authio 0.3.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 46dedee240bbb4a67ac3f37cc839f72a54ba31eec1524f0151887604cb90508c
+  data.tar.gz: b0e069d555664a0f4bc8c9f2f6db71cf93900602f0e094817bad05dc6e8efbf2
+SHA512:
+  metadata.gz: 90564c750d071a6f39f29570e162ffc865985f30e23c4da7f16178951e039b445660594da25b025b670c346d2c5fe04a81d43d19208240ee656a7b6488cca5a3
+  data.tar.gz: 7663208ef407426ab496969f936c00c40455596e3ace42553794e5c9851f7798a1f24623200b78e2fd877a40fc60d635c8df068ae0ecf857ee159b5969f56522

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Authio
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,152 @@
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset=".github/logo-dark.png">
+    <img alt="Authio" src=".github/logo-light.png" width="220">
+  </picture>
+</p>
+
+# authio (Ruby gem)
+
+> Part of **[Authio Lobby](https://authio.com/products/lobby)** —
+> Authio's drop-in passwordless authentication. Learn more at
+> https://authio.com/products/lobby.
+
+Authio Ruby SDK. Verifies session JWTs against Authio's JWKS, builds hosted
+sign-in URLs, and slots into Rails controllers via a `before_action` helper.
+
+## What's new — 2026-05-23 WorkOS-parity sprint
+
+The Authio API gained four new product surfaces this sprint
+([`authio_proto`](https://github.com/authio-com/authio_proto)). The Ruby gem already verifies the new JWT
+shape end-to-end (`claims["roles"]` and `claims["permissions"]` ride
+along on every customer session); idiomatic helpers for the new
+write-side endpoints are queued for the next release. Reference docs:
+
+- Embeddable widgets — [docs.authio.com/widgets/overview](https://docs.authio.com/widgets/overview)
+- Synchronous Actions — [docs.authio.com/actions/overview](https://docs.authio.com/actions/overview)
+  (Sinatra signature verification snippet on
+  [docs.authio.com/actions/signature-verification](https://docs.authio.com/actions/signature-verification))
+- DCR / CIMD / MCP — [docs.authio.com/concepts/dynamic-client-registration](https://docs.authio.com/concepts/dynamic-client-registration)
+- Roles + permissions — [docs.authio.com/concepts/roles-and-permissions](https://docs.authio.com/concepts/roles-and-permissions)
+
+## Install
+
+```ruby
+# Gemfile
+gem "authio", "~> 0.2"
+```
+
+```bash
+bundle install
+```
+
+## Configure
+
+```ruby
+# config/initializers/authio.rb
+Authio.configure do |config|
+  config.api_key = ENV.fetch("AUTHIO_SECRET_KEY", "")
+  # Management API (orgs, users, webhooks). JWT verify uses identity.authio.com.
+  config.api_url = ENV.fetch("AUTHIO_API_URL", "https://api.authio.com")
+  config.publishable_key = ENV.fetch("AUTHIO_PUBLISHABLE_KEY", "")
+  # JWKS + issuer for session JWT verify (EdDSA). Defaults to api_url if unset.
+  config.issuer = ENV.fetch("AUTHIO_ISSUER", "https://identity.authio.com")
+end
+```
+
+## Use in a Rails controller
+
+```ruby
+class ApplicationController < ActionController::Base
+  private
+
+  def authenticate_authio!
+    token = cookies[:authio_session]
+    @authio_session = token.present? ? Authio::Client.default.verify_token(token) : nil
+    unless @authio_session
+      redirect_to "/auth/sign-in?redirect_url=#{CGI.escape(request.fullpath)}"
+    end
+  end
+  helper_method :authio_session
+  attr_reader :authio_session
+end
+
+class DashboardController < ApplicationController
+  before_action :authenticate_authio!
+
+  def index
+    # @authio_session.user_id, @authio_session.org_id, @authio_session.role
+  end
+end
+```
+
+## API
+
+| Method                                            | Description                                       |
+| ------------------------------------------------- | ------------------------------------------------- |
+| `Authio.configure { |c| ... }`                    | Set api_key / api_url / publishable_key.          |
+| `Authio::Client.default`                          | Shared singleton.                                 |
+| `client.verify_token(token)`                      | Verify JWT vs cached JWKS. Returns `Session` or `nil`. |
+| `client.sign_in_url(redirect_url: "...")`         | Build the hosted-UI redirect URL.                 |
+| `client.start_magic_link(email:, redirect_url:)`  | POST `/v1/auth/magic-link/start`. Useful for tests. |
+| `Authio::Passkeys.list_passkeys(...)`             | List passkeys for the signed-in user.               |
+| `Authio::Passkeys.rename_passkey(...)`            | Rename a passkey nickname.                          |
+| `Authio::Passkeys.revoke_passkey(...)`            | Revoke a passkey.                                   |
+| `Authio::Passkeys.enroll_passkey_url(...)`        | Mint register-intent + build hosted-UI enroll URL.  |
+
+`Authio::Session` exposes `session_id`, `user_id`, `org_id`, `role`,
+`expires_at`, `claims`, `impersonation?`, `impersonator_email`.
+
+## Passkeys after signup
+
+The Ruby gem does not run WebAuthn ceremonies server-side. After a user
+signs up and you have their session access token, redirect them to the
+hosted sign-in UI to add a passkey:
+
+```ruby
+require "authio"
+
+token = cookies[:authio_session]
+api_url = ENV.fetch("AUTHIO_API_URL", "https://api.authio.com")
+project_id = ENV.fetch("AUTHIO_PROJECT_ID")
+sign_in_url = ENV.fetch("AUTHIO_SIGN_IN_URL") # hosted UI base, e.g. https://auth.acme.com
+
+# List / rename / revoke (server-side)
+devices = Authio::Passkeys.list_passkeys(
+  access_token: token,
+  project_id: project_id,
+  api_url: api_url,
+)
+Authio::Passkeys.rename_passkey(
+  access_token: token,
+  project_id: project_id,
+  api_url: api_url,
+  credential_id: devices.first.id,
+  name: "Work Mac",
+)
+
+# Enroll — redirect the browser (primary path for Rails apps)
+enroll_url = Authio::Passkeys.enroll_passkey_url(
+  access_token: token,
+  project_id: project_id,
+  api_url: api_url,
+  sign_in_url: sign_in_url,
+  email: current_user.email,
+  return_url: request.original_url,
+  next: "/account/security",
+)
+redirect_to enroll_url, allow_other_host: true
+```
+
+Lower-level helpers: `mint_passkey_register_intent` and
+`build_enroll_passkey_url` when you want to split intent minting from URL
+construction.
+
+## Requirements
+
+- Ruby 3.0+
+- `jwt` ~> 2.7 (installed automatically)
+
+## License
+
+MIT

