authing_ruby 1.0.6

data/lib/authing_ruby/management/ManagementClient.rb

@@ -0,0 +1,66 @@
+# 管理模块
+require_relative './ManagementTokenProvider.rb'
+require_relative './UsersManagementClient.rb'
+require_relative './ApplicationsManagementClient.rb'
+require_relative './AclManagementClient.rb'
+require_relative './UserpoolManagementClient.rb'
+require_relative './RolesManagementClient.rb'
+
+module AuthingRuby
+  class ManagementClient
+    
+    def initialize(options = {})
+      @userPoolId = options.fetch(:userPoolId, nil)
+      @secret = options.fetch(:secret, nil)
+      @appId = options.fetch(:appId, nil)
+      @host = options.fetch(:host, nil)
+      @accessToken = options.fetch(:accessToken, nil)
+      
+      if @userPoolId == nil && @appId == nil
+        throw '请提供 userPoolId 或 appId!'
+      end
+
+      graphqlApiEndpointV2 = "#{@host}/graphql/v2"
+      @graphqlClient = AuthingRuby::Common::GraphqlClient.new(graphqlApiEndpointV2, options)
+      @tokenProvider = AuthingRuby::ManagementTokenProvider.new(options, @graphqlClient)
+      @httpClient = AuthingRuby::Common::HttpClient.new(options, @tokenProvider)
+      @publicKeyManager = AuthingRuby::Common::PublicKeyManager.new(options)
+
+      @users = AuthingRuby::UsersManagementClient.new(
+        options,
+        @graphqlClient,
+        @httpClient,
+        @tokenProvider,
+        @publicKeyManager
+      );
+
+      @applications = AuthingRuby::ApplicationsManagementClient.new(
+        options,
+        @httpClient,
+        @graphqlClient,
+        @tokenProvider,
+      );
+
+      @acl = AuthingRuby::AclManagementClient.new(
+        options,
+        @httpClient,
+        @graphqlClient,
+        @tokenProvider,
+      );
+
+    end
+
+    def users
+      return @users
+    end
+
+    def applications
+      return @applications
+    end
+
+    def acl
+      return @acl
+    end
+    
+  end
+end

