authproto 0.3.0.beta1

data/sig/authproto/state/token_set.rbs

@@ -0,0 +1,40 @@
+module AuthProto
+  module State
+    class TokenSet
+      @access_token: String
+      @refresh_token: String?
+      @token_type: String
+      @scope: String
+      @sub: String
+      @expires_at: Time
+
+      attr_reader access_token: String
+      attr_reader refresh_token: String?
+      attr_reader token_type: String
+      attr_reader scope: String
+      attr_reader expires_at: Time
+      attr_reader sub: String
+
+      def initialize: (
+          access_token: String,
+          token_type: String,
+          expires_in: Integer,
+          scope: String,
+          sub: String,
+          ?refresh_token: String?
+        ) -> void
+
+      def renewable?: () -> bool
+
+      def expired?: (?Numeric buffer) -> bool
+
+      private
+
+      def validate_token_type: (String type) -> void
+
+      def validate_required: (String name, String? value) -> void
+
+      def validate_expires_in: (Integer expires_in) -> void
+    end
+  end
+end

data/sig/authproto/state.rbs

@@ -0,0 +1,6 @@
+module AuthProto
+  module State
+    class SessionError < AuthProto::Error
+    end
+  end
+end

data/sig/authproto/storage/interface.rbs

@@ -0,0 +1,20 @@
+module AuthProto
+  module Storage
+    class StorageError < AuthProto::Error
+    end
+    class LockError < StorageError
+    end
+
+    class Interface
+      def set: (String key, untyped value, ?ttl: Integer?) -> bool
+      def get: (String key) -> untyped
+      def delete: (String key) -> bool
+      def exists?: (String key) -> bool
+      def with_lock: [T] (String key, ?ttl: Integer) { () -> T } -> T
+
+      # Protected in Ruby; RBS exposes protected methods as public.
+      def validate_key: (String key) -> void
+      def validate_ttl: (Integer? ttl) -> void
+    end
+  end
+end

data/sig/authproto/storage/key_builder.rbs

@@ -0,0 +1,16 @@
+module AuthProto
+  module Storage
+    class KeyBuilder
+      NAMESPACE_SEPARATOR: String
+      NAMESPACE_PREFIX: String
+      def self.session_key: (String id) -> String
+      def self.state_key: (String token) -> String
+      def self.nonce_key: (String server_url) -> String
+      def self.dpop_key: (String client_id) -> String
+      def self.lock_key: (String namespace, String id) -> String
+
+      private
+      private def self.build_key: (*String parts) -> String
+    end
+  end
+end

data/sig/authproto/storage/memory.rbs

@@ -0,0 +1,22 @@
+module AuthProto
+  module Storage
+    class Memory < Interface
+      def initialize: () -> void
+      def set: (String key, untyped value, ?ttl: Integer?) -> true
+      def get: (String key) -> untyped
+      def delete: (String key) -> true
+      def exists?: (String key) -> bool
+      def with_lock: [T] (String key, ?ttl: Integer) { () -> T } -> T
+      def clear: () -> void
+
+      private
+      def acquire_lock: (String key, ttl: Integer) -> bool
+      def release_lock: (String key) -> true
+      def expired?: (String key) -> bool
+      def lock_expired?: (String lock_key) -> bool
+      def set_expiration: (String key, Integer ttl) -> Integer
+      def cleanup_expired: () -> void
+      def start_cleanup_thread: () -> Thread
+    end
+  end
+end

data/sig/authproto/storage/redis.rbs

@@ -0,0 +1,19 @@
+module AuthProto
+  module Storage
+    class Redis < Interface
+      class RedisError < StorageError
+      end
+
+      def initialize: (?redis_client: _RedisClient?) -> void
+      def set: (String key, untyped value, ?ttl: Integer?) -> true
+      def get: (String key) -> String?
+      def delete: (String key) -> bool
+      def exists?: (String key) -> bool
+      def with_lock: [T] (String key, ?ttl: Integer) { () -> T } -> T
+
+      private
+      def acquire_lock: (String key, ttl: Integer) -> String?
+      def release_lock: (String key) -> bool
+    end
+  end
+end

