authproto 0.3.0.beta1 → 0.3.0.beta2

data/lib/authproto/dpop/client.rb

@@ -15,6 +15,8 @@ module AuthProto
 
   module DPoP
 
+    ERROR_USE_NONCE = "use_dpop_nonce"
+
     # High-level client for managing DPoP operations. Integrates key management,
     # proof generation, and nonce tracking to provide a complete DPoP client
     # implementation according to RFC 9449.
@@ -60,23 +62,25 @@ module AuthProto
 
       # Generates a fresh DPoP proof using a supplied or stored nonce for the origin.
       #
-      # @param http_method [String] HTTP method, converted to uppercase
-      # @param http_uri [String] absolute HTTP(S) URL; callers should omit the query and fragment
+      # @param method [String] HTTP method, converted to uppercase
+      # @param uri [String] absolute HTTP(S) URL; callers should omit the query and fragment
       # @param access_token [String, nil] token to bind with an `ath` claim
       # @param nonce [String, nil] explicit nonce; `nil` looks up the origin's stored nonce
       # @return [JOSE::SignedBinary] compact signed DPoP JWT
       # @raise [Error] if URI parsing, nonce lookup or signing fails
       #
-      def generate_proof(http_method:, http_uri:, access_token: nil, nonce: nil)
-        uri = URI(http_uri)
-        server_url = "#{uri.scheme}://#{uri.host}#{":#{uri.port}" if uri.port != uri.default_port}"
+      def generate_proof(method:, uri:, access_token: nil, nonce: nil)
+        parsed_uri = URI(uri)
+
+        server_url = "#{parsed_uri.scheme}://#{parsed_uri.host}"
+        server_url += ":#{parsed_uri.port}" if parsed_uri.port != parsed_uri.default_port
 
         # Use provided nonce or get one from the manager
         nonce ||= @nonce_manager.get(server_url)
 
         @proof_generator.generate(
-          http_method: http_method,
-          http_uri: http_uri,
+          method: method,
+          uri: uri,
           nonce: nonce,
           access_token: access_token
         )
@@ -96,7 +100,7 @@ module AuthProto
         return unless response_headers
 
         # Look for DPoP-Nonce header (case insensitive)
-        nonce = response_headers.find { |k, _| k.downcase == "dpop-nonce" }&.last
+        nonce = response_headers.find { |k, v| k.downcase == 'dpop-nonce' }&.last
         return unless nonce
 
         # Store new nonce for future requests
@@ -104,58 +108,6 @@ module AuthProto
       rescue StandardError => e
         raise Error, "Failed to process response: #{e.message}"
       end
-
-      # Wraps a proof in an HTTP header hash.
-      #
-      # @param proof [String] signed DPoP JWT
-      # @return [Hash{String => String}] a single `DPoP` header
-      #
-      def request_headers(proof)
-        {
-          "DPoP" => proof
-        }
-      end
-
-      # Exports the current public signing key.
-      #
-      # @return [Hash{String => Object}] public JWK
-      # @raise [KeyManager::KeyError] if public-key export fails
-      #
-      def public_key
-        @key_manager.public_jwk
-      end
-
-      # Exports the current DPoP key for persistence or inspection.
-      #
-      # @param include_private [Boolean] include the private key needed to restore the same identity
-      # @return [JOSE::Map] JWK fields; call `to_h` for a Ruby hash
-      # @raise [KeyManager::KeyError] if key export fails
-      #
-      def export_key(include_private: false)
-        @key_manager.to_jwk(include_private: include_private)
-      end
-
-
-      private
-
-      def extract_nonce(headers)
-        # Headers can be hash with string or symbol keys, or http headers object
-        headers = headers.to_h if headers.respond_to?(:to_h)
-
-        # Try different common header key formats
-        nonce = headers["DPoP-Nonce"] || headers["dpop-nonce"] || headers[:dpop_nonce]
-
-        nonce&.strip
-      end
-
-      def origin_for_uri(uri)
-        port = uri.port
-        port = nil if (uri.scheme == "https" && port == 443) || (uri.scheme == "http" && port == 80)
-
-        origin = "#{uri.scheme}://#{uri.host}"
-        origin = "#{origin}:#{port}" if port
-        origin
-      end
     end
   end
 end

data/lib/authproto/dpop/key_manager.rb

@@ -55,13 +55,13 @@ module AuthProto
 
         # Create new map with all required properties
         key_map = {
-          "kty" => base_map["kty"],
-          "crv" => base_map["crv"],
-          "x" => base_map["x"],
-          "y" => base_map["y"],
-          "d" => base_map["d"],
-          "use" => "sig",
-          "kid" => generate_kid(base_map)
+          'kty' => base_map['kty'],
+          'crv' => base_map['crv'],
+          'x' => base_map['x'],
+          'y' => base_map['y'],
+          'd' => base_map['d'],
+          'use' => 'sig',
+          'kid' => generate_kid(base_map)
         }
 
