authentic-rb 1.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 3b3df53a31e58a8aa456c9e9f7056921cbd361f9f68610fe0beaa50cea027ec1
+  data.tar.gz: e8c51fe75e10af3718d636bf5b501e8f8f9e82ff8bd1079a0dd58752dac4cbdf
+SHA512:
+  metadata.gz: 7c67772174a1c70156c47f4acb9cfabdc7b1af5cedb9becd18db487fbc1b4ffd060d83b35bcb1c5c17dcbad4f52113bdea0e687cac0a439ffafd06b57be5f17c
+  data.tar.gz: 0333a4447268ccd350841ff55b72c7cdd48ebc1e164a8710484bb39f928837b752bd231b12453127ddc180d2640f411ee3c8840d4c31c194698195bfcd3174b6

data/lib/authentic/error.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+# nodoc
+module Authentic
+  # Public: Represents a request error when requesting OIDC config or JWKs from authorization server.
+  class RequestError < StandardError
+    attr_reader :code
+    def initialize(msg, code)
+      @code = code
+      super(msg)
+    end
+  end
+
+  # Public: Represents an error with JWK.
+  class InvalidKey < StandardError; end
+
+  # Public: Represents a error with options passed to Authentic::Validator.
+  class IncompleteOptions < StandardError; end
+
+  # Public: Represents a bad JWT.
+  class InvalidToken < StandardError; end
+end

data/lib/authentic/key_manager.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+require 'json/jwt'
+require 'unirest'
+require 'uri'
+require 'authentic/key_store'
+
+module Authentic
+  # Internal: manages JWK retrieval, caching, and validation.
+  class KeyManager
+    attr_reader :store, :well_known
+
+    def initialize(max_age)
+      @store = KeyStore.new(max_age || '10h')
+      @well_known = '/.well-known/openid-configuration'
+    end
+
+    # Public: retrieves JWK.
+    #
+    # jwt - JSON::JWT.
+    #
+    # Returns JSON::JWK.
+    def get(jwt)
+      iss = jwt.fetch(:iss)
+
+      result = store.get(iss, jwt.kid)
+
+      return result unless result.nil?
+
+      # Refresh all keys for an issuer while I have the updated data on hand
+      hydrate_iss_keys iss
+      store.get(iss, jwt.kid)
+    end
+
+    # Internal: validates RSA key.
+    #
+    # key - hash with key data.
+    #
+    # Returns boolean.
+    def valid_rsa_key(key)
+      key['use'] == 'sig' && key['kty'] == 'RSA' && key['kid']
+    end
+
+    # Internal: performs JSON request.
+    #
+    # key - hash with JWK data.
+    #
+    # Returns boolean.
+    def valid_key(key)
+      valid_rsa_key(key) && (key['x5c']&.length || (key['n'] && key['e']))
+    end
+
+    # Internal: performs JSON request.
+    #
+    # uri - endpoint to request.
+    #
+    # Returns JSON.
+    def json_req(uri)
+      resp = Unirest.get(uri, headers: { 'Accept' => 'application/json' })
+      raise RequestError.new("failed to retrieve JWK, status #{resp.code}", resp.code) unless (200..299).cover? resp.code
+
+      resp.body
+    end
+
+    # Internal: hydrates JWK cache.
+    #
+    # iss - issuer URI.
+    #
+    # Returns nothing.
+    def hydrate_iss_keys(iss)
+      uri = URI.join iss, well_known
+      json = json_req uri.to_s
+      body = json_req json['jwks_uri']
+
+      raise InvalidKey, "no valid JWK found, #{json['jwks_uri']}" if body['keys']&.blank?
+
+      keys = body['keys'].select { |key| valid_key(key) }
+      hydrate_store(keys, iss)
+    end
+
+    # Internal: hydrates key store.
+    #
+    # keys - array of keys hash.
+    # iss - JWT issuer endpoint.
+    #
+    # Returns nothing.
+    def hydrate_store(keys, iss)
+      keys.each do |key|
+        store.set(
+          iss, key['kid'],
+          JSON::JWK.new(
+            kty: key['kty'],
+            e: key['e'],
+            n: key['n'],
+            kid: key['kid']
+          )
+        )
+      end
+    end
+  end
+end

data/lib/authentic/key_store.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require 'authentic/oidc_key'
+
+# nodoc
+module Authentic
+  # Internal: Key store for caching JWKs.
+  class KeyStore
+    # Public: cache data
+    attr_reader :data, :max_age, :max_age_seconds
+
+    def initialize(max_age, data = {})
+      @data = data
+      @max_age = max_age
+      @max_age_seconds = human_time_to_seconds
+    end
+
+    # Public: Sets data, and wraps it in OIDCKey class if not presented as that type.
+    #
+    # iss - issuer
+    # kid - key id
+    #
+    # Returns JSON::JWK
+    def get(iss, kid)
+      key = get_key(iss, kid)
+      expires!(key)
+      data[key]&.value
+    end
+
+    # Internal: builds cache key
+    #
+    # iss - issuer
+    # kid - key id
+    #
+    # Returns string
+    def get_key(iss, kid)
+      "#{iss}/#{kid}"
+    end
+
+    # Public: Sets data, and wraps it in OIDCKey class if not presented as that type.
+    #
+    # iss - issuer
+    # kid - key id
+    # data - data to cache which is usually a single OIDC public key.
+    #
+    # Returns JSON::JWK
+    def set(iss, kid, new_data)
+      key = get_key(iss, kid)
+      data[key] = new_data.is_a?(OIDCKey) ? new_data : OIDCKey.new(new_data, max_age_seconds)
+      get(iss, kid)
+    end
+
+    # Internal: Verifies if data is expired and unset it
+    def expires!(key)
+      unset(key) if data[key]&.expired?
+    end
+
+    # Internal: deletes data from cache
+    def unset(key)
+      data.delete(key)
+    end
+
+    # frozen_string_literal: true
+
+    # Internal: converts human time to seconds for consumption of the cache service. Format ``
+    #
+    # human_time - represents time in hours, minutes, and seconds.
+    #
+    # Returns seconds.
+    def human_time_to_seconds
+      m = /(?:(\d*)h)?\s?(?:(\d*)?m)?\s?(?:(\d*)?s)?/.match(max_age)
+      h = ((m[1].to_i || 0) * 60) * 60
+      mi = (m[2].to_i || 0) * 60
+      s = (m[3].to_i || 0)
+      h + mi + s
+    end
+  end
+end

