auth0 4.11.0 → 5.20.0

data/lib/auth0/mixins/httpproxy.rb

@@ -1,44 +1,55 @@
+# frozen_string_literal: true
+
+require 'addressable/uri'
+require 'retryable'
+require_relative '../exception'
+
 module Auth0
   module Mixins
     # here's the proxy for Rest calls based on rest-client, we're building all request on that gem
     # for now, if you want to feel free to use your own http client
     module HTTPProxy
-      attr_accessor :headers, :base_uri, :timeout
+      attr_accessor :headers, :base_uri, :timeout, :retry_count
+
+      DEFAULT_RETRIES = 3
+      MAX_ALLOWED_RETRIES = 10
+      MAX_REQUEST_RETRY_JITTER = 250
+      MAX_REQUEST_RETRY_DELAY = 1000
+      MIN_REQUEST_RETRY_DELAY = 250
+      BASE_DELAY = 100
 
       # proxying requests from instance methods to HTTP class methods
-      %i(get post post_file put patch delete delete_with_body).each do |method|
-        define_method(method) do |path, body = {}, extra_headers = {}|
-          safe_path = URI.escape(path)
-          body = body.delete_if { |_, v| v.nil? }
-          result = if method == :get
-                     # Mutate the headers property to add parameters.
-                     add_headers({params: body})
-                     # Merge custom headers into existing ones for this req.
-                     # This prevents future calls from using them.
-                     get_headers = headers.merge extra_headers
-                     # Make the call with extra_headers, if provided.
-                     call(:get, url(safe_path), timeout, get_headers)
-                   elsif method == :delete
-                     call(:delete, url(safe_path), timeout, add_headers({params: body}))
-                   elsif method == :delete_with_body
-                     call(:delete, url(safe_path), timeout, headers, body)
-                   elsif method == :post_file
-                     body.merge!(multipart: true)
-                     call(:post, url(safe_path), timeout, headers, body)
-                   else
-                     call(method, url(safe_path), timeout, headers, body.to_json)
-                   end
-          case result.code
-          when 200...226 then safe_parse_json(result.body)
-          when 400       then raise Auth0::BadRequest.new(result.body, code: result.code, headers: result.headers)
-          when 401       then raise Auth0::Unauthorized.new(result.body, code: result.code, headers: result.headers)
-          when 403       then raise Auth0::AccessDenied.new(result.body, code: result.code, headers: result.headers)
-          when 404       then raise Auth0::NotFound.new(result.body, code: result.code, headers: result.headers)
-          when 429       then raise Auth0::RateLimitEncountered.new(result.body, code: result.code, headers: result.headers)
-          when 500       then raise Auth0::ServerError.new(result.body, code: result.code, headers: result.headers)
-          else                raise Auth0::Unsupported.new(result.body, code: result.code, headers: result.headers)
-          end
+      %i[get post post_file post_form put patch delete delete_with_body].each do |method|
+        define_method(method) do |uri, body = {}, extra_headers = {}|
+          body = safe_merge_body(body, extra_headers)
+          token = get_token
+          authorization_header(token) unless token.nil?
+          request_with_retry(method, uri, body, extra_headers)
+        end
+      end
+
+      def retry_options
+        sleep_timer = lambda do |attempt|
+          wait = BASE_DELAY * (2**attempt - 1) # Exponential delay with each subsequent request attempt.
+          wait += rand(wait + 1..wait + MAX_REQUEST_RETRY_JITTER) # Add jitter to the delay window.
+          wait = [MAX_REQUEST_RETRY_DELAY, wait].min # Cap delay at MAX_REQUEST_RETRY_DELAY.
+          wait = [MIN_REQUEST_RETRY_DELAY, wait].max # Ensure delay is no less than MIN_REQUEST_RETRY_DELAY.
+          wait / 1000.to_f.round(2) # convert ms to seconds
         end
+
+        tries = 1 + [Integer(retry_count || DEFAULT_RETRIES), MAX_ALLOWED_RETRIES].min # Cap retries at MAX_ALLOWED_RETRIES
+
+        {
+          tries: tries,
+          sleep: sleep_timer,
+          on: Auth0::RateLimitEncountered
+        }
+      end
+
+      def encode_uri(uri)
+        # if a base_uri is set then the uri can be encoded as a path
+        path = base_uri ? Addressable::URI.new(path: uri).normalized_path : Addressable::URI.escape(uri)
+        url(path)
       end
 
       def url(path)
@@ -47,6 +58,7 @@ module Auth0
 
       def add_headers(h = {})
         raise ArgumentError, 'Headers must be an object which responds to #to_hash' unless h.respond_to?(:to_hash)
+
         @headers ||= {}
         @headers.merge!(h.to_hash)
       end
@@ -57,6 +69,50 @@ module Auth0
         body
       end
 
+      def request_with_retry(method, uri, body = {}, extra_headers = {})
+        Retryable.retryable(retry_options) do
+          request(method, uri, body, extra_headers)
+        end
+      end
+
+      def request(method, uri, body = {}, extra_headers = {})
+        result = case method
+                 when :get
+                   @headers ||= {}
+                   get_headers = @headers.merge({ params: body }).merge(extra_headers)
+                   call(:get, encode_uri(uri), timeout, get_headers)
+                 when :delete
+                   @headers ||= {}
+                   delete_headers = @headers.merge({ params: body })
+                   call(:delete, encode_uri(uri), timeout, delete_headers)
+                 when :delete_with_body
+                   call(:delete, encode_uri(uri), timeout, headers, body.to_json)
+                 when :post_file
+                   body.merge!(multipart: true)
+                   # Ignore the default Content-Type headers and let the HTTP client define them
+                   post_file_headers = headers.except('Content-Type') unless headers.nil?
+                   # Actual call with the altered headers
+                   call(:post, encode_uri(uri), timeout, post_file_headers, body)
+                 when :post_form
+                   form_post_headers = headers.except('Content-Type') unless headers.nil?
+                   call(:post, encode_uri(uri), timeout, form_post_headers, body.compact)
+                 else
+                   call(method, encode_uri(uri), timeout, headers, body.to_json)
+                 end
+
+        case result.code
+        when 200...226 then safe_parse_json(result.body)
+        when 400       then raise Auth0::BadRequest.new(result.body, code: result.code, headers: result.headers)
+        when 401       then raise Auth0::Unauthorized.new(result.body, code: result.code, headers: result.headers)
+        when 403       then raise Auth0::AccessDenied.new(result.body, code: result.code, headers: result.headers)
+        when 404       then raise Auth0::NotFound.new(result.body, code: result.code, headers: result.headers)
+        when 429       then raise Auth0::RateLimitEncountered.new(result.body, code: result.code,
+                                                                               headers: result.headers)
+        when 500       then raise Auth0::ServerError.new(result.body, code: result.code, headers: result.headers)
+        else           raise Auth0::Unsupported.new(result.body, code: result.code, headers: result.headers)
+        end
+      end
+
       def call(method, url, timeout, headers, body = nil)
         RestClient::Request.execute(
           method: method,
@@ -68,11 +124,19 @@ module Auth0
       rescue RestClient::Exception => e
         case e
         when RestClient::RequestTimeout
-          raise Auth0::RequestTimeout.new(e.message)
+          raise Auth0::RequestTimeout, e.message
         else
-          return e.response
+          e.response
         end
       end
+
+      private
+      
+      def safe_merge_body(body, extra = {})
+        return body unless body.is_a?(Hash)
+        merged = extra.any? ? body.merge(extra) : body
+        merged.compact
+      end
     end
   end
 end

data/lib/auth0/mixins/initializer.rb

@@ -15,9 +15,13 @@ module Auth0
         @base_uri = base_url(options)
         @headers = client_headers
         @timeout = options[:timeout] || 10
+        @retry_count = options[:retry_count]
+        @client_assertion_signing_key = options[:client_assertion_signing_key]
+        @client_assertion_signing_alg = options[:client_assertion_signing_alg] || 'RS256';        
         extend Auth0::Api::AuthenticationEndpoints
         @client_id = options[:client_id]
         @client_secret = options[:client_secret]
+        @organization = options[:organization]
         initialize_api(options)
       end
 
@@ -40,7 +44,7 @@ module Auth0
       private
 
       def initialize_api(options)
-        api_v2?(options) ? initialize_v2(options) : initialize_v1
+        initialize_v2(options)
         raise InvalidCredentials, 'Must supply a valid API token' if @token.nil?
         if options.fetch(:authorization, nil) == 'Basic'
           authorization_header_basic(options)
@@ -57,14 +61,7 @@ module Auth0
 
       def initialize_v2(options)
         extend Auth0::Api::V2
-        @token = options[:access_token] || options[:token]
-        @token = api_token.token if @token.nil? && @client_id && @client_secret
-      end
-
-      def initialize_v1
-        extend Auth0::Api::V1
-        raise InvalidCredentials, 'Invalid API v1 client_id and client_secret' if @client_id.nil? || @client_secret.nil?
-        @token = obtain_access_token
+        initialize_token(options)
       end
 
       def api_v2?(options)

data/lib/auth0/mixins/permission_struct.rb

@@ -1,3 +1,3 @@
-Permission = Struct.new :permission_name, :resource_server_identifier do
+Auth0::Permission = Struct.new :permission_name, :resource_server_identifier do
 
-end
+end

data/lib/auth0/mixins/token_management.rb

@@ -0,0 +1,35 @@
+module Auth0
+  module Mixins
+    module TokenManagement
+
+      # Get the Client's api token (or generate a new one if it has expired).
+      #
+      # @note This method may perform a network request to refresh an expired token. It is not thread-safe.
+      # @return [String] the api token
+      def get_token
+        has_expired = @token && @token_expires_at ? @token_expires_at < (Time.now.to_i + 10) : false
+
+        if (@token.nil? || has_expired) && @client_id && (@client_secret || @client_assertion_signing_key)
+          response = api_token(audience: @audience)
+          @token = response.token
+          @token_expires_at = response.expires_in ? Time.now.to_i + response.expires_in : nil
+
+          @token
+        else
+          @token
+        end
+      end
+
+      private
+
+      def initialize_token(options)
+        @token = options[:access_token] || options[:token]
+        # default expiry to an hour if a token was given but no expires_at
+        @token_expires_at = @token ? options[:token_expires_at] || Time.now.to_i + 3600 : nil
+
+        @audience = options[:api_identifier] || "https://#{@domain}/api/v2/"
+        get_token() if @token.nil?
+      end
+    end
+  end
+end

data/lib/auth0/mixins/validation.rb

@@ -1,3 +1,11 @@
+require 'zache'
+
+class Zache
+  def last(key)
+    @hash[key][:value] if @hash.key?(key)
+  end
+end
+
 module Auth0
   module Mixins
     # Module to provide validation for specific data structures.
@@ -15,11 +23,337 @@ module Auth0
         raise Auth0::InvalidParameter, 'Must supply an array of Permissions' unless permissions.kind_of?(Array)
         raise Auth0::MissingParameter, 'Must supply an array of Permissions' if permissions.empty?
         raise Auth0::InvalidParameter, 'All array elements must be Permissions' unless permissions.all? do |permission|
-          permission.kind_of? Permission
+          permission.kind_of? ::Auth0::Permission
         end
         permissions.map { |permission| permission.to_h }
       end
 
+      # rubocop:disable Metrics/ClassLength
+      class IdTokenValidator
+        def initialize(context)
+          @context = context
+        end
+
+        def validate(id_token)
+          decoding_error = 'ID token could not be decoded'
+
+          unless !id_token.to_s.empty? && id_token.split('.').count == 3
+            raise Auth0::InvalidIdToken, decoding_error
+          end
+
+          begin
+            header = JWT::JSON.parse(JWT::Base64.url_decode(id_token.split('.').first))
+          rescue
+            raise Auth0::InvalidIdToken, decoding_error
+          end
+
+          claims = decode_and_validate_signature(id_token, header)
+          validate_claims(claims)
+        end
+
+        private
+
+        # rubocop:disable Metrics/MethodLength, Metrics/AbcSize, Metrics/CyclomaticComplexity
+        def decode_and_validate_signature(id_token, header)
+          algorithm = @context[:algorithm]
+
+          unless algorithm.is_a?(Auth0::Mixins::Validation::JWTAlgorithm)
+            raise Auth0::InvalidIdToken, "Signature algorithm of \"#{algorithm}\" is not supported"
+          end
+
+          # The expiration verification will be performed in the validate_claims method
+          options = { algorithms: [algorithm.name], verify_expiration: false, verify_not_before: false }
+          secret = nil
+
+          case algorithm
+          when Auth0::Algorithm::RS256
+            kid = header['kid']
+            jwks = JSON.parse(JSON[algorithm.jwks], symbolize_names: true)
+
+            if !jwks[:keys].find { |key| key[:kid] == kid } && !algorithm.fetched_jwks?
+              jwks = JSON.parse(JSON[algorithm.jwks(force: true)], symbolize_names: true)
+            end
+
+            options[:jwks] = jwks
+          when Auth0::Algorithm::HS256
+            secret = algorithm.secret
+          end
+
+          begin
+            result = JWT.decode(id_token, secret, true, options)
+            result.first
+          rescue JWT::VerificationError
+            raise Auth0::InvalidIdToken, 'Invalid ID token signature'
+          rescue JWT::IncorrectAlgorithm
+            alg = header['alg']
+            raise Auth0::InvalidIdToken, "Signature algorithm of \"#{alg}\" is not supported. Expected the ID token"\
+                                         " to be signed with \"#{algorithm.name}\""
+          rescue JWT::DecodeError
+            raise Auth0::InvalidIdToken, "Could not find a public key for Key ID (kid) \"#{kid}\""
+          end
+        end
+
+        # rubocop:disable Metrics/PerceivedComplexity
+        def validate_claims(claims)
+          leeway = @context[:leeway]
+          nonce = @context[:nonce]
+          issuer = @context[:issuer]
+          audience = @context[:audience]
+          max_age = @context[:max_age]
+          org = @context[:organization]
+
+          raise Auth0::InvalidParameter, 'Must supply a valid leeway' unless leeway.is_a?(Integer) && leeway >= 0
+          raise Auth0::InvalidParameter, 'Must supply a valid nonce' unless nonce.nil? || !nonce.to_s.empty?
+          raise Auth0::InvalidParameter, 'Must supply a valid issuer' unless issuer.nil? || !issuer.to_s.empty?
+          raise Auth0::InvalidParameter, 'Must supply a valid audience' unless audience.nil? || !audience.to_s.empty?
+          raise Auth0::InvalidParameter, 'Must supply a valid organization' unless org.nil? || !org.to_s.empty?
+
+          unless max_age.nil? || (max_age.is_a?(Integer) && max_age >= 0)
+            raise Auth0::InvalidParameter, 'Must supply a valid max_age'
+          end
+
+          validate_iss(claims, issuer)
+          validate_sub(claims)
+          validate_aud(claims, audience)
+          validate_exp(claims, leeway)
+          validate_iat(claims, leeway)
+          validate_nonce(claims, nonce) if nonce
+          validate_azp(claims, audience) if claims['aud'].is_a?(Array) && claims['aud'].count > 1
+          validate_auth_time(claims, max_age, leeway) if max_age
+          validate_org(claims, org) if org
+        end
+        # rubocop:enable Metrics/MethodLength, Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+
+        def validate_iss(claims, expected)
+          unless claims.key?('iss') && claims['iss'].is_a?(String)
+            raise Auth0::InvalidIdToken, 'Issuer (iss) claim must be a string present in the ID token'
+          end
+
+          unless expected == claims['iss']
+            raise Auth0::InvalidIdToken, "Issuer (iss) claim mismatch in the ID token; expected \"#{expected}\","\
+                                         " found \"#{claims['iss']}\""
+          end
+        end
+
+        def validate_sub(claims)
+          unless claims.key?('sub') && claims['sub'].is_a?(String)
+            raise Auth0::InvalidIdToken, 'Subject (sub) claim must be a string present in the ID token'
