atlas-auth 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 80f3e5a3fa6f404e3416096b1315e90babd798263583e3f61a47a33c59bf21b6
-  data.tar.gz: 9f243710f91725c971972e8216e54348dd23009bb60ec0189929b168d7f0775c
+  metadata.gz: 5d81044a8a8e996684c431cc963aa400821b8891b8eba14414b149230d5b7f9a
+  data.tar.gz: 437fbfbf228baacec51ce97db494bd080237d9d2bc96f31e895afa1ce0c78c7e
 SHA512:
-  metadata.gz: 00ed1612a4c79bc241ec64c2d1a9d49cd637292c1da84baaf8efbb480ed1afcf344f1ad556aca5825a0ddb629da8f6ad095f1dc6fa90f1303e710ad79c23f4c7
-  data.tar.gz: 4e11a62f2eb27a06a15f8512d4d0a9bc85083fc7cdbf058754113b1112affb1be4dc37345c494625cb514ab57a48cd9bd01782b1178e77c13a973ad87c96e3af
+  metadata.gz: b233a0b594a57f68abcb5722d22ec4685fb2436c65c033e8dd083b1f28a4c222eb67579fa61b812a366200b2d5f8928bf017bafe00911e0885f2ed049af6ee03
+  data.tar.gz: aac3d1478f65863e359c4bbeeedafcaeabfc4c0afa0e5164f26d0b99a0e924789ece9b42a5ad28ae8a59ea751fe595ffeb9142f4631d1e6ac7bc9987a570ba6d

data/lib/atlas/rails/controller.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Atlas
+  module Rails
+    # Controller mix-in exposing the request's Atlas session.
+    #
+    # The {Atlas::Rails::Middleware} has already verified the token by the time
+    # an action runs, so these helpers only read +env["atlas.auth"]+ — they
+    # never touch crypto.
+    #
+    #   class ApplicationController < ActionController::Base
+    #     include Atlas::Rails::Controller
+    #   end
+    #
+    #   class BillingController < ApplicationController
+    #     before_action :require_atlas_auth!
+    #     before_action -> { atlas_authorize!(permission: "org:billing:manage") }
+    #
+    #     def show
+    #       render json: { user: current_atlas_user_id }
+    #     end
+    #   end
+    module Controller
+      extend ActiveSupport::Concern
+
+      # The verified {Atlas::VerifyResult} for this request (ok or failed), or a
+      # failure result when the middleware is not in the stack.
+      # @return [Atlas::VerifyResult]
+      def current_atlas_session
+        request.env[Atlas::Rails::Middleware::ENV_KEY] ||
+          Atlas::VerifyResult.failure(:invalid)
+      end
+
+      # The verified claims hash (string-keyed), or nil when unauthenticated.
+      # @return [Hash, nil]
+      def current_atlas_claims
+        session = current_atlas_session
+        session.ok? ? session.claims : nil
+      end
+
+      # The authenticated user id (+sub+), or nil.
+      # @return [String, nil]
+      def current_atlas_user_id
+        current_atlas_claims&.fetch("sub", nil)
+      end
+
+      # True when this request carries a valid Atlas session.
+      def atlas_authenticated?
+        current_atlas_session.ok?
+      end
+
+      # +before_action+ guard: render 401 and halt unless authenticated.
+      def require_atlas_auth!
+        return true if atlas_authenticated?
+
+        render_atlas_unauthorized
+        false
+      end
+
+      # +before_action+ guard for a specific authorization condition, e.g.
+      # +atlas_authorize!(permission: "org:billing:manage")+. Renders 401 when
+      # unauthenticated and 403 when authenticated but not permitted. Accepts the
+      # same conditions as {Atlas::VerifyResult#has?}
+      # (+:permission+, +:role+, +:any_permission+, +:all_permissions+).
+      def atlas_authorize!(**condition)
+        unless atlas_authenticated?
+          render_atlas_unauthorized
+          return false
+        end
+
+        unless current_atlas_session.has?(condition)
+          render_atlas_forbidden
+          return false
+        end
+
+        true
+      end
+
+      private
+
+      def render_atlas_unauthorized
+        render json: {
+          errors: [{ "code" => "UNAUTHENTICATED", "message" => "Authentication required." }],
+        }, status: :unauthorized
+      end
+
+      def render_atlas_forbidden
+        render json: {
+          errors: [{ "code" => "FORBIDDEN", "message" => "You do not have permission to do that." }],
+        }, status: :forbidden
+      end
+    end
+  end
+end

