atproto_auth 0.2.3 → 0.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 50d239692b4a8497da937e550ef8a83e5e02a24c68e605d770ebaef774c585a7
-  data.tar.gz: 5904cc180dd65f4c50881164afb06b392082e87b6c1e5bd9609d7eabb0d6e057
+  metadata.gz: 50b5434e412dc6bd10dfbf53046cfe060110d050540b6b9750f73b473f75471d
+  data.tar.gz: d0b259b7e8c2508abdcd5a046e55d1f5aa24f40a1a7bd0e43be9378d7f40aefd
 SHA512:
-  metadata.gz: 7605b04694e36a6384210cc2016247f37f4756076d92aaec75e7d6c3788564554a380afad6182aae721c4f175185bbce81eedd15c160102fc9ae5ee150881747
-  data.tar.gz: 8847fb8b7d3fc9476ab9fadd3870c20e9e06cdd309b8649f256c2dd54b991e495662f9331b8a2602a0abecda34fe77283de0a784c4cd42ff47799024c1077e4f
+  metadata.gz: f267e07128db3850494cff1ba08a8678b04a91e6028d43d829eaffcab715a20c57e56b122f116e7ca93814fe4fdf7a16bc7041b1fc09230d8cd325489baa4c4c
+  data.tar.gz: efa4d2dfec732cf68eb1b54e0f753355f06abe07f2b3a4e25ad79e4c2bca75dd43a808d34c11484e4d03ecec509986742f8a546cb6ac4deb21705214f55c66df

data/CHANGELOG.md

@@ -4,7 +4,11 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [0.2.1] - 2024-12-11
+## [0.2.4] - 2024-12-11
+### Fixed
+- Token refresh now correctly handles expired tokens
+
+## [0.2.2] - 2024-12-11
 ### Added
 - Added support for did:web users
 

data/examples/confidential_client/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ../..
   specs:
-    atproto_auth (0.2.3)
+    atproto_auth (0.2.4)
       jose (~> 1.2)
       jwt (~> 2.9)
       redis (~> 5.3)

data/lib/atproto_auth/token/refresh.rb

@@ -120,24 +120,40 @@ module AtprotoAuth
       end
 
       def request_token_refresh
-        # Generate DPoP proof for token request
+        # Initial token request without nonce
+        response = make_token_request(session)
+
+        # Handle DPoP nonce requirement
+        if requires_dpop_nonce?(response)
+          # Extract and store nonce from error response
+          extract_dpop_nonce(response)
+          dpop_client.process_response(response[:headers], auth_server.issuer)
+
+          # Retry request with nonce
+          response = make_token_request(session)
+        end
+
+        handle_refresh_response(response)
+      end
+
+      def make_token_request(session)
+        # Generate proof
         proof = dpop_client.generate_proof(
           http_method: "POST",
           http_uri: auth_server.token_endpoint
         )
 
-        # Build refresh request
         body = {
           grant_type: "refresh_token",
           refresh_token: session.tokens.refresh_token,
-          scope: session.scope
+          scope: session.scope,
+          client_id: client_metadata.client_id
         }
 
         # Add client authentication if available
         add_client_authentication!(body) if client_metadata.confidential?
 
-        # Make request
-        response = AtprotoAuth.configuration.http_client.post(
+        AtprotoAuth.configuration.http_client.post(
           auth_server.token_endpoint,
           body: body,
           headers: {
@@ -145,16 +161,34 @@ module AtprotoAuth
             "DPoP" => proof
           }
         )
+      end
 
-        handle_refresh_response(response)
+      def requires_dpop_nonce?(response)
+        return false unless response[:status] == 400
+
+        error_data = JSON.parse(response[:body])
+        error_data["error"] == "use_dpop_nonce"
+      rescue JSON::ParserError
+        false
+      end
+
+      def extract_dpop_nonce(response)
+        headers = response[:headers]
+        nonce = headers["DPoP-Nonce"] ||
+                headers["dpop-nonce"] ||
+                headers["Dpop-Nonce"]
+
+        raise TokenError, "No DPoP nonce provided in error response" unless nonce
+
+        nonce
       end
 
       def add_client_authentication!(body)
-        return unless session.client_metadata.jwks && !session.client_metadata.jwks["keys"].empty?
+        return unless client_metadata.jwks && !client_metadata.jwks["keys"].empty?
 
-        signing_key = JOSE::JWK.from_map(session.client_metadata.jwks["keys"].first)
+        signing_key = JOSE::JWK.from_map(client_metadata.jwks["keys"].first)
         client_assertion = PAR::ClientAssertion.new(
-          client_id: session.client_metadata.client_id,
+          client_id: client_metadata.client_id,
           signing_key: signing_key
         )
 
@@ -194,25 +228,31 @@ module AtprotoAuth
           sub: data["sub"]
         )
       rescue JSON::ParserError => e
-        raise RefreshError, "Invalid response format: #{e.message}"
+        raise TokenError, "Invalid response format: #{e.message}"
       end
 
       def handle_400_response(response)
         error_data = JSON.parse(response[:body])
         error_description = error_data["error_description"] || error_data["error"]
 
-        # Handle DPoP nonce requirement
-        if error_data["error"] == "use_dpop_nonce"
+        case error_data["error"]
+        when "use_dpop_nonce"
           dpop_client.process_response(response[:headers], auth_server.issuer)
-          raise RefreshError, "Retry with DPoP nonce"
+          raise TokenError.new("Retry with DPoP nonce", retry_possible: true)
+        when "invalid_grant"
+          # The refresh token has been invalidated or already used
+          raise TokenError.new(
+            "Refresh token has been invalidated: #{error_description}",
+            retry_possible: false
+          )
+        else
+          raise TokenError.new(
+            "Refresh request failed: #{error_description}",
+            retry_possible: false
+          )
         end
-
-        raise RefreshError.new(
-          "Refresh request failed: #{error_description}",
-          retry_possible: false
-        )
       rescue JSON::ParserError
-        raise RefreshError, "Invalid error response format"
+        raise TokenError, "Invalid error response format"
       end
 
       def handle_rate_limit_response(response)
@@ -224,25 +264,25 @@ module AtprotoAuth
       def validate_refresh_response!(data)
         # Required fields
         %w[access_token token_type expires_in scope sub].each do |field|
-          raise RefreshError.new("Missing #{field} in response", retry_possible: false) unless data[field]
+          raise TokenError.new("Missing #{field} in response", retry_possible: false) unless data[field]
         end
 
         # Token type must be DPoP
         unless data["token_type"] == "DPoP"
-          raise RefreshError.new("Invalid token_type: #{data["token_type"]}", retry_possible: false)
+          raise TokenError.new("Invalid token_type: #{data["token_type"]}", retry_possible: false)
         end
 
         # Scope must include original scopes
         original_scopes = session.scope.split
         response_scopes = data["scope"].split
         unless (original_scopes - response_scopes).empty?
-          raise RefreshError.new("Invalid scope in response", retry_possible: false)
+          raise TokenError.new("Invalid scope in response", retry_possible: false)
         end
 
         # Subject must match
         return if data["sub"] == session.tokens.sub
 
-        raise RefreshError.new("Subject mismatch in response", retry_possible: false)
+        raise TokenError.new("Subject mismatch in response", retry_possible: false)
       end
     end
   end

data/lib/atproto_auth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AtprotoAuth
-  VERSION = "0.2.3"
+  VERSION = "0.2.4"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: atproto_auth
 version: !ruby/object:Gem::Version
-  version: 0.2.3
+  version: 0.2.4
 platform: ruby
 authors:
 - Josh Huckabee
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-12-12 00:00:00.000000000 Z
+date: 2024-12-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jose