authentic-rb 1.0.4 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 338211c4681854410e4b120cb9f3dd51485ffc6056fded46f513b94de6cbd353
-  data.tar.gz: 41b9ceb7f8d3dbc9300d20ab3c748f71305866b56ba33f8fdc35e3d74b7c8858
+  metadata.gz: 569cb68126c88d020f7a3a97f492a197f104054c766d0725de7650842fbc935d
+  data.tar.gz: 4276afbae6032bd9d2ed20ca93a3c9e1d2af1a3c59a4cefe6e67e39ee0895a7a
 SHA512:
-  metadata.gz: fc100141cc28b0a20f4a131cba993ab52662ca222645babb4f46e720bbf07efa21f4326565744c95725af490595aa4a36bf35230efb83eec695aaab43049bec9
-  data.tar.gz: 58d89a5b690c77f9975ae4abf18b3195854bae27789e47b43faf7a4aebda957f97370a2daa8b8e35c85b7ba34a02c5c8aa8674c4f1b363cf3a8c0bea4056dd33
+  metadata.gz: f68c71db7fa9f9c129b740b9599b25f3500735a2bd7bb16056a1e8a0ab5c3889abd47cf81804c8d2b6790d61e0ba7b113fb6a2eb54a32a396fb37a9b121815a9
+  data.tar.gz: 50eba9c344040ce7f91e63d350eadfd096334937aa6eb0b11ddb54da2772dae61c31c297cb880c8dbf9d4b0e1ceb71279b24c71ae40d3b6a60af53a7bd145c3d

data/lib/authentic/key_manager.rb

@@ -10,10 +10,14 @@ module Authentic
     attr_reader :store, :well_known
 
     def initialize(max_age)
-      @store = KeyStore.new(max_age || '10h')
+      @store = KeyStore.new(max_age)
       @well_known = '/.well-known/openid-configuration'
     end
 
+    def cache_max_age(max_age)
+      @store.configure_max_age(max_age)
+    end
+
     # Public: retrieves JWK.
     #
     # jwt - JSON::JWT.

data/lib/authentic/key_store.rb

@@ -11,10 +11,18 @@ module Authentic
 
     def initialize(max_age, data = {})
       @data = data
+      configure_max_age(max_age)
+    end
+
+    def configure_max_age(max_age)
       @max_age = max_age
       @max_age_seconds = human_time_to_seconds
     end
 
+    def reset_all
+      @data = {}
+    end
+
     # Public: Sets data, and wraps it in OIDCKey class if not presented as that type.
     #
     # iss - issuer

data/lib/authentic/validator.rb

@@ -8,9 +8,11 @@ module Authentic
   # Public: validate JWTs against JWKs using iss whitelist in an environment variable.
   #
   # token - raw JWT.
+  # opts  - Optionally pass configuration options.
   #
   # Returns boolean.
-  def self.valid?(token)
+  def self.valid?(token, opts = {})
+    Validator.configure(opts) unless opts.empty?
     Validator.new.valid?(token)
   end
 
@@ -18,23 +20,40 @@ module Authentic
   # raises an error for invalid JWTs, errors requesting JWKs, the lack of valid JWKs, or non white listed ISS.
   #
   # token - raw JWT.
+  # opts  - Optionally pass configuration options.
   #
   # Returns nothing.
-  def self.ensure_valid(token)
+  def self.ensure_valid(token, opts = {})
+    Validator.configure(opts) unless opts.empty?
     Validator.new.ensure_valid(token)
   end
 
   # Public: validates JWTs against JWKs.
   class Validator
-    attr_reader :iss_whitelist, :manager, :opts
+    @@manager = KeyManager.new('10h')
+    @@iss_whitelist = []
 
-    def initialize(options = {})
-      @opts = options
-      @iss_whitelist = opts.fetch(:iss_whitelist) { ENV['AUTHENTIC_ISS_WHITELIST']&.split(',') }
-      valid_opts = !iss_whitelist&.empty?
+    # Public: Configures iss_whitelist and cache_max_age
+    #
+    # opts - options to configure the validator with
+    #
+    # Returns nothing.
+    def self.configure(opts)
+      @@iss_whitelist = opts[:iss_whitelist]
+      @@manager.cache_max_age(opts.fetch(:cache_max_age, '10h'))
+    end
+
+    def initialize
+      # Default iss whitelist if it is empty
+      @@iss_whitelist = @@iss_whitelist&.empty? ? ENV['AUTHENTIC_ISS_WHITELIST']&.split(',') : @@iss_whitelist
+
+      valid_opts = !@@iss_whitelist&.empty?
       raise IncompleteOptions unless valid_opts
+    end
 
-      @manager = KeyManager.new opts[:cache_max_age]
+    # Private: resets key manager cache
+    def reset_cache
+      @@manager.store.reset_all
     end
 
     # Public: validates JWT, returns true if valid, false if not.
@@ -59,7 +78,7 @@ module Authentic
       jwt = decode_jwt token
 
       begin
-        key = manager.get jwt
+        key = @@manager.get jwt
 
         # Slightly more accurate to raise a key error here for nil key,
         # rather then verify raising an error that would lead to InvalidToken
@@ -82,7 +101,7 @@ module Authentic
       raise InvalidToken, 'invalid nil JWT provided' unless token
 
       JSON::JWT.decode(token, :skip_verification).tap do |jwt|
-        raise InvalidToken, 'JWT iss was not located in provided whitelist' unless iss_whitelist.index jwt[:iss]
+        raise InvalidToken, 'JWT iss was not located in provided whitelist' unless @@iss_whitelist.index jwt[:iss]
       end
     rescue JSON::JWT::InvalidFormat
       raise InvalidToken, 'invalid JWT format'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: authentic-rb
 version: !ruby/object:Gem::Version
-  version: 1.0.4
+  version: 1.1.0
 platform: ruby
 authors:
 - Articulate
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-11-26 00:00:00.000000000 Z
+date: 2019-01-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json-jwt