data/authio.gemspec

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require_relative "lib/authio/version"
+
+Gem::Specification.new do |spec|
+  spec.name = "authio"
+  spec.version = Authio::VERSION
+  spec.authors = ["Authio"]
+  spec.email = ["dev@authio.com"]
+
+  spec.summary = "Authio Ruby SDK — passwordless, multi-org auth for B2B Rails apps."
+  spec.description = "Verify Authio session JWTs against the JWKS, mint magic-link sign-in URLs, " \
+                     "and integrate with Rails controllers via `before_action :authenticate_authio!`."
+  spec.homepage = "https://github.com/Authio-com/authio_ruby"
+  spec.license = "MIT"
+  spec.required_ruby_version = ">= 3.0.0"
+
+  spec.metadata = {
+    "homepage_uri" => spec.homepage,
+    "source_code_uri" => spec.homepage,
+    "rubygems_mfa_required" => "true",
+  }
+
+  spec.files = Dir["lib/**/*.rb", "README.md", "LICENSE", "authio.gemspec"]
+  spec.require_paths = ["lib"]
+
+  # >= 2.10.3 excludes the empty-key HMAC bypass (GHSA / CVE-2026-44351
+  # sibling); staying under 3.0 keeps the 2.x API for consumers.
+  spec.add_dependency "jwt", "~> 2.10", ">= 2.10.3"
+  spec.add_dependency "jwt-eddsa", "~> 0.9"
+
+  spec.add_development_dependency "rspec", "~> 3.12"
+  spec.add_development_dependency "webmock", "~> 3.18"
+end

