aha_builder_core 1.0.3 → 1.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3bfa1fb612c68e9997d4058381ef9c4b6b8d7eb61ddcbb52800fac41ace7fcd0
-  data.tar.gz: e673fd8edc82b0ae0f1a7c32ecf82bdd6c8368ebe2b8b626dc4e5d1cf6d6b696
+  metadata.gz: 67c88ef564275000006548bd40149fb9d8c9c6a28d7b9faf430a8dd6b338147c
+  data.tar.gz: 10401cac65cfa9f711640911038c12491acaf73b160f340851becdce92edfbb2
 SHA512:
-  metadata.gz: a2b43eeff2fbea68a9b7b908097ca88bf858504035671808c8dac2716b0621d37219c06f92aaed8d9be7eb6571da665a1f8fed95f52cf02f3d02ba4151c29898
-  data.tar.gz: 927e0f48d3a1d2e4cb492ccefa7cb3bc377468ac7c57b3896abcaaa449a3b85a42cad99392927f0733127b28a7fe612d0f365c55060993b3c545c8c193048606
+  metadata.gz: f8c526217a495e3e9ec239c4d169eb0848f9bcc6f876ba92f02f114a420f0220313e7960ef1a56b1271c0d270f2906480a5524510e988ecda939eca8491e3f10
+  data.tar.gz: 1eb5ccd35517e18df03ea87a2c93b4eadea3152d79023f440ee19c9930f600543085c6c6ab2e45fccbfb3ee0df1a1bd14b0223ca11315e8826e2d655f5df5880

data/README.md

@@ -1,6 +1,6 @@
 # Aha Builder Core Client
 
-Ruby client for Aha! Builder core authentication services.
+Ruby client for Aha! Builder core authentication services which provides login and signup using email/password, social logins (Google, Github, Microsoft), SAML SSO and password reset.
 
 ## Installation
 
@@ -18,6 +18,8 @@ No configuration is necessary and no environment variables are necessary.
 
 The authentication UI is provided completely by the core system. During authentication the user is redirected to the login page, and will return (via HTTP redirect) to the `/callback` URL when authentication is complete. Your application must implement a callback action at `/callback` to receive the code. Any value passed in as `state` is returned verbatim to the callback.
 
+Protection against CSRF atacks is handled internally by the Aha::Auth library and there is no need to use a nonce in the state parameter.
+
 ### Generate Login URL
 
 Redirect users to the authentication and signup UI:

data/lib/aha/auth/version.rb

@@ -2,6 +2,6 @@
 
 module Aha
   module Auth
-    VERSION = "1.0.3"
+    VERSION = "1.0.4"
   end
 end

data/lib/aha/auth.rb

@@ -4,6 +4,8 @@ require "faraday"
 require "faraday/retry"
 require "jwt"
 require "concurrent"
+require "active_support"
+require "active_support/core_ext"
 
 require_relative "auth/version"
 require_relative "auth/errors"
@@ -40,11 +42,28 @@ module Aha
 
       # Generate login URL for redirecting users to the auth server
       #
+      # @param session [Hash] Session hash to store the nonce for CSRF verification
       # @param state [String] Optional state parameter to pass through the auth flow
       # @return [String] The login URL
-      def login_url(state: nil)
-        params = { client_id: configuration.client_id }
-        params[:state] = state if state
+      def login_url(session:, state: nil)
+        # Generate a nonce for CSRF protection
+        nonce = SecureRandom.hex(10)
+
+        # Store nonce in the client's session if provided
+        session[:auth_nonce] = nonce if session
+
+        # Encode the state with nonce
+        state_data = {
+          tunneled_state: state,
+          nonce: nonce,
+        }
+
+        encoded_state = Base64.urlsafe_encode64(state_data.to_json, padding: false)
+
+        params = {
+          client_id: configuration.client_id,
+          state: encoded_state
+        }
 
         query = URI.encode_www_form(params)
         "#{configuration.server_url}/auth_ui/start?#{query}"
@@ -52,10 +71,30 @@ module Aha
 
       # Exchange an authorization code for tokens
       #
-      # @param code [String] The authorization code from the callback
+      # @param code [String] The authorization code from the callback (may include nonce)
+      # @param session [Hash] Session hash containing the nonce for CSRF verification
       # @return [Hash] Token response with :session_token, :refresh_token, :expires_at, :user
-      def authenticate_with_code(code:)
-        client.authenticate_with_code(code: code)
+      def authenticate_with_code(code:, session:)
+        # Split the code and nonce if present
+        actual_code, nonce = code.split(".", 2)
+
+        # Verify CSRF protection if nonce is present
+        if nonce
+          session_nonce = session[:auth_nonce]
+
+          # Verify nonce matches
+          if session_nonce.blank? || session_nonce != nonce
+            raise "CSRF verification failed: nonce mismatch"
+          end
+
+          # Clear the nonce from session after verification
+          session.delete(:auth_nonce)
+        else
+          # If we fon't have a none, we can't verify CSRF.
+          raise "CSRF verification failed: unable to verify nonce"
+        end
+
+        client.authenticate_with_code(code: actual_code)
       end
 
       # Refresh tokens using a refresh token

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aha_builder_core
 version: !ruby/object:Gem::Version
-  version: 1.0.3
+  version: 1.0.4
 platform: ruby
 authors:
 - Aha! Labs Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-01-01 00:00:00.000000000 Z
+date: 2026-01-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport