auth0 5.10.0 → 5.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 40aab484c4f3864d285e116a837151c8e57872a9f879485bdf2433a926b4f668
-  data.tar.gz: 7affd4b6a58f93b73bfa66c8aea85c8064e14a0c74e692e8952223dfda8947a3
+  metadata.gz: 226246c8ebc3b3a01dfb4729ea30e1f5e348a4fef155287ae7a8d4a050022392
+  data.tar.gz: c720dba1ef6fb9661a981fd5a4603e212d3e9803cd1706bdd0a3b2f961551c3d
 SHA512:
-  metadata.gz: 68da74cb1dac1f68810babc29ceef1ea51d5ef16db4f462d728feb904e2734aae58882cf8a2e945710ccdd796d0c2957a378a42e36b2d3aeb0a286dd52604eae
-  data.tar.gz: 16a91e8033143986d95d8857c66f2642640df6b8416ab7e88f0478668336447c95fbf30fda20a058656cea7936ae1b36d376f99ade14953b10e25faa458de4bb
+  metadata.gz: ec7dbd4a49e195981a2b13362e3e0ba7867194cc54a4aad4898edc82f57957415805645f2b8f99ccf6c9d3bca3dab729585c99a6aad44cae32fed094899d9795
+  data.tar.gz: 41221c45b0c22f5fb8ae2a31230f77aa49d60b6b1cfd59443d5e172aa8ed8704c9fb59f2c2af83a7213a7ab3ee678a330ba4b5b93bcfc24fa24985a2731a8903

data/.circleci/config.yml

@@ -6,9 +6,9 @@ orbs:
 matrix_ruby_versions: &matrix_ruby_versions
   matrix:
     parameters:
-      ruby_version: ["2.7", "3.0", "3.1"]
+      ruby_version: ["2.7", "3.0", "3.1", "3.2"]
 # Default version of ruby to use for lint and publishing
-default_ruby_version: &default_ruby_version "3.1"
+default_ruby_version: &default_ruby_version "3.2"
 
 executors:
   ruby-image:

data/.devcontainer/devcontainer.json

@@ -8,7 +8,7 @@
 			// Update 'VARIANT' to pick a Ruby version: 3, 3.1, 3.0, 2, 2.7
 			// Append -bullseye or -buster to pin to an OS version.
 			// Use -bullseye variants on local on arm64/Apple Silicon.
-			"VARIANT": "3.1",
+			"VARIANT": "3.2",
 			// Options
 			"NODE_VERSION": "lts/*"
 		}

data/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Change Log
 
+## [v5.11.0](https://github.com/auth0/ruby-auth0/tree/v5.11.0) (2023-01-27)
+[Full Changelog](https://github.com/auth0/ruby-auth0/compare/v5.10.0...v5.11.0)
+
+**Added**
+- feat: support exchanging OTP codes for tokens [\#438](https://github.com/auth0/ruby-auth0/pull/438) ([stevehobbsdev](https://github.com/stevehobbsdev))
+- [SDK-3869] Support client credentials in management client [\#437](https://github.com/auth0/ruby-auth0/pull/437) ([stevehobbsdev](https://github.com/stevehobbsdev))
+- [SDK-3863] Add support for Client Assertion in authentication endpoints [\#434](https://github.com/auth0/ruby-auth0/pull/434) ([stevehobbsdev](https://github.com/stevehobbsdev))
+
+**Changed**
+- ci: include Ruby 3.2 in test matrix [\#436](https://github.com/auth0/ruby-auth0/pull/436) ([stevehobbsdev](https://github.com/stevehobbsdev))
+
 ## [v5.10.0](https://github.com/auth0/ruby-auth0/tree/v5.10.0) (2022-10-10)
 [Full Changelog](https://github.com/auth0/ruby-auth0/compare/v5.9.0...v5.10.0)
 

data/DEVELOPMENT.md

@@ -0,0 +1,35 @@
+# Development
+
+In order to set up the local environment you'd have to have Ruby installed and a few global gems used to run and record the unit tests. A working Ruby version can be taken from the [CI script](/.circleci/config.yml). At the moment of this writting we're using Ruby `2.5.7`.
+
+> It is expected that every Pull Request introducing a fix, change or feature contains enough test coverage to assert the new behavior.
+
+## Running the tests
+
+Install the gems required for this project.
+
+```bash
+bundle install
+```
+
+Finally, run the tests.
+
+```bash
+bundle exec rake test
+```
+
+### Running only unit tests
+
+You can run only the unit tests and ignore the integration tests by running the following:
+
+```bash
+bundle exec rake spec
+```
+
+### Running only integration tests
+
+You can run only the unit tests and ignore the integration tests by running the following:
+
+```bash
+bundle exec rake integration
+```