data/sig/authproto/storage/redis_client.rbs

@@ -0,0 +1,11 @@
+module AuthProto
+  module Storage
+    # Only the Redis client operations required by the optional adapter.
+    interface _RedisClient
+      def set: (String key, untyped value, ?ex: Integer?, ?nx: bool) -> String?
+      def get: (String key) -> String?
+      def del: (*String keys) -> Integer
+      def exists?: (String key) -> bool
+    end
+  end
+end

data/sig/authproto/storage/sqlite.rbs

@@ -0,0 +1,26 @@
+module AuthProto
+  module Storage
+    class SQLite < Interface
+      class SQLiteError < StorageError
+      end
+
+      DEFAULT_BUSY_TIMEOUT: Integer
+
+      def initialize: (path: String, ?busy_timeout: Integer) -> void
+      def set: (String key, String | Numeric | nil value, ?ttl: Integer?) -> true
+      def get: (String key) -> (String | Numeric | nil)
+      def delete: (String key) -> bool
+      def exists?: (String key) -> bool
+      def with_lock: [T] (String key, ?ttl: Integer) { () -> T } -> T
+      def close: () -> void
+
+      private
+      def configure_database: () -> void
+      def create_schema: () -> void
+      def acquire_lock: (String key, ttl: Integer) -> String?
+      def release_lock: (String key, String owner) -> bool
+      def delete_expired_value: (String key, Float now) -> void
+      def current_time: () -> Float
+    end
+  end
+end

data/sig/authproto/token/refresh.rbs

@@ -0,0 +1,47 @@
+module AuthProto
+  module Token
+    class Error < AuthProto::Error
+      attr_reader token_type: String
+      attr_reader error_code: String
+      attr_reader retry_possible: bool
+      def initialize: (String message, token_type: String, error_code: String, ?retry_possible: bool) -> void
+    end
+    class ExpiredTokenError < Error
+      def initialize: (token_type: String) -> void
+    end
+    class InvalidTokenError < Error
+      def initialize: (token_type: String) -> void
+    end
+    class RefreshError < Error
+      def initialize: (String message, ?retry_possible: bool) -> void
+    end
+
+    class Refresh
+      include MonitorMixin
+      MAX_RETRIES: Integer
+      BASE_DELAY: Integer
+      MAX_DELAY: Integer
+      attr_reader session: State::Session
+      attr_reader dpop_client: DPoP::Client
+      attr_reader auth_server: ServerMetadata::AuthorizationServer
+      attr_reader client_metadata: ClientMetadata
+
+      def initialize: (session: State::Session, dpop_client: DPoP::Client, auth_server: ServerMetadata::AuthorizationServer, client_metadata: ClientMetadata) -> void
+      def perform: () -> State::TokenSet
+
+      private
+      def with_retries: [T] () { () -> T } -> T
+      def calculate_delay: () -> Float
+      def request_token_refresh: () -> State::TokenSet
+      def make_token_request: (State::Session session) -> http_response
+      def requires_dpop_nonce?: (http_response response) -> bool
+      def extract_dpop_nonce: (http_response response) -> String
+      def add_client_authentication: (Hash[Symbol, untyped] body) -> void
+      def handle_refresh_response: (http_response response) -> State::TokenSet
+      def process_successful_response: (http_response response) -> State::TokenSet
+      def handle_400_response: (http_response response) -> bot
+      def handle_rate_limit_response: (http_response response) -> bot
+      def validate_refresh_response: (json_object data) -> void
+    end
+  end
+end

