authproto 0.3.0.beta1 → 0.3.0.beta2

data/sig/authproto/metadata/resource_server.rbs

@@ -0,0 +1,27 @@
+module AuthProto
+  module Metadata
+    class ResourceServer
+      @authorization_server: String
+
+      attr_reader authorization_server: String
+
+      def initialize: (Hash[String, untyped] metadata) -> void
+
+      def self.from_url: (String url) -> ResourceServer
+
+      private
+
+      def validate_authorization_servers: (untyped servers) -> String
+
+      private def self.fetch_metadata: (String url) -> http_response
+
+      private def self.validate_source_url: (String url) -> void
+
+      private def self.parse_metadata: (String? body) -> Hash[String, untyped]
+
+      private def self.validate_response: (http_response response) -> void
+
+      private def self.validate_resource: (untyped resource, String url) -> void
+    end
+  end
+end

data/sig/authproto/minisky_oauth.rbs

@@ -1,14 +1,15 @@
 # Signatures for the methods defined by the optional Minisky adapter.
 # Additional methods mixed in from Minisky::Requests belong to the minisky gem.
-class MiniskyOAuth
+class Minisky
+class OAuthClient
   MAX_NONCE_RETRIES: Integer
   attr_reader host: String
   attr_reader oauth_client: AuthProto::Client
   attr_reader session_id: String?
 
-  def initialize: (String host, client_id: String, redirect_uri: String, ?metadata: AuthProto::json_object?, ?dpop_key: (AuthProto::json_object | JOSE::Map)?) -> void
+  def initialize: (String host, client_id: String, redirect_uri: String, ?metadata: AuthProto::json_object?, ?dpop_key: (AuthProto::json_object | JOSE::Map)?, ?signing_key: (AuthProto::json_object | JOSE::JWK)?, ?session_id: String?) -> void
   def config: () -> nil
-  def authorize: (?handle: String?, ?pds_url: String?, ?scope: String) -> AuthProto::authorization_result
+  def authorize: (?handle: String?, ?pds: String?, ?scope: String) -> AuthProto::authorization_result
   def handle_callback: (code: String, state: String, iss: String) -> AuthProto::callback_result
   def get_request: (String | URI::HTTP method, ?Hash[untyped, untyped]? params, ?auth: bool, ?headers: Hash[String, String]?) -> untyped
   def post_request: (String | URI::HTTP method, ?untyped data, ?auth: bool, ?headers: Hash[String, String]?, ?params: Hash[untyped, untyped]?) -> untyped
@@ -20,3 +21,4 @@ class MiniskyOAuth
   def oauth_request: (singleton(Net::HTTP::Get) | singleton(Net::HTTP::Post) request_class, URI::HTTP url, Hash[String, String] headers, ?body: String?) -> Net::HTTPResponse
   def authentication_error: (Net::HTTPResponse response) -> String?
 end
+end

data/sig/authproto/par/client.rbs

@@ -1,17 +1,16 @@
 module AuthProto
   module PAR
     class Client
-      attr_reader endpoint: String
+      attr_reader authorization_server: Metadata::AuthorizationServer
+      attr_reader par_endpoint: String
       attr_reader dpop_client: DPoP::Client
-      attr_reader nonce_manager: DPoP::NonceManager
 
-      def initialize: (endpoint: String, dpop_client: DPoP::Client) -> void
+      def initialize: (authorization_server: Metadata::AuthorizationServer, dpop_client: DPoP::Client) -> void
       def submit: (Request request) -> Response
       def extract_nonce: (http_response response) -> String
-      def authorization_url: (authorize_endpoint: String, request_uri: String, client_id: String) -> String
+      def build_authorization_url: (request_uri: String, client_id: String) -> String
 
       private
-      def validate_endpoint: () -> void
       def make_request: (Request request) -> http_response
       def build_headers: (Request request, String dpop_proof) -> Hash[String, String]
       def requires_nonce?: (http_response response) -> bool
@@ -19,7 +18,6 @@ module AuthProto
       def server_origin: () -> String
       def handle_error_response: (http_response response) -> bot
       def process_response: (http_response response) -> Response
-      def encode_params: (Hash[String, String] params) -> String
     end
   end
 end

data/sig/authproto/par/client_assertion.rbs

@@ -3,7 +3,8 @@ module AuthProto
     class ClientAssertion
       class Error < AuthProto::Error
       end
-      def initialize: (client_id: String, signing_key: JOSE::JWK) -> void
+      attr_reader signing_key: JOSE::JWK
+      def initialize: (client_id: String, signing_key: (json_object | JOSE::JWK)) -> void
       def generate_jwt: (audience: String, ?lifetime: Integer) -> String
     end
   end

data/sig/authproto/par/request.rbs

@@ -1,55 +1,47 @@
 module AuthProto
   module PAR
     class Request
-      @response_type: String
       @client_id: String
       @redirect_uri: String
       @code_challenge: String
-      @code_challenge_method: String
       @state: String
       @scope: String
       @login_hint: String?
       @nonce: String?
       @dpop_proof: String?
-      @client_assertion_type: String?
-      @client_assertion: String?
+      @client_assertion: ClientAssertion?
 