data/EXAMPLES.md

@@ -0,0 +1,220 @@
+# Examples using ruby-auth0
+
+## Build a URL to Universal Login Page
+
+```ruby
+require 'auth0'
+
+client = Auth0Client.new(
+  client_id: ENV['AUTH0_RUBY_CLIENT_ID'],
+  client_secret: ENV['AUTH0_RUBY_CLIENT_SECRET'],
+  domain: ENV['AUTH0_RUBY_DOMAIN'],
+)
+
+client.authorize_url 'http://localhost:3000'
+
+> => #<URI::HTTPS https://YOUR_DOMAIN/authorize?client_id=YOUR_CLIENT_ID&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000>
+
+```
+
+## Management API Client
+
+As a simple example of how to get started with the management API, we'll create an admin route to point to a list of all users from Auth0:
+
+```ruby
+# config/routes.rb
+Rails.application.routes.draw do
+  # ...
+  get 'admin/users', to: 'all_users#index'
+  # ...
+end
+```
+
+... and a Controller to handle that route:
+
+```ruby
+# app/controllers/all_users_controller.rb
+require 'auth0'
+
+class AllUsersController < ApplicationController
+  # Get all users from Auth0 with "auth0" in their email.
+  def index
+    @params = {
+      q: "email:*auth0*",
+      fields: 'email,user_id,name',
+      include_fields: true,
+      page: 0,
+      per_page: 50
+    }
+    @users = auth0_client.users @params
+  end
+
+  private
+
+  # Setup the Auth0 API connection.
+  def auth0_client
+    @auth0_client ||= Auth0Client.new(
+      client_id: ENV['AUTH0_RUBY_CLIENT_ID'],
+      client_secret: ENV['AUTH0_RUBY_CLIENT_SECRET'],
+      domain: ENV['AUTH0_RUBY_DOMAIN'],
+      api_version: 2,
+      timeout: 15 # optional, defaults to 10
+    )
+  end
+end
+```
+
+In this example, we're using environment variables to store the values needed to connect to Auth0 and authorize. The `token` used above is an API token for the Management API with the scopes required to perform a specific action (in this case `read:users`). These tokens can be [generated manually](https://auth0.com/docs/api/management/v2/tokens#get-a-token-manually) using a test Application or with the [Application](https://manage.auth0.com/#/applications) being used for your project.
+
+Finally, we'll add a view to display the results:
+
+```ruby
+# app/views/all_users/index.html.erb
+<h1>Users</h1>
+<%= debug @params %>
+<%= debug @users %>
+```
+
+This should show the parameters passed to the `users` method and a list of users that matched the query (or an empty array if none).
+
+## Organizations
+
+[Organizations](https://auth0.com/docs/organizations) is a set of features that provide better support for developers who build and maintain SaaS and Business-to-Business (B2B) applications.
+
+Note that Organizations is currently only available to customers on our Enterprise and Startup subscription plans.
+
+### Logging in with an Organization
+
+Configure the Authentication API client and pass your Organization ID to the authorize url:
+
+```ruby
+require 'auth0'
+
+@auth0_client ||= Auth0Client.new(
+  client_id: '{YOUR_APPLICATION_CLIENT_ID}',
+  client_secret: '{YOUR_APPLICATION_CLIENT_SECRET}',
+  domain: '{YOUR_TENANT}.auth0.com',
+  organization: "{YOUR_ORGANIZATION_ID}"
+)
+
+universal_login_url = @auth0_client.authorization_url("https://{YOUR_APPLICATION_CALLBACK_URL}")
+
+# redirect_to universal_login_url
+```
+
+### Accepting user invitations
+
+Auth0 Organizations allow users to be invited using emailed links, which will direct a user back to your application. The URL the user will arrive at is based on your configured `Application Login URI`, which you can change from your Application's settings inside the Auth0 dashboard. When they arrive at this URL, a `invitation` and `organization` query parameters will be provided
+
+```ruby
+require 'auth0'
+
+@auth0_client ||= Auth0Client.new(
+  client_id: '{YOUR_APPLICATION_CLIENT_ID}',
+  client_secret: '{YOUR_APPLICATION_CLIENT_ID}',
+  domain: '{YOUR_TENANT}.auth0.com',
+  organization: "{YOUR_ORGANIZATION_ID}"
+)
+
+universal_login_url = @auth0_client.authorization_url("https://{YOUR_APPLICATION_CALLBACK_URL}", {
+  organization: "{ORGANIZATION_QUERY_PARAM}", # You can override organization if needed
+  invitation: "{INVITATION_QUERY_PARAM}"
+})
+
+# redirect_to universal_login_url
+```
+
+## ID Token Validation
+
+An ID token may be present in the credentials received after authentication. This token contains information associated with the user that has just logged in, provided the scope used contained `openid`. You can [read more about ID tokens here](https://auth0.com/docs/tokens/concepts/id-tokens).
+
+Before accessing its contents, you must first validate the ID token to ensure it has not been tampered with and that it is meant for your application to consume. Use the `validate_id_token` method to do so:
+
+```ruby
+begin
+  @auth0_client.validate_id_token 'YOUR_ID_TOKEN'
+rescue Auth0::InvalidIdToken => e
+  # In this case the ID Token contents should not be trusted
+end
+```
+
+The method takes the following optional keyword parameters:
+
+| Parameter      | Type           | Description                                                                                                               | Default value                                                                                                          |