data/lib/atlas/rails/middleware.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module Atlas
+  module Rails
+    # Rack middleware that authenticates every request and never blocks one.
+    #
+    # It reads the session JWT from the +Authorization: Bearer+ header (which
+    # wins) or the +__session+ cookie, verifies it through the gem's
+    # {Atlas::Backend}, and leaves the {Atlas::VerifyResult} at
+    # +env["atlas.auth"]+. Whether the token is present, absent or bad, the
+    # request passes through — enforcement is the controller's job
+    # ({Atlas::Rails::Controller#require_atlas_auth!}), so a public action and a
+    # protected one can share the same stack.
+    class Middleware
+      # The Rack env key the verified result is stashed under.
+      ENV_KEY = "atlas.auth"
+
+      # @param app [#call] the next Rack app.
+      # @param backend [Atlas::Backend, nil] an explicit verifier; when nil the
+      #   shared {Atlas.configuration} backend is used (and built lazily).
+      # @param configuration [Atlas::Configuration, nil] an explicit config.
+      def initialize(app, backend: nil, configuration: nil)
+        @app = app
+        @backend = backend
+        @configuration = configuration
+      end
+
+      def call(env)
+        env[ENV_KEY] = authenticate(env)
+        @app.call(env)
+      end
+
+      private
+
+      # Always returns a {Atlas::VerifyResult}, never raises. A missing or
+      # unconfigured backend degrades to "unauthenticated", never a 500.
+      def authenticate(env)
+        verifier = backend
+        return Atlas::VerifyResult.failure(:invalid) if verifier.nil?
+
+        verifier.authenticate_request(
+          "authorization" => env["HTTP_AUTHORIZATION"],
+          "cookie" => env["HTTP_COOKIE"],
+        )
+      rescue StandardError
+        Atlas::VerifyResult.failure(:invalid)
+      end
+
+      def backend
+        @backend ||= (@configuration || Atlas.configuration).backend
+      rescue Atlas::ConfigurationError
+        nil
+      end
+    end
+  end
+end

data/lib/atlas/rails/railtie.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+# Defined only inside a Rails app. Requiring "atlas/rails" from a plain Ruby
+# process (no Rails loaded) leaves this a no-op — the Railtie never comes into
+# being, so nothing tries to touch a middleware stack that isn't there.
+if defined?(::Rails::Railtie)
+  module Atlas
+    module Rails
+      # Wires the integration into the host Rails app with no manual steps:
+      # inserts the auth middleware and mixes the controller helpers into every
+      # controller once ActionController loads.
+      class Railtie < ::Rails::Railtie
+        initializer "atlas.middleware" do |app|
+          app.middleware.use Atlas::Rails::Middleware
+        end
+
+        initializer "atlas.controller" do
+          ActiveSupport.on_load(:action_controller) do
+            include Atlas::Rails::Controller
+          end
+        end
+      end
+    end
+  end
+end