data/lib/authio/client.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require "cgi"
+require "json"
+require "net/http"
+require "time"
+require "uri"
+
+module Authio
+  class Client
+    RESERVED_CLAIMS = %w[
+      iss sub aud exp iat jti nbf scope scopes sid act_org act_role
+      client_id token_type project_id is_impersonation
+      impersonator_user_id impersonator_email imp_grant_id
+    ].freeze
+
+    def self.default
+      @default ||= new(Authio.configuration)
+    end
+
+    def self.reset_default!
+      @default = nil
+    end
+
+    attr_reader :configuration
+
+    def initialize(configuration = Authio.configuration)
+      @configuration = configuration
+      @verifier = JwksVerifier.new(
+        api_url: configuration.effective_api_url,
+        issuer: configuration.effective_issuer,
+        audience: configuration.audience,
+        project_id: configuration.project_id,
+      )
+    end
+
+    # Verify an Authio access token. Returns a {Session} or nil when the
+    # token is missing / expired / cryptographically invalid.
+    def verify_token(token)
+      return nil if token.nil? || token.empty?
+
+      begin
+        claims = @verifier.verify(token)
+      rescue JWT::DecodeError, JWT::VerificationError, JWT::ExpiredSignature, StandardError
+        return nil
+      end
+
+      merged = claims.reject { |k, _| RESERVED_CLAIMS.include?(k) }
+      Session.new(
+        session_id: claims["sid"].to_s,
+        user_id: claims["sub"].to_s,
+        org_id: (claims["act_org"] && !claims["act_org"].empty? ? claims["act_org"] : nil),
+        role: (claims["act_role"] && !claims["act_role"].empty? ? claims["act_role"] : nil),
+        expires_at: claims["exp"] ? Time.at(claims["exp"]).utc.iso8601 : Time.now.utc.iso8601,
+        claims: merged,
+        impersonation?: claims["is_impersonation"] == true,
+        impersonator_email: claims["impersonator_email"],
+      )
+    end
+
+    # Build the hosted sign-in URL the browser should send the user to.
+    # The hosted UI handles passkey / magic-link / OAuth and redirects
+    # back to `redirect_url` with `?access_token=…` on success.
+    def sign_in_url(redirect_url:)
+      base = configuration.effective_api_url
+      "#{base}/v1/auth/sign-in?publishable_key=#{CGI.escape(configuration.publishable_key)}&redirect_url=#{CGI.escape(redirect_url)}"
+    end
+
+    # Server-side magic-link starter — useful for testing.
+    def start_magic_link(email:, redirect_url:)
+      uri = URI("#{configuration.effective_api_url}/v1/auth/magic-link/start")
+      req = Net::HTTP::Post.new(uri, {
+        "content-type" => "application/json",
+        "x-publishable-key" => configuration.publishable_key,
+      })
+      req.body = JSON.generate({ email: email, redirect_url: redirect_url })
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = uri.scheme == "https"
+      res = http.request(req)
+      raise Authio::Error.new(code: "magic_link_failed", message: res.body.to_s, status: res.code.to_i) unless res.is_a?(Net::HTTPSuccess)
+
+      JSON.parse(res.body) rescue {}
+    end
+  end
+end

data/lib/authio/configuration.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module Authio
+  class Configuration
+    attr_accessor :api_key, :api_url, :publishable_key, :issuer, :audience,
+                  :project_id
+
+    def initialize
+      @api_key = ""
+      @api_url = "https://api.authio.com"
+      @publishable_key = ""
+      @issuer = nil
+      @audience = "authio"
+      # Tenant binding. auth-core signs every tenant's tokens with one
+      # platform key under one fixed issuer/audience, so project_id is the
+      # only claim saying a token was minted for you rather than in
+      # someone else's Authio project — and sign-up is self-serve, so a
+      # valid foreign token is free to obtain. Defaults from the env var
+      # the docs already ask for.
+      @project_id = ENV["AUTHIO_PROJECT_ID"]&.strip
+      @project_id = nil if @project_id == ""
+    end
+
+    def effective_issuer
+      @issuer || JwksVerifier.strip_trailing_slashes(@api_url)
+    end
+
+    def effective_api_url
+      JwksVerifier.strip_trailing_slashes(@api_url)
+    end
+  end
+end

data/lib/authio/errors.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Authio
+  class Error < StandardError
+    attr_reader :code, :status
+
+    def initialize(code:, message:, status: 500)
+      super(message)
+      @code = code
+      @status = status
+    end
+  end
+end

data/lib/authio/jwks_verifier.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require "json"
+require "jwt"
+require "jwt/eddsa"
+require "net/http"
+require "uri"
+
+module Authio
+  # Verifies Authio access JWTs against the cached JWKS.
+  #
+  # Authio's auth-core signs JWTs with EdDSA (Ed25519). JWT.decode is
+  # routed through the JWKS keyset; the keyset is fetched lazily and
+  # cached for ~10 minutes.
+  class JwksVerifier
+    CACHE_TTL = 600
+    COOLDOWN = 30
+
+    def initialize(api_url:, issuer:, audience:, project_id: nil, http: nil)
+      @api_url = self.class.strip_trailing_slashes(api_url)
+      @issuer = issuer
+      @audience = audience
+      @project_id = project_id
+      @http = http
+      @keys = nil
+      @fetched_at = 0
+    end
+
+
+    # Strip trailing slashes without a regex.
+    #
+    # `sub(%r{/+\z}, "")` backtracks polynomially on a string of many
+    # slashes (CodeQL rb/polynomial-redos). api_url is operator-configured
+    # rather than attacker-supplied, so the exposure is small, but a
+    # linear scan is just as short and cannot degrade.
+    def self.strip_trailing_slashes(value)
+      s = value.to_s
+      s = s[0..-2] while s.end_with?("/")
+      s
+    end
+
+    # @return [Hash] decoded JWT claims, e.g. { "sub" => "user_...", ... }
+    def verify(token)
+      keys = fetch_keys
+      payload, = JWT.decode(
+        token,
+        nil,
+        true,
+        algorithms: ["EdDSA"],
+        iss: @issuer,
+        aud: @audience,
+        verify_iss: true,
+        verify_aud: true,
+        jwks: { keys: keys },
+      )
+      raise "authio: token missing sub" if payload["sub"].nil? || payload["sub"].empty?
+
+      assert_tenant(payload)
+      payload
+    end
+
+    private
+
+    # Tenant binding (security audit 2026-09-18).
+    #
+    # Signature, issuer and audience prove a token came from Authio. They
+    # do NOT prove it was minted for THIS customer: auth-core signs every
+    # tenant with one platform key under one fixed issuer/audience, so
+    # project_id is the only claim that tells two tenants apart. Sign-up
+    # is self-serve, so anyone can create ceo@your-company.com in their
+    # own project and present the resulting token here.
+    #
+    # Unset project_id keeps the previous behaviour and warns once, so
+    # upgrading the gem cannot sign anyone out on its own.
+    def assert_tenant(payload)
+      if @project_id.nil? || @project_id.empty?
+        warn_once(
+          :no_project,
+          "authio: no project_id configured, so tokens are not checked against " \
+          "your tenant. Any Authio-issued token will verify here, including one " \
+          "minted in someone else's project. Set AUTHIO_PROJECT_ID or " \
+          "Authio.configuration.project_id.",
+        )
+        return
+      end
+
+      claimed = payload["project_id"]
+      return if claimed == @project_id
+
+      raise "authio: token was issued for project #{claimed.inspect}, not #{@project_id.inspect}"
+    end
+
+    def warn_once(key, message)
+      @warned ||= {}
+      return if @warned[key]
+
+      @warned[key] = true
+      warn(message)
+    end
+
+    def fetch_keys
+      now = Time.now.to_i
+      return @keys if @keys && now - @fetched_at < CACHE_TTL
+      return @keys if @keys && now - @fetched_at < COOLDOWN
+
+      uri = URI("#{@api_url}/v1/auth/.well-known/jwks.json")
+      body = @http ? @http.get(uri.to_s) : Net::HTTP.get(uri)
+      data = JSON.parse(body)
+      raise "authio: invalid JWKS at #{uri}" unless data["keys"].is_a?(Array)
+
+      @keys = data["keys"]
+      @fetched_at = now
+      @keys
+    end
+  end
+end

