authproto 0.3.0.beta1

data/sig/authproto/dpop/proof_generator.rbs

@@ -0,0 +1,40 @@
+module AuthProto
+  module DPoP
+    class ProofGenerator
+      @key_manager: AuthProto::DPoP::KeyManager
+
+      class ProofError < AuthProto::Error
+      end
+
+      attr_reader key_manager: AuthProto::DPoP::KeyManager
+
+      def initialize: (AuthProto::DPoP::KeyManager key_manager) -> void
+
+      def generate: (
+          http_method: String,
+          http_uri: String,
+          ?nonce: String?,
+          ?access_token: String?,
+          ?ath: bool?
+        ) -> JOSE::SignedBinary
+
+      private
+
+      def validate_inputs: (String http_method, String http_uri) -> void
+
+      def build_header: () -> { typ: "dpop+jwt", alg: "ES256", jwk: Hash[String, untyped] }
+
+      def build_payload: (
+          http_method: String,
+          http_uri: String,
+          ?nonce: String?,
+          ?access_token: String?,
+          ?include_ath: bool?
+        ) -> Hash[String, untyped]
+
+      def normalize_uri: (String uri) -> String
+
+      def generate_access_token_hash: (String access_token) -> String
+    end
+  end
+end

data/sig/authproto/dpop/stored_nonce.rbs

@@ -0,0 +1,10 @@
+module AuthProto
+  module DPoP
+    class StoredNonce
+      attr_reader value: String
+      attr_reader server_url: String
+      attr_reader timestamp: Integer | Time
+      def initialize: (String value, String server_url, ?timestamp: (Integer | Time)?) -> void
+    end
+  end
+end

data/sig/authproto/encryption.rbs

@@ -0,0 +1,42 @@
+module AuthProto
+  module Encryption
+    type envelope = { version: Integer, iv: String, data: String, tag: String }
+
+    class Error < AuthProto::Error
+    end
+    class ConfigurationError < Error
+    end
+    class EncryptionError < Error
+    end
+    class DecryptionError < Error
+    end
+
+    module HKDF
+      def self.derive: (_ToS secret, salt: String, info: String, length: Integer) -> String
+    end
+
+    class Service
+      CIPHER: String
+      VERSION: Integer
+      def initialize: () -> void
+      def encrypt: (_ToS data, context: String) -> envelope
+      def decrypt: (envelope encrypted, context: String) -> String
+
+      private
+      def validate_encryption_inputs: (untyped data, untyped context) -> void
+      def validate_decryption_inputs: (untyped encrypted, untyped context) -> void
+      def validate_encrypted_data: (untyped encrypted) -> void
+    end
+
+    class KeyProvider
+      EPHEMERAL_KEY_MUTEX: Mutex
+      def self.ephemeral_master_key: () -> String
+      def initialize: () -> void
+      def key_for_context: (String context) -> String
+
+      private
+      def load_master_key: () -> String
+      def salt_for_context: (String context) -> String
+    end
+  end
+end