data/lib/authentic/oidc_key.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# nodoc
+module Authentic
+  # Internal: JWKs cache data.
+  class OIDCKey
+    attr_reader :expires, :value
+
+    def initialize(value, max_age_seconds)
+      @value = value
+      @expires = max_age_seconds.nil? ? nil : Time.now.utc + max_age_seconds
+    end
+
+    def expired?
+      !expires.nil? && Time.now.utc > expires
+    end
+  end
+end

data/lib/authentic/validator.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require 'authentic/error'
+require 'authentic/key_manager'
+
+# Public: proper validation of JWTs against JWKs.
+module Authentic
+  # Public: validate JWTs against JWKs using iss whitelist in an environment variable.
+  #
+  # token - raw JWT.
+  #
+  # Returns boolean.
+  def self.valid?(token)
+    Validator.new.valid?(token)
+  end
+
+  # Public: uses environment variable for iss whitelist and validates JWT,
+  # raises an error for invalid JWTs, errors requesting JWKs, the lack of valid JWKs, or non white listed ISS.
+  #
+  # token - raw JWT.
+  #
+  # Returns nothing.
+  def self.ensure_valid(token)
+    Validator.new.ensure_valid(token)
+  end
+
+  # Public: validates JWTs against JWKs.
+  class Validator
+    attr_reader :iss_whitelist, :manager, :opts
+
+    def initialize(options = {})
+      @opts = options
+      @iss_whitelist = opts.fetch(:iss_whitelist) { ENV['AUTHENTIC_ISS_WHITELIST']&.split(',') }
+      valid_opts = !iss_whitelist&.empty?
+      raise IncompleteOptions unless valid_opts
+
+      @manager = KeyManager.new opts[:cache_max_age]
+    end
+
+    # Public: validates JWT, returns true if valid, false if not.
+    #
+    # token - raw JWT.
+    #
+    # Returns boolean.
+    def valid?(token)
+      ensure_valid token
+      true
+    rescue InvalidToken, InvalidKey, RequestError
+      false
+    end
+
+    # Public: validates JWT, raises an error for invalid JWTs, errors requesting JWKs,
+    # the lack of valid JWKs, or non white listed ISS.
+    #
+    # token - raw JWT.
+    #
+    # Returns nothing.
+    def ensure_valid(token)
+      jwt = decode_jwt token
+
+      begin
+        key = manager.get jwt
+
+        # Slightly more accurate to raise a key error here for nil key,
+        # rather then verify raising an error that would lead to InvalidToken
+        raise InvalidKey, 'invalid JWK' if key.nil?
+
+        jwt.verify! key
+      rescue JSON::JWT::UnexpectedAlgorithm, JSON::JWT::VerificationFailed
+        raise InvalidToken, 'failed to validate token against JWK'
+      rescue OpenSSL::PKey::PKeyError
+        raise InvalidKey, 'invalid JWK'
+      end
+    end
+
+    # Decodes and does basic validation of JWT.
+    #
+    # token - raw JWT.
+    #
+    # Returns JSON::JWT
+    def decode_jwt(token)
+      raise InvalidToken, 'invalid nil JWT provided' unless token
+
+      JSON::JWT.decode(token, :skip_verification).tap do |jwt|
+        raise InvalidToken, 'JWT iss was not located in provided whitelist' unless iss_whitelist.index jwt[:iss]
+      end
+    rescue JSON::JWT::InvalidFormat
+      raise InvalidToken, 'invalid JWT format'
+    end
+  end
+end

data/lib/authentic.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require 'authentic/validator'

metadata

@@ -0,0 +1,90 @@
+--- !ruby/object:Gem::Specification
+name: authentic-rb
+version: !ruby/object:Gem::Version
+  version: 1.0.1
+platform: ruby
+authors:
+- Articulate
+- Andy Gertjejansen
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2018-11-26 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: json-jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.9'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.9.4
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.9'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.9.4
+- !ruby/object:Gem::Dependency
+  name: unirest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.1.2
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.1.2
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.1.2
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.1.2
+description: Ruby toolkit for Auth0 API https://auth0.com.
+email: 
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/authentic.rb
+- lib/authentic/error.rb
+- lib/authentic/key_manager.rb
+- lib/authentic/key_store.rb
+- lib/authentic/oidc_key.rb
+- lib/authentic/validator.rb
+homepage: https://rubygems.org/gems/authentic-rb
+licenses: []
+metadata:
+  source_code_uri: https://github.com/articulate/authentic-rb
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.7.8
+signing_key: 
+specification_version: 4
+summary: validation of JWTs against JWKs
+test_files: []