data/lib/authing_ruby/management/ManagementTokenProvider.rb

@@ -0,0 +1,92 @@
+# 复刻一个 JS SDK 里的 ManagementTokenProvider（方法名字，返回值，参数的数量和顺序，都尽量保持一致）
+# 用途：管理 accessToken
+
+# authing.js/src/lib/management/ManagementTokenProvider.ts
+
+require_relative '../GraphQLAPI.rb'
+require 'jwt'
+
+module AuthingRuby
+  class ManagementTokenProvider
+
+    def initialize(options = {}, graphqlClient = nil)
+      @options = options;
+      @graphqlClient = graphqlClient;
+
+      @_accessToken = nil
+      @_accessTokenExpriredAt = nil # 过期时间
+  
+      accessToken = options.fetch(:accessToken, nil)
+      # 如果 options 里传入了 accessToken
+      if accessToken
+        @_accessToken = accessToken;
+        decoded_token_array = JWT.decode @_accessToken, nil, false # 试着解析一下
+        payload = decoded_token_array[0]
+        exp = payload.dig('exp'); # exp 是过期时间（秒）
+        @_accessTokenExpriredAt = exp; # 把过期时间存起来
+      end
+    end
+
+    # 用途：获取 access token，如果没过期就直接返回缓存的版本
+    # 如果过期了就重新去获取
+    def getToken()
+      accessToken = @options.fetch(:accessToken, nil)
+      return accessToken if accessToken
+      
+      # 缓存到 accessToken 过期前 3600 s
+      current_timestamps_in_second = Time.now.to_i
+      if @_accessToken && @_accessTokenExpriredAt > current_timestamps_in_second + 3600
+        return @_accessToken
+      end
+
+      return _getAccessTokenFromServer();
+    end
+
+    # 用途：发请求，从服务器获取新的 AccessToken
+    def _getAccessTokenFromServer
+      accessToken = nil;
+      secret = @options.fetch(:secret, nil)
+      if secret
+        accessToken = getClientWhenSdkInit()
+      else
+        accessToken = refreshToken()
+      end
+
+      @_accessToken = accessToken;
+      decoded_token_array = JWT.decode @_accessToken, nil, false
+      payload = decoded_token_array[0]
+      # {"data"=>{"type"=>"user", "userPoolId"=>"59f86b4832eb28071bdd9214", "arn"=>"arn:cn:authing:59f86b4832eb28071bdd9214:user:607b0b15aab3a805f7ea6617", "id"=>"607b0b15aab3a805f7ea6617", "userId"=>"607b0b15aab3a805f7ea6617", "_id"=>"607b0b15aab3a805f7ea6617", "phone"=>"13556136684", "email"=>nil, "username"=>nil, "unionid"=>nil, "openid"=>nil, "clientId"=>"59f86b4832eb28071bdd9214"}, "iat"=>1619579553, "exp"=>1620875553}
+      exp = payload.dig('exp'); # exp 是过期时间（秒）
+      @_accessTokenExpriredAt = exp
+      return @_accessToken;
+    end
+
+    # 发送 GraphQL 接口请求获取 accessToken
+    def getClientWhenSdkInit
+      variables = {
+        userPoolId: @options.fetch(:userPoolId, nil),
+        secret: @options.fetch(:secret, nil),
+      }
+      api = AuthingRuby::GraphQLAPI.new
+      res = api.getAccessToken(@graphqlClient, variables)
+      # {"data":{"accessToken":{"accessToken":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkYXRhIjp7InR5cGUiOiJ1[省略]ZWE2NjE3IiwidXNlcks2lkIjoiNjA3YjBiMTVhYWIzYTgwNWY3ZWE2NjE3IiwiX2lkIjoiNjA3YjBiMTVhYWIzYTgwNWY3ZWE2NjE3IiwicGhvbmz3Mzk5M30.K7pwyvbxypeiOlYRsTIlLXY2xyk94tTd-CATQ85jYqM","exp":1620873993,"iat":1619577993}}}
+      hash = JSON.parse(res)
+      return hash.dig("data", "accessToken", "accessToken")
+    end
+
+    # TODO 还需要做什么？
+    def refreshToken
+      api = AuthingRuby::GraphQLAPI.new
+      res = api.refreshAccessToken(@graphqlClient, {
+        accessToken: @options.fetch(:accessToken, nil)
+      })
+      hash = JSON.parse(res)
+      # puts hash
+      # {"errors"=>[{"message"=>{"code"=>500, "message"=>"该 token 在黑名单中"}, "locations"=>[{"line"=>2, "column"=>5}], "path"=>["refreshAccessToken"], "extensions"=>{"code"=>"INTERNAL_SERVER_ERROR", "exception"=>{"name"=>"TokenInBlackListError"}}}], "data"=>nil}
+      if hash.dig("errors")
+        return hash
+      end
+      return hash.dig("data", "refreshAccessToken", "accessToken")
+    end
+  end
+end

data/lib/authing_ruby/management/RolesManagementClient.rb

@@ -0,0 +1,38 @@
+# 管理角色
+# TODO: 这个只写了个架子，具体的还没实现
+
+module AuthingRuby
+  class RolesManagementClient
+
+    def initialize(options = {}, graphqlClient = nil, tokenProvider = nil)
+      @options = options
+      @graphqlClient = graphqlClient
+      @tokenProvider = tokenProvider
+    end
+
+    # 创建角色
+    def create
+    end
+
+    # 删除角色
+    def delete
+    end
+
+    # 修改角色
+    def update
+    end
+
+    # 获取角色列表
+    def list
+    end
+
+    # 添加用户
+    def addUsers
+    end
+
+    # 移除用户
+    def removeUsers
+    end
+    
+  end
+end

data/lib/authing_ruby/management/UserpoolManagementClient.rb

@@ -0,0 +1,15 @@
+# 管理用户池配置
+
+module AuthingRuby
+  class UserpoolManagementClient
+
+    # 查询用户池配置
+    def detail
+    end
+
+    # 更新用户池配置
+    def update
+    end
+
+  end
+end

data/lib/authing_ruby/management/UsersManagementClient.rb

@@ -0,0 +1,161 @@
+# UsersManagementClient 负责什么？
+# https://github.com/Authing/authing.js/blob/master/src/lib/management/UsersManagementClient.ts
+
+module AuthingRuby	
+  class UsersManagementClient
+
+    def initialize(options = {}, graphqlClient = nil, httpClient = nil, tokenProvider = nil, publicKeyManager = nil)
+      @options = options
+      @graphqlClient = graphqlClient
+      @httpClient = httpClient
+      @tokenProvider = tokenProvider
+      @publicKeyManager = publicKeyManager
+    end
+
+    # 创建用户
+    def create(userInfo = {}, options = {})
+      keepPassword = options.fetch(:keepPassword, false)
+      password = userInfo.fetch(:password, nil)
+      # 先对密码进行处理
+      if password
+        publicKey = @publicKeyManager.getPublicKey()
+        encryptedPassword = AuthingRuby::Utils.encrypt(password, publicKey)
+        userInfo[:password] = encryptedPassword
+      end
+
+      # 然后再发请求
+      graphqlAPI = AuthingRuby::GraphQLAPI.new
+      variables = {
+        "userInfo": userInfo,
+        "keepPassword": keepPassword,
+      }
+      res = graphqlAPI.createUser(@graphqlClient, @tokenProvider, variables)
+      return res
+    end
+
+    # 修改用户资料
+    def update(id, updates = {})
+      # 预处理密码（如果有的话）
+      password = updates.fetch(:password, nil)
+      if password
+        publicKey = @publicKeyManager.getPublicKey()
+        encryptedPassword = AuthingRuby::Utils.encrypt(password, publicKey)
+        updates[:password] = encryptedPassword
+      end
+
+      # 然后再发请求
+      graphqlAPI = AuthingRuby::GraphQLAPI.new
+      variables = {
+        "id": id,
+        "input": updates
+      }
+      res = graphqlAPI.updateUser(@graphqlClient, @tokenProvider, variables)
+      return res
+    end
+
+    # 通过 ID 获取用户信息
+    def detail(user_id)
+      graphqlAPI = AuthingRuby::GraphQLAPI.new
+      variables = {
+        "id": user_id,
+      }
+      res = graphqlAPI.user(@graphqlClient, @tokenProvider, variables)
+      return res
+    end
+
+    # 删除用户
+    def delete(user_id)
+      variables = {
+        "id": user_id,
+      }
+      graphqlAPI = AuthingRuby::GraphQLAPI.new
+      res = graphqlAPI.deleteUser(@graphqlClient, @tokenProvider, variables)
+      return res
+      # {"data":{"deleteUser":{"message":"删除成功！","code":200}}}
+    end
+
+    # 批量删除用户
+    def deleteMany(user_ids = [])
+      variables = {
+        "ids": user_ids,
+      }
+      graphqlAPI = AuthingRuby::GraphQLAPI.new
+      res = graphqlAPI.deleteUsers(@graphqlClient, @tokenProvider, variables)
+      return res
+      # {"data":{"deleteUsers":{"message":"删除成功！","code":200}}}
+    end
+
+    # 获取用户列表
+    def list(page = 1, limit = 10)
+      variables = {
+        "page": page,
+        "limit": limit,
+      }
+      graphqlAPI = AuthingRuby::GraphQLAPI.new
+      res = graphqlAPI.users(@graphqlClient, @tokenProvider, variables)
+      return res
+    end
+
+    # TODO
+    # 批量获取用户
+    def batch
+    end
+
+    # 检查用户是否存在
+    def exists(options = {})
+      username = options.fetch(:username, nil)
+      email = options.fetch(:email, nil)
+      phone = options.fetch(:phone, nil)
+      if username == nil && email == nil && phone == nil
+        throw "缺少参数, 请至少传入一个选项: username, email, phone"
+      end
+
+      variables = {
+        "username": username,
+        "email": email,
+        "phone": phone,
+      }
+      graphqlAPI = AuthingRuby::GraphQLAPI.new
+      res = graphqlAPI.isUserExists(@graphqlClient, @tokenProvider, variables)
+      json = JSON.parse(res)
+      return json.dig('data', "isUserExists")
+    end
+
+    # 查找用户
+    def find(options = {})
+      username = options.fetch(:username, nil)
+      email = options.fetch(:email, nil)
+      phone = options.fetch(:phone, nil)
+      externalId = options.fetch(:externalId, nil)
+      if username == nil && email == nil && phone == nil && externalId == nil
+        throw "缺少参数, 请至少传入一个选项: username, email, phone, externalId"
+      end
+
+      variables = {
+        "username": username,
+        "email": email,
+        "phone": phone,
+        "externalId": externalId,
+      }
+      graphqlAPI = AuthingRuby::GraphQLAPI.new
+      res = graphqlAPI.findUser(@graphqlClient, @tokenProvider, variables)
+      json = JSON.parse(res)
+      return json
+    end
+
+    # TODO
+    def search
+    end
+
+    # TODO
+    def refreshToken
+    end
+
+    # TODO
+    # 返回用户的所有角色
+    # https://docs.authing.cn/v2/guides/basics/authenticate-first-user/how-to-implement-access-control.html#%E5%9C%A8%E5%90%8E%E7%AB%AF%E9%80%9A%E8%BF%87%E7%94%A8%E6%88%B7%E8%A7%92%E8%89%B2%E6%8E%A7%E5%88%B6%E6%9D%83%E9%99%90
+    def listRoles(user_id)
+    end
+
+  end
+end