data/sig/authproto/http_client.rbs

@@ -0,0 +1,45 @@
+module AuthProto
+  class HTTPClient
+    FORBIDDEN_IP_RANGES: Array[IPAddr]
+    ALLOWED_SCHEMES: Array[String]
+    DEFAULT_TIMEOUT: Integer
+    MAX_REDIRECTS: Integer
+    MAX_RESPONSE_SIZE: Integer
+
+    class SSRFError < AuthProto::Error
+    end
+
+    class HTTPError < AuthProto::Error
+      attr_reader response: Net::HTTPResponse?
+      def initialize: (String message, Net::HTTPResponse? response) -> void
+    end
+
+    class RedirectHandlerOptions < Data
+      attr_reader original_uri: URI::HTTP
+      attr_reader method: Symbol
+      attr_reader response: Net::HTTPResponse
+      attr_reader headers: Hash[String, String]
+      attr_reader redirect_count: Integer
+      attr_reader body: http_body
+      def self.new: (URI::HTTP original_uri, Symbol method, Net::HTTPResponse response, Hash[String, String] headers, Integer redirect_count, http_body body) -> instance
+                  | (original_uri: URI::HTTP, method: Symbol, response: Net::HTTPResponse, headers: Hash[String, String], redirect_count: Integer, body: http_body) -> instance
+    end
+
+    def initialize: (?timeout: Numeric, ?verify_ssl: bool) -> void
+    def get: (String url, ?Hash[String, String] headers, ?follow_redirects: bool) -> http_response
+    def post: (String url, ?body: http_body, ?headers: Hash[String, String]) -> http_response
+
+    private
+    def validate_uri: (String url) -> URI::HTTP
+    def validate_ip: (URI::HTTP uri) -> void
+    def forbidden_ip?: (IPAddr ip) -> bool
+    def make_request: (URI::HTTP uri, ?Hash[String, String] headers, ?Integer redirect_count, ?follow_redirects: bool) -> Net::HTTPResponse
+    def make_post_request: (URI::HTTP uri, http_body body, ?Hash[String, String] headers, ?Integer redirect_count) -> Net::HTTPResponse
+    def configure_http_client: (Net::HTTP http, ?ssl: bool) -> void
+    def add_security_headers: (Net::HTTPRequest request, Hash[String, String] headers) -> void
+    def handle_redirect: (original_uri: URI::HTTP, response: Net::HTTPResponse, headers: Hash[String, String], redirect_count: Integer, ?method: Symbol, ?body: http_body) -> Net::HTTPResponse
+    def validate_response: (Net::HTTPResponse response) -> void
+    def check_success_status: (Net::HTTPResponse response) -> void
+    def check_content_length: (Net::HTTPResponse response) -> void
+  end
+end

data/sig/authproto/insecure_http_client.rbs

@@ -0,0 +1,8 @@
+module AuthProto
+  class InsecureHTTPClient < HTTPClient
+    ALLOWED_SCHEMES: Array[String]
+
+    private
+    def validate_ip: (URI::HTTP uri) -> void
+  end
+end

data/sig/authproto/localhost_server.rbs

@@ -0,0 +1,30 @@
+module AuthProto
+  class LocalhostServer
+    type metadata = Hash[String | Symbol, untyped]
+    type callback_params = { code: String, state: String, iss: String }
+
+    MAX_HEADER_BYTES: Integer
+    REQUEST_TIMEOUT: Integer
+    LOOPBACK_RANGES: Array[IPAddr]
+
+    class CallbackError < StandardError
+      attr_reader error_code: String
+      attr_reader error_description: String?
+      def initialize: (String error_code, String? error_description) -> void
+    end
+    class InvalidRequest < StandardError
+    end
+
+    def self.start: [T] (metadata metadata, ?timeout: Numeric) { (callback_params) -> T } -> T
+    def initialize: (metadata metadata) -> void
+    def start: [T] (?timeout: Numeric) { (callback_params) -> T } -> T
+
+    private
+    def loopback_host?: (String? host) -> bool
+    def handle_connection: [T] (TCPSocket socket) { (callback_params) -> T } -> [bool, T?]
+    def handle_request: (TCPSocket socket) -> Hash[String, String]?
+    def read_request: (TCPSocket socket) -> [String, String]
+    def extract_callback_params: (URI::Generic uri) -> Hash[String, String]
+    def respond: (TCPSocket socket, Integer status, String reason, String body) -> void
+  end
+end