         # Create new JWK with all properties
@@ -78,8 +78,8 @@ module AuthProto
       def public_jwk
         jwk = @keypair.to_public.to_map.to_h
         # If somehow the properties aren't set, add them
-        jwk["use"] ||= "sig"
-        jwk["kid"] ||= generate_kid(jwk)
+        jwk['use'] ||= 'sig'
+        jwk['kid'] ||= generate_kid(jwk)
         jwk
       rescue StandardError => e
         raise KeyError, "Failed to export public key: #{e.message}"
@@ -111,7 +111,7 @@ module AuthProto
         payload = deep_stringify_keys(payload)
 
         # Configure JOSE to use ES256 for signing
-        signing_config = { "alg" => "ES256" }
+        signing_config = { 'alg' => 'ES256' }
 
         # Merge our header with JOSE's required fields
         full_header = header.merge(signing_config)
@@ -190,11 +190,11 @@ module AuthProto
       def generate_kid(jwk)
         # Generate a key ID based on the key's components
         components = [
-          jwk["kty"],
-          jwk["crv"],
-          jwk["x"],
-          jwk["y"]
-        ].join(":")
+          jwk['kty'],
+          jwk['crv'],
+          jwk['x'],
+          jwk['y']
+        ].join(':')
 
         # Create a SHA-256 hash and take first 8 bytes
         digest = OpenSSL::Digest::SHA256.digest(components)
@@ -208,11 +208,11 @@ module AuthProto
         raise KeyError, "Invalid key type: #{@keypair.kty}, must be :ec" unless @keypair.kty.is_a?(JOSE::JWK::KTY_EC)
 
         # Verify the curve
-        curve = @keypair.to_map["crv"]
+        curve = @keypair.to_map['crv']
         raise KeyError, "Invalid curve: #{curve}, must be #{CURVE}" unless curve == CURVE
 
         # Verify we can perform basic operations
-        test_data = "test"
+        test_data = 'test'
         signed = sign(test_data)
         raise KeyError, "Key validation failed: signature verification error" unless verify(signed)
       rescue StandardError => e

data/lib/authproto/dpop/nonce_manager.rb

@@ -6,6 +6,7 @@ require_relative '../configuration'
 require_relative '../errors'
 require_relative '../serialization/stored_nonce'
 require_relative '../storage/key_builder'
+require_relative '../validated_uri'
 require_relative 'stored_nonce'
 
 module AuthProto
@@ -94,27 +95,13 @@ module AuthProto
         AuthProto.storage.delete(key)
       end
 
-      # Checks for an unexpired nonce record in storage for a URL's origin.
-      #
-      # @param server_url [String] HTTPS URL, or HTTP URL with host `localhost`
-      # @return [Boolean] whether the backend reports a nonce record present
-      # @raise [NonceError] if the URL is invalid
-      # @raise [Storage::StorageError] if the existence check fails
-      #
-      def valid_nonce?(server_url)
-        validate_server_url(server_url)
-        origin = normalize_server_url(server_url)
-        key = Storage::KeyBuilder.nonce_key(origin)
-        AuthProto.storage.exists?(key)
-      end
-
       private
 
       def normalize_server_url(url)
         uri = URI(url)
         port = uri.port
-        port = nil if (uri.scheme == "https" && port == 443) ||
-                      (uri.scheme == "http" && port == 80)
+        port = nil if (uri.scheme == 'https' && port == 443) ||
+                      (uri.scheme == 'http' && port == 80)
 
         origin = "#{uri.scheme}://#{uri.host}"
         origin = "#{origin}:#{port}" if port
@@ -130,11 +117,10 @@ module AuthProto
       def validate_server_url(server_url)
         raise NonceError, "server_url is required" if server_url.nil? || server_url.empty?
 