data/lib/authing_ruby/management/WhitelistManagementClient.rb

@@ -0,0 +1 @@
+# 管理注册白名单

data/lib/authing_ruby/test/RSA.rb

@@ -0,0 +1,18 @@
+# 用途：把一个字符串通过 RSA 公钥进行加密
+# 把这个加密后的字符串，传递给 Authing 的 registerbyemail 的 muation 的 password 字段
+# 如何运行: ruby ./lib/test/RSA.rb
+
+# 2021-4-24 结论：这个能运行，但是暂时不确定传递给  Authing 是否能用，要先解决用户池id 的问题
+# https://github.com/Authing/authing.js/blob/cf4757d09de3b44c3c3f4509ae8c8715c9f302a2/src/lib/common/GraphqlClient.ts#L6
+# 用户池 id 是请求头里 'x-authing-userpool-id' 指定的
+# 解决了，实测可以，这个公钥加密方式是正确的。可以用这个密码登录。
+
+require 'openssl'
+require "base64"
+
+# 公钥来自 https://rails-demo.authing.cn/api/v2/.well-known
+public_key = "-----BEGIN PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4xKeUgQ+Aoz7TLfAfs9+paePb\n5KIofVthEopwrXFkp8OCeocaTHt9ICjTT2QeJh6cZaDaArfZ873GPUn00eOIZ7Ae\n+TiA2BKHbCvloW3w5Lnqm70iSsUi5Fmu9/2+68GZRH9L7Mlh8cFksCicW2Y2W2uM\nGKl64GDcIq3au+aqJQIDAQAB\n-----END PUBLIC KEY-----\n"
+key = OpenSSL::PKey::RSA.new(public_key)
+str = "password112233"
+result = key.public_encrypt(str)
+puts Base64.encode64(result)  # 如果不 encode 64 就直接输出，命令行会看到乱码

data/lib/authing_ruby/test/helper.rb

@@ -0,0 +1,15 @@
+
+module Test
+	class Helper
+		# 随机字母字符串，默认 6 位长度
+		def randomString(length = 6)
+			endIndex = length % 26
+			('a'..'z').to_a.shuffle[0,endIndex].join
+		end
+
+		# 随机数字字符串
+		def randomNumString(n = 6)
+			srand.to_s.chars.last(n).join
+		end
+	end
+end

data/lib/authing_ruby/test/js_sdk_test/1.buildAuthorizeUrl.js

@@ -0,0 +1,43 @@
+// 如何运行: 
+// node ./lib/test/js_sdk_test/1.buildAuthorizeUrl.js
+const { AuthenticationClient } = require('authing-js-sdk')
+
+// 测试目的: 生成 OIDC 协议的用户登录链接
+const client = new AuthenticationClient({
+  appId: '60800b9151d040af9016d60b',
+  appHost: 'https://rails-demo.authing.cn',
+  redirectUri: 'http://localhost:3000/authing_callback',
+});
+let url = client.buildAuthorizeUrl({ scope: 'openid profile offline_access' });
+console.log(url);
+// 把这个 url 复制粘贴到浏览器里
+// https://rails-demo.authing.cn/oidc/auth?nonce=42585064286980057&state=939818283327392&scope=openid+profile+offline_access&client_id=60800b9151d040af9016d60b&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fauthing_callback&response_type=code&prompt=consent
+
+// 分析 JS SDK 生成的：
+// https://rails-demo.authing.cn/oidc/auth?
+// nonce=42585064286980057
+// &state=939818283327392
+// &scope=openid+profile+offline_access
+// &client_id=60800b9151d040af9016d60b
+// &redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fauthing_callback
+// &response_type=code
+// &prompt=consent
+
+// 我们 Ruby SDK 生成的:
+// https://rails-demo.authing.cn/oidc/auth?
+// nonce=9568662818019284
+// &state=0611701018967879
+// &scope=openid%20profile%20email%20phone%20address
+// &client_id=60800b9151d040af9016d60b
+// &redirect_uri=http%3A%2F%2Flocalhost%3A3000
+// &response_type=code
+// &response_mode=query
+// &client_id=60800b9151d040af9016d60b
+// &redirect_uri=http%3A%2F%2Flocalhost%3A3000
+
+// 错在哪里？
+// 1. 我们的 scope 不对
+// 2. 我们的 client_id 重复了
+// 3. 我们的 redirect_uri 和网页里设置的不一致
+// 4. 我们多了个 response_mode
+// 改正后就可以了