+| -------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
+| `algorithm`    | `JWTAlgorithm` | The [signing algorithm](https://auth0.com/docs/tokens/concepts/signing-algorithms) used by your Auth0 application.        | `Auth0::Algorithm::RS256` (using the [JWKS URL](https://auth0.com/docs/tokens/concepts/jwks) of your **Auth0 Domain**) |
+| `leeway`       | Integer        | Number of seconds to account for clock skew when validating the `exp`, `iat` and `azp` claims.                            | `60`                                                                                                                   |
+| `nonce`        | String         | The `nonce` value you sent in the call to `/authorize`, if any.                                                           | `nil`                                                                                                                  |
+| `max_age`      | Integer        | The `max_age` value you sent in the call to `/authorize`, if any.                                                         | `nil`                                                                                                                  |
+| `issuer`       | String         | By default the `iss` claim will be checked against the URL of your **Auth0 Domain**. Use this parameter to override that. | `nil`                                                                                                                  |
+| `audience`     | String         | By default the `aud` claim will be compared to your **Auth0 Client ID**. Use this parameter to override that.             | `nil`                                                                                                                  |
+| `organization` | String         | By default the `org_id` claim will be compared to your **Organization ID**. Use this parameter to override that.          | `nil`                                                                                                                  |
+
+You can check the signing algorithm value under **Advanced Settings > OAuth > JsonWebToken Signature Algorithm** in your Auth0 application settings panel. [We recommend](https://auth0.com/docs/tokens/concepts/signing-algorithms#our-recommendation) that you make use of asymmetric signing algorithms like `RS256` instead of symmetric ones like `HS256`.
+
+```ruby
+# HS256
+
+begin
+  @auth0_client.validate_id_token 'YOUR_ID_TOKEN', algorithm: Auth0::Algorithm::HS256.secret('YOUR_SECRET')
+rescue Auth0::InvalidIdToken => e
+  # Handle error
+end
+
+# RS256 with a custom JWKS URL
+
+begin
+  @auth0_client.validate_id_token 'YOUR_ID_TOKEN', algorithm: Auth0::Algorithm::RS256.jwks_url('YOUR_URL')
+rescue Auth0::InvalidIdToken => e
+  # Handle error
+end
+```
+
+### Organization ID Token Validation
+
+If an org_id claim is present in the Access Token, then the claim should be validated by the API to ensure that the value received is expected or known.
+
+In particular:
+
+- The issuer (iss) claim should be checked to ensure the token was issued by Auth0
+
+- the org_id claim should be checked to ensure it is a value that is already known to the application. This could be validated against a known list of organization IDs, or perhaps checked in conjunction with the current request URL. e.g. the sub-domain may hint at what organization should be used to validate the Access Token.
+
+Normally, validating the issuer would be enough to ensure that the token was issued by Auth0. In the case of organizations, additional checks should be made so that the organization within an Auth0 tenant is expected.
+
+If the claim cannot be validated, then the application should deem the token invalid.
+
+```ruby
+begin
+  @auth0_client.validate_id_token 'YOUR_ID_TOKEN', organization: '{Expected org_id}'
+rescue Auth0::InvalidIdToken => e
+  # In this case the ID Token contents should not be trusted
+end
+```
+
+For more information, please read [Work with Tokens and Organizations](https://auth0.com/docs/organizations/using-tokens) on Auth0 Docs.
+
+## Use a private key to authenticate with Auth0
+
+You are able to take advantage of using a JWT signed with a private key to authenticate with Auth0 in place of using a client secret.
+
+**Note:** you must upload the corresponding public key to your Auth0 tenant, so that Auth0 is able to verify the JWT signature.
+
+Specify the client assertion key when creating the Auth0 client as in the following example:
+
+```ruby
+key_string = File.read 'key.pem'
+key = OpenSSL::PKey::RSA.new key_string
+
+client = Auth0Client.new(
+  domain: 'AUTH0_DOMAIN',
+  client_id: 'AUTH0_CLIENT_ID',
+  client_assertion_signing_key: key,
+  client_assertion_signing_alg: 'RS256')
+```
+
+Some notes:
+
+* If both `client_secret` and `client_assertion_signing_key` are specified, `client_assertion_signing_key` takes precedence
+* `client_assertion_signing_alg` is optional and defaults to `RS256` if omitted
+* Only `RS256`, `RS384` and `PS256` algorithms are supported by Auth0 currently