data/sig/authproto/minisky_oauth.rbs

@@ -0,0 +1,22 @@
+# Signatures for the methods defined by the optional Minisky adapter.
+# Additional methods mixed in from Minisky::Requests belong to the minisky gem.
+class MiniskyOAuth
+  MAX_NONCE_RETRIES: Integer
+  attr_reader host: String
+  attr_reader oauth_client: AuthProto::Client
+  attr_reader session_id: String?
+
+  def initialize: (String host, client_id: String, redirect_uri: String, ?metadata: AuthProto::json_object?, ?dpop_key: (AuthProto::json_object | JOSE::Map)?) -> void
+  def config: () -> nil
+  def authorize: (?handle: String?, ?pds_url: String?, ?scope: String) -> AuthProto::authorization_result
+  def handle_callback: (code: String, state: String, iss: String) -> AuthProto::callback_result
+  def get_request: (String | URI::HTTP method, ?Hash[untyped, untyped]? params, ?auth: bool, ?headers: Hash[String, String]?) -> untyped
+  def post_request: (String | URI::HTTP method, ?untyped data, ?auth: bool, ?headers: Hash[String, String]?, ?params: Hash[untyped, untyped]?) -> untyped
+  def log_in: (*untyped args) -> bot
+  def perform_token_refresh: () -> AuthProto::refreshed_tokens
+  def check_access: () -> (:ok | :refreshed)
+
+  private
+  def oauth_request: (singleton(Net::HTTP::Get) | singleton(Net::HTTP::Post) request_class, URI::HTTP url, Hash[String, String] headers, ?body: String?) -> Net::HTTPResponse
+  def authentication_error: (Net::HTTPResponse response) -> String?
+end

data/sig/authproto/par/client.rbs

@@ -0,0 +1,25 @@
+module AuthProto
+  module PAR
+    class Client
+      attr_reader endpoint: String
+      attr_reader dpop_client: DPoP::Client
+      attr_reader nonce_manager: DPoP::NonceManager
+
+      def initialize: (endpoint: String, dpop_client: DPoP::Client) -> void
+      def submit: (Request request) -> Response
+      def extract_nonce: (http_response response) -> String
+      def authorization_url: (authorize_endpoint: String, request_uri: String, client_id: String) -> String
+
+      private
+      def validate_endpoint: () -> void
+      def make_request: (Request request) -> http_response
+      def build_headers: (Request request, String dpop_proof) -> Hash[String, String]
+      def requires_nonce?: (http_response response) -> bool
+      def store_nonce: (String nonce) -> void
+      def server_origin: () -> String
+      def handle_error_response: (http_response response) -> bot
+      def process_response: (http_response response) -> Response
+      def encode_params: (Hash[String, String] params) -> String
+    end
+  end
+end

data/sig/authproto/par/client_assertion.rbs

@@ -0,0 +1,10 @@
+module AuthProto
+  module PAR
+    class ClientAssertion
+      class Error < AuthProto::Error
+      end
+      def initialize: (client_id: String, signing_key: JOSE::JWK) -> void
+      def generate_jwt: (audience: String, ?lifetime: Integer) -> String
+    end
+  end
+end

data/sig/authproto/par/request.rbs

@@ -0,0 +1,73 @@
+module AuthProto
+  module PAR
+    class Request
+      @response_type: String
+      @client_id: String
+      @redirect_uri: String
+      @code_challenge: String
+      @code_challenge_method: String
+      @state: String
+      @scope: String
+      @login_hint: String?
+      @nonce: String?
+      @dpop_proof: String?
+      @client_assertion_type: String?
+      @client_assertion: String?
+
+      class Configuration
+        attr_accessor client_id: String?
+        attr_accessor redirect_uri: String?
+        attr_accessor code_challenge: String?
+        attr_accessor code_challenge_method: String?
+        attr_accessor state: String?
+        attr_accessor scope: String?
+        attr_accessor login_hint: String?
+        attr_accessor nonce: String?
+        attr_accessor dpop_proof: String?
+        attr_accessor client_assertion_type: String?
+        attr_accessor client_assertion: String?
+      end
+
+      attr_reader response_type: String
+      attr_reader client_id: String
+      attr_reader code_challenge: String
+      attr_reader code_challenge_method: String
+      attr_reader state: String
+      attr_reader redirect_uri: String
+      attr_reader scope: String
+      attr_reader login_hint: String?
+      attr_reader nonce: String?
+      attr_reader dpop_proof: String?
+      attr_reader client_assertion_type: String?
+      attr_reader client_assertion: String?
+
+      def self.build: () { (Configuration) -> untyped } -> Request
+
+      def initialize: (Configuration config) -> void
+
+      def to_form: () -> String
+
+      private
+
+      def build_params: () -> Hash[String, String]
+
+      def add_optional_params: (Hash[String, String] params) -> void
+
+      def add_client_auth_params: (Hash[String, String] params) -> void
+
+      def validate_request: () -> void
+
+      def validate_required_params: () -> void
+
+      def validate_response_type: () -> void
+
+      def validate_code_challenge_method: () -> void
+
+      def validate_scope: () -> void
+
+      def validate_client_auth: () -> void
+
+      def encode_params: (Hash[String, String]) -> String
+    end
+  end
+end