       class Configuration
         attr_accessor client_id: String?
         attr_accessor redirect_uri: String?
         attr_accessor code_challenge: String?
-        attr_accessor code_challenge_method: String?
         attr_accessor state: String?
         attr_accessor scope: String?
         attr_accessor login_hint: String?
         attr_accessor nonce: String?
         attr_accessor dpop_proof: String?
-        attr_accessor client_assertion_type: String?
-        attr_accessor client_assertion: String?
+        attr_accessor client_assertion: ClientAssertion?
       end
 
-      attr_reader response_type: String
       attr_reader client_id: String
       attr_reader code_challenge: String
-      attr_reader code_challenge_method: String
       attr_reader state: String
       attr_reader redirect_uri: String
       attr_reader scope: String
       attr_reader login_hint: String?
       attr_reader nonce: String?
       attr_reader dpop_proof: String?
-      attr_reader client_assertion_type: String?
-      attr_reader client_assertion: String?
+      attr_reader client_assertion: ClientAssertion?
 
       def self.build: () { (Configuration) -> untyped } -> Request
 
       def initialize: (Configuration config) -> void
 
-      def to_form: () -> String
+      def to_form: (?audience: String?) -> String
 
       private
 
-      def build_params: () -> Hash[String, String]
+      def build_params: (audience: String?) -> Hash[String, String]
 
       def add_optional_params: (Hash[String, String] params) -> void
 
@@ -59,15 +51,9 @@ module AuthProto
 
       def validate_required_params: () -> void
 
-      def validate_response_type: () -> void
-
-      def validate_code_challenge_method: () -> void
-
       def validate_scope: () -> void
 
       def validate_client_auth: () -> void
-
-      def encode_params: (Hash[String, String]) -> String
     end
   end
 end

data/sig/authproto/par/response.rbs

@@ -7,11 +7,7 @@ module AuthProto
       attr_reader request_uri: String
       attr_reader expires_in: Integer
 
-      def initialize: (request_uri: String, expires_in: Integer | String) -> void
-
-      private
-
-      def validate_response: () -> void
+      def initialize: (request_uri: String, expires_in: Integer) -> void
     end
   end
 end

data/sig/authproto/pkce.rbs

@@ -1,24 +1,14 @@
 module AuthProto
-  module PKCE
+  class PKCE
     class Error < AuthProto::Error
     end
 
-    MIN_VERIFIER_LENGTH: Integer
-    MAX_VERIFIER_LENGTH: Integer
-    ALLOWED_VERIFIER_CHARS: ::Regexp
+    CHALLENGE_METHOD_S256: String
+    VERIFIER_BYTES: Integer
 
-    def self.generate_verifier: (?Integer length) -> String
+    attr_reader verifier: String
+    attr_reader challenge: String
 
-    def self.generate_challenge: (String verifier) -> String
-
-    def self.verify: (String challenge, String verifier) -> bool
-
-    private
-
-    private def self.validate_verifier_length: (Integer length) -> void
-
-    private def self.validate_verifier: (String verifier) -> void
-
-    private def self.secure_compare: (String str1, String str2) -> bool
+    def initialize: () -> void
   end
 end

data/sig/authproto/serialization/session.rbs

@@ -12,8 +12,8 @@ module AuthProto
 
       def serialize_token_set: (State::TokenSet? tokens) -> String?
       def deserialize_token_set: (String? data) -> State::TokenSet?
-      def serialize_auth_server: (ServerMetadata::AuthorizationServer? server) -> Hash[Symbol, untyped]?
-      def deserialize_auth_server: (json_object? data) -> ServerMetadata::AuthorizationServer?
+      def serialize_auth_server: (Metadata::AuthorizationServer? server) -> Hash[Symbol, untyped]?
+      def deserialize_auth_server: (json_object? data) -> Metadata::AuthorizationServer?
     end
   end
 end

data/sig/authproto/state/session.rbs

@@ -9,20 +9,17 @@ module AuthProto
       attr_reader scope: String
       attr_reader pkce_verifier: String
       attr_reader pkce_challenge: String
-      attr_reader auth_server: ServerMetadata::AuthorizationServer?
+      attr_reader auth_server: Metadata::AuthorizationServer?
       attr_reader did: String?
       attr_reader tokens: TokenSet?
 
