apple_id 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e000f6003a2baeecbb6683a9636b311cac3eec9ec20df988f79f0bbd50231135
-  data.tar.gz: e4890bdb603981bcd9d4489915e607029490c221210816315f96dd3d6fccfd9d
+  metadata.gz: d5d84152da940b14a875e1e927bf5660b3b7a625ca3f84e5f9c5e4e8f0815ae2
+  data.tar.gz: 1d8cfa5bf964c5bf482e327a8f205c6e46b54c836622ce4bf4391a399d11d061
 SHA512:
-  metadata.gz: 1bb4b14f28e1906cf6517e2382422a5dd44c864479ea550bf2ad54a2758b166ab0464e0e04539f0e2f26c592daae932eba81d4f82f508b0aae2d45f956d1bcce
-  data.tar.gz: 406ae5c6dca6868bfac746b83b3422b1a92876e6f6d75ced236f2b653b88e8d6469ca5544b33afae387d8bca78aa2237608e1557022daff8d3f334667c8e1663
+  metadata.gz: 34ea5191c7f74a974195d6acc31be3684ae5dd6cc325a46771debbbab1bdcd0fc0252669a8ddcb130499a5043363ad63120bdf5a65bbefc9fe1efaef1ac70887
+  data.tar.gz: 1b950617cdfce0691403c63f464c32654a99279ecce7f9587575a5303f61426d6bb39a6a6b88e237e7a406669f79e72da144e70fac464ee067367727c07559ad

data/.travis.yml

@@ -2,6 +2,8 @@
 sudo: false
 language: ruby
 cache: bundler
+before_install: gem install bundler
 rvm:
-  - 2.6.2
-before_install: gem install bundler -v 1.17.2
+  - 2.4.6
+  - 2.5.5
+  - 2.6.2

data/README.md

@@ -2,9 +2,7 @@
 
 "Sign-in with Apple" is an implementation of OpenID Connect with small custom features.
 
-This gem handles such custom features.
-
-Basically, this gem is based on my [OpenID Connect gem](https://github.com/nov/openid_connect) and [OAuth2 gem](https://github.com/nov/rack-oauth2), so the usage is almost same with them.
+This gem handles these Apple custom features.
 
 ## Installation
 
@@ -26,52 +24,9 @@ Or install it yourself as:
 
 There is [a sample rails app](https://github.com/nov/signin-with-apple) running at [signin-with-apple.herokuapp.com](https://signin-with-apple.herokuapp.com).
 
-If you run script in your terminal only, do like below.
+If you run script in your terminal only, [do like this](https://gist.github.com/nov/993a303aa6badd8447f7b96fb952088e).
 
-```ruby
-require 'apple_id'
-
-# NOTE: in debugging mode, you can see all HTTPS request & response in the log.
-# AppleID.debug!
-
-pem = <<-PEM
------BEGIN PRIVATE KEY-----
-  :
-  :
------END PRIVATE KEY-----
-PEM
-private_key = OpenSSL::PKey::EC.new pem
-
-client = AppleID::Client.new(
-  identifier: '<YOUR-CLIENT-ID>',
-  team_id: '<YOUR-TEAM-ID>',
-  key_id: '<YOUR-KEY-ID>',
-  private_key: private_key,
-  redirect_uri: '<YOUR-REDIRECT-URI>'
-)
-
-authorization_uri = client.authorization_uri(scope: [:email, :name])
-puts authorization_uri
-`open "#{authorization_uri}"`
-
-print 'code: ' and STDOUT.flush
-code = gets.chop
-
-client.authorization_code = code
-response = client.access_token!
-
-response.id_token.verify!(
-  client,
-  access_token: response.access_token,
-
-  # NOTE:
-  #  When verifying signature, one http request to Apple's JWKs are required.
-  #  You can skip ID Token signature verification when you got the token directly from the token endpoint in TLS channel.
-  verify_signature: false
-)
-puts response.id_token.sub # => OpenID Connect Subject Identifier (= Apple User ID)
-puts response.id_token.original_jwt.pretty_generate
-```
+For more details, see [AppleID Wiki](https://github.com/nov/apple_id/wiki).
 
 ## Development
 

data/VERSION

@@ -1 +1 @@
-0.1.0
+0.2.0

data/apple_id.gemspec

@@ -19,7 +19,7 @@ Gem::Specification.new do |spec|
   spec.require_paths = ['lib']
 
   spec.add_runtime_dependency 'rack-oauth2', '~> 1.9.3'
-  spec.add_runtime_dependency 'openid_connect', '~> 1.0'
+  spec.add_runtime_dependency 'openid_connect', '~> 1.1.7'
   spec.add_development_dependency 'bundler'
   spec.add_development_dependency 'rake'
   spec.add_development_dependency 'rspec'

data/lib/apple_id/id_token.rb

@@ -4,9 +4,9 @@ module AppleID
 
     alias_method :original_jwt, :raw_attributes
 
-    def verify!(expected_client, access_token: nil, code: nil, verify_signature: true)
+    def verify!(verify_signature: true, client: nil, nonce: nil, state: nil, access_token: nil, code: nil)
       verify_signature! if verify_signature
-      verify_claims! expected_client, access_token, code
+      verify_claims! client, nonce, state, access_token, code
       self
     end
 
@@ -31,14 +31,52 @@ module AppleID
       raise VerificationFailed, 'Signature Verification Failed'
     end
 
-    def verify_claims!(expected_client, access_token, code)
-      # TODO: verify at_hash & c_hash
-      unless (
-        iss == ISSUER &&
-        aud == expected_client.identifier &&
-        Time.now.to_i.between?(iat, exp)
-      )
-        raise VerificationFailed, 'Claims Verification Failed'
+    def verify_claims!(client, nonce, state, access_token, code)
+      aud = if client.respond_to?(:identifier)
+        client.identifier
+      else
+        client
+      end
+
+      hash_length = original_jwt.alg.to_s[2, 3].to_i
+      s_hash = if state.present?
+        left_half_hash_of state, hash_length
+      end
+      at_hash = if access_token.present?
+        left_half_hash_of access_token, hash_length
+      end
+      c_hash = if code.present?
+        left_half_hash_of code, hash_length
+      end
+
+      failure_reasons = []
+      if self.iss != ISSUER
+        failure_reasons << :iss
+      end
+      if aud.present? && self.aud != aud
+        failure_reasons << :aud
+      end
+      if nonce.present? && self.nonce != nonce
+        failure_reasons << :nonce
+      end
+      if s_hash.present? && self.s_hash != s_hash
+        failure_reasons << :s_hash
+      end
+      if at_hash.present? && self.at_hash != at_hash
+        failure_reasons << :at_hash
+      end
+      if c_hash.present? && self.c_hash != c_hash
+        failure_reasons << :c_hash
+      end
+      if Time.now.to_i < iat
+        failure_reasons << :iat
+      end
+      if Time.now.to_i >= exp
+        failure_reasons << :exp
+      end
+
+      if failure_reasons.present?
+        raise VerificationFailed, "Claims Verification Failed at #{failure_reasons}"
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: apple_id
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - nov
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-06-05 00:00:00.000000000 Z
+date: 2019-06-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack-oauth2
@@ -30,14 +30,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: 1.1.7
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: 1.1.7
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement