuration is usually read from the environment automatically so there is no need for custom configuration in most cases.
-
-```ruby
-require "aha_builder_core"
-
-Aha::Auth.configure do |config|
-  config.server_url = "https://secure.aha.io"  # Auth server URL
-  config.client_id = "your-client-id"          # ID of the builder application
-  config.api_key = "your-api-key"              # For server-to-server auth
-  config.jwks_cache_ttl = 3600                 # JWKS cache duration (default: 1 hour)
-  config.refresh_threshold = 120               # Seconds before expiry to refresh (default: 2 min)
-  config.timeout = 30                          # HTTP timeout in seconds
-end
-```
+No configuration is necessary and no environment variables are necessary.
 
 ## Authentication Flow
 
@@ -38,11 +25,12 @@ Redirect users to the authentication and signup UI:
 ```ruby
 url = Aha::Auth.login_url(
   state: { return_to: "/" }.to_json,
-  redirect_uri: "#{ENV['APPLICATION_URL']}/callback"
 )
 redirect_to url
 ```
 
+Redirecting to the login_url must be done with a full page load. It will not work using XHR.
+
 ### Exchange Authorization Code
 
 In the `/callback` action callback, you must exchange the code for a session token and refresh token:
@@ -54,11 +42,11 @@ result = Aha::Auth.authenticate_with_code(code: params[:code])
 #   refresh_token: "...",
 #   expires_at: Time,
 #   user: {
-#     "id" => "user-uuid",
-#     "first_name" => "Jane",
-#     "last_name" => "Doe",
-#     "email" => "jane.doe@example.com",
-#     "email_verified" => true
+#     id: "user-uuid",
+#     first_name: "Jane",
+#     last_name: "Doe",
+#     email: "jane.doe@example.com",
+#     email_verified: true
 #   }
 # }
 ```
@@ -68,8 +56,8 @@ result = Aha::Auth.authenticate_with_code(code: params[:code])
 The `user` object returned contains the authenticated user's profile information from the Builder Core system:
 
 - `id`: The unique identifier for the user in Builder Core
-- `first_name`: User's first name
-- `last_name`: User's last name
+- `first_name`: User's first name. first_name is optional and may not be present.
+- `last_name`: User's last name. last_name is optional and may not be present.
 - `email`: User's email address
 - `email_verified`: Boolean indicating if the email has been verified
 
@@ -86,10 +74,10 @@ local_user = User.find_or_initialize_by(auth_identifier: result[:user]["id"])
 
 # Update local user attributes
 local_user.update!(
-  email: result[:user]["email"],
-  first_name: result[:user]["first_name"],
-  last_name: result[:user]["last_name"],
-  email_verified: result[:user]["email_verified"]
+  email: result[:user][:email],
+  first_name: result[:user][:first_name],
+  last_name: result[:user][:last_name],
+  email_verified: result[:user][:email_verified]
 )
 
 # Store tokens in session or database

data/lib/aha/auth/client.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "active_support/core_ext/hash/indifferent_access"
+
 module Aha
   module Auth
     # HTTP client for communicating with the BuilderCore auth server
@@ -47,14 +49,16 @@ module Aha
       # @param refresh_token [String, nil] Optional refresh token for automatic refresh
       # @return [Session] Session validation result
       def validate_session(session_token, refresh_token: nil)
-        claims = decode_and_verify_token(session_token)
-        return Session.invalid unless claims
+        begin
+          claims = decode_and_verify_token(session_token)
+          return Session.from_claims(claims) if claims
+        rescue ExpiredTokenError 
+          # Token has expired, attempt refresh
+        end
 
-        # Check if token is about to expire and we have a refresh token
-        exp = claims["exp"]
-        if exp && refresh_token && should_refresh?(exp)
+        if refresh_token
           begin
-            tokens = refresh_tokens(refresh_token: refresh_token)
+            tokens = authenticate_with_refresh_token(refresh_token: refresh_token)
             new_claims = decode_and_verify_token(tokens[:session_token])
 
             return Session.from_claims(
@@ -64,13 +68,11 @@ module Aha
