authentic-rb 1.2.0 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3a3e28c6d5e92fd5fce9edf02b6876814912d5efa4f986b237bf8071ac24e66f
-  data.tar.gz: 30e8bdef21c0341eee35492d28041405ce291889a4f0868c9ba52089a4f5e2de
+  metadata.gz: 9e863c99c2e2d4b8312101c42e2a7079e90d610756156e0a2c57906c1afdf131
+  data.tar.gz: 72dff9af3c38d789c32398000f56fc378f355a5f52369a553f389e49692ac7f2
 SHA512:
-  metadata.gz: 7a1ff3430a2a8d73566a2c0e77274698395f8f825ae49b4d56db2db740da4c71540123e6f071aaf6c7f93af0559eca24e3129d1ea2b5fa1ea6e5ae7c7d532388
-  data.tar.gz: 80e3776ff22768e4e1c49810893e103f0484769fc36e1170a5ffa23f9726d1a140863d101d88edbc281688e3bf127037934723bcffdc35fbdc34d2e4872e49f6
+  metadata.gz: 90e92d91ef2076db91ca8251ca61ce756636ff0c1e1432ecf1926bbbf8cba1c47e250585e7f841f99b9495673379df2957744cc8371be5fa7818f0d2efb6cd71
+  data.tar.gz: 725f1a1e56b8f22d98e18941cde23a66719b3725457938aa1fa43e175aa136e61ac1f95575af4acd17fa62f00bbbebc35febf58a8d9f7544ea5835d9711b1b65

data/lib/authentic/key_manager.rb

@@ -14,10 +14,6 @@ module Authentic
       @well_known = '/.well-known/openid-configuration'
     end
 
-    def cache_max_age(max_age)
-      @store.configure_max_age(max_age)
-    end
-
     # Public: retrieves JWK.
     #
     # jwt - JSON::JWT.

data/lib/authentic/key_store.rb

@@ -11,16 +11,7 @@ module Authentic
 
     def initialize(max_age, data = {})
       @data = data
-      configure_max_age(max_age)
-    end
-
-    def configure_max_age(max_age)
-      @max_age = max_age
-      @max_age_seconds = human_time_to_seconds
-    end
-
-    def reset_all
-      @data = {}
+      @max_age_seconds = human_time_to_seconds(max_age)
     end
 
     # Public: Sets data, and wraps it in OIDCKey class if not presented as that type.
@@ -70,13 +61,14 @@ module Authentic
 
     # frozen_string_literal: true
 
-    # Internal: converts human time to seconds for consumption of the cache service. Format ``
+    # Internal: converts human time to seconds for consumption of the cache service. Format example: `10h5m30s`.
+    # All units are optional.
     #
-    # human_time - represents time in hours, minutes, and seconds.
+    # time - time to convert, it is a string that represents time in hours, minutes, and seconds.
     #
     # Returns seconds.
-    def human_time_to_seconds
-      m = /(?:(\d*)h)?\s?(?:(\d*)?m)?\s?(?:(\d*)?s)?/.match(max_age)
+    def human_time_to_seconds(time)
+      m = /(?:(\d*)h)?\s?(?:(\d*)?m)?\s?(?:(\d*)?s)?/.match(time)
       h = ((m[1].to_i || 0) * 60) * 60
       mi = (m[2].to_i || 0) * 60
       s = (m[3].to_i || 0)

data/lib/authentic/validator.rb

@@ -5,55 +5,16 @@ require 'authentic/key_manager'
 
 # Public: proper validation of JWTs against JWKs.
 module Authentic
-  # Public: validate JWTs against JWKs using iss whitelist in an environment variable.
-  #
-  # token - raw JWT.
-  # opts  - Optionally pass configuration options.
-  #
-  # Returns boolean.
-  def self.valid?(token, opts = {})
-    Validator.configure(opts) unless opts.empty?
-    Validator.new.valid?(token)
-  end
-
-  # Public: uses environment variable for iss whitelist and validates JWT,
-  # raises an error for invalid JWTs, errors requesting JWKs, the lack of valid JWKs, or non white listed ISS.
-  #
-  # token - raw JWT.
-  # opts  - Optionally pass configuration options.
-  #
-  # Returns nothing.
-  def self.ensure_valid(token, opts = {})
-    Validator.configure(opts) unless opts.empty?
-    Validator.new.ensure_valid(token)
-  end
-
   # Public: validates JWTs against JWKs.
   class Validator
-    @@manager = KeyManager.new('10h')
-    @@iss_whitelist = []
+    attr_reader :iss_whitelist, :manager, :opts
 
-    # Public: Configures iss_whitelist and cache_max_age
-    #
-    # opts - options to configure the validator with
-    #
-    # Returns nothing.
-    def self.configure(opts)
-      @@iss_whitelist = opts[:iss_whitelist]
-      @@manager.cache_max_age(opts.fetch(:cache_max_age, '10h'))
-    end
-
-    def initialize
-      # Default iss whitelist if it is empty
-      @@iss_whitelist = @@iss_whitelist&.empty? ? ENV['ISS_WHITELIST']&.split('|') : @@iss_whitelist
-
-      valid_opts = !@@iss_whitelist&.empty?
-      raise IncompleteOptions unless valid_opts
-    end
+    def initialize(options = {})
+      @iss_whitelist = options.fetch(:iss_whitelist) { [] }
+      raise IncompleteOptions if iss_whitelist.empty?
 
-    # Private: resets key manager cache
-    def reset_cache
-      @@manager.store.reset_all
+      max_age = options.fetch(:cache_max_age) { '10h' }
+      @manager = options.fetch(:key_manager) { KeyManager.new(max_age) }
     end
 
     # Public: validates JWT, returns true if valid, false if not.
@@ -62,7 +23,7 @@ module Authentic
     #
     # Returns boolean.
     def valid?(token)
-      ensure_valid token
+      ensure_valid(token)
       true
     rescue InvalidToken, InvalidKey, RequestError
       false
@@ -75,16 +36,16 @@ module Authentic
     #
     # Returns nothing.
     def ensure_valid(token)
-      jwt = decode_jwt token
+      jwt = decode_jwt(token)
 
       begin
-        key = @@manager.get jwt
+        key = manager.get(jwt)
 
         # Slightly more accurate to raise a key error here for nil key,
         # rather then verify raising an error that would lead to InvalidToken
         raise InvalidKey, 'invalid JWK' if key.nil?
 
-        jwt.verify! key
+        jwt.verify!(key)
       rescue JSON::JWT::UnexpectedAlgorithm, JSON::JWT::VerificationFailed
         raise InvalidToken, 'failed to validate token against JWK'
       rescue OpenSSL::PKey::PKeyError
@@ -101,7 +62,7 @@ module Authentic
       raise InvalidToken, 'invalid nil JWT provided' unless token
 
       JSON::JWT.decode(token, :skip_verification).tap do |jwt|
-        raise InvalidToken, 'JWT iss was not located in provided whitelist' unless @@iss_whitelist.index jwt[:iss]
+        raise InvalidToken, 'JWT iss was not located in provided whitelist' unless iss_whitelist.include?(jwt[:iss])
       end
     rescue JSON::JWT::InvalidFormat
       raise InvalidToken, 'invalid JWT format'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: authentic-rb
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.3.0
 platform: ruby
 authors:
 - Articulate
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-01-14 00:00:00.000000000 Z
+date: 2019-01-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json-jwt