+          end
+        end
+
+        def validate_aud(claims, expected)
+          unless claims.key?('aud') && (claims['aud'].is_a?(String) || claims['aud'].is_a?(Array))
+            raise Auth0::InvalidIdToken, 'Audience (aud) claim must be a string or array of strings present'\
+                                         ' in the ID token'
+          end
+
+          if claims['aud'].is_a?(String) && expected != claims['aud']
+            raise Auth0::InvalidIdToken, "Audience (aud) claim mismatch in the ID token; expected \"#{expected}\","\
+                                         " found \"#{claims['aud']}\""
+          elsif claims['aud'].is_a?(Array) && !claims['aud'].include?(expected)
+            raise Auth0::InvalidIdToken, "Audience (aud) claim mismatch in the ID token; expected \"#{expected}\""\
+                                         " but was not one of \"#{claims['aud'].join ', '}\""
+          end
+        end
+
+        def validate_exp(claims, leeway)
+          unless claims.key?('exp') && claims['exp'].is_a?(Integer)
+            raise Auth0::InvalidIdToken, 'Expiration Time (exp) claim must be a number present in the ID token'
+          end
+
+          now = @context[:clock] || Time.now.to_i
+          exp_time = claims['exp'] + leeway
+
+          unless now < exp_time
+            raise Auth0::InvalidIdToken, 'Expiration Time (exp) claim mismatch in the ID token; current time'\
+                                         " \"#{now}\" is after expiration time \"#{exp_time}\""
+          end
+        end
+
+        def validate_iat(claims, leeway)
+          unless claims.key?('iat') && claims['iat'].is_a?(Integer)
+            raise Auth0::InvalidIdToken, 'Issued At (iat) claim must be a number present in the ID token'
+          end
+        end
+
+        def validate_nonce(claims, expected)
+          unless claims.key?('nonce') && claims['nonce'].is_a?(String)
+            raise Auth0::InvalidIdToken, 'Nonce (nonce) claim must be a string present in the ID token'
+          end
+
+          unless expected == claims['nonce']
+            raise Auth0::InvalidIdToken, "Nonce (nonce) claim mismatch in the ID token; expected \"#{expected}\","\
+                                         " found \"#{claims['nonce']}\""
+          end
+        end
+
+        def validate_org(claims, expected)
+          validate_as_id = expected.start_with? 'org_'
+
+          if validate_as_id
+            unless claims.key?('org_id') && claims['org_id'].is_a?(String)
+              raise Auth0::InvalidIdToken, 'Organization Id (org_id) claim must be a string present in the ID token'
+            end
+
+            unless expected == claims['org_id']
+              raise Auth0::InvalidIdToken, "Organization Id (org_id) claim value mismatch in the ID token; expected \"#{expected}\","\
+                                          " found \"#{claims['org_id']}\""
+            end
+          else
+            unless claims.key?('org_name') && claims['org_name'].is_a?(String)
+              raise Auth0::InvalidIdToken, 'Organization Name (org_name) claim must be a string present in the ID token'
+            end
+
+            unless expected.downcase == claims['org_name']
+              raise Auth0::InvalidIdToken, "Organization Name (org_name) claim value mismatch in the ID token; expected \"#{expected}\","\
+                                          " found \"#{claims['org_name']}\""
+            end
+          end
+        end
+
+        def validate_azp(claims, expected)
+          unless claims.key?('azp') && claims['azp'].is_a?(String)
+            raise Auth0::InvalidIdToken, 'Authorized Party (azp) claim must be a string present in the ID token'
+          end
+
+          unless expected == claims['azp']
+            raise Auth0::InvalidIdToken, 'Authorized Party (azp) claim mismatch in the ID token; expected'\
+                                         " \"#{expected}\", found \"#{claims['azp']}\""
+          end
+        end
+
+        def validate_auth_time(claims, max_age, leeway)
+          unless claims.key?('auth_time') && claims['auth_time'].is_a?(Integer)
+            raise Auth0::InvalidIdToken, 'Authentication Time (auth_time) claim must be a number present in the ID'\
+                                         ' token when Max Age (max_age) is specified'
+          end
+
+          now = @context[:clock] || Time.now.to_i
+          auth_valid_until = claims['auth_time'] + max_age + leeway
+
+          unless now < auth_valid_until
+            raise Auth0::InvalidIdToken, 'Authentication Time (auth_time) claim in the ID token indicates that too'\
+                                         ' much time has passed since the last end-user authentication. Current time'\
+                                         " \"#{now}\" is after last auth at \"#{auth_valid_until}\""