-      def initialize: (client_id: String, scope: String, ?auth_server: ServerMetadata::AuthorizationServer?, ?did: String?) -> void
-      def authorization_server=: (ServerMetadata::AuthorizationServer server) -> ServerMetadata::AuthorizationServer
+      def initialize: (client_id: String, scope: String, ?auth_server: Metadata::AuthorizationServer?, ?did: String?) -> void
+      def authorization_server=: (Metadata::AuthorizationServer server) -> Metadata::AuthorizationServer
       def did=: (String did) -> String
       def tokens=: (TokenSet tokens) -> String
+      def session_data: () -> AuthProto::session_data?
       def authorized?: () -> bool
       def renewable?: () -> bool
-      def validate_state: (String? state) -> bool
-
-      private
-      def secure_compare: (String str1, String str2) -> bool
     end
   end
 end

data/sig/authproto/state/session_manager.rbs

@@ -4,11 +4,11 @@ module AuthProto
       @serializer: Serialization::Session
 
       def initialize: () -> void
-      def create_session: (client_id: String, scope: String, ?auth_server: ServerMetadata::AuthorizationServer?, ?did: String?) -> Session
+      def create_session: (client_id: String, scope: String, ?auth_server: Metadata::AuthorizationServer?, ?did: String?) -> Session
       def update_session: (Session session) -> Session
       def get_session: (String session_id) -> Session?
       def get_session_by_state: (String? state) -> Session?
-      def remove_session: (String session_id) -> void
+      def delete_session: (String session_id) -> void
       def cleanup_expired: () -> void
     end
   end

data/sig/authproto/token/refresh.rbs

@@ -23,11 +23,11 @@ module AuthProto
       MAX_DELAY: Integer
       attr_reader session: State::Session
       attr_reader dpop_client: DPoP::Client
-      attr_reader auth_server: ServerMetadata::AuthorizationServer
-      attr_reader client_metadata: ClientMetadata
+      attr_reader auth_server: Metadata::AuthorizationServer
+      attr_reader client_metadata: Metadata::ClientMetadata
 
-      def initialize: (session: State::Session, dpop_client: DPoP::Client, auth_server: ServerMetadata::AuthorizationServer, client_metadata: ClientMetadata) -> void
-      def perform: () -> State::TokenSet
+      def initialize: (session: State::Session, dpop_client: DPoP::Client, auth_server: Metadata::AuthorizationServer, client_metadata: Metadata::ClientMetadata, ?signing_key: (json_object | JOSE::JWK)?) -> void
+      def perform_refresh: () -> State::TokenSet
 
       private
       def with_retries: [T] () { () -> T } -> T

data/sig/authproto/validated_uri.rbs

@@ -0,0 +1,36 @@
+module AuthProto
+  class ValidatedURI
+    @uri: URI::HTTP
+    @port: String?
+    @userinfo: String?
+    @path: String
+
+    attr_reader port: String?
+    attr_reader userinfo: String?
+    attr_reader path: String
+
+    def initialize: (String | URI::Generic url) -> void
+
+    def specified_port: () -> String?
+    def effective_port: () -> Integer
+    def to_uri: () -> URI::HTTP
+
+    def scheme: () -> String
+    def host: () -> String
+    def hostname: () -> String
+    def query: () -> String?
+    def fragment: () -> String?
+    def user: () -> String?
+    def password: () -> String?
+    def registry: () -> String?
+    def opaque: () -> String?
+    def default_port: () -> Integer
+    def request_uri: () -> String
+    def origin: () -> String
+    def absolute?: () -> bool
+    def relative?: () -> bool
+    def hierarchical?: () -> bool
+    def to_s: () -> String
+    def to_str: () -> String
+  end
+end

data/sig/authproto.rbs

@@ -7,9 +7,11 @@ module AuthProto
   type json_object = Hash[String, untyped]
   type http_body = String | Hash[untyped, untyped] | nil
   type http_response = { status: Integer, headers: Hash[String, String], body: String? }
-  type token_info = { access_token: String, token_type: String, expires_in: Integer, refresh_token: String?, scope: String }
-  type refreshed_tokens = { access_token: String, token_type: String, expires_in: Integer, refresh_token: String?, scope: String, session_id: String }
-  type callback_result = { access_token: String, token_type: String, expires_in: Integer, refresh_token: String?, scope: String, session_id: String, did: String }
+  type session_data = { access_token: String, token_type: String, expires_in: Integer,
+                        refresh_token: String?, scope: String, session_id: String, did: String }
+  type token_info = session_data
+  type refreshed_tokens = session_data
+  type callback_result = session_data
   type authorization_result = { url: String, session_id: String }
 