data/lib/authio/passkeys.rb

@@ -0,0 +1,161 @@
+# frozen_string_literal: true
+
+require "cgi"
+require "json"
+require "net/http"
+require "uri"
+
+module Authio
+  # Passkey management against auth-core `/v1/me/passkeys`.
+  #
+  # WebAuthn ceremonies are not available server-side — use
+  # {#enroll_passkey_url} to redirect the browser to the hosted sign-in UI
+  # (`mode=add_credential`).
+  module Passkeys
+    Passkey = Struct.new(
+      :id,
+      :nickname,
+      :aaguid,
+      :authenticator_name,
+      :transports,
+      :sign_count,
+      :last_used_at,
+      :created_at,
+      keyword_init: true,
+    ) do
+      def self.from_hash(row)
+        new(
+          id: row["id"],
+          nickname: row["nickname"],
+          aaguid: row["aaguid"],
+          authenticator_name: row["authenticator_name"],
+          transports: row["transports"] || [],
+          sign_count: row["sign_count"],
+          last_used_at: row["last_used_at"],
+          created_at: row["created_at"],
+        )
+      end
+    end
+
+    RegisterIntent = Struct.new(:token, :expires_in, keyword_init: true)
+
+    module_function
+
+    # List passkeys for the signed-in user (`GET /v1/me/passkeys`).
+    def list_passkeys(access_token:, project_id:, api_url:)
+      res = api_request(
+        access_token: access_token,
+        project_id: project_id,
+        api_url: api_url,
+        method: "GET",
+        path: "/v1/me/passkeys",
+      )
+      (res["data"] || []).map { |row| Passkey.from_hash(row) }
+    end
+
+    # Rename a passkey (`PATCH /v1/me/passkeys/{credential_id}`).
+    def rename_passkey(access_token:, project_id:, api_url:, credential_id:, name:)
+      api_request(
+        access_token: access_token,
+        project_id: project_id,
+        api_url: api_url,
+        method: "PATCH",
+        path: "/v1/me/passkeys/#{URI.encode_www_form_component(credential_id.to_s)}",
+        body: { nickname: name },
+      )
+      nil
+    end
+
+    # Revoke a passkey (`DELETE /v1/me/passkeys/{credential_id}`).
+    def revoke_passkey(access_token:, project_id:, api_url:, credential_id:)
+      api_request(
+        access_token: access_token,
+        project_id: project_id,
+        api_url: api_url,
+        method: "DELETE",
+        path: "/v1/me/passkeys/#{URI.encode_www_form_component(credential_id.to_s)}",
+      )
+      nil
+    end
+
+    # Mint a short-lived JWT for add-credential WebAuthn (`POST register-intent`).
+    def mint_passkey_register_intent(access_token:, project_id:, api_url:)
+      body = api_request(
+        access_token: access_token,
+        project_id: project_id,
+        api_url: api_url,
+        method: "POST",
+        path: "/v1/me/passkeys/register-intent",
+        body: {},
+      )
+      RegisterIntent.new(token: body["token"], expires_in: body["expires_in"])
+    end
+
+    # Build the hosted-UI URL for `mode=add_credential` passkey enrollment.
+    def build_enroll_passkey_url(sign_in_url:, project_id:, email:, register_token:, return_url:, next: nil)
+      next_path = binding.local_variable_get(:next)
+      base = JwksVerifier.strip_trailing_slashes(sign_in_url)
+      params = [
+        ["mode", "add_credential"],
+        ["project_id", project_id],
+        ["email", email],
+        ["token", register_token],
+        ["redirect_uri", return_url],
+      ]
+      params << ["next", next_path] unless next_path.nil?
+      query = params.map { |k, v| "#{URI.encode_www_form_component(k)}=#{URI.encode_www_form_component(v.to_s)}" }.join("&")
+      "#{base}?#{query}"
+    end
+
+    # Mint a register-intent token and return the hosted-UI enrollment URL.
+    #
+    # Redirect the browser to this URL — Ruby cannot run WebAuthn ceremonies.
+    def enroll_passkey_url(access_token:, project_id:, api_url:, sign_in_url:, email:, return_url:, next: nil)
+      next_path = binding.local_variable_get(:next)
+      intent = mint_passkey_register_intent(
+        access_token: access_token,
+        project_id: project_id,
+        api_url: api_url,
+      )
+      build_enroll_passkey_url(
+        sign_in_url: sign_in_url,
+        project_id: project_id,
+        email: email,
+        register_token: intent.token,
+        return_url: return_url,
+        next: next_path,
+      )
+    end
+
+    def api_request(access_token:, project_id:, api_url:, method:, path:, body: nil)
+      base = JwksVerifier.strip_trailing_slashes(api_url)
+      uri = URI("#{base}#{path}")
+      req_class = Net::HTTP.const_get(method.capitalize)
+      req = req_class.new(uri)
+      req["accept"] = "application/json"
+      req["content-type"] = "application/json"
+      req["authorization"] = "Bearer #{access_token}"
+      req["x-authio-project"] = project_id
+      req["x-authio-sdk"] = "authio-ruby/#{Authio::VERSION}"
+      req.body = JSON.generate(body) if body
+
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = uri.scheme == "https"
+      res = http.request(req)
+
+      unless res.is_a?(Net::HTTPSuccess)
+        parsed = JSON.parse(res.body) rescue {}
+        raise Authio::Error.new(
+          code: parsed["code"] || parsed["error"] || "request_failed",
+          message: parsed["message"] || res.body.to_s,
+          status: res.code.to_i,
+        )
+      end
+
+      return {} if res.body.nil? || res.body.empty?
+
+      JSON.parse(res.body)
+    end
+    private_class_method :api_request
+  end
+end