+          end
+        end
+      end
+      # rubocop:enable Metrics/ClassLength
+
+      class JWTAlgorithm
+        private_class_method :new
+
+        def name
+          raise RuntimeError, 'Must be overriden by the subclasses'
+        end
+      end
+
+      module Algorithm
+        # Represents the HS256 algorithm, which rely on shared secrets.
+        # @see https://auth0.com/docs/tokens/concepts/signing-algorithms
+        class HS256 < JWTAlgorithm
+          class << self
+            private :new
+
+            # Create a new instance passing the shared secret.
+            # @param secret [string] The HMAC shared secret.
+            # @return [HS256] A new instance.
+            def secret(secret)
+              new secret
+            end
+          end
+
+          attr_accessor :secret
+
+          def initialize(secret)
+            raise Auth0::InvalidParameter, 'Must supply a valid secret' if secret.to_s.empty?
+
+            @secret = secret
+          end
+
+          # Returns the algorithm name.
+          # @return [string] The algorithm name.
+          def name
+            'HS256'
+          end
+        end
+
+        # Represents the RS256 algorithm, which rely on public key certificates.
+        # @see https://auth0.com/docs/tokens/concepts/signing-algorithms
+        class RS256 < JWTAlgorithm
+          include Auth0::Mixins::HTTPProxy
+
+          @@cache = Zache.new.freeze
+
+          class << self
+            private :new
+
+            # Create a new instance passing the JWK set url.
+            # @param url [string] The url where the JWK set is located.
+            # @param lifetime [integer] The lifetime of the JWK set in-memory cache in seconds.
+            #   Must be a non-negative value. Defaults to *600 seconds* (10 minutes).
+            # @return [RS256] A new instance.
+            def jwks_url(url, lifetime: 10 * 60)
+              new url, lifetime
+            end
+
+            # Clear the JWK set cache.
+            def remove_jwks
+              @@cache.remove_by { true }
+            end
+          end
+
+          def initialize(jwks_url, lifetime)
+            raise Auth0::InvalidParameter, 'Must supply a valid jwks_url' if jwks_url.to_s.empty?
+            raise Auth0::InvalidParameter, 'Must supply a valid lifetime' unless lifetime.is_a?(Integer) && lifetime >= 0
+
+            @lifetime = lifetime
+            @jwks_url = jwks_url
+            @did_fetch_jwks = false
+          end
+
+          # Returns the algorithm name.
+          # @return [string] The algorithm name.
+          def name
+            'RS256'
+          end
+
+          # Fetches the JWK set from the in-memory cache or from the url.
+          # @return [hash] A JWK set.
+          def jwks(force: false)
+            result = fetch_jwks if force
+
+            if result
+              @@cache.put(@jwks_url, result, lifetime: @lifetime)
+              return result
+            end
+
+            previous_value = @@cache.last(@jwks_url)
+
+            @@cache.get(@jwks_url, lifetime: @lifetime, dirty: true) do
+              new_value = fetch_jwks
+
+              raise Auth0::InvalidIdToken, 'Could not fetch the JWK set' unless new_value || previous_value
+
+              new_value || previous_value
+            end
+          end
+
+          # Returns whether or not the JWK set was fetched from the url.
+          # @return [boolean] +true+ if a request to the JWK set url was made, +false+ otherwise.
+          def fetched_jwks?
+            @did_fetch_jwks
+          end
+
+          private
+
+          def fetch_jwks
+            result = request_with_retry(:get, @jwks_url, {}, {})
+            @did_fetch_jwks = result.is_a?(Hash) && result.key?('keys')
+            result if @did_fetch_jwks
+          end
+        end
+      end
     end
   end
 end

data/lib/auth0/mixins.rb

@@ -9,15 +9,16 @@ require 'auth0/mixins/httpproxy'
 require 'auth0/mixins/initializer'
 require 'auth0/mixins/permission_struct'
 require 'auth0/mixins/validation'
+require 'auth0/mixins/token_management'
 
 require 'auth0/api/authentication_endpoints'
-require 'auth0/api/v1'
 require 'auth0/api/v2'
 
 module Auth0
   # Collecting dependencies here
   module Mixins
     include Auth0::Mixins::Headers
+    include Auth0::Mixins::TokenManagement
     include Auth0::Mixins::HTTPProxy
     include Auth0::Mixins::Initializer
   end

data/lib/auth0/version.rb

@@ -1,4 +1,4 @@
 # current version of gem
 module Auth0
-  VERSION = '4.11.0'.freeze
+  VERSION = '5.20.0'.freeze
 end

data/lib/auth0.rb

@@ -1,6 +1,7 @@
 require 'auth0/version'
 require 'auth0/mixins'
 require 'auth0/exception'
+require 'auth0/algorithm'
 require 'auth0/client'
 require 'auth0_client'
 # Namespace for ruby-auth0 logic