-        uri = URI(server_url)
-        raise NonceError, "server_url must be HTTP(S)" unless uri.is_a?(URI::HTTP)
+        uri = ValidatedURI.new(server_url)
 
         # Allow HTTP for localhost only
-        if uri.host != "localhost" && uri.scheme != "https"
+        if uri.host != 'localhost' && uri.scheme != 'https'
           raise NonceError, "server_url must be HTTPS (except for localhost)"
         end
       rescue URI::InvalidURIError => e

data/lib/authproto/dpop/proof_generator.rb

@@ -6,6 +6,7 @@ require 'securerandom'
 require 'uri'
 
 require_relative '../errors'
+require_relative '../validated_uri'
 require_relative 'key_manager'
 
 module AuthProto
@@ -42,24 +43,24 @@ module AuthProto
       # Builds and signs a fresh DPoP JWT with `jti`, `htm`, `htu` and `iat` claims.
       #
       # A nonce and access-token hash are added when requested. The URI normalizer removes
-      # fragments and default ports; callers must remove query strings before calling.
+      # query strings, fragments and default ports.
       #
-      # @param http_method [String] nonempty HTTP method, converted to uppercase
-      # @param http_uri [String] absolute HTTP(S) request URL without a query string
+      # @param method [String] nonempty HTTP method, converted to uppercase
+      # @param uri [String] absolute HTTP(S) request URL
       # @param nonce [String, nil] server-provided nonce to include
       # @param access_token [String, nil] access token to bind to the proof
       # @param ath [Boolean, nil] include an access-token hash; `nil` enables it when a token is supplied
       # @return [JOSE::SignedBinary] compact signed DPoP JWT
       # @raise [ProofError] if input validation or proof generation fails
       #
-      def generate(http_method:, http_uri:, nonce: nil, access_token: nil, ath: nil)
-        validate_inputs(http_method, http_uri)
+      def generate(method:, uri:, nonce: nil, access_token: nil, ath: nil)
+        validate_inputs(method, uri)
         ath = !access_token.nil? if ath.nil?
 
         header = build_header
         payload = build_payload(
-          http_method: http_method,
-          http_uri: http_uri,
+          method: method,
+          uri: uri,
           nonce: nonce,
           access_token: access_token,
           include_ath: ath
@@ -72,46 +73,49 @@ module AuthProto
 
       private
 
-      def validate_inputs(http_method, http_uri)
-        raise ProofError, "http_method is required" if http_method.nil? || http_method.empty?
-        raise ProofError, "http_uri is required" if http_uri.nil? || http_uri.empty?
+      def validate_inputs(method, uri)
+        raise ProofError, "method is required" if method.nil? || method.empty?
+        raise ProofError, "uri is required" if uri.nil? || uri.empty?
 
-        uri = URI(http_uri)
-        raise ProofError, "invalid http_uri" unless uri.is_a?(URI::HTTP)
+        ValidatedURI.new(uri)
       rescue URI::InvalidURIError => e
-        raise ProofError, "invalid http_uri: #{e.message}"
+        raise ProofError, "invalid uri: #{e.message}"
       end
 
       def build_header
         {
-          typ: "dpop+jwt",
-          alg: "ES256",
+          typ: 'dpop+jwt',
+          alg: 'ES256',
           jwk: key_manager.public_jwk.to_h
         }
       end
 
-      def build_payload(http_method:, http_uri:, nonce: nil, access_token: nil, include_ath: nil)
+      def build_payload(method:, uri:, nonce: nil, access_token: nil, include_ath: nil)
         payload = {
-          "jti" => SecureRandom.uuid,
-          "htm" => http_method.upcase,
-          "htu" => normalize_uri(http_uri),
-          "iat" => Time.now.to_i
+          'jti' => SecureRandom.uuid,
+          'htm' => method.upcase,
+          'htu' => normalize_uri(uri),
+          'iat' => Time.now.to_i
         }
 
         # Add the nonce if provided
-        payload["nonce"] = nonce if nonce
+        payload['nonce'] = nonce if nonce
 
         # Add access token hash if needed
-        payload["ath"] = generate_access_token_hash(access_token) if access_token && include_ath
+        payload['ath'] = generate_access_token_hash(access_token) if access_token && include_ath
 
         payload
       end
 
       def normalize_uri(uri)
         uri = URI(uri)
+
         # Remove default ports
-        uri.port = nil if (uri.scheme == "https" && uri.port == 443) || (uri.scheme == "http" && uri.port == 80)
+        uri.port = nil if (uri.scheme == 'https' && uri.port == 443) || (uri.scheme == 'http' && uri.port == 80)
+
+        uri.query = nil
         uri.fragment = nil
+
         uri.to_s
       end
 

data/lib/authproto/errors.rb

@@ -58,7 +58,7 @@ module AuthProto
   #
   # @example Handling authorization server errors
   #   begin
-  #     server = AuthProto::ServerMetadata::AuthorizationServer.from_issuer("https://auth.example.com")
+  #     server = AuthProto::Metadata::AuthorizationServer.from_url("https://auth.example.com")
   #   rescue AuthProto::InvalidAuthorizationServer => e
   #     puts "Failed to validate authorization server: #{e.message}"
   #   end

data/lib/authproto/http_client.rb

@@ -7,6 +7,7 @@ require 'resolv'
 require 'uri'
 
 require_relative 'errors'
+require_relative 'validated_uri'
 
 module AuthProto
 
@@ -96,20 +97,20 @@ module AuthProto
     # Sends an HTTP GET request with destination validation and redirect handling.
     #
     # Uses HTTPS and rejects private/loopback destinations by default. Subclasses may
-    # relax these rules. Follows at most {MAX_REDIRECTS} redirects and checks size
+    # relax these rules. When enabled, follows at most {MAX_REDIRECTS} redirects and checks size
     # against {MAX_RESPONSE_SIZE} using `Content-Length`, or body bytes when absent.
     # Non-2xx status codes are returned for the caller to interpret; they do not
     # themselves raise an exception.
     #
     # @param url [String] absolute HTTPS request URL without a fragment
     # @param headers [Hash{String => String}] additional request headers; can override the default `Cache-Control` value
-    # @param follow_redirects [Boolean] follow redirects, or return the initial response when false
+    # @param follow_redirects [Boolean] follow redirects; defaults to false
     # @return [Hash{Symbol => Integer, Hash{String => String}, String, nil}] `:status` (Integer), lowercase `:headers` (Hash), and `:body` (String or nil)
     # @raise [SSRFError] if initial scheme, host, fragment or resolved address is rejected
     # @raise [HTTPError] if transport, TLS, redirect validation or response size checks fail
     # @raise [URI::InvalidURIError] if the initial URL cannot be parsed
     #
-    def get(url, headers = {}, follow_redirects: true)
+    def get(url, headers = {}, follow_redirects: false)
       uri = validate_uri(url)
       validate_ip(uri)
 
@@ -123,11 +124,11 @@ module AuthProto
       }
     end
 
-    # Sends an HTTP POST request with destination validation and redirect handling.
+    # Sends an HTTP POST request with destination validation, without following redirects.
     #
     # Uses HTTPS and rejects private/loopback destinations by default. Subclasses may
-    # relax these rules. Follows at most {MAX_REDIRECTS} redirects and checks size
-    # against {MAX_RESPONSE_SIZE} using `Content-Length`, or body bytes when absent.
+    # relax these rules. Checks size against {MAX_RESPONSE_SIZE} using `Content-Length`,
+    # or body bytes when absent.
     # Non-2xx status codes are returned for the caller to interpret; they do not
     # themselves raise an exception.
     #
@@ -157,17 +158,16 @@ module AuthProto
     private
 
     def validate_uri(url)
-      uri = URI(url)
+      uri = ValidatedURI.new(url)
       unless self.class::ALLOWED_SCHEMES.include?(uri.scheme)
         raise SSRFError, "URL scheme must be one of: #{self.class::ALLOWED_SCHEMES.join(", ")}"
       end
 
-      # Extract and validate host before any network activity
-      host = uri.host.to_s.strip
-      raise SSRFError, "URL must include host" if host.empty?
       raise SSRFError, "URL must not include fragment" if uri.fragment
 
-      uri
+      uri.to_uri
+    rescue URI::InvalidURIError => e
+      raise SSRFError, e.message
     end
 
     def validate_ip(uri)
@@ -207,9 +207,9 @@ module AuthProto
       FORBIDDEN_IP_RANGES.any? { |range| range.include?(ip) }
     end
 
-    def make_request(uri, headers = {}, redirect_count = 0, follow_redirects: true)
+    def make_request(uri, headers = {}, redirect_count = 0, follow_redirects: false)
       http = Net::HTTP.new(uri.hostname, uri.port)
-      configure_http_client(http, ssl: uri.scheme == "https")
+      configure_http_client(http, ssl: uri.scheme == 'https')
 
       request = Net::HTTP::Get.new(uri.request_uri)
       add_security_headers(request, headers)
@@ -228,23 +228,15 @@ module AuthProto
       raise HTTPError.new("Request failed: #{e.message}", nil)
     end
 
-    def make_post_request(uri, body, headers = {}, redirect_count = 0)
+    def make_post_request(uri, body, headers = {})
       http = Net::HTTP.new(uri.hostname, uri.port)
-      configure_http_client(http, ssl: uri.scheme == "https")
+      configure_http_client(http, ssl: uri.scheme == 'https')
 
       request = Net::HTTP::Post.new(uri.request_uri)
       add_security_headers(request, headers)
       request.body = body.is_a?(Hash) ? URI.encode_www_form(body) : body if body
 
-      response = http.request(request)
-      handle_redirect(
-        original_uri: uri,
-        body: body,
-        method: :post,
-        response: response,
-        headers: headers,
-        redirect_count: redirect_count
-      )
+      http.request(request)
     rescue Net::OpenTimeout, Net::ReadTimeout => e
       raise HTTPError.new("Request timeout: #{e.message}", nil)
     rescue StandardError => e
@@ -269,11 +261,9 @@ module AuthProto
     # Handle HTTP redirects
     # kwargs can include:
     # - original_uri: URI of the original request
-    # - method: HTTP method of the original request (:get or :post)
     # - response: Net::HTTPResponse object
     # - headers: Hash of headers from the original request
     # - redirect_count: Number of redirects so far
-    # - body: Request body for POST requests
     #
     def handle_redirect(**kwargs)
       response = kwargs[:response]
@@ -292,11 +282,7 @@ module AuthProto
       redirect_count += 1
 
       # Recursive call to handle the next redirect
-      if kwargs[:method] == :post
-        make_post_request(location, kwargs[:body], kwargs[:headers], redirect_count)
-      else
-        make_request(location, kwargs[:headers], redirect_count)
-      end
+      make_request(location, kwargs[:headers], redirect_count, follow_redirects: true)
     end
 
     def validate_response(response)

data/lib/authproto/localhost_server.rb

@@ -5,6 +5,9 @@ require 'socket'
 require 'timeout'
 require 'uri'
 
+require_relative 'metadata/client_metadata'
+require_relative 'validated_uri'
+
 module AuthProto
 
   #
@@ -89,25 +92,31 @@ module AuthProto
     # Accepts `localhost`, IPv4 loopback, or IPv6 loopback. The URI must have a valid
     # port and no user information or fragment. Its path is used as the callback path.
     #
-    # @param metadata [Hash{String, Symbol => Object}] metadata containing a nonempty `redirect_uris` array of strings
+    # @param metadata [Hash{String, Symbol => Object}, Metadata::ClientMetadata]
+    #   metadata containing a nonempty `redirect_uris` array of strings
     # @raise [ArgumentError] if the first redirect URI is missing, malformed or not a supported HTTP loopback URL
     #
     def initialize(metadata)
-      redirects = metadata['redirect_uris'] || metadata[:redirect_uris]
+      redirects = if metadata.is_a?(Metadata::ClientMetadata)
+        metadata.redirect_uris
+      else
+        metadata['redirect_uris'] || metadata[:redirect_uris]
+      end
 
       unless redirects.is_a?(Array) && redirects.first.is_a?(String)
         raise ArgumentError, "metadata must contain a non-empty redirect_uris array"
       end
 
-      @uri = URI(redirects.first)
+      uri = ValidatedURI.new(redirects.first)
+      @uri = uri.to_uri
 
-      unless @uri.is_a?(URI::HTTP) && @uri.scheme == "http" && loopback_host?(@uri.hostname)
+      unless uri.scheme == 'http' && loopback_host?(uri.hostname)
         raise ArgumentError, "The first redirect URI must be an HTTP loopback URL"
       end
 
       raise ArgumentError, "The redirect URI should have a valid port" unless @uri.port.between?(1, 65_535)
-      raise ArgumentError, "The redirect URI should not include user info" unless !@uri.userinfo
-      raise ArgumentError, "The redirect URI should not include a URL fragment" unless !@uri.fragment
+      raise ArgumentError, "The redirect URI should not include user info" if uri.userinfo
+      raise ArgumentError, "The redirect URI should not include a URL fragment" if uri.fragment
 
       @path = (@uri.path.empty?) ? "/" : @uri.path
     rescue URI::InvalidURIError