authentic-jwt 0.0.4 → 0.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 59f788359a77abb136b7c38fdcab253d45c00f13
-  data.tar.gz: 5d21ada90226e6763e18f4e360e5f1eed29ad991
+  metadata.gz: 3e6fcda5fe67f9a0e8a4e2831f3d4415ddf32cc9
+  data.tar.gz: 15d4b595ceec5f589edbdfc83dddecf3e7f3db09
 SHA512:
-  metadata.gz: fb34b5b23fe8000435777be76f5e25d09293523c88658361e6fca0b21c5dbb1d807b2281429d72302ccef32f67cfcf14e810c0bd4d1f4a8415a8ef343fba74fd
-  data.tar.gz: aea12556a8dac589d6e52ad51cbca4bdd30c488975415cf8fe6a1351159992e06e552f25985e53de72f8dfdacf8d1696366f99a2ef33d2413b1eb578489d8fbd
+  metadata.gz: ce798a44e216d19e62d4f4bdf76b447255d7ee4b72c97e1cb6241a384cf9b525f70b79b673930828d25e70634001ebb7e6c378b35e4784aaa5dfdc81113872c5
+  data.tar.gz: fda56a15d6d0eca70705f4b958010eaad4b5d35dc603e64f55b7f2f3b357f9eeb88622516e2ac7ef651364bb0ae78e4bbae8523beb6c77708b9b524c0f52abf8

data/Gemfile

@@ -1,5 +1,3 @@
 source "https://rubygems.org"
 
 gemspec
-
-gem "google-protobuf", "3.2.0.rc2"

data/lib/authentic-jwt.rb

@@ -2,3 +2,5 @@ require "authentic_jwt/version"
 require "authentic_jwt/errors"
 require "authentic_jwt/payload_pb"
 require "authentic_jwt/role"
+require "authentic_jwt/validator"
+require "authentic_jwt/authorizer"

data/lib/authentic_jwt/authorizer.rb

@@ -0,0 +1,46 @@
+module AuthenticJwt
+  class Authorizer
+    def initialize(account_id: ENV["AUTHENTIC_AUTH_ACCOUNT_ID"])
+      unless account_id.to_s.empty?
+        @account_id = account_id.to_s
+      end
+    end
+
+    attr_reader :account_id
+
+    def call(payload:, scope: nil)
+      return unless account_id
+
+      account = payload.accounts.detect { |account| account.aud == account_id }
+
+      unless account
+        raise Forbidden, "No access to account"
+      end
+
+      roles = account.roles.collect(&:downcase)
+
+      unless roles.any?
+        raise Forbidden, "Account has no roles"
+      end
+
+      acceptable_roles = calculate_acceptable_roles(scope: scope)
+
+      unless (acceptable_roles & roles).any?
+        raise Forbidden, "Account role is too low"
+      end
+
+      true
+    end
+
+    protected
+
+    def calculate_acceptable_roles(scope:)
+      return [] unless scope
+        case scope
+        when "read"  then AuthenticJwt::Role.read
+        when "write" then AuthenticJwt::Role.write
+        else raise ArgumentError
+      end
+    end
+  end
+end

data/lib/authentic_jwt/grape/auth_methods.rb

@@ -5,7 +5,7 @@ module AuthenticJwt
 
       def jwt_sub
         return unless jwt_payload
-        jwt_payload["sub"]
+        jwt_payload.sub
       end
     end
   end

data/lib/authentic_jwt/grape/middleware.rb

@@ -1,7 +1,5 @@
 require "authentic_jwt/grape/extension"
 require "authentic_jwt/grape/auth_methods"
-require "openssl"
-require "jwt"
 
 module AuthenticJwt
   module Grape
@@ -9,39 +7,26 @@ module AuthenticJwt
       def before
         return unless scope
 
-        raise Unauthorized, "JWT public key not present" unless public_key
+        validator = AuthenticJwt::Validator.new
+        payload = validator.call(header: header)
 
-        raise Unauthorized, "Authorization header not present" unless authorization_header
-
-        raise Unauthorized, "Bearer token not present" unless bearer_token
-
-        raise Unauthorized, "JWT payload not present" unless jwt_payload
+        authorizer = AuthenticJwt::Authorizer.new
+        authorizer.call(payload: payload, scope: scope)
 
         context.extend(AuthMethods)
-        context.jwt_payload = jwt_payload
-
-        return unless account_id
-
-        raise Forbidden, "Account has no role" unless account_roles.any?
-
-        raise Forbidden, "Account role is too low" unless (acceptable_roles & account_roles).any?
+        context.jwt_payload = payload
       end
 
       protected
 
-      PUBLIC_KEY_ENV_VAR = "AUTHENTIC_AUTH_PUBLIC_KEY".freeze
-      ACCOUNT_ID_ENV_VAR = "AUTHENTIC_AUTH_ACCOUNT_ID".freeze
-      BEARER_PATTERN     = /Bearer (.+)/
+      def header
+        env["HTTP_AUTHORIZATION"]
+      end
 