data/lib/atlas/rails.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+require_relative "../atlas"
+
+# atlas-auth — Rails-native integration.
+#
+# This file is loaded ONLY when you ask for it:
+#
+#   # Gemfile
+#   gem "atlas-auth", require: "atlas/rails"
+#
+# Requiring the base gem (+require "atlas"+) never pulls Rails in, so the SDK
+# stays usable in a plain Ruby or non-Rails service. Loading this file in a
+# Rails app registers {Atlas::Rails::Railtie}, which:
+#
+#   * inserts {Atlas::Rails::Middleware} — it verifies the session JWT carried by
+#     the +Authorization: Bearer+ header (or the +__session+ cookie) and stashes
+#     the {Atlas::VerifyResult} in +env["atlas.auth"]+, and
+#   * mixes {Atlas::Rails::Controller} into every controller, giving you
+#     +current_atlas_session+, +current_atlas_user_id+, +atlas_authenticated?+,
+#     +require_atlas_auth!+ and +atlas_authorize!+.
+#
+# All verification is delegated to the gem's existing {Atlas::Backend} — this
+# layer adds no crypto of its own. Configure it once:
+#
+#   Atlas.configure do |c|
+#     c.jwks_url = "https://your-instance.atlasauth.net/v1/jwks"
+#     c.issuer   = "https://your-instance.atlasauth.net"
+#     c.secret_key = Rails.application.credentials.dig(:atlas, :secret_key)
+#   end
+#
+# or leave it unset and let it read +ATLAS_JWKS_URL+ / +ATLAS_ISSUER+ /
+# +ATLAS_SECRET_KEY+ from the environment or Rails credentials (+atlas:+).
+module Atlas
+  # Process-wide configuration for the Rails integration. A single
+  # {Atlas::Backend} is built from it, lazily, and reused across requests
+  # (its JWKS cache is the whole point of keeping one instance).
+  class Configuration
+    # @return [String, nil] the instance JWKS URL (+ATLAS_JWKS_URL+).
+    attr_accessor :jwks_url
+    # @return [String, nil] expected +iss+ (+ATLAS_ISSUER+).
+    attr_accessor :issuer
+    # @return [String, nil] +sk_+ key, only needed for +verify_online+ (+ATLAS_SECRET_KEY+).
+    attr_accessor :secret_key
+    # @return [String, nil] BAPI base URL, only needed for +verify_online+.
+    attr_accessor :bapi_base_url
+    # @return [Array<String>, nil] optional +azp+ allowlist.
+    attr_accessor :authorized_parties
+
+    def initialize
+      @jwks_url           = resolve("ATLAS_JWKS_URL", :jwks_url)
+      @issuer             = resolve("ATLAS_ISSUER", :issuer)
+      @secret_key         = resolve("ATLAS_SECRET_KEY", :secret_key)
+      @bapi_base_url      = resolve("ATLAS_BAPI_BASE_URL", :bapi_base_url)
+      @authorized_parties = nil
+      @backend            = nil
+    end
+
+    # True once the minimum needed for local verification is present.
+    def configured?
+      !blank?(jwks_url) && !blank?(issuer)
+    end
+
+    # The shared, memoized verifier. Raises {Atlas::ConfigurationError} rather
+    # than silently building a backend that can never verify anything.
+    # @return [Atlas::Backend]
+    def backend
+      unless configured?
+        raise Atlas::ConfigurationError,
+              "Atlas Rails integration needs jwks_url and issuer. Set them via " \
+              "Atlas.configure, or ATLAS_JWKS_URL / ATLAS_ISSUER (env or Rails " \
+              "credentials under `atlas:`)."
+      end
+
+      @backend ||= Atlas::Backend.new(
+        jwks_url: jwks_url,
+        issuer: issuer,
+        authorized_parties: authorized_parties,
+        secret_key: secret_key,
+        bapi_base_url: bapi_base_url,
+      )
+    end
+
+    # Drop the memoized backend so the next request rebuilds it. Called after
+    # {Atlas.configure} so edited values (and a fresh JWKS cache) take effect.
+    def reset_backend!
+      @backend = nil
+    end
+
+    private
+
+    def blank?(value)
+      value.nil? || (value.respond_to?(:empty?) && value.empty?)
+    end
+
+    # ENV first, then Rails credentials under the +atlas:+ namespace.
+    def resolve(env_key, cred_key)
+      value = ENV[env_key]
+      return value unless blank?(value)
+
+      rails_credential(cred_key)
+    end
+
+    def rails_credential(key)
+      return nil unless defined?(::Rails) && ::Rails.respond_to?(:application) && ::Rails.application
+
+      atlas = ::Rails.application.credentials.respond_to?(:atlas) ? ::Rails.application.credentials.atlas : nil
+      return nil if atlas.nil?
+
+      atlas.respond_to?(:[]) ? (atlas[key] || atlas[key.to_s]) : nil
+    rescue StandardError
+      nil
+    end
+  end
+
+  class << self
+    # The current {Atlas::Configuration}, created on first use.
+    def configuration
+      @configuration ||= Configuration.new
+    end
+
+    # Configure the Rails integration.
+    #
+    #   Atlas.configure do |c|
+    #     c.jwks_url = "https://your-instance.atlasauth.net/v1/jwks"
+    #     c.issuer   = "https://your-instance.atlasauth.net"
+    #   end
+    #
+    # @yieldparam config [Atlas::Configuration]
+    # @return [Atlas::Configuration]
+    def configure
+      yield(configuration) if block_given?
+      configuration.reset_backend!
+      configuration
+    end
+
+    # Forget all configuration. Primarily for tests.
+    def reset_configuration!
+      @configuration = nil
+    end
+  end
+end
+
+require_relative "rails/middleware"
+require_relative "rails/controller"
+require_relative "rails/railtie"

data/lib/atlas/version.rb

@@ -2,5 +2,5 @@
 
 module Atlas
   # The gem version. Tracks the TypeScript/Python backend SDK line.
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: atlas-auth
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Atlas
@@ -51,6 +51,34 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '13.0'
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '6.1'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '6.1'
+- !ruby/object:Gem::Dependency
+  name: rack-test
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.1'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.1'
 description: |
   A typed Ruby client over the Atlas Backend API (BAPI), the Ruby peer of the
   TypeScript @atlasauth/backend and Python atlas-backend SDKs. Covers the full
@@ -72,6 +100,10 @@ files:
 - lib/atlas/handshake.rb
 - lib/atlas/jwks_cache.rb
 - lib/atlas/pagination.rb
+- lib/atlas/rails.rb
+- lib/atlas/rails/controller.rb
+- lib/atlas/rails/middleware.rb
+- lib/atlas/rails/railtie.rb
 - lib/atlas/resources/actions.rb
 - lib/atlas/resources/actor_tokens.rb
 - lib/atlas/resources/api_keys.rb
@@ -124,7 +156,7 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://atlasauth.net
-  source_code_uri: https://github.com/atlas-auth/atlas-ruby
+  source_code_uri: https://github.com/alphajew420/ssoly/tree/main/sdks/ruby
   documentation_uri: https://atlasauth.net/docs/sdks/ruby
   rubygems_mfa_required: 'true'
 rdoc_options: []