               new_refresh_token: tokens[:refresh_token]
             )
           rescue Error
-            puts "Token refresh failed"
-            # Refresh failed, return session with original token if still valid
-            return Session.invalid if Time.at(exp).utc < Time.now.utc
+            return Session.invalid
           end
         end
 
-        Session.from_claims(claims)
+        Session.invalid
       rescue InvalidTokenError, ExpiredTokenError
         Session.invalid
       end
@@ -80,7 +82,7 @@ module Aha
       # @param session_token [String] The session token to revoke
       # @return [Boolean] true if successful
       def logout(session_token:)
-        get("/api/core/auth/logout", headers: { "Authorization" => "Bearer #{session_token}" })
+        get("/api/core/auth_ui/logout", headers: { "Authorization" => "Bearer #{session_token}" })
         true
       rescue ApiError
         false
@@ -90,8 +92,7 @@ module Aha
       #
       # @return [Hash] The JWKS response
       def fetch_jwks
-        response = http_client.get("/api/core/auth/jwks/#{@configuration.client_id}")
-        handle_response(response)
+        get("/api/core/auth/jwks/#{@configuration.client_id}")
       end
 
       private
@@ -125,17 +126,13 @@ module Aha
         raise InvalidTokenError, "Invalid token: #{e.message}"
       end
 
-      def should_refresh?(exp)
-        Time.at(exp).utc - Time.now.utc <= @configuration.refresh_threshold
-      end
-
       def parse_token_response(response)
         {
           session_token: response["session_token"],
           refresh_token: response["refresh_token"],
           expires_at: response["expires_at"] ? Time.iso8601(response["expires_at"]) : nil,
           user: response["user"]
-        }
+        }.with_indifferent_access
       end
 
       def get(path, headers: {})

data/lib/aha/auth/configuration.rb

@@ -22,7 +22,7 @@ module Aha
       attr_accessor :timeout
 
       def initialize
-        @server_url = ENV.fetch("AHA_CORE_SERVER_URL", nil) || "https://secure.aha.io/api/core"
+        @server_url = ENV.fetch("AHA_CORE_SERVER_URL", "https://secure.aha.io/api/core")
         @api_key = ENV.fetch("AHA_CORE_API_KEY", nil)
         @client_id = ENV.fetch("APPLICATION_ID", nil)
         @jwks_cache_ttl = 3600 # 1 hour

data/lib/aha/auth/sessions_resource.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'time'
+
 module Aha
   module Auth
     # API resource for session management operations

data/lib/aha/auth/user.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'time'
+
 module Aha
   module Auth
     # Represents a user from the auth server

data/lib/aha/auth/version.rb

@@ -2,6 +2,6 @@
 
 module Aha
   module Auth
-    VERSION = "1.0.0"
+    VERSION = "1.0.3"
   end
 end

data/lib/aha/auth.rb

@@ -41,15 +41,13 @@ module Aha
       # Generate login URL for redirecting users to the auth server
       #
       # @param state [String] Optional state parameter to pass through the auth flow
-      # @param redirect_uri [String] Optional redirect URI after authentication
       # @return [String] The login URL
-      def login_url(state: nil, redirect_uri: nil)
+      def login_url(state: nil)
         params = { client_id: configuration.client_id }
         params[:state] = state if state
-        params[:redirect_uri] = redirect_uri if redirect_uri
 
         query = URI.encode_www_form(params)
-        "#{configuration.server_url}/auth/start?#{query}"
+        "#{configuration.server_url}/auth_ui/start?#{query}"
       end
 
       # Exchange an authorization code for tokens

metadata

@@ -1,15 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: aha_builder_core
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.3
 platform: ruby
 authors:
 - Aha! Labs Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-12-21 00:00:00.000000000 Z
+date: 2026-01-01 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
   requirement: !ruby/object:Gem::Requirement
@@ -124,7 +138,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.3.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="