data/sig/authproto/version.rbs

@@ -0,0 +1,3 @@
+module AuthProto
+  VERSION: String
+end

data/sig/authproto.rbs

@@ -0,0 +1,54 @@
+interface _HTTPClient
+  def get: (String url, ?Hash[String, String] headers, ?follow_redirects: bool) -> AuthProto::http_response
+  def post: (String url, ?body: AuthProto::http_body, ?headers: Hash[String, String]) -> AuthProto::http_response
+end
+
+module AuthProto
+  type json_object = Hash[String, untyped]
+  type http_body = String | Hash[untyped, untyped] | nil
+  type http_response = { status: Integer, headers: Hash[String, String], body: String? }
+  type token_info = { access_token: String, token_type: String, expires_in: Integer, refresh_token: String?, scope: String }
+  type refreshed_tokens = { access_token: String, token_type: String, expires_in: Integer, refresh_token: String?, scope: String, session_id: String }
+  type callback_result = { access_token: String, token_type: String, expires_in: Integer, refresh_token: String?, scope: String, session_id: String, did: String }
+  type authorization_result = { url: String, session_id: String }
+
+  class Error < StandardError
+  end
+
+  class OAuthError < Error
+    attr_reader error_code: String
+    def initialize: (String message, String error_code) -> void
+  end
+
+  class InvalidClientMetadata < OAuthError
+    def initialize: (String message) -> void
+  end
+
+  class InvalidAuthorizationServer < OAuthError
+    def initialize: (String message) -> void
+  end
+
+  class ConfigurationError < Error
+  end
+
+  class Configuration
+    attr_accessor default_token_lifetime: Integer
+    attr_accessor dpop_nonce_lifetime: Integer
+    attr_accessor encryption: untyped
+    attr_accessor http_client: _HTTPClient?
+    attr_accessor logger: Logger
+    attr_accessor storage: Storage::Interface
+    def initialize: () -> void
+    def validate: () -> true
+
+    private
+    def validate_storage: () -> void
+    def validate_http_client: () -> void
+  end
+
+  attr_writer self.configuration: Configuration
+  def self.configuration: () -> Configuration
+  def self.configure: () { (Configuration) -> untyped } -> Configuration
+  def self.storage: () -> Storage::Interface
+  def self.reset_configuration: () -> Configuration
+end