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    auth0 (5.10.0)
+    auth0 (5.11.0)
       addressable (~> 2.8)
       jwt (~> 2.5)
       rest-client (~> 2.1)
@@ -11,20 +11,20 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    actionpack (7.0.4)
-      actionview (= 7.0.4)
-      activesupport (= 7.0.4)
+    actionpack (7.0.4.2)
+      actionview (= 7.0.4.2)
+      activesupport (= 7.0.4.2)
       rack (~> 2.0, >= 2.2.0)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actionview (7.0.4)
-      activesupport (= 7.0.4)
+    actionview (7.0.4.2)
+      activesupport (= 7.0.4.2)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activesupport (7.0.4)
+    activesupport (7.0.4.2)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
@@ -33,8 +33,7 @@ GEM
       public_suffix (>= 2.0.2, < 6.0)
     ast (2.4.2)
     builder (3.2.4)
-    coderay (1.1.3)
-    concurrent-ruby (1.1.10)
+    concurrent-ruby (1.2.0)
     coveralls (0.7.1)
       multi_json (~> 1.3)
       rest-client
@@ -52,7 +51,7 @@ GEM
     dotenv-rails (2.8.1)
       dotenv (= 2.8.1)
       railties (>= 3.2)
-    erubi (1.11.0)
+    erubi (1.12.0)
     faker (2.23.0)
       i18n (>= 1.8.11, < 2)
     fuubar (2.5.1)
@@ -65,55 +64,50 @@ GEM
       domain_name (~> 0.5)
     i18n (1.12.0)
       concurrent-ruby (~> 1.0)
-    io-console (0.5.11)
-    irb (1.4.2)
+    io-console (0.6.0)
+    irb (1.6.2)
       reline (>= 0.3.0)
-    json (2.6.2)
-    jwt (2.5.0)
-    loofah (2.19.0)
+    json (2.6.3)
+    jwt (2.6.0)
+    loofah (2.19.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
-    method_source (0.9.2)
+    method_source (1.0.0)
     mime-types (3.4.1)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2022.0105)
-    minitest (5.16.3)
+    minitest (5.17.0)
     multi_json (1.15.0)
     netrc (0.11.0)
-    nokogiri (1.13.8-x86_64-linux)
+    nokogiri (1.14.0-x86_64-linux)
       racc (~> 1.4)
     parallel (1.22.1)
-    parser (3.1.2.1)
+    parser (3.2.0.0)
       ast (~> 2.4.1)
-    pp (0.3.0)
+    pp (0.4.0)
       prettyprint
     prettyprint (0.1.1)
-    pry (0.12.2)
-      coderay (~> 1.1.0)
-      method_source (~> 0.9.0)
-    pry-nav (0.3.0)
-      pry (>= 0.9.10, < 0.13.0)
-    public_suffix (5.0.0)
-    racc (1.6.0)
-    rack (2.2.4)
+    public_suffix (5.0.1)
+    racc (1.6.2)
+    rack (2.2.6.2)
     rack-test (0.8.3)
       rack (>= 1.0, < 3)
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.4.3)
-      loofah (~> 2.3)
-    railties (7.0.4)
-      actionpack (= 7.0.4)
-      activesupport (= 7.0.4)
+    rails-html-sanitizer (1.5.0)
+      loofah (~> 2.19, >= 2.19.1)
+    railties (7.0.4.2)
+      actionpack (= 7.0.4.2)
+      activesupport (= 7.0.4.2)
       method_source
       rake (>= 12.2)
       thor (~> 1.0)
       zeitwerk (~> 2.5)
     rainbow (3.1.1)
     rake (13.0.6)
-    regexp_parser (2.6.0)
-    reline (0.3.1)
+    regexp_parser (2.6.2)
+    reline (0.3.2)
       io-console (~> 0.5)
     rest-client (2.1.0)
       http-accept (>= 1.7.0, < 2.0)
@@ -122,37 +116,37 @@ GEM
       netrc (~> 0.8)
     retryable (3.0.5)
     rexml (3.2.5)
-    rspec (3.11.0)
-      rspec-core (~> 3.11.0)
-      rspec-expectations (~> 3.11.0)
-      rspec-mocks (~> 3.11.0)
-    rspec-core (3.11.0)
-      rspec-support (~> 3.11.0)
-    rspec-expectations (3.11.1)
+    rspec (3.12.0)
+      rspec-core (~> 3.12.0)
+      rspec-expectations (~> 3.12.0)
+      rspec-mocks (~> 3.12.0)
+    rspec-core (3.12.0)
+      rspec-support (~> 3.12.0)
+    rspec-expectations (3.12.2)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.11.0)
-    rspec-mocks (3.11.1)
+      rspec-support (~> 3.12.0)
+    rspec-mocks (3.12.3)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.11.0)
-    rspec-support (3.11.1)
-    rubocop (1.36.0)
+      rspec-support (~> 3.12.0)
+    rspec-support (3.12.0)
+    rubocop (1.44.1)
       json (~> 2.3)
       parallel (~> 1.10)
-      parser (>= 3.1.2.1)
+      parser (>= 3.2.0.0)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 1.8, < 3.0)
       rexml (>= 3.2.5, < 4.0)
-      rubocop-ast (>= 1.20.1, < 2.0)
+      rubocop-ast (>= 1.24.1, < 2.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.21.0)
+      unicode-display_width (>= 2.4.0, < 3.0)
+    rubocop-ast (1.24.1)
       parser (>= 3.1.1.0)
-    rubocop-rails (2.16.1)
+    rubocop-rails (2.17.4)
       activesupport (>= 4.2.0)
       rack (>= 1.1)
       rubocop (>= 1.33.0, < 2.0)
     ruby-progressbar (1.11.0)
-    simplecov (0.21.2)
+    simplecov (0.22.0)
       docile (~> 1.1)
       simplecov-html (~> 0.11)
       simplecov_json_formatter (~> 0.1)
@@ -165,22 +159,22 @@ GEM
     term-ansicolor (1.7.1)
       tins (~> 1.0)
     thor (1.2.1)
-    timecop (0.9.5)
-    tins (1.31.1)
+    timecop (0.9.6)
+    tins (1.32.1)
       sync
     tzinfo (2.0.5)
       concurrent-ruby (~> 1.0)
     unf (0.1.4)
       unf_ext
     unf_ext (0.0.8.2)
-    unicode-display_width (2.3.0)
+    unicode-display_width (2.4.2)
     vcr (6.1.0)
     webmock (3.18.1)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
     zache (0.12.0)
-    zeitwerk (2.6.1)
+    zeitwerk (2.6.6)
 
 PLATFORMS
   x86_64-linux
@@ -195,8 +189,6 @@ DEPENDENCIES
   gem-release (~> 0.7)
   irb
   pp
-  pry (~> 0.10)
-  pry-nav (~> 0.2)
   rack (~> 2.1)
   rack-test (~> 0.6)
   rake (~> 13.0)
@@ -210,4 +202,4 @@ DEPENDENCIES
   webmock
 
 BUNDLED WITH
-   2.3.11
+   2.3.26