data/lib/authio/session.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Authio
+  # A verified Authio session. `user_id` is always set; `org_id` may be
+  # nil when the user authenticated but has not yet selected one of
+  # their memberships.
+  Session = Struct.new(
+    :session_id,
+    :user_id,
+    :org_id,
+    :role,
+    :expires_at,
+    :claims,
+    :impersonation?,
+    :impersonator_email,
+    keyword_init: true,
+  ) do
+    def to_h
+      {
+        session_id: session_id,
+        user_id: user_id,
+        org_id: org_id,
+        role: role,
+        expires_at: expires_at,
+        claims: claims || {},
+        is_impersonation: impersonation? == true,
+        impersonator_email: impersonator_email,
+      }
+    end
+  end
+end

data/lib/authio/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Authio
+  VERSION = "0.3.0"
+end

data/lib/authio.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require_relative "authio/version"
+require_relative "authio/configuration"
+require_relative "authio/session"
+require_relative "authio/jwks_verifier"
+require_relative "authio/client"
+require_relative "authio/passkeys"
+require_relative "authio/errors"
+
+# Authio — passwordless, multi-org auth for B2B Ruby / Rails apps.
+#
+#   Authio.configure do |c|
+#     c.api_key = ENV["AUTHIO_SECRET_KEY"]
+#     c.api_url = "https://api.authio.com"
+#     c.publishable_key = ENV["AUTHIO_PUBLISHABLE_KEY"]
+#   end
+#
+#   session = Authio::Client.default.verify_token(token)
+#   session&.user_id  # => "user_..."
+#   session&.org_id   # => "org_..." or nil for users who haven't picked an org yet
+module Authio
+  def self.configure
+    yield configuration
+  end
+
+  def self.configuration
+    @configuration ||= Configuration.new
+  end
+
+  def self.reset_configuration!
+    @configuration = Configuration.new
+  end
+end

metadata

@@ -0,0 +1,120 @@
+--- !ruby/object:Gem::Specification
+name: authio
+version: !ruby/object:Gem::Version
+  version: 0.3.0
+platform: ruby
+authors:
+- Authio
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2026-10-03 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.10'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.10.3
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.10'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.10.3
+- !ruby/object:Gem::Dependency
+  name: jwt-eddsa
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.12'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.12'
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.18'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.18'
+description: Verify Authio session JWTs against the JWKS, mint magic-link sign-in
+  URLs, and integrate with Rails controllers via `before_action :authenticate_authio!`.
+email:
+- dev@authio.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- authio.gemspec
+- lib/authio.rb
+- lib/authio/client.rb
+- lib/authio/configuration.rb
+- lib/authio/errors.rb
+- lib/authio/jwks_verifier.rb
+- lib/authio/passkeys.rb
+- lib/authio/session.rb
+- lib/authio/version.rb
+homepage: https://github.com/Authio-com/authio_ruby
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/Authio-com/authio_ruby
+  source_code_uri: https://github.com/Authio-com/authio_ruby
+  rubygems_mfa_required: 'true'
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.0.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.5.22
+signing_key:
+specification_version: 4
+summary: Authio Ruby SDK — passwordless, multi-org auth for B2B Rails apps.
+test_files: []