data/sig/authproto/par/response.rbs

@@ -0,0 +1,17 @@
+module AuthProto
+  module PAR
+    class Response
+      @request_uri: String
+      @expires_in: Integer
+
+      attr_reader request_uri: String
+      attr_reader expires_in: Integer
+
+      def initialize: (request_uri: String, expires_in: Integer | String) -> void
+
+      private
+
+      def validate_response: () -> void
+    end
+  end
+end

data/sig/authproto/par.rbs

@@ -0,0 +1,7 @@
+module AuthProto
+  module PAR
+    CLIENT_ASSERTION_TYPE: String
+    class Error < AuthProto::Error
+    end
+  end
+end

data/sig/authproto/pkce.rbs

@@ -0,0 +1,24 @@
+module AuthProto
+  module PKCE
+    class Error < AuthProto::Error
+    end
+
+    MIN_VERIFIER_LENGTH: Integer
+    MAX_VERIFIER_LENGTH: Integer
+    ALLOWED_VERIFIER_CHARS: ::Regexp
+
+    def self.generate_verifier: (?Integer length) -> String
+
+    def self.generate_challenge: (String verifier) -> String
+
+    def self.verify: (String challenge, String verifier) -> bool
+
+    private
+
+    private def self.validate_verifier_length: (Integer length) -> void
+
+    private def self.validate_verifier: (String verifier) -> void
+
+    private def self.secure_compare: (String str1, String str2) -> bool
+  end
+end

data/sig/authproto/serialization/base.rbs

@@ -0,0 +1,36 @@
+module AuthProto
+  module Serialization
+    type data_hash = Hash[String | Symbol, untyped]
+
+    class Error < AuthProto::Error
+    end
+    class VersionError < Error
+    end
+    class TypeMismatchError < Error
+    end
+    class ValidationError < Error
+    end
+
+    class Base[T]
+      CURRENT_VERSION: Integer
+      SENSITIVE_FIELDS: Array[String]
+      def self.serialize: (untyped obj) -> String
+      def self.deserialize: (String data) -> untyped
+      def initialize: () -> void
+      def serialize: (T obj) -> String
+      def deserialize: (String data) -> T
+
+      private
+      def encrypt_sensitive_fields: (data_hash data, ?path: Array[String | Symbol]) -> void
+      def decrypt_sensitive_fields: (data_hash data, ?path: Array[String | Symbol]) -> void
+      def sensitive_field?: (String | Symbol field) -> bool
+      def type_identifier: () -> String
+      def serialize_data: (T obj) -> data_hash
+      def deserialize_data: (json_object data) -> T
+      def validate_object: (T obj) -> void
+      def parse_json: (String data) -> untyped
+      def validate_serialized_data: (untyped data) -> void
+      def deserialize_version: (json_object data) -> T
+    end
+  end
+end

data/sig/authproto/serialization/dpop_key.rbs

@@ -0,0 +1,14 @@
+module AuthProto
+  module Serialization
+    class DPoPKey < Base[DPoP::KeyManager]
+      def self.serialize: (DPoP::KeyManager obj) -> String
+      def self.deserialize: (String data) -> DPoP::KeyManager
+      def type_identifier: () -> String
+
+      private
+      def validate_object: (DPoP::KeyManager obj) -> void
+      def serialize_data: (DPoP::KeyManager obj) -> json_object
+      def deserialize_data: (json_object data) -> DPoP::KeyManager
+    end
+  end
+end