       def context
         env["api.endpoint"]
       end
 
-      def authorization_header
-        return if env["HTTP_AUTHORIZATION"].to_s.empty?
-        env["HTTP_AUTHORIZATION"]
-      end
-
       def route_setting
         context.route_setting(:oauth2)
       end
@@ -50,54 +35,6 @@ module AuthenticJwt
         return unless route_setting
         route_setting.fetch(:scope, nil)
       end
-
-      def bearer_token
-        return unless authorization_header
-        if authorization_header =~ BEARER_PATTERN
-          result = Regexp.last_match(1)
-          unless result.to_s.empty?
-            result
-          end
-        end
-      end
-
-      def public_key
-        result = ENV[PUBLIC_KEY_ENV_VAR].to_s
-        return if result.empty?
-        OpenSSL::PKey::RSA.new(result)
-      end
-
-      def jwt_payload
-        return unless bearer_token
-        return unless public_key
-        payload, header = JWT.decode(bearer_token, public_key, true, algorithm: "RS512")
-        payload
-      end
-
-      def account_id
-        result = ENV[ACCOUNT_ID_ENV_VAR].to_s
-        return if result.empty?
-        result
-      end
-
-      def account_payload
-        return unless jwt_payload
-        jwt_payload["accounts"].detect { |account| account["aud"] == account_id }
-      end
-
-      def account_roles
-        return [] unless account_payload
-        account_payload["roles"].collect(&:downcase)
-      end
-
-      def acceptable_roles
-        return [] unless scope
-        case scope
-        when "read"  then AuthenticJwt::Role.read
-        when "write" then AuthenticJwt::Role.write
-        else raise ArgumentError
-        end
-      end
     end
   end
 end

data/lib/authentic_jwt/validator.rb

@@ -0,0 +1,66 @@
+require "openssl"
+require "jwt"
+
+module AuthenticJwt
+  class Validator
+    def initialize(public_key: ENV["AUTHENTIC_AUTH_PUBLIC_KEY"])
+      if public_key.to_s.empty?
+        raise Unauthorized, "JWT public key not present"
+      end
+
+      @public_key = OpenSSL::PKey::RSA.new(public_key.to_s)
+    end
+
+    def call(header:)
+      if header.to_s.empty?
+        raise Unauthorized, "Authorization header missing"
+      end
+
+      bearer_token = extract_bearer_token(header: header)
+
+      extract_payload(bearer_token: bearer_token)
+    end
+
+    protected
+
+    BEARER_PATTERN = /Bearer (.+)/
+    ALGORITHM = "RS512"
+
+    attr_reader :public_key
+
+    def extract_bearer_token(header:)
+      if header =~ BEARER_PATTERN
+        bearer_token = Regexp.last_match(1)
+      else
+        raise Unauthorized, "Authorization header is not a Bearer token"
+      end
+
+      if bearer_token.to_s.empty?
+        raise Unauthorized, "Bearer token not present"
+      end
+
+      bearer_token
+    end
+
+    def extract_payload(bearer_token:)
+      raw, header = begin
+        JWT.decode(bearer_token, public_key, true, algorithm: ALGORITHM)
+      rescue JWT::DecodeError => error
+        if error.message =~ /Signature verification raised/
+          raise Unauthorized, "JWT does not match signature"
+        else
+          raise Unauthorized, "Bearer token is not a valid JWT"
+        end
+      end
+
+      # TODO bypass this step
+      json = JSON.dump(raw)
+
+      begin
+        Payload.decode_json(json)
+      rescue Google::Protobuf::ParseError
+        raise Unauthorized, "JWT is not in the correct format"
+      end
+    end
+  end
+end

data/lib/authentic_jwt/version.rb

@@ -1,3 +1,3 @@
 module AuthenticJwt
-  VERSION = "0.0.4".freeze
+  VERSION = "0.0.5".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authentic-jwt
 version: !ruby/object:Gem::Version
-  version: 0.0.4
+  version: 0.0.5
 platform: ruby
 authors:
 - Authentic Limited
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-02-06 00:00:00.000000000 Z
+date: 2017-02-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: google-protobuf
@@ -142,12 +142,14 @@ files:
 - bin/setup
 - definitions/payload.proto
 - lib/authentic-jwt.rb
+- lib/authentic_jwt/authorizer.rb
 - lib/authentic_jwt/errors.rb
 - lib/authentic_jwt/grape/auth_methods.rb
 - lib/authentic_jwt/grape/extension.rb
 - lib/authentic_jwt/grape/middleware.rb
 - lib/authentic_jwt/payload_pb.rb
 - lib/authentic_jwt/role.rb
+- lib/authentic_jwt/validator.rb
 - lib/authentic_jwt/version.rb
 homepage: https://github.com/mytours/authentic-jwt
 licenses: []
@@ -168,7 +170,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.8
+rubygems_version: 2.5.2
 signing_key: 
 specification_version: 4
 summary: Client authentication for Authentic Apps