auth0 4.17.0 → 5.20.0

data/lib/auth0/mixins/permission_struct.rb

@@ -1,3 +1,3 @@
-Permission = Struct.new :permission_name, :resource_server_identifier do
+Auth0::Permission = Struct.new :permission_name, :resource_server_identifier do
 
-end
+end

data/lib/auth0/mixins/token_management.rb

@@ -0,0 +1,35 @@
+module Auth0
+  module Mixins
+    module TokenManagement
+
+      # Get the Client's api token (or generate a new one if it has expired).
+      #
+      # @note This method may perform a network request to refresh an expired token. It is not thread-safe.
+      # @return [String] the api token
+      def get_token
+        has_expired = @token && @token_expires_at ? @token_expires_at < (Time.now.to_i + 10) : false
+
+        if (@token.nil? || has_expired) && @client_id && (@client_secret || @client_assertion_signing_key)
+          response = api_token(audience: @audience)
+          @token = response.token
+          @token_expires_at = response.expires_in ? Time.now.to_i + response.expires_in : nil
+
+          @token
+        else
+          @token
+        end
+      end
+
+      private
+
+      def initialize_token(options)
+        @token = options[:access_token] || options[:token]
+        # default expiry to an hour if a token was given but no expires_at
+        @token_expires_at = @token ? options[:token_expires_at] || Time.now.to_i + 3600 : nil
+
+        @audience = options[:api_identifier] || "https://#{@domain}/api/v2/"
+        get_token() if @token.nil?
+      end
+    end
+  end
+end

data/lib/auth0/mixins/validation.rb

@@ -23,7 +23,7 @@ module Auth0
         raise Auth0::InvalidParameter, 'Must supply an array of Permissions' unless permissions.kind_of?(Array)
         raise Auth0::MissingParameter, 'Must supply an array of Permissions' if permissions.empty?
         raise Auth0::InvalidParameter, 'All array elements must be Permissions' unless permissions.all? do |permission|
-          permission.kind_of? Permission
+          permission.kind_of? ::Auth0::Permission
         end
         permissions.map { |permission| permission.to_h }
       end
@@ -100,11 +100,13 @@ module Auth0
           issuer = @context[:issuer]
           audience = @context[:audience]
           max_age = @context[:max_age]
+          org = @context[:organization]
 
           raise Auth0::InvalidParameter, 'Must supply a valid leeway' unless leeway.is_a?(Integer) && leeway >= 0
           raise Auth0::InvalidParameter, 'Must supply a valid nonce' unless nonce.nil? || !nonce.to_s.empty?
           raise Auth0::InvalidParameter, 'Must supply a valid issuer' unless issuer.nil? || !issuer.to_s.empty?
           raise Auth0::InvalidParameter, 'Must supply a valid audience' unless audience.nil? || !audience.to_s.empty?
+          raise Auth0::InvalidParameter, 'Must supply a valid organization' unless org.nil? || !org.to_s.empty?
 
           unless max_age.nil? || (max_age.is_a?(Integer) && max_age >= 0)
             raise Auth0::InvalidParameter, 'Must supply a valid max_age'
@@ -118,6 +120,7 @@ module Auth0
           validate_nonce(claims, nonce) if nonce
           validate_azp(claims, audience) if claims['aud'].is_a?(Array) && claims['aud'].count > 1
           validate_auth_time(claims, max_age, leeway) if max_age
+          validate_org(claims, org) if org
         end
         # rubocop:enable Metrics/MethodLength, Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
 
@@ -184,6 +187,30 @@ module Auth0
           end
         end
 
+        def validate_org(claims, expected)
+          validate_as_id = expected.start_with? 'org_'
+
+          if validate_as_id
+            unless claims.key?('org_id') && claims['org_id'].is_a?(String)
+              raise Auth0::InvalidIdToken, 'Organization Id (org_id) claim must be a string present in the ID token'
+            end
+
+            unless expected == claims['org_id']
+              raise Auth0::InvalidIdToken, "Organization Id (org_id) claim value mismatch in the ID token; expected \"#{expected}\","\
+                                          " found \"#{claims['org_id']}\""
+            end
+          else
+            unless claims.key?('org_name') && claims['org_name'].is_a?(String)
+              raise Auth0::InvalidIdToken, 'Organization Name (org_name) claim must be a string present in the ID token'
+            end
+
+            unless expected.downcase == claims['org_name']
+              raise Auth0::InvalidIdToken, "Organization Name (org_name) claim value mismatch in the ID token; expected \"#{expected}\","\
+                                          " found \"#{claims['org_name']}\""
+            end
+          end
+        end
+
         def validate_azp(claims, expected)
           unless claims.key?('azp') && claims['azp'].is_a?(String)
             raise Auth0::InvalidIdToken, 'Authorized Party (azp) claim must be a string present in the ID token'
@@ -272,7 +299,7 @@ module Auth0
 
             # Clear the JWK set cache.
             def remove_jwks
-              @@cache.remove(:jwks)
+              @@cache.remove_by { true }
             end
           end
 
@@ -297,13 +324,13 @@ module Auth0
             result = fetch_jwks if force
 
             if result
-              @@cache.put(:jwks, result, lifetime: @lifetime)
+              @@cache.put(@jwks_url, result, lifetime: @lifetime)
               return result
             end
 
-            previous_value = @@cache.last(:jwks)
+            previous_value = @@cache.last(@jwks_url)
 
-            @@cache.get(:jwks, lifetime: @lifetime, dirty: true) do
+            @@cache.get(@jwks_url, lifetime: @lifetime, dirty: true) do
               new_value = fetch_jwks
 
               raise Auth0::InvalidIdToken, 'Could not fetch the JWK set' unless new_value || previous_value
@@ -321,7 +348,7 @@ module Auth0
           private
 
           def fetch_jwks
-            result = get(@jwks_url)
+            result = request_with_retry(:get, @jwks_url, {}, {})
             @did_fetch_jwks = result.is_a?(Hash) && result.key?('keys')
             result if @did_fetch_jwks
           end

data/lib/auth0/mixins.rb

@@ -9,15 +9,16 @@ require 'auth0/mixins/httpproxy'
 require 'auth0/mixins/initializer'
 require 'auth0/mixins/permission_struct'
 require 'auth0/mixins/validation'
+require 'auth0/mixins/token_management'
 
 require 'auth0/api/authentication_endpoints'
-require 'auth0/api/v1'
 require 'auth0/api/v2'
 
 module Auth0
   # Collecting dependencies here
   module Mixins
     include Auth0::Mixins::Headers
+    include Auth0::Mixins::TokenManagement
     include Auth0::Mixins::HTTPProxy
     include Auth0::Mixins::Initializer
   end

data/lib/auth0/version.rb

@@ -1,4 +1,4 @@
 # current version of gem
 module Auth0
-  VERSION = '4.17.0'.freeze
+  VERSION = '5.20.0'.freeze
 end