atproto_auth 0.2.2 → 0.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1543cc3c9cf5c099a76a62e75990217400930bfd00f8fa19b53b4bef9c035940
-  data.tar.gz: 294daf80d312117a27d7bcfda8fdb1e48865793736aa3a491bf13f61f73caeaa
+  metadata.gz: 50d239692b4a8497da937e550ef8a83e5e02a24c68e605d770ebaef774c585a7
+  data.tar.gz: 5904cc180dd65f4c50881164afb06b392082e87b6c1e5bd9609d7eabb0d6e057
 SHA512:
-  metadata.gz: 1f58e87d6dddab0421cc3637c166d84468f3b863004e6e22f377a200bb149b4bf51db8bf6b4d5d15161a897bcdee15801352932f7d457b57a53142dc4da42296
-  data.tar.gz: 21ce4544366475e39cce0bc0e52596fbfd9278b32a18c8b30193330f3b9946177c06450c3ddda93d3136bd386e9496279834821b7fec45be5f8c369e015f6ed7
+  metadata.gz: 7605b04694e36a6384210cc2016247f37f4756076d92aaec75e7d6c3788564554a380afad6182aae721c4f175185bbce81eedd15c160102fc9ae5ee150881747
+  data.tar.gz: 8847fb8b7d3fc9476ab9fadd3870c20e9e06cdd309b8649f256c2dd54b991e495662f9331b8a2602a0abecda34fe77283de0a784c4cd42ff47799024c1077e4f

data/examples/confidential_client/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ../..
   specs:
-    atproto_auth (0.2.2)
+    atproto_auth (0.2.3)
       jose (~> 1.2)
       jwt (~> 2.9)
       redis (~> 5.3)

data/lib/atproto_auth/http_client.rb

@@ -94,23 +94,38 @@ module AtprotoAuth
       unless ALLOWED_SCHEMES.include?(uri.scheme)
         raise SSRFError, "URL scheme must be one of: #{ALLOWED_SCHEMES.join(", ")}"
       end
-      raise SSRFError, "URL must include host" unless uri.host
+
+      # Extract and validate host before any network activity
+      host = uri.host.to_s.strip
+      raise SSRFError, "URL must include host" if host.empty?
       raise SSRFError, "URL must not include fragment" if uri.fragment
 
       uri
     end
 
     def validate_ip!(uri)
-      ip = resolve_ip(uri.host)
-      return unless forbidden_ip?(ip)
-
-      raise SSRFError, "Request to forbidden IP address"
-    end
+      # Check if host is an IP address by trying to parse it
+      if uri.host =~ /^(\d{1,3}\.){3}\d{1,3}$/
+        begin
+          ip = IPAddr.new(uri.host)
+          raise SSRFError, "Request to forbidden IP address" if forbidden_ip?(ip)
+        rescue IPAddr::InvalidAddressError
+          # Not a valid IP, will be handled as hostname below
+        end
+      end
 
-    def resolve_ip(hostname)
-      IPAddr.new(Addrinfo.ip(hostname).ip_address)
-    rescue SocketError => e
-      raise SSRFError, "Failed to resolve hostname: #{e.message}"
+      # Also check resolved IPs for hostnames
+      begin
+        ips = Resolv::DNS.new.getaddresses(uri.host)
+        ips.each do |x|
+          ip_addr = IPAddr.new(x.to_s)
+          raise SSRFError, "Request to forbidden IP address" if forbidden_ip?(ip_addr)
+        rescue IPAddr::InvalidAddressError
+          next
+        end
+      rescue Resolv::ResolvError
+        raise SSRFError, "Could not resolve hostname"
+      end
     end
 
     def forbidden_ip?(ip)

data/lib/atproto_auth/identity/resolver.rb

@@ -62,7 +62,11 @@ module AtprotoAuth
       # @raise [ValidationError] if verification fails
       def verify_pds_binding(did, pds_url)
         info = get_did_info(did)
-        normalize_url(info[:pds]) == normalize_url(pds_url)
+        if normalize_url(info[:pds]) != normalize_url(pds_url)
+          raise ValidationError, "PDS #{pds_url} is not authorized for DID #{did}"
+        end
+
+        true
       rescue StandardError => e
         raise ValidationError, "Failed to verify PDS binding: #{e.message}"
       end
@@ -82,7 +86,11 @@ module AtprotoAuth
         auth_server_url = resource_server.authorization_servers.first
 
         # Compare normalized URLs
-        normalize_url(auth_server_url) == normalize_url(issuer)
+        if normalize_url(auth_server_url) != normalize_url(issuer)
+          raise ValidationError, "Issuer #{issuer} is not authorized for DID #{did}"
+        end
+
+        true
       rescue StandardError => e
         raise ValidationError, "Failed to verify issuer binding: #{e.message}"
       end
@@ -94,7 +102,13 @@ module AtprotoAuth
       # @raise [ValidationError] if verification fails
       def verify_handle_binding(handle, did)
         info = get_did_info(did)
-        info[:document].has_handle?(handle)
+
+        unless info[:document].has_handle?(handle)
+          raise ValidationError,
+                "Handle #{handle} does not belong to DID #{did}"
+        end
+
+        true
       rescue StandardError => e
         raise ValidationError, "Failed to verify handle binding: #{e.message}"
       end
@@ -137,14 +151,7 @@ module AtprotoAuth
       def extract_domain(handle)
         # Remove @ prefix if present
         handle = handle[1..] if handle.start_with?("@")
-
-        # Handle could be user.domain.com or domain.com format
-        # We just need the domain portion
-        if handle.count(".") == 1
-          handle
-        else
-          handle.split(".", 2)[1]
-        end
+        handle
       end
 
       def fetch_txt_records(domain)

data/lib/atproto_auth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AtprotoAuth
-  VERSION = "0.2.2"
+  VERSION = "0.2.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: atproto_auth
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 0.2.3
 platform: ruby
 authors:
 - Josh Huckabee