data/lib/authing_ruby/test/js_sdk_test/2.buildAuthorizeUrl_PKCE.js

@@ -0,0 +1,47 @@
+// 如何运行: 
+// node ./lib/test/js_sdk_test/2.buildAuthorizeUrl_PKCE.js
+const { AuthenticationClient } = require('authing-js-sdk')
+
+// 测试目的: 生成 OIDC 协议的用户登录链接
+const client = new AuthenticationClient({
+  appId: '60800b9151d040af9016d60b',
+  appHost: 'https://rails-demo.authing.cn',
+  redirectUri: 'http://localhost:3000/authing_callback',
+});
+
+// PKCE 场景使用示例
+// 生成一个 code_verifier
+let codeChallenge = client.generateCodeChallenge()
+// 计算 code_verifier 的 SHA256 摘要
+let codeChallengeDigest = client.getCodeChallengeDigest({ codeChallenge, method: 'S256' })
+// 构造 OIDC 授权码 + PKCE 模式登录 URL
+let url2 = client.buildAuthorizeUrl({ codeChallenge: codeChallengeDigest, codeChallengeMethod: 'S256' });
+console.log(url2)
+// https://rails-demo.authing.cn/oidc/auth?nonce=8366121074426842&state=8460658619689978&scope=openid+profile+email+phone+address&client_id=60800b9151d040af9016d60b&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fauthing_callback&response_type=code&code_challenge=LtE99dfPutuMXGSMCzKsbeTTCGlwmUi9sbQDFDZbB20&code_challenge_method=S256
+
+// 分析 JS SDK 生成的：
+// https://rails-demo.authing.cn/oidc/auth?
+// nonce=8366121074426842
+// &state=8460658619689978
+// &scope=openid+profile+email+phone+address
+// &client_id=60800b9151d040af9016d60b
+// &redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fauthing_callback
+// &response_type=code
+// &code_challenge=LtE99dfPutuMXGSMCzKsbeTTCGlwmUi9sbQDFDZbB20
+// &code_challenge_method=S256
+
+// 我们 Ruby SDK 生成的
+// https://rails-demo.authing.cn/oidc/auth?
+// nonce=1232057194833633
+// &state=3333848247084549
+// &scope=openid%20profile%20email%20phone%20address
+// &client_id=60800b9151d040af9016d60b
+// &redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fauthing_callback
+// &response_type=code
+// &code_challenge=NGZkOTJiMjYzY2Q3NTkzMjM5YTE5N2E3NTUyOGFiYWZiM2MzOTE0NmIyYTY1%0AYzE2YzYxMjRmYzczNjM5YTljMw%0A
+// &code_challenge_method=S256
+
+// 区别:
+// 1. scope 不同
+// 2. 我的少了 code_challenge
+// 3. 我的少了 code_challenge_method

data/lib/authing_ruby/test/js_sdk_test/README.md

@@ -0,0 +1,5 @@
+## 测试: Authing JS SDK
+说明：我们这个 Ruby SDK 都是模仿 JS SDK 的代码。   
+JS SDK 里有些地方光看代码还不够，需要实际跑一下，看看具体返回什么，这样能帮助理解。
+
+* `test/js_sdk_test/` 就是这些测试代码

data/lib/authing_ruby/test/js_sdk_test/node_modules/authing-js-sdk/CONTRIBUTION.md

@@ -0,0 +1,23 @@
+## 运行测试用例
+
+1. 添加配置文件 `.env`
+
+```
+AUTHING_USERPOOL_ID=5fe2005c10f750726160a04f
+AUTHING_USERPOOL_SECRET=818892297020b628eb5d75144db32146
+AUTHING_HOST=https://core.authing.cn
+```
+
+1. 执行 yarn watch
+
+2. 运行全部测试用例
+
+```
+npx ava build/main/lib/**/*.spec.js
+```
+
+3. 运行单个文件测试用例
+
+```
+npx ava build/main/lib/management/RolesManagementClient.spec.js
+```

data/lib/authing_ruby/test/js_sdk_test/node_modules/authing-js-sdk/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2019 cj
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.