metadata

@@ -0,0 +1,200 @@
+--- !ruby/object:Gem::Specification
+name: authproto
+version: !ruby/object:Gem::Version
+  version: 0.3.0.beta1
+platform: ruby
+authors:
+- Josh Huckabee
+- Kuba Suder
+bindir: exe
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: jose
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.2'
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.3'
+- !ruby/object:Gem::Dependency
+  name: didkit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.5.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.5.0
+description: A Ruby library for implementing AT Protocol OAuth flows, including DPoP,
+  PAR, and dynamic client registration. Supports both client and server-side implementations
+  with comprehensive security features.
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".rspec"
+- ".rubocop.yml"
+- ".tm_properties"
+- ".yardopts"
+- CHANGELOG.md
+- MIT-LICENSE.txt
+- README.md
+- Rakefile
+- SECURITY.md
+- examples/confidential_client/.gitignore
+- examples/confidential_client/Gemfile
+- examples/confidential_client/Gemfile.lock
+- examples/confidential_client/README.md
+- examples/confidential_client/app.rb
+- examples/confidential_client/config.ru
+- examples/confidential_client/config/client-metadata.example.json
+- examples/confidential_client/public/styles.css
+- examples/confidential_client/screenshots/screenshot-1-sign-in.png
+- examples/confidential_client/screenshots/screenshot-2-success.png
+- examples/confidential_client/scripts/generate_keys.rb
+- examples/confidential_client/views/authorized.erb
+- examples/confidential_client/views/index.erb
+- examples/confidential_client/views/layout.erb
+- examples/minisky_console/.gitignore
+- examples/minisky_console/Gemfile
+- examples/minisky_console/Gemfile.lock
+- examples/minisky_console/README.md
+- examples/minisky_console/app.rb
+- examples/minisky_console/bin/console
+- examples/minisky_console/config.ru
+- examples/minisky_console/localhost.rb
+- examples/minisky_console/production.rb
+- lib/authproto.rb
+- lib/authproto/client.rb
+- lib/authproto/client_metadata.rb
+- lib/authproto/configuration.rb
+- lib/authproto/dpop/client.rb
+- lib/authproto/dpop/key_manager.rb
+- lib/authproto/dpop/nonce_manager.rb
+- lib/authproto/dpop/proof_generator.rb
+- lib/authproto/dpop/stored_nonce.rb
+- lib/authproto/encryption.rb
+- lib/authproto/errors.rb
+- lib/authproto/http_client.rb
+- lib/authproto/insecure_http_client.rb
+- lib/authproto/localhost_server.rb
+- lib/authproto/minisky.rb
+- lib/authproto/par.rb
+- lib/authproto/par/client.rb
+- lib/authproto/par/client_assertion.rb
+- lib/authproto/par/request.rb
+- lib/authproto/par/response.rb
+- lib/authproto/pkce.rb
+- lib/authproto/serialization/base.rb
+- lib/authproto/serialization/dpop_key.rb
+- lib/authproto/serialization/session.rb
+- lib/authproto/serialization/stored_nonce.rb
+- lib/authproto/serialization/token_set.rb
+- lib/authproto/server_metadata.rb
+- lib/authproto/server_metadata/authorization_server.rb
+- lib/authproto/server_metadata/origin_url.rb
+- lib/authproto/server_metadata/resource_server.rb
+- lib/authproto/state.rb
+- lib/authproto/state/session.rb
+- lib/authproto/state/session_manager.rb
+- lib/authproto/state/token_set.rb
+- lib/authproto/storage/interface.rb
+- lib/authproto/storage/key_builder.rb
+- lib/authproto/storage/memory.rb
+- lib/authproto/storage/redis.rb
+- lib/authproto/storage/sqlite.rb
+- lib/authproto/token/refresh.rb
+- lib/authproto/version.rb
+- sig/authproto.rbs
+- sig/authproto/client.rbs
+- sig/authproto/client_metadata.rbs
+- sig/authproto/dependencies.rbs
+- sig/authproto/dpop/client.rbs
+- sig/authproto/dpop/key_manager.rbs
+- sig/authproto/dpop/nonce_manager.rbs
+- sig/authproto/dpop/proof_generator.rbs
+- sig/authproto/dpop/stored_nonce.rbs
+- sig/authproto/encryption.rbs
+- sig/authproto/http_client.rbs
+- sig/authproto/insecure_http_client.rbs
+- sig/authproto/localhost_server.rbs
+- sig/authproto/minisky_oauth.rbs
+- sig/authproto/par.rbs
+- sig/authproto/par/client.rbs
+- sig/authproto/par/client_assertion.rbs
+- sig/authproto/par/request.rbs
+- sig/authproto/par/response.rbs
+- sig/authproto/pkce.rbs
+- sig/authproto/serialization/base.rbs
+- sig/authproto/serialization/dpop_key.rbs
+- sig/authproto/serialization/session.rbs
+- sig/authproto/serialization/stored_nonce.rbs
+- sig/authproto/serialization/token_set.rbs
+- sig/authproto/server_metadata/authorization_server.rbs
+- sig/authproto/server_metadata/origin_url.rbs
+- sig/authproto/server_metadata/resource_server.rbs
+- sig/authproto/state.rbs
+- sig/authproto/state/session.rbs
+- sig/authproto/state/session_manager.rbs
+- sig/authproto/state/token_set.rbs
+- sig/authproto/storage/interface.rbs
+- sig/authproto/storage/key_builder.rbs
+- sig/authproto/storage/memory.rbs
+- sig/authproto/storage/redis.rbs
+- sig/authproto/storage/redis_client.rbs
+- sig/authproto/storage/sqlite.rbs
+- sig/authproto/token/refresh.rbs
+- sig/authproto/version.rbs
+homepage: https://github.com/mackuba/authproto
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/mackuba/authproto
+  source_code_uri: https://github.com/mackuba/authproto
+  changelog_uri: https://github.com/mackuba/authproto/blob/main/CHANGELOG.md
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.3'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.23
+specification_version: 4
+summary: Ruby implementation of the AT Protocol OAuth specification
+test_files: []