data/sig/authproto/serialization/session.rbs

@@ -0,0 +1,19 @@
+module AuthProto
+  module Serialization
+    class Session < Base[State::Session]
+      def self.serialize: (State::Session obj) -> String
+      def self.deserialize: (String data) -> State::Session
+      def type_identifier: () -> String
+
+      private
+      def validate_object: (State::Session obj) -> void
+      def serialize_data: (State::Session obj) -> data_hash
+      def deserialize_data: (json_object data) -> State::Session
+
+      def serialize_token_set: (State::TokenSet? tokens) -> String?
+      def deserialize_token_set: (String? data) -> State::TokenSet?
+      def serialize_auth_server: (ServerMetadata::AuthorizationServer? server) -> Hash[Symbol, untyped]?
+      def deserialize_auth_server: (json_object? data) -> ServerMetadata::AuthorizationServer?
+    end
+  end
+end

data/sig/authproto/serialization/stored_nonce.rbs

@@ -0,0 +1,14 @@
+module AuthProto
+  module Serialization
+    class StoredNonce < Base[DPoP::StoredNonce]
+      def self.serialize: (DPoP::StoredNonce obj) -> String
+      def self.deserialize: (String data) -> DPoP::StoredNonce
+      def type_identifier: () -> String
+
+      private
+      def validate_object: (DPoP::StoredNonce obj) -> void
+      def serialize_data: (DPoP::StoredNonce obj) -> data_hash
+      def deserialize_data: (json_object data) -> DPoP::StoredNonce
+    end
+  end
+end

data/sig/authproto/serialization/token_set.rbs

@@ -0,0 +1,14 @@
+module AuthProto
+  module Serialization
+    class TokenSet < Base[State::TokenSet]
+      def self.serialize: (State::TokenSet obj) -> String
+      def self.deserialize: (String data) -> State::TokenSet
+      def type_identifier: () -> String
+
+      private
+      def validate_object: (State::TokenSet obj) -> void
+      def serialize_data: (State::TokenSet obj) -> data_hash
+      def deserialize_data: (json_object data) -> State::TokenSet
+    end
+  end
+end

data/sig/authproto/server_metadata/authorization_server.rbs

@@ -0,0 +1,71 @@
+module AuthProto
+  module ServerMetadata
+    class AuthorizationServer
+      @issuer: String
+      @authorization_endpoint: String
+      @token_endpoint: String
+      @pushed_authorization_request_endpoint: String
+      @response_types_supported: Array[String]
+      @grant_types_supported: Array[String]
+      @code_challenge_methods_supported: Array[String]
+      @token_endpoint_auth_methods_supported: Array[String]
+      @token_endpoint_auth_signing_alg_values_supported: Array[String]
+      @scopes_supported: Array[String]
+      @dpop_signing_alg_values_supported: Array[String]
+
+      REQUIRED_FIELDS: ::Array["issuer" | "authorization_endpoint" | "token_endpoint" | "response_types_supported" | "grant_types_supported" | "code_challenge_methods_supported" | "token_endpoint_auth_methods_supported" | "token_endpoint_auth_signing_alg_values_supported" | "scopes_supported" | "dpop_signing_alg_values_supported" | "pushed_authorization_request_endpoint"]
+
+      attr_reader issuer: String
+      attr_reader authorization_endpoint: String
+      attr_reader token_endpoint: String
+      attr_reader pushed_authorization_request_endpoint: String
+      attr_reader response_types_supported: Array[String]
+      attr_reader grant_types_supported: Array[String]
+      attr_reader code_challenge_methods_supported: Array[String]
+      attr_reader token_endpoint_auth_methods_supported: Array[String]
+      attr_reader token_endpoint_auth_signing_alg_values_supported: Array[String]
+      attr_reader scopes_supported: Array[String]
+      attr_reader dpop_signing_alg_values_supported: Array[String]
+
+      def initialize: (Hash[String, untyped] metadata) -> void
+
+      # Fetches and validates Authorization Server metadata from an issuer URL
+      # @param issuer [String] Authorization Server issuer URL
+      # @return [AuthorizationServer] new instance with fetched metadata
+      # @raise [InvalidAuthorizationServer] if metadata is invalid
+      def self.from_issuer: (String issuer) -> AuthorizationServer
+
+      def to_h: () -> Hash[Symbol, untyped]
+
+      private
+
+      def validate_and_set_metadata: (Hash[String, untyped] metadata) -> void
+
+      def validate_issuer: (String issuer) -> String
+
+      def validate_https_url: (String url) -> String
+
+      def validate_response_types: (Array[String] types) -> void
+
+      def validate_grant_types: (Array[String] types) -> void
+
+      def validate_code_challenge_methods: (Array[String] methods) -> void
+
+      def validate_token_endpoint_auth_methods: (Array[String] methods) -> void
+
+      def validate_token_endpoint_auth_signing_algs: (Array[String] algs) -> void
+
+      def validate_dpop_signing_algs: (Array[String] algs) -> void
+
+      def validate_scopes: (Array[String] scopes) -> void
+
+      def validate_boolean_field: (Hash[String, untyped] metadata, String field, bool required_value) -> void
+
+      private def self.fetch_metadata: (String issuer) -> http_response
+
+      private def self.parse_metadata: (String body) -> Hash[String, untyped]
+
+      private def self.validate_issuer: (String metadata_issuer, String request_issuer) -> void
+    end
+  end
+end

data/sig/authproto/server_metadata/origin_url.rbs

@@ -0,0 +1,21 @@
+module AuthProto
+  module ServerMetadata
+    class OriginURL
+      @url: String
+      @uri: URI::Generic
+
+      attr_reader url: String
+      attr_reader uri: URI::Generic
+
+      def initialize: (String url) -> void
+
+      def valid?: () -> bool
+
+      private
+
+      def https_scheme?: () -> bool
+      def root_path?: () -> bool
+      def explicit_port?: () -> bool
+    end
+  end
+end

data/sig/authproto/server_metadata/resource_server.rbs

@@ -0,0 +1,27 @@
+module AuthProto
+  module ServerMetadata
+    class ResourceServer
+      @authorization_servers: Array[String]
+
+      attr_reader authorization_servers: Array[String]
+
+      def initialize: (Hash[String, untyped] metadata) -> void
+
+      def self.from_url: (String url) -> ResourceServer
+
+      private
+
+      def validate_authorization_servers: (Array[String] servers) -> Array[String]
+
+      def ensure_servers_exist: (Array[String] | nil) -> void
+
+      def ensure_exactly_one_server: (Array[String]) -> void
+
+      def validate_server_url_format: (String server_url) -> void
+
+      private def self.fetch_metadata: (String url) -> http_response
+
+      private def self.parse_metadata: (String body) -> Hash[String, untyped]
+    end
+  end
+end

data/sig/authproto/state/session.rbs

@@ -0,0 +1,28 @@
+module AuthProto
+  module State
+    class Session
+      include MonitorMixin
+
+      attr_reader session_id: String
+      attr_reader state_token: String
+      attr_reader client_id: String
+      attr_reader scope: String
+      attr_reader pkce_verifier: String
+      attr_reader pkce_challenge: String
+      attr_reader auth_server: ServerMetadata::AuthorizationServer?
+      attr_reader did: String?
+      attr_reader tokens: TokenSet?
+
+      def initialize: (client_id: String, scope: String, ?auth_server: ServerMetadata::AuthorizationServer?, ?did: String?) -> void
+      def authorization_server=: (ServerMetadata::AuthorizationServer server) -> ServerMetadata::AuthorizationServer
+      def did=: (String did) -> String
+      def tokens=: (TokenSet tokens) -> String
+      def authorized?: () -> bool
+      def renewable?: () -> bool
+      def validate_state: (String? state) -> bool
+
+      private
+      def secure_compare: (String str1, String str2) -> bool
+    end
+  end
+end

data/sig/authproto/state/session_manager.rbs

@@ -0,0 +1,15 @@
+module AuthProto
+  module State
+    class SessionManager
+      @serializer: Serialization::Session
+
+      def initialize: () -> void
+      def create_session: (client_id: String, scope: String, ?auth_server: ServerMetadata::AuthorizationServer?, ?did: String?) -> Session
+      def update_session: (Session session) -> Session
+      def get_session: (String session_id) -> Session?
+      def get_session_by_state: (String? state) -> Session?
+      def remove_session: (String session_id) -> void
+      def cleanup_expired: () -> void
+    end
+  end
+end