   class Error < StandardError

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: authproto
 version: !ruby/object:Gem::Version
-  version: 0.3.0.beta1
+  version: 0.3.0.beta2
 platform: ruby
 authors:
 - Josh Huckabee
@@ -63,6 +63,7 @@ files:
 - ".rubocop.yml"
 - ".tm_properties"
 - ".yardopts"
+- AGENTS.md
 - CHANGELOG.md
 - MIT-LICENSE.txt
 - README.md
@@ -74,7 +75,7 @@ files:
 - examples/confidential_client/README.md
 - examples/confidential_client/app.rb
 - examples/confidential_client/config.ru
-- examples/confidential_client/config/client-metadata.example.json
+- examples/confidential_client/config/oauth-client-metadata.example.json
 - examples/confidential_client/public/styles.css
 - examples/confidential_client/screenshots/screenshot-1-sign-in.png
 - examples/confidential_client/screenshots/screenshot-2-success.png
@@ -93,7 +94,6 @@ files:
 - examples/minisky_console/production.rb
 - lib/authproto.rb
 - lib/authproto/client.rb
-- lib/authproto/client_metadata.rb
 - lib/authproto/configuration.rb
 - lib/authproto/dpop/client.rb
 - lib/authproto/dpop/key_manager.rb
@@ -105,6 +105,10 @@ files:
 - lib/authproto/http_client.rb
 - lib/authproto/insecure_http_client.rb
 - lib/authproto/localhost_server.rb
+- lib/authproto/metadata.rb
+- lib/authproto/metadata/authorization_server.rb
+- lib/authproto/metadata/client_metadata.rb
+- lib/authproto/metadata/resource_server.rb
 - lib/authproto/minisky.rb
 - lib/authproto/par.rb
 - lib/authproto/par/client.rb
@@ -117,10 +121,6 @@ files:
 - lib/authproto/serialization/session.rb
 - lib/authproto/serialization/stored_nonce.rb
 - lib/authproto/serialization/token_set.rb
-- lib/authproto/server_metadata.rb
-- lib/authproto/server_metadata/authorization_server.rb
-- lib/authproto/server_metadata/origin_url.rb
-- lib/authproto/server_metadata/resource_server.rb
 - lib/authproto/state.rb
 - lib/authproto/state/session.rb
 - lib/authproto/state/session_manager.rb
@@ -131,10 +131,11 @@ files:
 - lib/authproto/storage/redis.rb
 - lib/authproto/storage/sqlite.rb
 - lib/authproto/token/refresh.rb
+- lib/authproto/validated_uri.rb
 - lib/authproto/version.rb
+- misc/yard_attributes.rb
 - sig/authproto.rbs
 - sig/authproto/client.rbs
-- sig/authproto/client_metadata.rbs
 - sig/authproto/dependencies.rbs
 - sig/authproto/dpop/client.rbs
 - sig/authproto/dpop/key_manager.rbs
@@ -145,6 +146,9 @@ files:
 - sig/authproto/http_client.rbs
 - sig/authproto/insecure_http_client.rbs
 - sig/authproto/localhost_server.rbs
+- sig/authproto/metadata/authorization_server.rbs
+- sig/authproto/metadata/client_metadata.rbs
+- sig/authproto/metadata/resource_server.rbs
 - sig/authproto/minisky_oauth.rbs
 - sig/authproto/par.rbs
 - sig/authproto/par/client.rbs
@@ -157,9 +161,6 @@ files:
 - sig/authproto/serialization/session.rbs
 - sig/authproto/serialization/stored_nonce.rbs
 - sig/authproto/serialization/token_set.rbs
-- sig/authproto/server_metadata/authorization_server.rbs
-- sig/authproto/server_metadata/origin_url.rbs
-- sig/authproto/server_metadata/resource_server.rbs
 - sig/authproto/state.rbs
 - sig/authproto/state/session.rbs
 - sig/authproto/state/session_manager.rbs
@@ -171,6 +172,7 @@ files:
 - sig/authproto/storage/redis_client.rbs
 - sig/authproto/storage/sqlite.rbs
 - sig/authproto/token/refresh.rbs
+- sig/authproto/validated_uri.rbs
 - sig/authproto/version.rbs
 homepage: https://github.com/mackuba/authproto
 licenses: